PUP.HackAgent

The detection of PUP.HackAgent on your system indicates the presence of a potentially unwanted program (PUP) that may be compromising your computer's security and performance. It is essential to understand the nature of this threat and take immediate action to remove it and prevent potential harm.

What Is PUP.HackAgent?

PUP.HackAgent is a type of malware that is classified as a potentially unwanted program. This category of threats includes software that may not be malicious in the classical sense but can still cause significant problems for computer users. PUPs often find their way onto systems through bundled downloads, deceptive installation practices, or exploits in software vulnerabilities. They can lead to a range of issues, from annoying advertisements and data collection to more severe problems like system instability and security breaches.

How PUP.HackAgent Operates

Once installed, PUP.HackAgent can operate in various ways, depending on its design and the intentions of its creators. Common behaviors of PUPs include displaying unwanted advertisements, collecting user data without consent, and altering system settings to facilitate further malicious activities. They may also install additional unwanted software or create backdoors for other types of malware. Understanding how PUP.HackAgent operates is crucial for developing an effective removal strategy and preventing future infections.

Symptoms of Infection

Identifying the symptoms of a PUP.HackAgent infection can be challenging, as they often mimic legitimate system activities or may not produce overt signs of infection. However, common indicators include unexpected pop-ups or advertisements, unfamiliar programs or toolbars, slow system performance, and unexpected changes in browser settings or homepage redirects. If you suspect that your system is infected with PUP.HackAgent, it is vital to act promptly to mitigate potential damage.

• Unwanted advertisements and pop-ups
• Slow system performance
• Unfamiliar programs or toolbars
• Changes in browser settings or homepage redirects

How to Remove PUP.HackAgent

1. Boot your computer in Safe Mode with Networking to prevent PUP.HackAgent from loading and to allow for internet access for downloading removal tools.
2. Download and run a full scan with a reputable anti-malware tool, such as SpyHunter, to detect and remove PUP.HackAgent and any associated malware.
3. Uninstall any suspicious programs that were installed around the time the symptoms appeared, as these could be related to the PUP.
4. Reset your web browsers (Chrome, Firefox, Edge) to their default settings to remove any changes made by the PUP, such as altered homepages or search engines.
5. Reboot your computer and run another scan with your anti-malware tool to ensure that all components of PUP.HackAgent have been removed.

Conclusion

Removing PUP.HackAgent from your system requires careful attention to detail and a thorough approach to ensure that all components of the malware are eliminated. By following the steps outlined above and maintaining good computer hygiene practices, such as regularly updating your operating system and applications, using strong antivirus software, and being cautious when downloading and installing new programs, you can protect your system from PUP.HackAgent and other types of malware. Remember, prevention and vigilance are key to maintaining the security and integrity of your computer system.

SpyHunter Detects & Remove PUP.HackAgent

Analysis Report

General information

Family Name:	PUP.HackAgent
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: e322b3ab32a9085d3f9d2f27ee209150 SHA1: 0b656fbcd90286cf76aa69c3954c72e39f413ca0 File Size: 621.77 KB, 621772 bytes

MD5: 275fbdc57fac614c146c381f0aee0e70 SHA1: f43c2c41e32920774629088179b3fbe923777653 File Size: 1.17 MB, 1167360 bytes

MD5: 28d11b45b77b0f3aa347f577f81e03f2 SHA1: 93c0567d4c277dafef4222429745ecf4ac8e7923 SHA256: 4DF372F2D12FDDC598B8F7AD50F9559612F26EE08E7B0ADC322CDA22ECD53F00 File Size: 16.38 KB, 16384 bytes

MD5: fd741844d1d68b2ab325e9eb379fbc71 SHA1: 2f979b409424632762aa42bdc677f49fda93535f SHA256: 3BA26F830E9C9B61DD8DF6916AAA35723BE0734AE3AE9C3402EE5175E59ED934 File Size: 4.11 MB, 4105773 bytes

MD5: 6061e547ead3ec7d74a94bab6abd08d4 SHA1: b4f153674c417fa4102181c108d5f61ba2297124 SHA256: 5084F59500F82CF4805672D90FD98428D0F2C09B8B38D27368894E8E90C957B6 File Size: 980.48 KB, 980480 bytes

Show More

MD5: 406da6d2f4fae22194e1702ef2202538 SHA1: efbcf490a77ece4299aa56ae09549a4d27c9ba4e SHA256: 5C32E7D163ED5141ECB6F752D7AC478B05FA8875599E4FCF1579D3E2BB428F7B File Size: 5.11 MB, 5106677 bytes

MD5: cf20ed1f8c7ddc187bf94ac9d69f9f50 SHA1: 2b02d57fa75ce3835ed4394506534b4a9843929d SHA256: 71E90B73BBC663B68AD41EAA83328081BA9DFE484BDCC6F0465DF2008497F37A File Size: 378.37 KB, 378368 bytes

MD5: c00a2082424c1bd7675d8c2a6233f121 SHA1: 5fbe9110cea88d162c842bd4f92a36f1e0770f23 SHA256: B26359D8D510195720CCC9B30996475B564114C640CBFC0C0C3934BC87A375D7 File Size: 1.25 MB, 1245184 bytes

MD5: 8de9559cb473bafdc7ece644ad35263e SHA1: 195814bccef7563713d156be0e6f4995517e0b5e SHA256: 3DB6213F17C1EA3C3D92D3D7E12A287312BBF7E8877CE95A353881E4BAEF8270 File Size: 3.95 MB, 3948664 bytes

MD5: 5f0b943faa1fd443f70981fcf19902bf SHA1: d1d341af4f06102b6c4384674593dc0bcbe567d8 SHA256: 2F7A01F1632E717CDAADB6BB07760CDFFF1DBAE40073D7888854DC4D2A7F25E7 File Size: 249.07 KB, 249068 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File has exports table
• File is .NET application
• File is 32-bit executable
• File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
• File is either console or GUI application

Show More

• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Assembly Version	1.0.0.0
Company Name	Milan Vyšata Nullworks
File Description	ADSearch GameInst Application iTV - televizní program a přehrávač rádií a TV do počítače macaddress Steam Account Generator
File Version	3.6.1.115 1.0.0.0 1, 7, 0, 0 1, 1, 2, 0 1, 0, 0, 1
Internal Name	ADSearch.exe GameInst iTV macaddress.exe
Legal Copyright	Copyright (C) 2004 Copyright (C) 2007-2012 Copyright © 2011 Copyright © 2020 Copyright © 2021 Nullworks
Original Filename	ADSearch.exe GameInst.exe itv.exe macaddress.exe
Product Name	ADSearch GameInst Application iTV - televizní program macaddress Steam Account Generator
Product Version	3.6.1 1.40 1.03 1.0.0.0 1, 7, 0, 0 1, 0, 0, 1

File Traits

• .adata
• .NET
• 2+ executable sections
• Agile.net
• big overlay
• Fody
• fptable
• HighEntropy
• Installer Manifest
• Installer Version

Show More

• nosig nsis
• Nullsoft Installer
• VirtualQueryEx
• WriteProcessMemory
• x86

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Similar Families

i

Similar Families

This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.

• Ditertag.A

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
\device\namedpipe\gmdasllogger	Generic Write,Read Attributes
c:\program files (x86)\.zt612c.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.0.regtrans-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.1.regtrans-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\.rz615b.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\doneinstall.html	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\doneinstall.html	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\doneinstall.html	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\doneinstalldx.html	Generic Read,Write Data,Write Attributes,Write extended,Append data

Show More

c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\doneinstalldx.html	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\doneinstalldx.html	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\doneuninstall.html	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\doneuninstall.html	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\doneuninstall.html	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\doneinstall.html	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\doneinstall.html	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\doneinstall.html	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\doneinstalldx.html	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\doneinstalldx.html	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\doneinstalldx.html	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\doneuninstall.html	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\doneuninstall.html	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\doneuninstall.html	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\images\footer.gif	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\images\footer.gif	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\images\footer.gif	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\install.html	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\install.html	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\install.html	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\scripts\mm.js	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\scripts\mm.js	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\scripts\mm.js	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\setup.html	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\setup.html	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\setup.html	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\styles\reg_style.css	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\styles\reg_style.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\styles\reg_style.css	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\uninstall.html	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\uninstall.html	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\uninstall.html	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\unsupportedos.html	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\unsupportedos.html	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\unsupportedos.html	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\waitinstall.html	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\waitinstall.html	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\waitinstall.html	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\waituninstall.html	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\waituninstall.html	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\funpass\waituninstall.html	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\annuleren_square.gif	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\annuleren_square.gif	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\annuleren_square.gif	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\annuleren_square_over.gif	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\annuleren_square_over.gif	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\annuleren_square_over.gif	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\bladeren_square.gif	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\bladeren_square.gif	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\bladeren_square.gif	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\bladeren_square_over.gif	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\bladeren_square_over.gif	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\bladeren_square_over.gif	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\button_annuleer.jpg	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\button_annuleer.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\button_annuleer.jpg	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\button_annuleer_over.jpg	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\button_annuleer_over.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\button_annuleer_over.jpg	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\button_bladeren.gif	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\button_bladeren.gif	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\button_bladeren.gif	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\button_bladeren_over.gif	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\button_bladeren_over.gif	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\button_bladeren_over.gif	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\button_ok.gif	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\button_ok.gif	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\button_ok.gif	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\button_ok_over.gif	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\button_ok_over.gif	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\button_ok_over.gif	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\button_start.gif	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\button_start.gif	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\button_start.gif	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\button_start_over.gif	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\button_start_over.gif	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\button_start_over.gif	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\code_bladeren.jpg	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\code_bladeren.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\code_bladeren.jpg	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\gametitle.jpg	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\gametitle.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\gametitle.jpg	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\loading.gif	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\loading.gif	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\loading.gif	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\ok_square.gif	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\ok_square.gif	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\ok_square.gif	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\ok_square_over.gif	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\ok_square_over.gif	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\ok_square_over.gif	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\pijl.jpg	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\pijl.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\pijl.jpg	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\pijl_over.jpg	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\pijl_over.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\images\pijl_over.jpg	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\install.html	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\install.html	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\install.html	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\npzylomgamesplayer.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\npzylomgamesplayer.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\npzylomgamesplayer.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\nsizylomplugin.xpt	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\nsizylomplugin.xpt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\nsizylomplugin.xpt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\setup.html	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\setup.html	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\setup.html	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\styles\reg_style.css	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\styles\reg_style.css	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\styles\reg_style.css	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\uninstall.html	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\uninstall.html	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\uninstall.html	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\unsupportedos.html	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\unsupportedos.html	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\unsupportedos.html	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\waitinstall.html	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\waitinstall.html	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\waitinstall.html	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\waituninstall.html	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\waituninstall.html	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\waituninstall.html	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\zylomgamesplayer.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\zylomgamesplayer.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\.zylominstallertemp1752631634\zylomgamesplayer.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\02e6db87-f0c8-4f45-93d3-d3d1c4df46c9.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsqbcce.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nsxf17f.tmp\nsprocess.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsxf17f.tmp\stdutils.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsxf17f.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\popcfg2\defines.xml	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\popcfg2\defines.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\popcfg2\defines.xml	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\popcfg2\files.cab	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\popcfg2\install.xml	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\popcfg2\install.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\popcfg2\install.xml	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\popcfg2\license.txt	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\popcfg2\license.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\popcfg2\license.txt	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\popcfg2\logo.bmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\popcfg2\logo.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\popcfg2\logo.bmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\popcfg2\product.bmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\popcfg2\product.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\popcfg2\product.bmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\popcfg2\props.xml	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\popcfg2\props.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\popcfg2\props.xml	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\popcfg2\readme.html	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\popcfg2\readme.html	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\popcfg2\readme.html	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\~nsua.tmp\un_a.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\windows\appcompat\programs\amcache.hve	Read Data,Read Control,Write Data
c:\windows\appcompat\programs\amcache.hve.log1	Read Data,Write Data
c:\windows\appcompat\programs\amcache.hve.log2	Read Data,Write Data

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\software\wow6432node\wildtangent\gamechannel::xxxadmintestxxx	1Y	RegNtPreCreateKey
HKCU\software\microsoft\ctf\msutb::left	ঔ	RegNtPreCreateKey
HKCU\software\microsoft\ctf\msutb::top		RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	*1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old5af52*1\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old5af62*1\??\C:\P	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Syscall Use	ntdll.dll!NtAccessCheck ntdll.dll!NtAdjustPrivilegesToken ntdll.dll!NtAlertThreadByThreadId ntdll.dll!NtAlpcConnectPort ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl ntdll.dll!NtAssociateWaitCompletionPacket ntdll.dll!NtClearEvent ntdll.dll!NtClose ntdll.dll!NtConnectPort Show More ntdll.dll!NtCreateEvent ntdll.dll!NtCreateFile ntdll.dll!NtCreateIoCompletion ntdll.dll!NtCreateKey ntdll.dll!NtCreateMutant ntdll.dll!NtCreateSection ntdll.dll!NtCreateSemaphore ntdll.dll!NtCreateTimer2 ntdll.dll!NtCreateWaitCompletionPacket ntdll.dll!NtCreateWorkerFactory ntdll.dll!NtDelayExecution ntdll.dll!NtDeleteValueKey ntdll.dll!NtDeviceIoControlFile ntdll.dll!NtDuplicateObject ntdll.dll!NtDuplicateToken ntdll.dll!NtEnumerateKey ntdll.dll!NtEnumerateValueKey ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtFsControlFile ntdll.dll!NtLoadKeyEx ntdll.dll!NtMapViewOfSection ntdll.dll!NtNotifyChangeKey ntdll.dll!NtOpenDirectoryObject ntdll.dll!NtOpenEvent ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenProcessTokenEx ntdll.dll!NtOpenSection ntdll.dll!NtOpenSemaphore ntdll.dll!NtOpenSymbolicLinkObject ntdll.dll!NtOpenThread ntdll.dll!NtOpenThreadToken ntdll.dll!NtOpenThreadTokenEx ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryDefaultLocale ntdll.dll!NtQueryDirectoryFileEx ntdll.dll!NtQueryFullAttributesFile ntdll.dll!NtQueryInformationFile ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryLicenseValue ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityAttributesToken ntdll.dll!NtQuerySecurityObject ntdll.dll!NtQuerySymbolicLinkObject ntdll.dll!NtQuerySystemInformation ntdll.dll!NtQuerySystemInformationEx ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryWnfStateData ntdll.dll!NtReadVirtualMemory ntdll.dll!NtReleaseMutant ntdll.dll!NtReleaseSemaphore ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtRequestWaitReplyPort ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationKey ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationThread ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtSubscribeWnfStateChange ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtTraceEvent ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtUnmapViewOfSectionEx ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitForWorkViaWorkerFactory ntdll.dll!NtWaitLowEventPair ntdll.dll!NtWorkerFactoryWorkerReady ntdll.dll!NtWriteFile ntdll.dll!NtWriteVirtualMemory UNKNOWN win32u.dll!NtUserGetKeyboardLayout win32u.dll!NtUserGetObjectInformation win32u.dll!NtUserGetProcessWindowStation win32u.dll!NtUserGetThreadDesktop win32u.dll!NtUserGetThreadState
User Data Access	GetComputerNameEx GetUserDefaultLocaleName GetUserObjectInformation
Anti Debug	IsDebuggerPresent NtQuerySystemInformation
Process Shell Execute	CreateProcess
Encryption Used	BCryptOpenAlgorithmProvider
Process Manipulation Evasion	NtUnmapViewOfSection ReadProcessMemory

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\\dw20.exe dw20.exe -x -s 860

C:\Users\Kabyjcxm\AppData\Local\Temp\02E6DB87-F0C8-4F45-93D3-D3D1C4DF46C9.exe

"C:\Users\Pbfegylq\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=c:\users\user\downloads\