PUP.Gamehack.GSM
The detection of PUP.Gamehack.GSM on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It's essential to understand the nature of this threat and take immediate action to remove it from your system to prevent any potential harm.
Table of Contents
What Is PUP.Gamehack.GSM?
PUP.Gamehack.GSM is a type of potentially unwanted program that may have been installed on your system without your knowledge or consent. PUPs are software applications that may not be malicious in nature but can still cause problems with your system's performance, stability, and security. They often bundled with other software or downloaded from untrusted sources, and can be challenging to remove without proper guidance.
How PUP.Gamehack.GSM Operates
PUPs like PUP.Gamehack.GSM can operate in various ways, including displaying unwanted advertisements, collecting user data, and modifying system settings. They may also consume system resources, slowing down your computer and causing it to become unresponsive. In some cases, PUPs can also download and install additional malware or unwanted software, further compromising your system's security.
Symptoms of Infection
If your system is infected with PUP.Gamehack.GSM, you may experience a range of symptoms, including slow system performance, unwanted pop-ups and advertisements, and changes to your browser settings. You may also notice that your system is crashing or freezing frequently, or that your browser is being redirected to unfamiliar websites. Additionally, you may see unfamiliar programs or icons on your desktop or in your system tray.
- Unwanted changes to your browser settings or homepage
- Pop-ups and advertisements that appear unexpectedly
- Slow system performance or crashes
- Unfamiliar programs or icons on your desktop or system tray
How to Remove PUP.Gamehack.GSM
- Boot your system in Safe Mode with Networking to prevent the PUP from loading and to allow for a clean removal process
- Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and detect any malware or unwanted software
- Uninstall any suspicious programs or software that may be related to the PUP
- Reset your browser settings to their default values, including Chrome, Firefox, and Edge
- Reboot your system and perform a follow-up scan to ensure that the PUP has been completely removed
Conclusion
Removing PUP.Gamehack.GSM from your system is crucial to preventing any potential harm and restoring your system's performance and security. By following the steps outlined above, you can effectively remove the PUP and prevent any further issues. It's also essential to practice safe computing habits, such as avoiding suspicious downloads and being cautious when installing software, to prevent similar infections in the future. Remember to always use reputable anti-malware tools and keep your system and software up to date to ensure the best possible protection against malware and other online threats.
Analysis Report
General information
| Family Name: | PUP.Gamehack.GSM |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
cf6372b1fd1d81dc2abbb0887a8be48f
SHA1:
d23e5b71990f3c0c7fdeff6c84419807a8e7f57a
SHA256:
508EA1C9D11E98B025D63904019C1063F101D3D5B3FEA5CD91BFE631653A8B8E
File Size:
2.77 MB, 2774016 bytes
|
|
MD5:
2ba79fe934204ede469732cea0a34fd4
SHA1:
3597aeebe42172c4cd577b33e3c4941130b5291c
SHA256:
7DAE7FC3770835C7FC4AB564D515E77E8CEAB9897DEA1A5096D9BAB7EFB6E0D6
File Size:
1.25 MB, 1247744 bytes
|
|
MD5:
1ac331f89d0dae544fd1a625fdec8b02
SHA1:
2270bb3b81c70ab5c10276ae44630943cb94e5b1
SHA256:
2B7FBFE7FB33D3C86BE57B37553C06EE0E57ABBB57B0089B3BE7FACBFEDA3933
File Size:
1.44 MB, 1443328 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have security information
- File has TLS information
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
File Traits
- GetConsoleWindow
- imgui
- No Version Info
- VirtualQueryEx
- WriteProcessMemory
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 3,580 |
|---|---|
| Potentially Malicious Blocks: | 219 |
| Whitelisted Blocks: | 3,256 |
| Unknown Blocks: | 105 |
Visual Map
0
0
0
0
0
0
0
0
x
?
0
?
0
0
0
?
0
0
0
0
x
0
x
x
0
x
0
0
0
0
x
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
x
x
0
x
0
x
0
0
0
0
0
0
0
0
0
0
x
0
?
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
?
?
0
0
?
0
0
0
0
0
0
0
x
0
x
0
0
x
0
0
x
?
0
x
x
x
0
x
x
x
0
?
0
x
0
0
0
0
x
x
1
x
0
0
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
0
0
?
x
0
x
0
0
0
0
?
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
x
0
x
0
0
0
0
0
x
0
x
x
x
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
x
x
0
0
x
0
0
x
x
x
0
0
?
0
?
0
0
0
0
0
x
0
0
0
0
0
0
x
x
x
x
0
0
0
0
0
0
0
0
0
1
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
x
0
0
0
x
0
0
0
0
0
x
0
0
0
0
0
x
0
0
0
0
0
x
x
0
x
x
x
0
0
0
0
0
0
0
0
0
0
0
?
0
0
x
0
0
0
x
0
0
0
?
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
x
0
0
0
0
x
0
0
0
0
0
x
0
0
0
0
0
x
0
0
0
0
0
0
x
x
x
x
0
0
0
x
x
0
0
0
0
x
0
x
0
0
0
0
?
?
0
0
?
0
0
0
0
0
0
0
0
0
0
?
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
1
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
1
0
0
0
1
0
0
1
?
0
0
0
0
1
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
0
0
0
0
0
x
x
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
x
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
x
x
0
0
x
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
x
0
0
0
0
0
x
x
x
x
0
x
0
0
0
x
x
x
x
x
0
0
x
x
x
x
0
0
0
0
0
0
0
0
0
x
0
0
0
0
1
0
0
x
x
0
0
x
x
0
0
0
0
0
0
0
x
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
0
?
0
0
?
x
x
0
0
0
0
x
0
0
0
x
x
0
0
0
x
0
0
x
0
0
x
0
0
0
x
0
0
0
0
x
x
x
0
0
0
0
0
x
x
x
0
0
x
x
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
0
0
?
?
0
0
0
?
?
?
x
0
?
?
x
x
?
x
?
?
0
0
?
?
?
?
0
?
?
x
?
0
?
?
?
?
?
0
?
0
0
0
?
0
?
?
?
?
?
0
?
0
0
0
?
0
?
?
?
?
?
0
?
0
0
0
?
0
?
?
0
?
?
?
0
0
?
0
0
0
?
0
?
?
?
0
0
0
?
?
0
?
0
?
?
?
0
0
0
?
?
x
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
0
?
?
0
0
0
0
?
x
0
x
?
0
0
0
x
0
0
0
0
0
0
0
0
0
x
0
0
0
x
0
x
0
0
x
0
0
0
0
x
0
x
0
x
x
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
1
0
0
0
0
0
0
0
x
x
x
0
0
0
0
0
0
x
x
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
x
?
?
?
0
0
0
0
0
0
0
0
x
x
0
x
x
x
x
0
0
0
x
x
0
x
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
x
0
0
0
0
0
0
0
x
x
0
x
x
x
0
0
?
0
0
0
x
0
x
?
x
?
0
x
0
x
x
0
0
?
x
x
x
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
?
x
0
0
0
x
0
0
0
x
0
0
0
x
1
0
0
0
0
x
x
?
x
0
0
0
0
0
0
0
?
?
0
?
?
0
0
0
0
0
0
0
x
0
0
0
?
0
x
x
0
?
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Gamehack.GDDI
- Gamehack.GSH
- Gamehack.GSM
- Kryptik.BESC
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\appdata\local\temp\vexos_checker.log | Generic Write,Read Attributes |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| Anti Debug |
|
| User Data Access |
|
