PUP.Keygen.FAC
The detection of PUP.Keygen.FAC on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It is essential to understand the nature of this threat and take immediate action to remove it to prevent further damage.
Table of Contents
What Is PUP.Keygen.FAC?
PUP.Keygen.FAC is a type of potentially unwanted program that may have been installed on your system without your knowledge or consent. PUPs are software applications that may not be malicious in nature but can still cause problems with your computer's performance, stability, and security. They often infiltrate systems through bundled software downloads, infected websites, or suspicious email attachments.
How PUP.Keygen.FAC Operates
PUPs like PUP.Keygen.FAC typically operate by installing additional software, displaying unwanted advertisements, or collecting user data without consent. They may also modify system settings, registry entries, or browser configurations to achieve their goals. In some cases, PUPs can serve as a gateway for more severe malware infections, making it crucial to remove them promptly.
Once installed, PUP.Keygen.FAC may connect to remote servers to download additional components, update its configuration, or send collected data back to its creators. This communication can lead to further system compromise, data breaches, or the installation of more malicious software.
Symptoms of Infection
Systems infected with PUP.Keygen.FAC may exhibit various symptoms, including slow system performance, frequent pop-up ads, unwanted browser toolbars, or changes to default search engines. You may also notice unfamiliar programs or icons on your desktop, unexpected system crashes, or increased network activity.
- Unwanted advertisements or pop-ups
- Slow system performance or freezes
- Unfamiliar programs or icons on the desktop
- Changes to browser settings or search engines
- Increased network activity or data usage
How to Remove PUP.Keygen.FAC
- Boot your system in Safe Mode with Networking to prevent the PUP from loading and to allow for easier removal.
- Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all components of PUP.Keygen.FAC.
- Uninstall any suspicious programs or applications that may be related to the PUP.
- Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any modifications made by the PUP.
- Reboot your system and perform another full scan to ensure that all remnants of PUP.Keygen.FAC have been removed.
Conclusion
Removing PUP.Keygen.FAC from your system is crucial to preventing further damage and protecting your personal data. By following the steps outlined above, you can effectively remove this potentially unwanted program and restore your system to a safe and secure state. Remember to always be cautious when downloading software, avoid suspicious websites, and keep your anti-malware tools up to date to prevent future infections.
Analysis Report
General information
| Family Name: | PUP.Keygen.FAC |
|---|---|
| Packers: | UPX |
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
7938bb5e7544d818766f2f0aa4969907
SHA1:
501a1be8d46745bbf9452e284f43520418506ce6
File Size:
588.24 KB, 588241 bytes
|
|
MD5:
8819973709116c5410b9315504dba2fb
SHA1:
b067e91576d3d6c67cd66d541ed209d1a02d9901
SHA256:
FF26339AE5328844F3C56B4EA55EB2430FE385845BBF3523237D909A97A5C75C
File Size:
848.09 KB, 848085 bytes
|
|
MD5:
ccbddbf1f9c7d6e1dcd95aa8ec81bcc1
SHA1:
be1b02272953b1c2c29f4f47947623ac91d90eae
SHA256:
C2DD62C59324E4C3D9DBD6A170A5C4365DE468E11354450B5C429DDBCACADD40
File Size:
866.63 KB, 866627 bytes
|
|
MD5:
507eeabad74921a707044df7b6a604d5
SHA1:
111ab504d77fe862056a6359a775e775a0092f92
SHA256:
996CF239D7989BB1604E636040727D6B41FFAFBFC26450F1D69E7555A38DD358
File Size:
1.14 MB, 1144136 bytes
|
|
MD5:
68fbfe1d4eac5caf436b522e4bdc8704
SHA1:
00a774517eeffd576790844972b48bef306cc621
SHA256:
F492D3FAE75F95499C00C158D75AAD400A8DD9DB6313BC6EEA9BC6B48C2C90A2
File Size:
578.61 KB, 578610 bytes
|
Show More
|
MD5:
fd4bef5bb6fbc45a64758f535ce23227
SHA1:
72dafc290761749de5b11b20f07a36e8e002d32e
SHA256:
3708EB087EEBC75906C6D3E710E3E7AE745EB1731244EA90A1A4CD95EC3213C5
File Size:
666.09 KB, 666085 bytes
|
|
MD5:
f065ed4579d1ca2341e6a663a7c03acd
SHA1:
fc5d506e1b7dbf8bfb6db40e68e4d1b8f71b164a
SHA256:
3734AF8FA40F694E5B3B219F60729680BB320CB0AC2F4F447C327D1043BDDC1E
File Size:
538.75 KB, 538745 bytes
|
|
MD5:
d46adbc06c323d9de3d4cd5e009492d6
SHA1:
fa2231ebf0bd826a53317ef7a85d0e0e5e8eb3dc
SHA256:
E3438E2BC25CA6EFF0411DFC5FC5AB7F582C408801162E1CF478037BE33F6D9B
File Size:
540.63 KB, 540628 bytes
|
|
MD5:
56af4c68967c843c7ee071d062527a7f
SHA1:
b4a3f4e0bf2da820345480ceaf1aca3fee2c8b3b
SHA256:
C50F5D4A32B346D2378DC9EE8F10CE9A1328EC05E43A8D2CFF85CF3EC766DEDE
File Size:
6.64 MB, 6637530 bytes
|
|
MD5:
c5c6cb89e5dbf3c65f6f2f4afdc755c3
SHA1:
56eb42c0db0ff86502c94616f8a1445a8171dfa3
SHA256:
B91ABE195C0460A2ED98D4F2528D68A1904C331AE436E5199DCAB00CFA0D2D8D
File Size:
522.82 KB, 522816 bytes
|
|
MD5:
487e2d84d60cdf51f7508cc8e5fbed4f
SHA1:
3693b80c420e1f172757d691badb25fb60e0a01a
SHA256:
274A3BD0CC7FF456C2407C85A71543AEC9896C17E50513CA57F1812C92A2AD24
File Size:
530.18 KB, 530182 bytes
|
|
MD5:
3aa80fc35f49c1e92f92436b227d71d2
SHA1:
69e619c5002d5de05b0cc6deee9103d79cb3a34b
SHA256:
421F1BA0282B1822A9C98F0F8CF9BCD499A3CB7DAC7A8A2F051EE8B168BCA743
File Size:
1.15 MB, 1150327 bytes
|
|
MD5:
549a0956e80e581bfbc1dd4e24358de0
SHA1:
eac27597d5baea67704b00a921ed1fb7d5ae958d
SHA256:
8B9F444AC4357126FCBF1A1EC73F656E1057CE0BB29B1D4CC2F565EFA4FA9EDA
File Size:
4.39 MB, 4390696 bytes
|
|
MD5:
2e040192efa5d2de7009030a5da729b2
SHA1:
717db05fac12e1ece5f1d5a8eff8ffb0eecc0b2a
SHA256:
947DDE657D513CEE6216B7AA0FB939DCAD5DBBE71CBE33E4BB3C0C270312A050
File Size:
566.38 KB, 566379 bytes
|
|
MD5:
5a35dc3b181c4e3deb0995ca23da312e
SHA1:
00225889d68780fe8b3761e1b80dbcd5d21b77bc
SHA256:
81F139370A2759C71599EC740D4BFEC54DA09A01ABB0E5F80F58E0C56C23537D
File Size:
611.71 KB, 611707 bytes
|
|
MD5:
dc4fbcdbfb9530bb226cf5625f96a44d
SHA1:
4beda80d8a13a03d58e2c7b3dca7f07e4d5b4587
SHA256:
FDE3CA68FAC4ADACC3C82B5BCEFB14E6DB993F4740FB361B22D5CF1F3CF9EC3B
File Size:
1.10 MB, 1097956 bytes
|
|
MD5:
37d686f2398881b3f6278ff96d0d26cd
SHA1:
acc061434bdffbfaa432a0d201dcccb9cf9cf4fd
SHA256:
A621A431FCE7B8511E3032C15A5D728FF5EE5890658E732A944D7F26EBCED7A3
File Size:
1.20 MB, 1196930 bytes
|
|
MD5:
9cd5ac78667f3f8068e880a4561a6749
SHA1:
fc30de1c16ca1690b370c4e301f2a919458288b0
SHA256:
486AB9A76F78EEBE781A9EFA211B42463A4F424373D0C86FAA647920E330C47F
File Size:
589.83 KB, 589827 bytes
|
|
MD5:
d2b357fb9f6fe3548181963aeb6fe0fb
SHA1:
1dc008896a2b4e89caf81a93715007dc91756b5d
SHA256:
65EFD356D32094D970801BAAE46C5D775766137D95521AC36BD033C07CC2D0F7
File Size:
730.60 KB, 730598 bytes
|
|
MD5:
ac24b216a3e842593761f9024322b1c1
SHA1:
32df786ce1e76a3a069757d8644046e1b095a1a0
SHA256:
5A72CB4C0146F31CE1AA7FB50D2010BAD536796907CA93BAAC5E40D3DC5AA32C
File Size:
833.39 KB, 833390 bytes
|
|
MD5:
b67591fdea517786691c0cb060bf9a98
SHA1:
0b475bf4405ad7e932a68c384b48dec0110d86f5
SHA256:
2D83A98E2CE8A1339B36826ED032875C31C39FE443204ACC415BFA6E136D5584
File Size:
1.83 MB, 1827039 bytes
|
|
MD5:
f1eb3933c436dfd20259b00a7e6f44e2
SHA1:
76097a2a8bbad657428b7a1eda5153284e6b7003
SHA256:
3A5C446DC4B155DC147F13499977855962A1B619E7FF08BE86D8732BE840CA29
File Size:
1.12 MB, 1118031 bytes
|
|
MD5:
935a4cd7dc73bfb71b6f31523309f5b0
SHA1:
b9a2b25650a5c5747854016c0d347eb8570b8850
SHA256:
D8F18E97E9BBA08DE0A738BA82A4D8F7BB3596CEF68F71DA6225F96A02285E41
File Size:
643.65 KB, 643655 bytes
|
|
MD5:
4712a74420a319fac6c4d8c76c3d6136
SHA1:
b4f04b861f7a57aa70b3c997327dd4a8a2d6b9cb
SHA256:
43AA694A01A2ED83378185340066C24959F8E7126402D5841DCBB67FC4951C90
File Size:
593.75 KB, 593754 bytes
|
|
MD5:
bc64d4437e19548ba9bf057d9b90197b
SHA1:
0bb3ad102d09797e464479e7a09a0a4f9d309480
SHA256:
CB92B066941E137C877593C93B657FFAC4DF1A7C1D5BFD45F04C6C77AC9822B8
File Size:
641.51 KB, 641506 bytes
|
|
MD5:
d17c5589e1d4c163385aa8c54042caaf
SHA1:
6a0b819d9a7ed05cbb8a2f558c4de0603eb60f98
SHA256:
3A96C3D731641BB3E0EEDC8A8E6DC68A3721A06DCC72F878E17B5DFF0F0574A3
File Size:
558.05 KB, 558052 bytes
|
|
MD5:
29a11890825d9bcb2a25bdadfe8a5582
SHA1:
d796f8f05d38d83940fc45cf696a955b61aa3e8e
SHA256:
DB10E552D984B33B790915772B31453E439F3180563078D2AFA1DAFF56998B39
File Size:
1.04 MB, 1039893 bytes
|
|
MD5:
79de3776e7c1f40a80e6d9ee7f220aa7
SHA1:
1413d107337cc06a31fe0426835b1909d7d2f86b
SHA256:
4D91337E167A90C7698C0F74D7AC4E822BC6D6D530746E34C638A1C1990A5512
File Size:
659.79 KB, 659792 bytes
|
|
MD5:
279d5c7d394f49dfd4ab3d43c4ddc233
SHA1:
3729cb540cdb0800cd8b3757885583d71778afa1
SHA256:
21A05AB2FDD0E01F5BE4D9939C0F143511F1652E438CCC9C4B7D7160C0B263DC
File Size:
930.82 KB, 930818 bytes
|
|
MD5:
f6b31526f7170d35875200ee03ccaa07
SHA1:
31946b4b391515176a2d37432e828dafa858cfec
SHA256:
C7C1C8704E47CBDF204E2C2D3DB776576632841D51452E43222BB84B6541FFAF
File Size:
1.11 MB, 1109489 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has been packed
- File has exports table
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show More
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Show More
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Comments |
|
| Company Name |
Show More
|
| File Description |
Show More
|
| File Version |
Show More
|
| Internal Name |
Show More
|
| Legal Copyright |
Show More
|
| Legal Trademarks |
Show More
|
| Original Filename |
Show More
|
| Private Build |
Show More
|
| Product Name |
Show More
|
| Product Version |
Show More
|
| Special Build |
Show More
|
File Traits
- big overlay
- HighEntropy
- Installer Version
- packed
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 2,179 |
|---|---|
| Potentially Malicious Blocks: | 437 |
| Whitelisted Blocks: | 1,739 |
| Unknown Blocks: | 3 |
Visual Map
x
x
x
x
0
x
x
x
x
0
x
x
x
0
0
0
0
0
0
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
0
x
x
x
0
x
x
x
x
x
x
x
x
x
x
0
0
x
x
x
x
x
0
0
0
0
0
0
x
x
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
x
x
x
x
x
x
x
x
x
0
0
x
x
x
0
x
0
x
x
x
x
0
0
x
x
x
x
x
x
x
x
x
x
0
0
0
0
x
x
x
0
x
x
x
0
x
x
x
0
x
x
x
x
x
x
x
x
0
0
x
0
0
0
x
x
x
0
x
x
x
x
x
0
x
x
x
0
x
x
0
0
x
0
x
0
x
x
0
x
0
x
0
0
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
0
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
0
0
x
x
x
x
x
0
x
0
0
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
0
0
x
x
0
x
x
x
0
x
x
x
x
0
0
0
0
0
x
0
x
0
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
0
x
x
0
0
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
0
x
0
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
0
x
x
x
0
x
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
x
x
x
x
x
x
x
x
x
0
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
0
0
x
x
x
x
x
x
0
0
x
x
x
x
0
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
0
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
x
x
x
x
x
x
x
x
x
0
x
0
0
0
0
x
x
x
x
0
x
x
x
x
0
0
0
0
0
x
0
1
0
0
0
0
0
0
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
0
x
0
x
x
x
x
x
x
0
x
x
x
x
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
x
0
0
x
0
0
0
0
0
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
0
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
1
0
0
0
0
0
0
1
0
0
0
0
0
0
0
1
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
1
1
1
0
0
0
0
1
0
0
0
0
0
0
0
0
1
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Keygen.FAC
- Keygen.FH
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe\gmdasllogger | Generic Write,Read Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name | 501a1be8d46745bbf9452e284f43520418506ce6_0000588241.exe | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::id | ∌䜻 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name | b067e91576d3d6c67cd66d541ed209d1a02d9901_0000848085 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name | be1b02272953b1c2c29f4f47947623ac91d90eae_0000866627 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name | 111ab504d77fe862056a6359a775e775a0092f92_0001144136 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::id | ⓤ䜻 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name | 00a774517eeffd576790844972b48bef306cc621_0000578610 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::id | 剄䍯 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name | 72dafc290761749de5b11b20f07a36e8e002d32e_0000666085 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name | fc5d506e1b7dbf8bfb6db40e68e4d1b8f71b164a_0000538745 | RegNtPreCreateKey |
Show More
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name | fa2231ebf0bd826a53317ef7a85d0e0e5e8eb3dc_0000540628 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name | 56eb42c0db0ff86502c94616f8a1445a8171dfa3_0000522816 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name | 3693b80c420e1f172757d691badb25fb60e0a01a_0000530182 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name | 717db05fac12e1ece5f1d5a8eff8ffb0eecc0b2a_0000566379 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name | 00225889d68780fe8b3761e1b80dbcd5d21b77bc_0000611707 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name | 4beda80d8a13a03d58e2c7b3dca7f07e4d5b4587_0001097956 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name | acc061434bdffbfaa432a0d201dcccb9cf9cf4fd_0001196930 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name | fc30de1c16ca1690b370c4e301f2a919458288b0_0000589827 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name | 1dc008896a2b4e89caf81a93715007dc91756b5d_0000730598 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name | 32df786ce1e76a3a069757d8644046e1b095a1a0_0000833390 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name | 76097a2a8bbad657428b7a1eda5153284e6b7003_0001118031 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name | b9a2b25650a5c5747854016c0d347eb8570b8850_0000643655 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name | b4f04b861f7a57aa70b3c997327dd4a8a2d6b9cb_0000593754 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name | 0bb3ad102d09797e464479e7a09a0a4f9d309480_0000641506 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name | 6a0b819d9a7ed05cbb8a2f558c4de0603eb60f98_0000558052 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name | d796f8f05d38d83940fc45cf696a955b61aa3e8e_0001039893 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name | 1413d107337cc06a31fe0426835b1909d7d2f86b_0000659792 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name | 3729cb540cdb0800cd8b3757885583d71778afa1_0000930818 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name | 31946b4b391515176a2d37432e828dafa858cfec_0001109489 | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Anti Debug |
|
| User Data Access |
|
| Other Suspicious |
|
