PUP.Hudun
The detection of PUP.Hudun on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It is essential to understand the nature of this threat and take immediate action to remove it and prevent further damage.
Table of Contents
What Is PUP.Hudun?
PUP.Hudun is a type of malware that is classified as a potentially unwanted program. This means that it is not necessarily a virus or a Trojan, but rather a program that may be installed on your system without your knowledge or consent. PUPs can be bundled with other software, downloaded from the internet, or installed through exploited vulnerabilities. They often exhibit behaviors that are annoying, disruptive, or potentially harmful, such as displaying unwanted ads, collecting personal data, or slowing down system performance.
How PUP.Hudun Operates
PUP.Hudun, like other PUPs, can operate in various ways to achieve its goals. It may install itself as a browser extension, add-on, or plugin, allowing it to collect browsing data, display ads, or redirect search results. It may also install additional software, such as toolbars, search bars, or desktop applications, which can further compromise system security. In some cases, PUP.Hudun may even communicate with remote servers to receive updates, transmit data, or download additional malware.
Symptoms of Infection
If your system is infected with PUP.Hudun, you may notice various symptoms, including unwanted ads, pop-ups, or banners; slow system performance; unusual browser behavior, such as redirects or changed homepage settings; appearance of suspicious programs or icons; or increased data usage. You may also experience issues with your browser, such as crashes, freezes, or errors. It is essential to be aware of these symptoms and take action promptly to prevent further damage.
- Unwanted ads, pop-ups, or banners
- Slow system performance
- Unusual browser behavior
- Appearance of suspicious programs or icons
- Increased data usage
How to Remove PUP.Hudun
- Boot your system in Safe Mode with Networking to prevent PUP.Hudun from loading and to allow for a more effective removal process.
- Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all instances of PUP.Hudun and related malware.
- Uninstall any suspicious programs or applications that may be related to PUP.Hudun, using the Control Panel or Settings app.
- Reset your browser settings to their default values, including Chrome, Firefox, and Edge, to remove any malicious extensions, add-ons, or plugins.
- Reboot your system and perform a follow-up scan to ensure that all remnants of PUP.Hudun have been removed.
Conclusion
Removing PUP.Hudun from your system requires a combination of technical knowledge, caution, and the right tools. By following the steps outlined above and maintaining good security practices, such as keeping your operating system and software up-to-date, using strong antivirus software, and being cautious when downloading and installing software, you can help prevent future infections and keep your system secure. Remember to always be vigilant and monitor your system for any suspicious activity, and take immediate action if you suspect that your system has been compromised.
Analysis Report
General information
| Family Name: | PUP.Hudun |
|---|---|
| Signature status: | Root Not Trusted |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
adcd298380b29cc7fb9b1f26da4e85a5
SHA1:
dfe8cf02020bcd63ef08d6a1f53dd9f36d75f6ee
SHA256:
E23C6FFF0D2766F1CABB190E7B7EBE0B826CA41EC2E36E4BF7C28F80B4752336
File Size:
2.73 MB, 2732232 bytes
|
|
MD5:
34ab32f3d4bf2210ce46c3735bcbab58
SHA1:
694366337c014995c1cd096645c2e6acd8a054bc
SHA256:
1BB3E9442EF22B9649C4E3F623CAC0A41B273DDB435A272082E3D4C525E5F39B
File Size:
1.17 MB, 1168072 bytes
|
|
MD5:
c15f800435286a74d210f9f600e3472b
SHA1:
5d4bf6b374b8feb910708ad490312d2af1932f87
SHA256:
95D877C9B31BB447FF72AAF5CAA6A3D4E4F11F27D5BB927A0E2F460EBBC44A60
File Size:
1.22 MB, 1224032 bytes
|
|
MD5:
f9f9d43f0390a8cb1acd4ee9929805d0
SHA1:
6b6943dbfbe7beed9cfae3346c9e5d1439ee4cf7
SHA256:
4925FBBDC34570D86972F902AADED79F4467CA72DC930B472191F52D8E15AA6E
File Size:
9.49 MB, 9492680 bytes
|
|
MD5:
e05af82ee9fa65cd1b7f3a5444df515f
SHA1:
90de084d5e73d67291496353110aacfcd4f3a39a
SHA256:
152C59B88F4186F7A4F09A78E0B5F6E4AE70EA19FA2F1A381FC743DFFE6DEF99
File Size:
48.84 KB, 48840 bytes
|
Show More
|
MD5:
771e5fc4c141ab18954de60ccff8a412
SHA1:
2bec222a746d8a6def9662315661e0905f01c91f
SHA256:
AFF7F06FF0CB8E5451F1A1648D3DBF7DF5A730F82FA33D041936A66777E9E180
File Size:
1.31 MB, 1311456 bytes
|
|
MD5:
cd02a12e43632bc938b0d8a59308f68c
SHA1:
eb75005de30e63844abdba0588ae5c5492352d3a
SHA256:
392C8FEC09A9ED3573F32AC4EA8992A4FFA5DC4CE3F082BB1531CDF5A43A90B0
File Size:
2.26 MB, 2256072 bytes
|
|
MD5:
1dba55dce2f270e32fdd90a3012ce11d
SHA1:
e4f0819e6576d65884cf904e0965a301ceee5ac2
SHA256:
57E220238E3E43417B690E4855B91F8BF5FFE53AC54A4CEB77A232CCDF84B215
File Size:
2.29 MB, 2290888 bytes
|
|
MD5:
8768627c3281834c6f470d0ebdfad90b
SHA1:
799f7250ca2d4f168fb32238f8a6de721e5ec71b
SHA256:
74EC62FFCD93F7DDB7A8D499C98FDCA9C073A8728AE60A0105665C28E3817CA3
File Size:
2.32 MB, 2321896 bytes
|
|
MD5:
356c306f64d7b645c0852ad7df8c5c75
SHA1:
4d981af7e80b6995e4cddab2317b63f1184bc45d
SHA256:
8FED6A3D4FE87D7420D552FAB685B0D91628491850F6762BA3D1FEB29B03949B
File Size:
126.18 KB, 126176 bytes
|
|
MD5:
2a49f5b764f43256110bf802ef110b4c
SHA1:
55555e9e988f67fa2b429fdf9a1373a89414548f
SHA256:
CF9F92D1A8D53DB993580DD450A77839A99365D7B2CACF27D6A83325E1B47FE8
File Size:
1.50 MB, 1504232 bytes
|
|
MD5:
d3c13963689bc0697df22d7d3af07427
SHA1:
0bbc17e8a6a8b3a0984aa2d61675cdadf496f385
SHA256:
D0D51B8BCC6F0058566E19F23865FFEC78E2972841AFB1665854760BE6F41DE5
File Size:
1.72 MB, 1717592 bytes
|
|
MD5:
6e3544e2c195a2664d592cf920bd9434
SHA1:
303242e9b8505eab51af13026aeb042b316d31cf
SHA256:
10B722EB5A4473457E1180CF25614D6A8750FF498AC8CE7DCB55302466D17DD9
File Size:
2.87 MB, 2874080 bytes
|
|
MD5:
4e85682ed1c8aae83edab581c793d39a
SHA1:
ef17a68e7006083c5293d8e2426f00e850e00010
SHA256:
45C75F43B2F369C41209A4BB4F37509BC52F63A5A74287DA1C00672D65D289D5
File Size:
2.84 MB, 2843992 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File has exports table
- File has TLS information
- File is 32-bit executable
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
Show More
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Comments |
|
| Company Name |
|
| File Description |
Show More
|
| File Version |
|
| Internal Name |
Show More
|
| Legal Copyright |
|
| Legal Trademarks |
|
| Original Filename |
Show More
|
| Private Build |
|
| Product Name |
Show More
|
| Product Version |
|
| Special Build |
|
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| Shanghai Hudun Information Technology Co., Ltd. | AAA Certificate Services | Root Not Trusted |
| Shanghai Hudun Information Technology Co., Ltd. | DigiCert High Assurance EV Root CA | Root Not Trusted |
| Shanghai Hudun Information Technology Co., Ltd. | DigiCert High Assurance EV Root CA | Root Not Trusted |
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 6,450 |
|---|---|
| Potentially Malicious Blocks: | 520 |
| Whitelisted Blocks: | 5,858 |
| Unknown Blocks: | 72 |
Visual Map
x
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
x
x
x
0
x
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
x
x
x
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
x
x
?
x
x
0
x
x
x
x
0
x
0
0
x
x
0
x
x
x
x
x
x
x
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
x
x
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
x
x
x
x
x
x
x
x
0
0
0
x
0
x
0
x
0
0
x
x
x
x
x
x
x
x
x
0
x
x
0
x
0
x
0
0
x
0
x
x
x
0
0
0
0
x
x
0
0
1
1
0
0
x
0
x
x
x
x
0
1
1
x
x
x
x
0
x
x
?
?
?
?
0
x
0
0
x
0
0
x
x
x
x
x
x
x
x
0
0
x
?
x
x
x
x
x
?
0
x
x
?
?
?
0
0
x
x
x
?
x
x
?
?
x
x
x
?
x
x
0
0
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
x
0
?
x
?
0
0
x
x
x
x
x
x
?
0
0
x
x
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
x
x
x
0
x
x
0
0
0
0
0
x
x
0
x
0
0
x
0
0
0
0
0
x
0
x
x
x
x
x
x
0
0
0
0
0
x
0
x
?
0
0
x
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
x
x
x
0
x
x
x
0
0
0
0
0
0
0
0
0
0
0
?
0
0
x
?
?
?
?
?
0
0
?
?
0
?
?
0
?
0
0
?
0
0
0
0
0
0
0
?
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
x
0
0
x
x
0
0
x
0
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
x
0
0
x
x
x
0
0
x
0
0
x
x
x
0
0
x
0
0
0
x
0
0
x
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
0
0
x
x
x
x
0
0
0
0
0
0
0
0
0
0
?
?
0
x
0
0
x
0
0
0
0
x
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
0
x
0
x
x
x
0
x
0
x
0
0
0
x
x
0
x
x
x
0
0
0
0
0
0
0
0
0
0
0
x
x
x
0
x
x
0
x
0
0
1
0
0
x
0
?
0
x
x
0
0
x
x
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
0
0
0
0
0
0
0
0
x
0
x
0
x
0
0
0
x
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
1
0
0
0
0
0
0
0
x
0
0
0
0
0
x
x
x
x
0
x
x
x
x
x
x
0
0
x
x
x
0
x
x
x
0
0
x
0
x
0
x
0
x
0
0
0
x
0
0
0
0
0
?
0
0
?
?
0
?
0
0
0
0
x
0
0
0
x
0
0
0
0
x
x
x
x
x
0
0
x
x
0
x
x
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
x
0
0
0
x
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
0
0
0
0
0
0
0
0
0
x
0
0
x
0
0
0
0
0
x
0
0
0
0
0
0
0
0
x
0
0
x
x
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
x
x
x
x
x
x
x
x
x
x
0
0
0
0
x
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
x
x
0
x
0
0
0
0
0
0
x
x
x
0
0
0
0
0
x
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
x
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
x
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
x
0
0
0
0
0
0
0
x
0
0
0
x
x
0
0
0
x
0
0
0
x
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
0
0
0
x
0
0
0
0
0
0
0
0
0
x
0
x
x
0
1
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
0
0
0
0
0
0
0
x
x
x
x
1
0
1
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
x
x
0
0
x
0
0
x
x
x
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
x
0
x
x
0
0
0
0
x
0
0
0
x
0
0
0
0
0
x
0
x
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
x
x
0
0
0
0
x
x
x
0
0
0
0
0
0
0
0
x
0
x
0
0
0
0
0
x
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
0
0
0
0
0
x
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Hudun.A
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\appdata\local\hdlocal\gaituyaphotoeditor.downloader\gaituyaphotoeditor.downloader_hdsconfigure.ini | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\hdlocal\gaituyaphotoeditor.downloader\gaituyaphotoeditor.downloader_hdslog.txt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\hdlocal\gaituyaphotoeditor.downloader\gaituyaphotoeditor.downloader_hdslog.txt | Generic Write,Read Attributes |
| c:\users\user\appdata\local\hdlocal\universalpictureeditor.downloader\universalpictureeditor.downloader_hdsconfigure.ini | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\hdlocal\universalpictureeditor.downloader\universalpictureeditor.downloader_hdslog.txt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\hdlocal\universalpictureeditor.downloader\universalpictureeditor.downloader_hdslog.txt | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\~huduntemp.92482b06fb471e17\xjpdfeditor_un_asa.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\users\user\appdata\local\temp\~huduntemp.92482b06fb471e17\xjvideoconverter_un_asa.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\users\user\appdata\local\temp\~huduntemp.92482b06fb471e17\xjvideocrop_un_asa.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\users\user\appdata\local\temp\~huduntemp.92482b06fb471e17\xunjieppt_un_asa.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\software\wow6432node\microsoft\direct3d\mostrecentapplication::name | dfe8cf02020bcd63ef08d6a1f53dd9f36d75f6ee_0002732232 | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | � xy �ރ ��^ ��z Vs} kP~ ��1 �� e � ��1 �� | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries | `$�!�:i�� +00�� � Gs]XM��� "�2� � FX D�' :D��exA-� �LG=�A��J� �C� | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\content::cacheprefix | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\cookies::cacheprefix | Cookie: | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\history::cacheprefix | Visited: | RegNtPreCreateKey |
Show More
| HKCU\software\microsoft\edge\blbeacon::failed_count | RegNtPreCreateKey | |
| HKCU\software\microsoft\edge\blbeacon::state | RegNtPreCreateKey | |
| HKCU\software\microsoft\edge\thirdparty::statuscodes | (NULL) | RegNtPreCreateKey |
| HKCU\software\microsoft\edge\thirdparty::statuscodes | RegNtPreCreateKey | |
| HKCU\software\microsoft\edge\elfbeacon::version | 142.0.3595.53 | RegNtPreCreateKey |
| HKCU\software\microsoft\edge\blbeacon::failed_count | RegNtPreCreateKey | |
| HKCU\software\microsoft\edge\blbeacon::state | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | �� * � /�� Y� d� � � �ރ �p �o � Vs} kP~ ��1 �� 7 � �� ﺃ d B F e ��1 �� i e�� r � | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | 闸 ȁ ਪˣ 鈯ˣ 遙̃ 豤̃ অˣ 炑̃ 龡^ 濖̃ 賬̃ + 獖} 偫~ 엦1 ˣ 邯̃ 뫯ʃd ᵂċ ᵆċe ࠄ 엦1 ¶i ꙥr ֢ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | � xy * � /�� Y� d� kP~ � � �ރ �p ��^ �o � ee3 Vs} kP~ ��1 . �� 7 � �� ﺃ e e�� � ��1 �� f e�� g � | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �j � 8��81��B �6 �v y� �Z xy �� �a ۀT�B� ����� 1���� �5����eeBx �<�� �� �R �7 �!wz "M)"Wc#�#��$kF$�� %"�%:� %�&� &�x'�(�(X�)�`*J*9*�^+�[+��,=� ,��/9� /��1`1� | RegNtPreCreateKey |
| HKCU\software\microsoft\edge\elfbeacon::version | 143.0.3650.96 | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Anti Debug |
|
| Network Winsock2 |
|
| Keyboard Access |
|
| Syscall Use |
Show More
|
| Process Shell Execute |
|
| Process Manipulation Evasion |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
open C:\Users\Fpyuozrb\AppData\Local\Temp\~HuDunTemp.92482B06FB471E17\XJVideoCrop_un_asa.exe -instdir="Test"
|
open http://tj.sjhfrj.com/redirect/ver1/videocrop/discount2/1.0/installer/123456
|
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://tj.sjhfrj.com/redirect/ver1/videocrop/discount2/1.0/installer/123456
|
open C:\Users\Fijksnmi\AppData\Local\Temp\~HuDunTemp.92482B06FB471E17\XJPDFEditor_un_asa.exe -instdir="Test"
|
open C:\Users\Mjvjcded\AppData\Local\Temp\~HuDunTemp.92482B06FB471E17\XunjiePPT_un_asa.exe -instdir="Test"
|
Show More
open C:\Users\Qzudoixs\AppData\Local\Temp\~HuDunTemp.92482B06FB471E17\XJVideoConverter_un_asa.exe -instdir="Test"
|
open http://tj.sjhfrj.com/redirect/ver1/videoconverter/discount2/1.0/installer/123456
|
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://tj.sjhfrj.com/redirect/ver1/videoconverter/discount2/1.0/installer/123456
|
