PUP.ProcessHacker
The detection of PUP.ProcessHacker on your system indicates the presence of a potentially unwanted program (PUP) that may compromise your computer's security and performance. It is essential to understand the nature of this threat and take immediate action to remove it and prevent future infections.
Table of Contents
What Is PUP.ProcessHacker?
PUP.ProcessHacker is a type of malware that is classified as a potentially unwanted program. This category of threats includes software that may not be malicious in nature but can still cause problems for computer users. PUPs can be installed on a system without the user's knowledge or consent, often through bundled software downloads or deceptive installation practices. While PUPs may not be as harmful as other types of malware, they can still pose a risk to your privacy and system security.
How PUP.ProcessHacker Operates
PUP.ProcessHacker, like other PUPs, can operate in various ways to achieve its goals. It may collect user data, display unwanted advertisements, or install additional software without permission. In some cases, PUPs can also interfere with system settings, causing performance issues or stability problems. The primary goal of PUP.ProcessHacker is to generate revenue for its creators, often through affiliate marketing or pay-per-install schemes. To achieve this, it may employ various tactics, including manipulating search results, redirecting users to suspicious websites, or displaying fake alerts and warnings.
Symptoms of Infection
Identifying the symptoms of a PUP.ProcessHacker infection can be challenging, as they may be similar to those caused by other types of malware. However, some common indicators of a PUP infection include unwanted pop-ups or advertisements, unexpected changes to system settings, slow system performance, or the presence of unfamiliar programs or toolbars. If you suspect that your system is infected with PUP.ProcessHacker, it is crucial to take immediate action to remove the threat and prevent further damage.
How to Remove PUP.ProcessHacker
- Boot your system in Safe Mode with Networking to prevent PUP.ProcessHacker from interfering with the removal process.
- Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all instances of PUP.ProcessHacker.
- Uninstall any suspicious programs or software that may be related to the PUP infection.
- Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any malicious extensions or add-ons.
- Reboot your system and perform a follow-up scan to ensure that all remnants of PUP.ProcessHacker have been removed.
Conclusion
Removing PUP.ProcessHacker from your system requires a combination of technical knowledge and caution. By following the steps outlined above, you can help ensure the complete removal of this potentially unwanted program and prevent future infections. It is essential to remain vigilant and take proactive measures to protect your system from malware threats, including keeping your operating system and software up to date, using reputable antivirus software, and avoiding suspicious downloads or links. By taking these precautions, you can help safeguard your computer and personal data from the risks associated with PUP.ProcessHacker and other types of malware.
Analysis Report
General information
| Family Name: | PUP.ProcessHacker |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
d3ff67603d13b9c1f957ff5a097d0821
SHA1:
c42ff0e1aa805eeb9b8e1e01d00b0fe66c717106
File Size:
9.03 MB, 9028096 bytes
|
|
MD5:
2689be732e6dbb077b3d2292886d4cfa
SHA1:
8903b5c73902f8a8486f2de55f257c2b7e2e53ab
File Size:
2.61 MB, 2614272 bytes
|
|
MD5:
8c524f964caefdf4d7422604c32ba610
SHA1:
545c4d5e5aa42cc84262e181389bc927ed0e4759
SHA256:
C60DFE039A03DF84FA83AC7CD2133DD0BA38FDE0B4481CB63593BC61EF59A224
File Size:
865.79 KB, 865792 bytes
|
|
MD5:
1d0dbd284013c28725484850b1cf2616
SHA1:
19cf429d2a8c2b6a0e3b0671fa8238916ef6dfe4
SHA256:
897FD3CE8431BC062A5E4D36692CF09A3AD64B7E8E0D37493C69447AF504D4C3
File Size:
369.43 KB, 369429 bytes
|
|
MD5:
20f0721d3ddfad8ffd6b6937e91eb9f4
SHA1:
e88c7f5f71ed623556cc738523ef929bbf8f6967
SHA256:
D2D3A15D8BFFE2FF7F0374D41212CFA1B5327DC681A62A2F04D5197F07BCF739
File Size:
154.62 KB, 154624 bytes
|
Show More
|
MD5:
4ec2797c85ce9da86c8fbddcdbb8ad0a
SHA1:
4b7c953f2682b496bff582c9fbb4316fee77aca8
SHA256:
077E17BA55765A135649C22E049F031E7D5C20AA8B57A33A81E578D3C80E5CE0
File Size:
77.82 KB, 77824 bytes
|
|
MD5:
852671989d5968d7746a12aa8c36f46b
SHA1:
a66447b3088993d27167b3a4f05ff019b8756adf
SHA256:
5E06233F332F29E91D87C9B7D2EDE4A37D7848058230AD08B1090C15A472CE26
File Size:
200.70 KB, 200704 bytes
|
|
MD5:
4de05750d219d29e7665fd1913338217
SHA1:
4eabf2c63eb58b01ebbc258eb51335e6c6911997
SHA256:
D7847A1280098B7F0F8BB13EE966FF8AC0AFAC7F6306E26245E13992C74C45C3
File Size:
2.48 MB, 2479669 bytes
|
|
MD5:
db1680e4ba86a1ab121e56af1dc4b30e
SHA1:
b4a1b480b74f6d7d2be4a6fe4a37d84f626cd4fc
SHA256:
487D4F743B9845FAF4B2A37C992D21B17094AD2F301421441827907BC53E197A
File Size:
2.41 MB, 2406157 bytes
|
|
MD5:
bbc2f92c20aeedfc3d10c4ce42fc312a
SHA1:
d2fff127e605f1fda465a0e44505a2ea4c58b46f
SHA256:
02A0584D31D841F8CA341142AA04697D3CAF4F47E32EFB300226645909B1BA86
File Size:
393.21 KB, 393207 bytes
|
|
MD5:
469cbb94b809f4e15bcfebe1a8f2b10c
SHA1:
666d262d914616839746d7c81c6278ed87344b5b
SHA256:
20908C91466FD02B6907FE29A6D6A8B102228E830B957F4629258021E7B64C9A
File Size:
9.02 MB, 9020416 bytes
|
|
MD5:
b8ca7ca99731137bf60a52a59c45e22e
SHA1:
0de86837ab5dd60d30cc65b846a7140651e10470
SHA256:
B7DB05F2171444AD2ACF0EC2A352485EA110C2B16CCC1EE753CF7C9EB26C7B96
File Size:
3.24 MB, 3235840 bytes
|
|
MD5:
bfd8b8822b0d37b0ef790d18df4cf3ae
SHA1:
c8053c878e4bcea7bd67a8712b109a9824e19500
SHA256:
F67E564F6B824D30A08641EA468C1245ECD53EF59B660C9C2C943171B46E6C03
File Size:
540.42 KB, 540425 bytes
|
|
MD5:
eb3dbff6f41dc119b5c3eb7abc72fffb
SHA1:
f853e38cb95bfe820a44c75226ca6172eca76347
SHA256:
E80128C898D6E320A16B013FA4760E38BA21D380C372016E588478A94BE206DE
File Size:
3.88 MB, 3883008 bytes
|
|
MD5:
9430400e1617d462da705c64dcc12a83
SHA1:
c21e425f66b84f38f655e69867f081a9282199fc
SHA256:
5AC7E344893A0E659F8DE76899845055CA1F5EC5F2B2B3813E969DCC69FE4DAC
File Size:
3.18 MB, 3177984 bytes
|
|
MD5:
336de1ca9104de22d33da3fd94181f72
SHA1:
d7e029ef94dbbc392d2a8ea1c0b9b0ad2ea7083f
SHA256:
A51A76E606E1F833E9C5881E1E99C1AA301F0DEB3821A6EE1AEE79D96884090B
File Size:
6.55 MB, 6554112 bytes
|
|
MD5:
90bb38381f28c0044ebfb55e7f65eb9a
SHA1:
e2227feeaa5bb4642d16472750bb20bd9dfd784f
SHA256:
EDD791D9316F2505E5B76EB7A47B557A6F8C2D67C72FDBAA505D3230AFC7B19E
File Size:
9.73 MB, 9729536 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has exports table
- File has TLS information
- File is .NET application
- File is 32-bit executable
- File is 64-bit executable
Show More
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version | 3.2.25113.1114 |
| Comments |
|
| Company Name |
|
| File Description |
|
| File Version |
Show More
|
| Internal Name |
|
| Legal Copyright |
|
| Original Filename |
|
| Product Name |
|
| Product Version |
Show More
|
File Traits
- .NET
- 2+ executable sections
- Badsig nsis
- dll
- fptable
- GetConsoleWindow
- HighEntropy
- Inno
- InnoSetup Installer
- Installer Manifest
Show More
- Installer Version
- ntdll
- Nullsoft Installer
- WriteProcessMemory
- x64
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 1,033 |
|---|---|
| Potentially Malicious Blocks: | 4 |
| Whitelisted Blocks: | 780 |
| Unknown Blocks: | 249 |
Visual Map
?
?
?
0
?
?
0
?
0
?
?
0
?
?
?
?
?
?
0
?
?
?
0
?
0
?
?
?
0
?
0
?
?
?
?
0
?
0
?
?
?
?
?
?
?
?
0
?
0
?
0
0
?
?
?
0
?
?
?
?
?
?
?
?
?
?
0
?
0
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
0
?
?
0
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
?
?
0
?
0
?
x
x
?
?
?
?
?
?
?
?
?
?
?
0
0
?
?
?
?
?
?
?
?
1
?
0
0
?
?
?
0
?
?
?
?
?
0
0
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
0
?
?
0
0
?
?
?
?
?
?
?
?
?
0
?
0
?
x
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
0
?
?
0
0
0
0
?
?
?
?
0
0
?
?
0
?
?
?
0
?
0
?
?
0
?
?
?
0
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
0
0
0
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
0
0
?
0
?
?
?
?
0
?
0
0
?
?
?
?
0
?
?
?
0
0
0
0
?
0
?
?
?
?
?
?
0
?
0
?
?
?
?
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
1
1
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
1
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
1
0
0
0
1
0
0
0
0
0
0
0
0
0
1
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
1
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
1
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
1
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
2
0
0
0
3
1
1
0
1
1
0
1
0
2
0
1
0
0
0
0
0
0
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Farfli.DH
- GameHack.GF
- SteamStealer.C
- Trojan.Agent.Gen.JC
- Trojan.Kryptik.Gen.NU
Show More
- Trojan.Kryptik.Gen.RL
- Trojan.Kryptik.Gen.UG
- Trojan.ShellcodeRunner.Gen.DZ
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.0.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.1.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Anti Debug |
|
| User Data Access |
|
| Syscall Use |
Show More
17 additional items are not displayed above. |
| Service Control |
|
| Keyboard Access |
|
| Other Suspicious |
|
