PUP.Soft32DownloadManager
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 8,688 |
| Threat Level: | 10 % (Normal) |
| Infected Computers: | 26,038 |
| First Seen: | March 27, 2019 |
| Last Seen: | October 4, 2026 |
| OS(es) Affected: | Windows |
The detection of PUP.Soft32DownloadManager on your system indicates the presence of a potentially unwanted program (PUP) that may be compromising your computer's security and performance. It is essential to understand the nature of this threat and take immediate action to remove it and prevent further damage.
Table of Contents
What Is PUP.Soft32DownloadManager?
PUP.Soft32DownloadManager is a type of malware that is categorized as a potentially unwanted program. This means that while it may not be as destructive as other types of malware, such as viruses or trojans, it can still cause significant problems for your computer and your personal data. PUPs are often installed unintentionally, bundled with other software or downloaded from untrusted sources.
How PUP.Soft32DownloadManager Operates
PUP.Soft32DownloadManager operates by installing itself on your system, often without your knowledge or consent. Once installed, it can begin to display unwanted advertisements, collect your personal data, and even install additional malware or PUPs. It may also modify your browser settings, changing your homepage or default search engine, and can even redirect your searches to unwanted websites. In some cases, PUPs can also slow down your computer's performance, causing frustration and inconvenience.
Symptoms of Infection
The symptoms of a PUP.Soft32DownloadManager infection can vary, but common signs include unwanted advertisements or pop-ups, slow computer performance, and changes to your browser settings. You may also notice that your computer is taking longer to start up or shut down, or that your internet connection is slower than usual. In some cases, you may even receive fake alerts or warnings, claiming that your computer is infected with a virus or other malware.
- Unwanted advertisements or pop-ups
- Slow computer performance
- Changes to your browser settings
- Slow internet connection
- Fake alerts or warnings
How to Remove PUP.Soft32DownloadManager
- Boot your computer in Safe Mode with Networking to prevent the PUP from loading and to allow you to download and install removal tools.
- Download and install a reputable anti-malware tool, such as SpyHunter, and run a full scan to detect and remove the PUP and any associated malware.
- Uninstall any suspicious programs that may be related to the PUP, using the Add/Remove Programs feature in your computer's Control Panel.
- Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any changes made by the PUP.
- Reboot your computer and run another scan with your anti-malware tool to ensure that the PUP has been completely removed.
Conclusion
Removing PUP.Soft32DownloadManager from your system is crucial to preventing further damage and protecting your personal data. By following the steps outlined above, you can safely and effectively remove this potentially unwanted program and restore your computer to its optimal performance. Remember to always be cautious when downloading software or clicking on links, and to keep your anti-malware tools up to date to prevent future infections.
SpyHunter Detects & Remove PUP.Soft32DownloadManager
File System Details
PUP.Soft32DownloadManager may create the following file(s):
| # | File Name | MD5 |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|---|
| 1. | 4.5_Installer_mixcraft_8.1.412.exe | d17eaded233cd89fad67b267aaec922e | 21 |
Analysis Report
General information
| Family Name: | PUP.Soft32DownloadManager |
|---|---|
| Signature status: | Modified signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
ead0f3b22aa74708032f6bb80dcdfaf5
SHA1:
c09141aadc474e74a7a6088b84541acf634770f4
SHA256:
BD91B80EBC8486CEAA55F6293CD95169F038E2923282C2C97A5D135B24776429
File Size:
865.11 KB, 865112 bytes
|
|
MD5:
214521b645998a39f13d4e28e7f26c3f
SHA1:
0a020d97f3a94bbe2f8dc082f610da6f164fccdd
SHA256:
90CB93E483DB2F15AC275C6CD5D81059DC44AB20B9B254D444D281FD5C709B84
File Size:
607.06 KB, 607064 bytes
|
|
MD5:
09f430bad38b7ec2f102fc25453b676c
SHA1:
430042c1681931d7d90db06bdfd30fc2accb33ee
SHA256:
DA57A0BE63506BFD55EF7787575A2D76CBC29BE034203B354CD0050E265BF72C
File Size:
383.82 KB, 383816 bytes
|
|
MD5:
84ee84ca8c142dbfffa6cdd09a198498
SHA1:
3ec29e194044a51190c05beadd664d4d3db4ecfe
SHA256:
8A4B8BEEC3478BE3AFDC3B60791540275753FBE5488BEFCA02B10E03785C8526
File Size:
850.69 KB, 850688 bytes
|
|
MD5:
81b8f2759178f8eb41d0cdad52a757b7
SHA1:
dec8ffffae5a592afad499b0f37313ca865e96ed
SHA256:
3796EAC558F8454CE14DD8EA94E5B9F5FEA733B10EBFE202394E3D3CE42420B9
File Size:
865.11 KB, 865112 bytes
|
Show More
|
MD5:
426c704ae82417dba39c9c1e5a74c4f6
SHA1:
8b11776f05bcc6a64ce444a88b955feb3b6448c4
SHA256:
21640223450C4332D8821A68791D48E8AB1007C5274D98A5BFE3351D579E1773
File Size:
1.12 MB, 1116952 bytes
|
|
MD5:
ddaaae1a7cb8cc04b1747578840942da
SHA1:
5c6f81ad4b858ffcc6e038cce52229ed67a17dae
SHA256:
C5B4B64D395E5BB32DBF77E88341871F8EFD76AD698ADEC4C2555FAF716E9589
File Size:
762.01 KB, 762008 bytes
|
|
MD5:
4d5bb43a65eae79f467968d16b63d542
SHA1:
edcd884d97b49676cb9827d071d577e97a2cdc30
SHA256:
06BCD5A088249C6013762E14D720ED5B1D7B46D01868533F17997BB3F83D454B
File Size:
383.70 KB, 383696 bytes
|
|
MD5:
dcb4b0da22ebf815fef81a666ce7da20
SHA1:
6b6177b9cf2545cd6e66e31de9ac7baab7006ec5
SHA256:
91ECC4B0D51180C9C4162D644A14D20BBA5C7A5989C800C9DB1FE3A3DFB27DE2
File Size:
913.41 KB, 913408 bytes
|
|
MD5:
22209f6517484f0e782113a5b3fc5fd8
SHA1:
f59eff03c37f3b2e16c3367aa9bc101953963bf1
SHA256:
A11E7B1554D4DD96D982CD336C25A09D9D664BDC4DA06C3611C3699335914BE6
File Size:
557.20 KB, 557200 bytes
|
|
MD5:
de6af3a2eafb7d96741a4dff8fdba4c2
SHA1:
56d1820d3f6019406dea62667218380fb9ef994f
SHA256:
F98CA97A0FCBA21B52718F185C8E3AA68F6EBB6C9AEAB01225E975316670E0C7
File Size:
1.12 MB, 1116952 bytes
|
|
MD5:
df6a0e06514866956998a798d593a495
SHA1:
a1b4fcb39136e20369c7f4b6686e26dc4c20d8aa
SHA256:
C5995DBD806A10F39A6047EB68AB5E705C5BB51B347B7C0B81C07BDD1AFBEEBC
File Size:
1.19 MB, 1185328 bytes
|
|
MD5:
258e8c6724d7b9fe8fa7746e3ea9f94e
SHA1:
4ad83258dc45e7d9cad61dd53c383ba8c76a4e54
SHA256:
FD25C2F3ACAF6EDB1FBF1C89B1BDB2A63D084B9135B3A140549E876FC43928E4
File Size:
606.08 KB, 606080 bytes
|
|
MD5:
1fb9d1b63c7fd758443f4aeac684f65e
SHA1:
e8891549c9de67971150d6a67649325092bd4a07
SHA256:
685A796063E1DB25A6719CF348FC30F851ADC972F5203198C6A2607C1EAC4112
File Size:
865.11 KB, 865112 bytes
|
|
MD5:
ae446527e21d4d1e68f77d1189304c8b
SHA1:
77f1e9bf29ca139c7f90edc03060a795da10280d
SHA256:
4961E24C7EFAFC71FEE01F353C72DC939CC41B94AFD2BE6E44CE0B2A254EAAC1
File Size:
534.37 KB, 534368 bytes
|
|
MD5:
f57d6dffe1d0f19211c5b9383642b5ff
SHA1:
8aabad591b7d95e26a5130ba13c4efb6259b01d4
SHA256:
735F4285C8C601DE28F5A13728C2B31A0193F16E740435E67D9A831ACEB14F07
File Size:
5.98 MB, 5979600 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has been packed
- File has exports table
- File has TLS information
- File is .NET application
- File is 32-bit executable
Show More
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version |
|
| Company Name |
|
| File Description |
|
| File Version |
|
| Internal Name |
|
| Legal Copyright |
|
| Original Filename |
|
| Product Name |
|
| Product Version |
|
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| ITNT SRL | Entrust Extended Validation Code Signing CA - EVCS1 | Self Signed |
| Zulu Soft SRL | Symantec Class 3 Extended Validation Code Signing CA | Self Signed |
| I.T.N.T. SRL | thawte Primary Root CA | Root Not Trusted |
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 82 |
|---|---|
| Potentially Malicious Blocks: | 6 |
| Whitelisted Blocks: | 76 |
| Unknown Blocks: | 0 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Downloader.AA
- MSIL.Bundler.D
- MSIL.Downloader.UGG
- MSIL.Krypt.GBTD
- Soft32Download.A
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe\gmdasllogger | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\h2odal.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\h2odal.dll.lock | Generic Write,Read Attributes,Delete |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\h2omodels.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\h2omodels.dll.lock | Generic Write,Read Attributes,Delete |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\h2oservices.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\h2oservices.dll.lock | Generic Write,Read Attributes,Delete |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\h2outilities.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\h2outilities.dll.lock | Generic Write,Read Attributes,Delete |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\h2oviewmodels.dll | Generic Write,Read Attributes |
Show More
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\h2oviewmodels.dll.lock | Generic Write,Read Attributes,Delete |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\htmlagilitypack.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\htmlagilitypack.dll.lock | Generic Write,Read Attributes,Delete |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\msvcp140.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\msvcp140.dll.lock | Generic Write,Read Attributes,Delete |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\ninject.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\ninject.dll.lock | Generic Write,Read Attributes,Delete |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\offersdk.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\offersdk.dll.lock | Generic Write,Read Attributes,Delete |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\sciterwrapper.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\sciterwrapper.dll.lock | Generic Write,Read Attributes,Delete |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\servicehide.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\servicehide.dll.lock | Generic Write,Read Attributes,Delete |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\servicehide.net.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\servicehide.net.dll.lock | Generic Write,Read Attributes,Delete |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\vcruntime140.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\vcruntime140.dll.lock | Generic Write,Read Attributes,Delete |
| c:\users\user\appdata\local\temp\7zs02bea81b\2026.03.08_16.31.03.457216_installer_pid=284.txt | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\2026.03.08_16.31.03.457216_installer_pid=284.txt | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\bundleconfig.xml | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\bundleconfig.xml | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\de | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\de | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\de\devlib.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\de\devlib.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\devlib.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\devlib.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\en | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\en | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\en\devlib.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\en\devlib.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\es | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\es | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\es\devlib.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\es\devlib.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\externalresource.xml | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\externalresource.xml | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\fr | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\fr | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\fr\devlib.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\fr\devlib.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\genericsetup.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\genericsetup.exe | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\genericsetup.exe.config | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\genericsetup.exe.config | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\installer.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\installer.exe | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\microsoft.win32.taskscheduler.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\microsoft.win32.taskscheduler.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\wizardpages.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02bea81b\wizardpages.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\dm_2cyoe94uba\downloadmanager.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\dm_ak2hennudh\downloadmanager.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\dm_fiuopqsa5j\downloadmanager.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\dm_hqh1bqb3rs\downloadmanager.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\dm_jx2hmdegiy\downloadmanager.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\dm_tzqdqjndpk\downloadmanager.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\dm_yoggp1pabm\downloadmanager.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\dm_yrotooeoyo\downloadmanager.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsa2b3f.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsa2b3f.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsc673f.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsc673f.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsef5fa.tmp\inetc.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsef5fa.tmp\pwgen.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsef5fa.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsef5fa.tmp\userinfo.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsf363c.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsf363c.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsk3c6a.tmp\inetc.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsk3c6a.tmp\pwgen.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsk3c6a.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsk3c6a.tmp\userinfo.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsm6692.tmp\inetc.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsm6692.tmp\pwgen.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsm6692.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsm6692.tmp\userinfo.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsm7de6.tmp\inetc.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsm7de6.tmp\pwgen.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsm7de6.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsm7de6.tmp\userinfo.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsof687.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsof687.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsp3cdb.tmp\inetc.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsp3cdb.tmp\pwgen.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsp3cdb.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsp3cdb.tmp\userinfo.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsq2ab2.tmp\inetc.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsq2ab2.tmp\pwgen.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsq2ab2.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsq2ab2.tmp\userinfo.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsr7e54.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsr7e54.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsu3cf7.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsu3cf7.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsuf3e7.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsuf3e7.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsz35cd.tmp\inetc.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsz35cd.tmp\pwgen.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsz35cd.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsz35cd.tmp\userinfo.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsz3d68.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsz3d68.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nszf369.tmp\inetc.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nszf369.tmp\pwgen.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nszf369.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nszf369.tmp\userinfo.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\26ad01f9c002fad37427e734302383d8_3d35b005d6c0b647da10c78f31832a40 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\26ad01f9c002fad37427e734302383d8_89128fe16ee2322384ba30e95e606e62 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\398ee64d66758b5715368aa94044b13a | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\7d266d9e1e69fa1eefb9699b009b34c8_1d5a876a9113ec07224c45e5a870e3bd | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\8dfdf057024880d7a081afbf6d26b92f | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\b3bb9c1ba2d19e090ae305b2683903a0_608e9093e4033cb74cfdfdb1e83a5bc5 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\c27229390f3f6926292942fb717a1f0f | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\ee44eca143b76f2b9f2a5aa75b5d1ec6_847118be2683f0c241d1d702f3a3f5f9 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\26ad01f9c002fad37427e734302383d8_3d35b005d6c0b647da10c78f31832a40 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\26ad01f9c002fad37427e734302383d8_89128fe16ee2322384ba30e95e606e62 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\398ee64d66758b5715368aa94044b13a | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\7d266d9e1e69fa1eefb9699b009b34c8_1d5a876a9113ec07224c45e5a870e3bd | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\8dfdf057024880d7a081afbf6d26b92f | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b3bb9c1ba2d19e090ae305b2683903a0_608e9093e4033cb74cfdfdb1e83a5bc5 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\c27229390f3f6926292942fb717a1f0f | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\ee44eca143b76f2b9f2a5aa75b5d1ec6_847118be2683f0c241d1d702f3a3f5f9 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\getrighttogo\.data | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\getrighttogo\.data0 | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\content::cacheprefix | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\cookies::cacheprefix | Cookie: | RegNtPreCreateKey |
Show More
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\history::cacheprefix | Visited: | RegNtPreCreateKey |
| HKLM\software\microsoft\systemcertificates\authroot\certificates\4eb6d578499b1ccf5f581ead56be3d9b6744a5e5::blob | ់㹧ৢ䗾鍗ᳺ ứ霞輫穆轙⊩㢅즔S c 愰ℰଆ虠ňŅᜇ〆〒ؐ⬊ĆĄ㞂ļ́ダ؟怉䢆蘁泽ĂሰူਆثЁ舁㰷āȃ쀀ᬰԆ腧Č〃〒ؐ⬊ĆĄ㞂ļ́翀 Ā ⨀ ب⬈Ćԅ̇⬈Ćԅ̇⬈Ćԅ̇⬈Ćԅ̇ँ Ā ⨀ ب⬈Ćԅ̇⬈Ćԅ | RegNtPreCreateKey |
| HKLM\software\microsoft\systemcertificates\authroot\certificates\4eb6d578499b1ccf5f581ead56be3d9b6744a5e5::blob | \ ص�6�hbu�B�Ҫ�7 N��xI� �_X �V�=�gD��h ~ �/-�� ����\L�A��T�a V e r i S i g n �e�����0 �C9��313b �ϫ~C��k&*����e������d��� * 0( | RegNtPreCreateKey |
| HKLM\software\microsoft\systemcertificates\root\certificates\be36a4562fb2ee05dbb3d32323adf445084ed656::blob | \ Ѐ 볝蚽㾜ࠛ컯퇄춈ᔻ ᰘ兘槹镹⍋ . Thawte Timestamping CA ਰࠆثԁ܅ࠃ 㚾嚤눯돛⏓괣䗴丈囖 晿煺硩騠ᑑ莝⃚ ꗨ뺘芄ﺎ炮ᔑ㔁뉶 ʥ | RegNtPreCreateKey |
| HKCU\software\headlight\getrighttogo\customizedapps:: | RegNtPreCreateKey | |
| HKCU\software\headlight\getrighttogo\sharedconfig::busypause | RegNtPreCreateKey | |
| HKCU\software\headlight\getrighttogo\sharedconfig::filecache | RegNtPreCreateKey | |
| HKCU\software\headlight\getrighttogo\sharedconfig::filecachekb | d | RegNtPreCreateKey |
| HKCU\software\headlight\getrighttogo\sharedconfig::rollback | RegNtPreCreateKey | |
| HKCU\software\headlight\getrighttogo\sharedconfig::dotgetright | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | l � 8�tX�jg�8 �6 �v �Z xy �� T������ ���5����3bBx �� !wz #�#��$kF%:� &� (�(X�)E)�`*J*9+�[,��-!R/9� /��1`1�1HO 1�D5�09ߔ<.:>3� @V� F?G�IH[uH�pH�� I��J�� K��N$N� R20U5� | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | *1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old122e4 *1\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old12352 *1\??\C:\P | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Encryption Used |
|
| Network Wininet |
|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
| Syscall Use |
Show More
7 additional items are not displayed above. |
| User Data Access |
|
| Anti Debug |
|
| Other Suspicious |
|
| Network Winsock2 |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
DownloadManager.exe "c:\users\user\downloads\c09141aadc474e74a7a6088b84541acf634770f4_0000865112"
|
DownloadManager.exe "c:\users\user\downloads\0a020d97f3a94bbe2f8dc082f610da6f164fccdd_0000607064"
|
DownloadManager.exe "c:\users\user\downloads\dec8ffffae5a592afad499b0f37313ca865e96ed_0000865112"
|
DownloadManager.exe "c:\users\user\downloads\5c6f81ad4b858ffcc6e038cce52229ed67a17dae_0000762008"
|
.\installer.exe
|
Show More
C:\Users\Qiufxghr\AppData\Local\Temp\7zS02BEA81B\GenericSetup.exe C:\Users\Qiufxghr\AppData\Local\Temp\7zS02BEA81B\GenericSetup.exe
|
DownloadManager.exe "c:\users\user\downloads\f59eff03c37f3b2e16c3367aa9bc101953963bf1_0000557200"
|
DownloadManager.exe "c:\users\user\downloads\4ad83258dc45e7d9cad61dd53c383ba8c76a4e54_0000606080"
|
DownloadManager.exe "c:\users\user\downloads\e8891549c9de67971150d6a67649325092bd4a07_0000865112"
|
DownloadManager.exe "c:\users\user\downloads\77f1e9bf29ca139c7f90edc03060a795da10280d_0000534368"
|
