Adware.AdLoad.DG

The detection of Adware.AdLoad.DG on your system indicates the presence of a potentially unwanted program that may be causing issues with your computer's performance and security. Adware, short for advertising-supported software, is a type of malware that displays unwanted advertisements on your device, often in the form of pop-ups, banners, or sponsored content. In this report, we will provide an overview of Adware.AdLoad.DG, its operating methods, symptoms of infection, and steps to remove it from your system.

What Is Adware.AdLoad.DG?

Adware.AdLoad.DG is a type of adware program that is designed to display unwanted advertisements on your device. The name itself does not provide specific information about the malware family or its origins. However, it is clear that this program is intended to generate revenue for its creators by displaying ads, often in a way that is intrusive and disruptive to the user experience. Adware programs like Adware.AdLoad.DG can be bundled with other software, downloaded from the internet, or installed through exploits in vulnerable applications.

How Adware.AdLoad.DG Operates

Adware.AdLoad.DG operates by installing itself on your system, often without your knowledge or consent. Once installed, it can modify system settings, registry entries, and browser configurations to display unwanted advertisements. This can include pop-ups, banners, sponsored content, and other types of ads that may be difficult to close or remove. Adware programs like Adware.AdLoad.DG can also collect user data, such as browsing history and search queries, to deliver targeted advertisements. This can compromise your privacy and security, as well as slow down your system's performance.

Symptoms of Infection

Symptoms of Adware.AdLoad.DG infection can include unwanted advertisements, slow system performance, and changes to browser settings. You may notice that your browser homepage has been changed, or that new toolbars or extensions have been installed without your consent. You may also experience pop-ups and ads that appear even when you are not browsing the internet. In some cases, Adware.AdLoad.DG may also cause system crashes, freezes, or errors, particularly if it is interfering with other applications or system processes.

How to Remove Adware.AdLoad.DG

1. Boot your system in Safe Mode with Networking to prevent Adware.AdLoad.DG from loading and to allow for a clean removal process.
2. Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all instances of Adware.AdLoad.DG.
3. Uninstall any suspicious programs or applications that may be related to Adware.AdLoad.DG, taking care to remove all associated files and registry entries.
4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any changes made by Adware.AdLoad.DG.
5. Reboot your system and perform a follow-up scan to ensure that Adware.AdLoad.DG has been completely removed.

Conclusion

Removing Adware.AdLoad.DG from your system requires a combination of technical knowledge and the right tools. By following the steps outlined in this report, you can help to ensure that your system is free from this potentially unwanted program and that your privacy and security are protected. It is essential to remain vigilant and to take steps to prevent future infections, such as keeping your operating system and applications up to date, using reputable anti-malware software, and avoiding suspicious downloads and links.

Analysis Report

General information

Family Name:	Adware.AdLoad.DG
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 2443195057f473d55ccaf5004f405bbb SHA1: 8c25a120e030a3bc797d8823b2bfe587ab52e913 SHA256: 07BA357FBB5164D7E3100F84A9BD88EE1AC23D8B17948A13DE7A7574C9584FFA File Size: 4.75 MB, 4749446 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have security information
• File has exports table
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Company Name	huanghongxun
File Description	Hello Minecraft! Launcher For Windows
File Version	3.5.0.0
Internal Name	HMCL.exe
Legal Copyright	Copyright (C) 2021 huangyuhui
Original Filename	HMCL.exe
Product Name	Hello Minecraft! Launcher
Product Version	3.5.0.0

File Traits

• x86

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries	`$�!�:i��+00�� �Gs]XM���"�2� �FX D�':D��exA-��LG=�A��J� �C �	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\content::cacheprefix		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\cookies::cacheprefix	Cookie:	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\history::cacheprefix	Visited:	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�k  �r� e  � �* ��� �8 \x� �B +� �� �6 �}�� �� 7� xy �� �� ۀ  > �= �����B�O���� �x�% ���8 �5���� Bx�����\�! I N�sb! > !wz#@�#�� #�O $kF $��%:�%f�%� '�'i '�	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�k  �r� e  � �* ��� �8 \x� �B +� �� �6 �}�� �� 7� xy �� �� ۀ  > �= �����B�O���� �x�% ���8 �5���� Bx�����\�! I N�sb! > !wz#@�#�� #�O $kF $��%:�%f�%� '�'i '�	RegNtPreCreateKey
HKCU\software\microsoft\edge\blbeacon::failed_count		RegNtPreCreateKey
HKCU\software\microsoft\edge\blbeacon::state		RegNtPreCreateKey
HKCU\software\microsoft\edge\thirdparty::statuscodes	(NULL)	RegNtPreCreateKey
HKCU\software\microsoft\edge\thirdparty::statuscodes		RegNtPreCreateKey

Show More

HKCU\software\microsoft\edge\elfbeacon::version	142.0.3595.53	RegNtPreCreateKey
HKCU\software\microsoft\edge\blbeacon::state		RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Process Shell Execute	CreateProcess ShellExecute
Syscall Use	ntdll.dll!NtAccessCheck ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl ntdll.dll!NtAssociateWaitCompletionPacket ntdll.dll!NtClose ntdll.dll!NtCreateFile ntdll.dll!NtCreateMutant ntdll.dll!NtCreateSection ntdll.dll!NtCreateSemaphore ntdll.dll!NtDeleteValueKey Show More ntdll.dll!NtDuplicateToken ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenProcessTokenEx ntdll.dll!NtOpenSection ntdll.dll!NtOpenThreadTokenEx ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryLicenseValue ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityObject ntdll.dll!NtQuerySystemInformation ntdll.dll!NtQuerySystemInformationEx ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtReleaseMutant ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtSetValueKey ntdll.dll!NtTestAlert ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWriteFile UNKNOWN
Process Manipulation Evasion	ReadProcessMemory

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

"jre-x64\bin\javaw.exe" -XX:MinHeapFreeRatio=5 -XX:MaxHeapFreeRatio=15 -jar "8c25a120e030a3bc797d8823b2bfe587ab52e913_0004749446"

"jre-x86\bin\javaw.exe" -XX:MinHeapFreeRatio=5 -XX:MaxHeapFreeRatio=15 -jar "8c25a120e030a3bc797d8823b2bfe587ab52e913_0004749446"

"javaw" -XX:MinHeapFreeRatio=5 -XX:MaxHeapFreeRatio=15 -jar "8c25a120e030a3bc797d8823b2bfe587ab52e913_0004749446"

(NULL) https://aka.ms/download-jdk/microsoft-jdk-17-windows-x64.msi