PUP.Gamehack.HRE
The detection of PUP.Gamehack.HRE on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It's essential to understand the nature of this threat and take immediate action to remove it and prevent further damage.
Table of Contents
What Is PUP.Gamehack.HRE?
PUP.Gamehack.HRE is a type of malware that is classified as a potentially unwanted program. This means that it may not be as malicious as other types of malware, such as viruses or Trojans, but it can still cause problems with your system and compromise your personal data. PUPs are often installed unintentionally, and they can be difficult to remove without the right tools and expertise.
How PUP.Gamehack.HRE Operates
PUP.Gamehack.HRE, like other PUPs, can operate in various ways, including collecting user data, displaying unwanted advertisements, and modifying system settings. It may also install additional malware or unwanted software on your system, which can lead to further problems. PUPs can be particularly tricky to deal with because they often disguise themselves as legitimate programs or system files, making them harder to detect and remove.
Symptoms of Infection
If your system is infected with PUP.Gamehack.HRE, you may notice a range of symptoms, including slow system performance, unwanted pop-ups and advertisements, and changes to your system settings. You may also notice that your browser is redirecting to unfamiliar websites or that your search results are being hijacked. In some cases, PUPs can also cause system crashes, freezes, and other stability issues.
- Unwanted changes to your system settings or browser configuration
- Slow system performance or frequent crashes
- Unwanted pop-ups, advertisements, or browser redirects
- Difficulty removing unwanted programs or add-ons
How to Remove PUP.Gamehack.HRE
- Boot your system in Safe Mode with Networking to prevent the malware from loading and to give you access to the internet for downloading removal tools.
- Download and install a reputable anti-malware tool, such as SpyHunter, and perform a full system scan to detect and remove PUP.Gamehack.HRE and any other malware that may be present.
- Uninstall any suspicious programs or add-ons that you don't recognize or that were installed without your consent.
- Reset your browser settings to their default values, including Chrome, Firefox, and Edge, to remove any unwanted changes or add-ons.
- Reboot your system and perform another full scan with your anti-malware tool to ensure that all malware has been removed and that your system is clean.
Conclusion
Removing PUP.Gamehack.HRE from your system requires careful attention to detail and the right tools. By following the steps outlined above, you can help ensure that your system is clean and free from malware. It's also essential to take steps to prevent future infections, including being cautious when installing software, avoiding suspicious downloads, and keeping your operating system and software up to date. Remember, prevention is key, and staying informed about the latest malware threats can help you stay one step ahead of cybercriminals.
Analysis Report
General information
| Family Name: | PUP.Gamehack.HRE |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
55b03769d1cd10b44f11f533fdf488ba
SHA1:
1c45ff108f1a67f8aebb469b03c2993a79caa556
SHA256:
4E7FF75F97DDAA1085B552EBFB49699975CA6545B48591CB1E8124A42ED8484E
File Size:
4.98 MB, 4979200 bytes
|
|
MD5:
28af0571cd3b03709a418c9a12bb02eb
SHA1:
3bab84ec2e8a59b35a12220ebfc23a4422b881f5
SHA256:
7477C2706A0598D0D7D1A84BBA2C401B381853906795AA5A9B04BE38BE41436A
File Size:
4.85 MB, 4853760 bytes
|
|
MD5:
78b63f3744e569ae579ece67a613787e
SHA1:
8fe876f827ce4a712b901c83d0f467c7a5b1ea38
SHA256:
75D29674A4E028419D4087F8931806106824F2F165CCB2A173535B6F9BB30C00
File Size:
4.88 MB, 4884480 bytes
|
|
MD5:
d1184fc1a499a6c86b261c873562656a
SHA1:
5a78b93920e2cc856d780f5b2b8f933acd4faa50
SHA256:
2BB562FA4B744E990C3E76544984D0E3319B7294D4012CA8AB33485C09FA367D
File Size:
1.42 MB, 1415168 bytes
|
|
MD5:
b6c864cf925b064951f6c94e4f98feb5
SHA1:
e1ee907cde45bfb366d85b6f1de97c74a3f3a620
SHA256:
0C7E35C8A8D26BCC44637F4F04B7481F92A209047AFF89EA608A09034282743D
File Size:
5.04 MB, 5039104 bytes
|
Show More
|
MD5:
1927e469b77a31c45bc5ea610d088cff
SHA1:
fd46d3880907c20b13f9238dab9fc5f07828fab8
SHA256:
0B33AC109F7ED80AF76F37F3F7AF065E0D1EEB913D64170BAA2F83EAFF443E4F
File Size:
4.86 MB, 4857344 bytes
|
|
MD5:
b7542826c27698da86c660c90e6512e6
SHA1:
b5e60ed04f48376e1bf1609f8b99ff5ac847c73a
SHA256:
6A22F67B0A9C2FA814F3D9F183BF85B87188D7C516BB349B919A16976E6B28E0
File Size:
1.93 MB, 1928704 bytes
|
|
MD5:
8a5c2390e3a110ec0ae05b7d52be981e
SHA1:
cf2153ea6a278fa795478d4625ba5cec00a58918
SHA256:
B8A8F6124AACE184703F4428F78B0636CD27A3001FC1ABF20678EF421E380868
File Size:
4.86 MB, 4857344 bytes
|
|
MD5:
3e42a13ff0838a751dd8c00a9f164e45
SHA1:
1b7e6d8b5e87938741752a6212add37d8df74324
SHA256:
6D89D6DFA300B6DE2C34F02B9B9CB8C8536AC923D2742486B1D15F32DFA112F0
File Size:
1.95 MB, 1945088 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have security information
- File has been packed
- File has exports table
- File has TLS information
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
Show More
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Traits
- CryptUnprotectData
- dll
- imgui
- packed
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 2,964 |
|---|---|
| Potentially Malicious Blocks: | 757 |
| Whitelisted Blocks: | 2,207 |
| Unknown Blocks: | 0 |
Visual Map
x
x
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
x
x
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
x
0
0
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
1
0
0
0
0
0
0
1
0
0
0
x
x
x
x
x
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
x
0
0
x
0
0
0
0
0
0
0
x
1
x
0
x
0
0
0
0
0
1
0
0
0
0
0
1
0
0
x
x
x
0
0
0
x
0
0
x
x
x
x
x
0
x
x
0
x
x
0
x
x
x
x
0
x
x
x
0
0
0
0
0
0
0
0
x
x
x
x
x
x
x
0
0
x
x
x
0
0
0
0
1
0
0
0
0
1
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
x
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
0
0
x
x
x
0
x
x
x
0
x
x
x
x
x
x
x
0
x
x
x
x
0
x
x
x
0
x
x
x
0
x
0
0
x
x
x
x
x
0
0
x
0
0
0
x
0
x
x
x
x
0
x
x
0
x
0
x
0
x
x
0
x
x
x
x
x
x
0
x
0
x
x
x
0
x
x
x
x
x
x
0
0
x
x
x
0
0
x
x
x
0
0
0
x
x
x
0
x
x
x
x
0
0
x
0
0
x
0
x
x
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
0
0
x
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
0
0
0
0
x
0
0
x
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
x
0
x
0
x
x
x
0
x
x
0
x
x
x
0
0
x
0
x
x
x
x
x
0
0
0
0
0
0
0
0
x
x
x
x
x
0
0
x
0
0
0
0
0
0
x
0
x
0
x
x
x
x
x
x
0
x
x
x
x
x
0
x
x
0
x
x
0
x
x
x
x
x
x
x
0
x
x
x
0
x
x
x
0
x
x
x
0
x
x
x
x
x
0
x
0
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
0
x
x
x
x
x
x
x
x
x
0
x
x
0
x
x
x
0
x
x
x
x
x
x
0
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
0
0
x
x
x
0
0
x
x
x
0
0
x
x
x
0
x
0
0
0
x
x
x
0
x
x
x
x
0
x
x
x
0
x
x
x
x
x
x
0
x
x
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
x
0
0
0
0
0
1
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
x
x
x
x
0
x
x
0
x
0
x
x
x
x
x
x
x
x
0
x
0
0
0
0
0
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
0
0
0
0
x
x
x
x
x
0
0
0
0
0
x
x
x
x
x
x
0
x
x
0
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
0
x
0
x
0
0
x
0
x
0
x
x
x
0
x
0
x
0
0
x
0
x
x
x
x
0
x
x
x
0
x
x
x
x
0
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
0
0
x
x
x
x
0
0
x
x
x
x
0
0
0
0
0
0
0
0
0
0
0
1
x
0
x
0
0
0
0
0
0
0
0
0
0
0
x
x
x
x
x
x
x
x
x
x
0
x
x
x
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
x
x
0
x
x
x
x
x
0
0
x
0
0
0
x
0
0
x
0
0
0
0
x
0
0
0
0
0
0
0
x
0
x
x
x
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
x
0
x
0
0
0
x
x
x
x
x
0
0
0
0
x
x
x
0
0
1
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
0
x
x
x
x
x
x
x
x
0
x
0
x
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
x
x
x
0
x
1
x
x
x
x
0
0
0
0
x
0
1
x
x
x
x
1
0
x
0
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
0
x
x
0
x
x
x
x
0
x
x
0
x
x
0
x
x
0
x
x
0
x
x
0
x
x
x
0
x
x
x
x
x
x
x
x
x
0
0
x
x
x
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
0
x
0
x
0
0
0
x
0
0
0
x
0
0
0
0
0
0
x
0
0
0
0
x
0
0
0
x
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
0
x
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
x
x
0
0
x
0
0
0
0
x
0
x
0
0
0
x
0
0
0
x
0
x
0
0
0
x
0
x
0
0
0
0
0
0
0
x
0
0
0
0
x
0
0
0
0
0
0
0
0
x
0
0
0
0
x
0
0
0
x
0
0
0
0
0
0
0
0
0
x
0
0
0
x
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
x
0
0
0
0
x
0
0
x
0
0
0
0
x
0
0
0
0
x
0
x
0
0
0
0
0
0
x
0
0
0
0
x
x
0
0
x
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Gamehack.HRE
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\repos\spyhunter5\sandboxtool\builds\releasenologencrypt-x64\injected-x64.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\axis menu\cout.log | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\axis menu\settings.json | Generic Write,Read Attributes |
| c:\windows\system32\1c45ff108f1a67f8aebb469b03c2993a79caa556_0004979200.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\3bab84ec2e8a59b35a12220ebfc23a4422b881f5_0004853760.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\5a78b93920e2cc856d780f5b2b8f933acd4faa50_0001415168.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\8fe876f827ce4a712b901c83d0f467c7a5b1ea38_0004884480.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\advapi32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\apphelp.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\bcrypt.pdb | Read Attributes,Synchronize,Write Attributes |
Show More
| c:\windows\system32\bcryptprimitives.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\cf2153ea6a278fa795478d4625ba5cec00a58918_0004857344.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\combase.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\crypt32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\cryptsp.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\d3dcompiler_47.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dbghelp.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\advapi32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\apphelp.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\bcrypt.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\bcryptprimitives.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\combase.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\crypt32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\cryptsp.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\d3dcompiler_47.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\dbghelp.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\gdi32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\gdi32full.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\imagehlp.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\imm32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\injected-x64.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\kernel32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\kernelbase.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\msvcp140.amd64.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\msvcp_win.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\msvcrt.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\netapi32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\netjoin.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\netprovfw.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\netutils.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\ntdll.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\ole32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\oleaut32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\rpcrt4.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\samcli.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\schedcli.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\sechost.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\shcore.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\shell32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\srvcli.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\ucrtbase.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\user32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\vcruntime140.amd64.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\vcruntime140_1.amd64.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\win32u.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\wininet.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\wkscli.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\ws2_32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\e1ee907cde45bfb366d85b6f1de97c74a3f3a620_0005039104.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\exe\1c45ff108f1a67f8aebb469b03c2993a79caa556_0004979200.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\exe\3bab84ec2e8a59b35a12220ebfc23a4422b881f5_0004853760.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\exe\5a78b93920e2cc856d780f5b2b8f933acd4faa50_0001415168.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\exe\8fe876f827ce4a712b901c83d0f467c7a5b1ea38_0004884480.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\exe\cf2153ea6a278fa795478d4625ba5cec00a58918_0004857344.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\exe\e1ee907cde45bfb366d85b6f1de97c74a3f3a620_0005039104.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\exe\fd46d3880907c20b13f9238dab9fc5f07828fab8_0004857344.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\exe\rundll32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\fd46d3880907c20b13f9238dab9fc5f07828fab8_0004857344.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\gdi32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\gdi32full.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\imagehlp.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\imm32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\injected-x64.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\kernel32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\kernelbase.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\msvcp140.amd64.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\msvcp_win.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\msvcrt.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\netapi32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\netjoin.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\netprovfw.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\netutils.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\ntdll.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\ole32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\oleaut32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\rpcrt4.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\rundll32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\samcli.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\schedcli.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\sechost.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\shcore.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\shell32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\srvcli.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\advapi32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\apphelp.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\bcrypt.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\bcryptprimitives.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\combase.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\crypt32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\cryptsp.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\d3dcompiler_47.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\dbghelp.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\gdi32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\gdi32full.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\imagehlp.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\imm32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\injected-x64.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\kernel32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\kernelbase.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\msvcp140.amd64.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\msvcp_win.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\msvcrt.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\netapi32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\netjoin.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\netprovfw.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\netutils.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\ntdll.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\ole32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\oleaut32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\rpcrt4.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\samcli.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\schedcli.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\sechost.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\shcore.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\shell32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\srvcli.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\ucrtbase.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\user32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\vcruntime140.amd64.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\vcruntime140_1.amd64.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\win32u.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\wininet.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\wkscli.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\ws2_32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\exe\1c45ff108f1a67f8aebb469b03c2993a79caa556_0004979200.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\exe\3bab84ec2e8a59b35a12220ebfc23a4422b881f5_0004853760.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\exe\5a78b93920e2cc856d780f5b2b8f933acd4faa50_0001415168.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\exe\8fe876f827ce4a712b901c83d0f467c7a5b1ea38_0004884480.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\exe\cf2153ea6a278fa795478d4625ba5cec00a58918_0004857344.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\exe\e1ee907cde45bfb366d85b6f1de97c74a3f3a620_0005039104.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\exe\fd46d3880907c20b13f9238dab9fc5f07828fab8_0004857344.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\exe\rundll32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\ucrtbase.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\user32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\vcruntime140.amd64.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\vcruntime140_1.amd64.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\win32u.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\wininet.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\wkscli.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\ws2_32.pdb | Read Attributes,Synchronize,Write Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 䃷롯檒ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ୖ삜氣ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 鐓瑢ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ⁱ汒糞ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 쫒侩鯻ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 遙紿쒦ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �k 6 �v �Z����Bx #�(�,��/��1`1�1HO 1�D9ߔ@V� H�pN$R20U5�`b.`�2g �k`k�ql(�o �o�ww�m{�=�P� �jI��!� � ��3��~�� ��� �T���T�T���*�T��m� Ù� �V �$�8���l� �΄��&M��(�@� �~ .SLB1_ `� | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 儏た왛ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 纮矄퐓ǜ | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
10 additional items are not displayed above. |
| Anti Debug |
|
| User Data Access |
|
| Process Terminate |
|
