PUP.HackKMS.DH

The detection of PUP.HackKMS.DH on your system indicates the presence of a potentially unwanted program (PUP) that may be causing harm or disrupting the normal functioning of your computer. It is essential to understand the nature of this threat and take immediate action to remove it and prevent further damage.

What Is PUP.HackKMS.DH?

PUP.HackKMS.DH is a type of malware that is classified as a potentially unwanted program. This category of threats includes software that may not be malicious in the classical sense but can still cause problems for users, such as unwanted advertisements, data collection, or system modifications without consent. The name PUP.HackKMS.DH itself does not directly imply a specific malware family, but rather indicates that it has been identified as a potentially unwanted program that could be related to hacking or unauthorized activation (KMS stands for Key Management Service) of software.

How PUP.HackKMS.DH Operates

Like many PUPs, PUP.HackKMS.DH likely operates by exploiting vulnerabilities in software or by tricking users into installing it, often bundled with other programs or presented as a useful tool. Once installed, it may start to exhibit behaviors that are detrimental to the user's experience, such as displaying unwanted advertisements, collecting user data without permission, or even attempting to activate or crack other software illegally. The exact mechanisms can vary, but the end result is a compromised system that may be slower, less secure, or more annoying to use.

Symptoms of Infection

Symptoms of a PUP.HackKMS.DH infection can include, but are not limited to, an increase in unwanted pop-ups or advertisements, unexpected changes in browser settings or homepage, slow system performance, or the appearance of unfamiliar programs or icons. Users might also notice that their system is more prone to crashes or that certain security features are disabled. Recognizing these symptoms is crucial for taking prompt action against the PUP.

How to Remove PUP.HackKMS.DH

1. Boot your computer in Safe Mode with Networking to prevent the malware from loading and to give you a cleaner environment to work in.
2. Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all traces of PUP.HackKMS.DH and any other potential threats.
3. Manually uninstall any suspicious programs that you do not recognize or that were installed around the time you noticed the infection.
4. Reset your web browsers (Chrome, Firefox, Edge, etc.) to their default settings to remove any unwanted extensions or changes made by the PUP.
5. After completing the above steps, reboot your computer and perform another scan with your anti-malware tool to ensure that all threats have been removed.

Conclusion

Removing PUP.HackKMS.DH from your system requires a combination of using the right tools, understanding how PUPs operate, and taking careful steps to eradicate the threat. By following the removal guide and maintaining good computer hygiene practices, such as regularly updating your software, being cautious with email attachments and downloads, and using strong, unique passwords, you can significantly reduce the risk of future infections. Remember, vigilance and proactive measures are key to protecting your digital environment from potentially unwanted programs and other types of malware.

Analysis Report

General information

Family Name:	PUP.HackKMS.DH
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: b7076b9e23a91c523f20909e7194c2ae SHA1: 40f3d7edb852eb361bba710b0329f937602d46bf SHA256: 1182810D8BFE41D4819FC59A94D0862DA91FECD9E62BA39E70683787D8BDD870 File Size: 1.51 MB, 1510346 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File has TLS information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)

Show More

• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Comments	This installation was built with Inno Setup.
File Description	KMS_VL_ALL Setup
Product Name	KMS_VL_ALL

File Traits

• dll
• ntdll
• x86

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\users\user\appdata\local\temp\is-dhd4l.tmp\40f3d7edb852eb361bba710b0329f937602d46bf_0001510346.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-p63b6.tmp\1-sppextcomobjpatcher.bak	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-p63b6.tmp\2-activate-local.bak	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-p63b6.tmp\_isetup\_isdecmp.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-p63b6.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-p63b6.tmp\check-activation-status.bak	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-p63b6.tmp\cleanospp.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-p63b6.tmp\convert-c2r.bak	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-p63b6.tmp\fart.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-p63b6.tmp\innocallback.dll	Generic Write,Read Attributes

Show More

c:\users\user\appdata\local\temp\is-p63b6.tmp\key.cmd	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-p63b6.tmp\keyoff.cmd	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-p63b6.tmp\kms_vl_all.bak	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-p63b6.tmp\msvcr100.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-p63b6.tmp\sppextcomobjhook.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-p63b6.tmp\svctrigger.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-p63b6.tmp\win32\key.cmd	Synchronize,Write Data
c:\users\user\appdata\local\temp\is-p63b6.tmp\win32\svctrigger.xml	Synchronize,Write Data
c:\users\user\appdata\local\temp\is-p63b6.tmp\x64\cleanospp.exe	Synchronize,Write Data
c:\users\user\appdata\local\temp\is-p63b6.tmp\x64\msvcr100.dll	Synchronize,Write Data
c:\users\user\appdata\local\temp\is-p63b6.tmp\x64\sppextcomobjhook.dll	Synchronize,Write Data
c:\users\user\appdata\local\temp\is-p63b6.tmp\x86\keyoff.cmd	Synchronize,Write Data

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Process Manipulation Evasion	NtUnmapViewOfSection
Process Shell Execute	CreateProcess
User Data Access	GetUserObjectInformation
Keyboard Access	GetKeyState

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

"C:\Users\Pqxnebli\AppData\Local\Temp\is-DHD4L.tmp\40f3d7edb852eb361bba710b0329f937602d46bf_0001510346.tmp" /SL5="$60310,1092994,202752,c:\users\user\downloads\40f3d7edb852eb361bba710b0329f937602d46bf_0001510346"