Trojan.GameHack.BU
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 6,392 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 574 |
| First Seen: | January 10, 2022 |
| Last Seen: | July 29, 2026 |
| OS(es) Affected: | Windows |
The detection of Trojan.GameHack.BU on your system indicates a potential security threat that requires immediate attention. This Trojan-type threat can compromise your computer's security and put your personal data at risk. It is essential to understand the nature of this threat and take prompt action to remove it from your system.
Table of Contents
What Is Trojan.GameHack.BU?
Trojan.GameHack.BU is a type of malicious software that can infiltrate your system without your knowledge or consent. Trojans are known for their ability to disguise themselves as legitimate programs, making them difficult to detect. The name Trojan.GameHack.BU suggests that this particular threat may be related to gaming or hacking activities, but its true intentions and capabilities can only be determined through further analysis.
How Trojan.GameHack.BU Operates
Trojan-type threats like Trojan.GameHack.BU typically operate by exploiting vulnerabilities in your system or deceiving you into installing them. Once installed, they can communicate with their creators, allowing them to access your system remotely. This can lead to a range of malicious activities, including data theft, system compromise, and the installation of additional malware. Trojans can also be used to create backdoors, allowing hackers to access your system at will.
Symptoms of Infection
Identifying the symptoms of a Trojan.GameHack.BU infection can be challenging, as Trojans often disguise themselves as legitimate programs. However, some common signs of infection include unusual system behavior, slow performance, and unexpected changes to your system settings. You may also notice unfamiliar programs or icons on your desktop, or receive unexpected pop-ups and alerts. If you suspect that your system has been infected with Trojan.GameHack.BU, it is crucial to take immediate action to remove the threat.
How to Remove Trojan.GameHack.BU
- Restart your system in Safe Mode with Networking to prevent the malware from loading and to allow you to download and install removal tools.
- Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove the Trojan.GameHack.BU threat.
- Uninstall any suspicious programs or applications that may be related to the infection. Be cautious when removing programs, as some may be legitimate.
- Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any malicious extensions or add-ons.
- Reboot your system and perform another full scan to ensure that the threat has been completely removed.
Conclusion
Removing Trojan.GameHack.BU from your system requires careful attention to detail and a thorough understanding of the threat. By following the steps outlined above and taking proactive measures to protect your system, you can minimize the risk of infection and keep your personal data safe. Remember to always be cautious when downloading and installing software, and to keep your anti-malware tools up to date to ensure the best possible protection against emerging threats.
Analysis Report
General information
| Family Name: | Trojan.GameHack.BU |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
4f6bc325551cd84c129c0138a00fdd88
SHA1:
c8134b2977eb4b8c4d0ccf0c96861b4678ae5e12
SHA256:
7A0972F3EDB9C5DAC50A094AF212519142FF383E34D6290BE61FB0D6075A1086
File Size:
7.89 MB, 7889544 bytes
|
|
MD5:
caf0929c730f1cced0373a8f7513db32
SHA1:
2eedc4cc30a09d06eedf5bf4c6b86e1960169400
SHA256:
1612E7F1EFAF47F12FE9E51FDB8FF613E4F2E461E4D9C02136CBA299031E1824
File Size:
7.86 MB, 7856208 bytes
|
|
MD5:
86dacbdfac9099f4269b39af380d5667
SHA1:
a2e4081f6c3a338e87d4ff55550569103fed5f27
SHA256:
1DF21011C49559009847A030C7C7B319B003A019EC3B7227342C7598E8BE68CD
File Size:
573.95 KB, 573952 bytes
|
|
MD5:
cba1251a852bc382b5d3aa72e672ac07
SHA1:
57682148358aac407e56b66cae7ccc1ee765f3d8
SHA256:
4D00E36096F25FC94779FA120A74C04DDB474631908AA25B09E3B7B0E2570B09
File Size:
6.14 MB, 6144000 bytes
|
|
MD5:
b4e23c07489703c963459a28d8e41b40
SHA1:
ac3472776b5332492b09b453fc8f6a0a7e2737e3
SHA256:
20008211846100D18E8460306B2A113889D7630758D49DF2304233903C201EAD
File Size:
7.90 MB, 7902344 bytes
|
Show More
|
MD5:
80e58081bffbe942263506d1831a2828
SHA1:
5a4a60b8fcbf9fd8000455bf7690c75f65101509
SHA256:
BE3831302F3D2341ACFFA5E70142CD8FD3F0EF1950F271A1E2ACCFC4DC55920B
File Size:
6.39 MB, 6387200 bytes
|
|
MD5:
7b112cacbca26a42cda8e3774b92a65a
SHA1:
d76702086095a734c6816282f98adec838513ff9
SHA256:
F20FA36FAC9B98821994A4DFDB766CF030A4C46918ABDFFDCDDCEE642247B207
File Size:
7.86 MB, 7864968 bytes
|
|
MD5:
f0a8d0b2acedd2b8ae7a95084cd39b9b
SHA1:
142409c76a1ef2c0b6e81fae27a484d4c07e8579
SHA256:
26279F098BAC4E525E68D2E2C83607EBF5C0A2E945B765E39C04189B0EB49F13
File Size:
7.85 MB, 7853704 bytes
|
|
MD5:
5d79aa9497cc8066e66c1d17b022fd9d
SHA1:
1cc9f7692e687833156751b0898a4bb982480a66
SHA256:
3E7643436EFBB86F6B46A32EA48D72B35FD5EB5B412566E038A7924589B4D901
File Size:
7.85 MB, 7853704 bytes
|
|
MD5:
e419251a256c86e2cf313d4ec1435a8e
SHA1:
39a995f049f64c6da16d2b856165a24a0e5acc2d
SHA256:
A5A6678FE4CDA299DE9D6A594E15AD607FB2A438FA23A88450F9FC7FF010534E
File Size:
6.06 MB, 6057984 bytes
|
|
MD5:
058fa828610f56ea5c05238cd0652d5b
SHA1:
da5f73bb0e17947b80df269dabe204d7cf783140
SHA256:
5A27447FDF1D4851A13DA7570604DDACAA8AD92EE1CD4B42AA38A71FDBD0EEDF
File Size:
7.85 MB, 7852680 bytes
|
|
MD5:
d7eac52ce5bb496fb6b5839b7a9bcd96
SHA1:
a1be30809e9c47e938647606ab5767efc7dca347
SHA256:
BBA80B1657956A8793ECE66F24BA8AB0DBECE17371897EE85C3CBA014BCB1269
File Size:
7.85 MB, 7854728 bytes
|
|
MD5:
47101a9a88b11636bbee8e3e804e71c1
SHA1:
0c2fcffde17316d910d3d698edb8b5fd46d5df6c
SHA256:
37F80D0231B001296A974324432C431D419FB36E8FBEE0CD1903B5AA88F1CCC4
File Size:
7.86 MB, 7856776 bytes
|
|
MD5:
bcbb04268281cc3736cef9fa6a1141c7
SHA1:
329f890d4455571bd86d940a9a865b83db749b80
SHA256:
507C393398B89F30B6FE6F7E277F55E2C9F83672ED1B303A14B0476C5C8B4DC2
File Size:
7.86 MB, 7857800 bytes
|
|
MD5:
00625d63db8145bb35088577345ce413
SHA1:
51e9c4778c444315b89d2498faa9071db5ee4969
SHA256:
88F6BB8C34924A8D9FAC453D596A3581A3FB51CA14E716ACA4B9BD776EF58584
File Size:
7.86 MB, 7861384 bytes
|
|
MD5:
8d539ba8daf7e453e166a9762c8c13e1
SHA1:
c1bf775c7e8ac2dd24770024d5283b3ee3f5d451
SHA256:
8689489D974EE5842959C79FDD2364A9EC9495D2B0044FDD4BF0D4914EAEF111
File Size:
7.86 MB, 7859336 bytes
|
|
MD5:
c103b5584e173d3c8f1c640c53f6cb97
SHA1:
2df42209b578f2f45088b055299dd14c1fd0053e
SHA256:
6BB96F3A6616AB6E3CD8A8E3CE665A852F4A2BBB61900C1FD59862217740B3E5
File Size:
7.86 MB, 7856776 bytes
|
|
MD5:
f095728944ce92629891ef63dc85d857
SHA1:
7478b5ed8b6664bd39a52b2aca5ce880047a4932
SHA256:
72D6500D53104F6E7BE107A6096DB602D07311D9B7D4357C8516592ECEFF066E
File Size:
7.86 MB, 7856264 bytes
|
|
MD5:
ba13da95b1368f2f5d0be802524afd49
SHA1:
6498c01c9e1c50af180d6e44b7e95d21ab48a58b
SHA256:
5DFAE62FD3B484B24C7F798147B306B737A39E8D0B11099F69F313A78AFA06C8
File Size:
7.86 MB, 7856264 bytes
|
|
MD5:
57b3baed5abb1e7fcc5514ed0cd1915f
SHA1:
f502d15a5553a7d99a4b3dd1498a48de16c9d6c2
SHA256:
937A8C4DE260D28AD2D7A1BA013B2C6361ADB18B001A32DAC3C53C5030B4CF5F
File Size:
7.39 MB, 7390720 bytes
|
|
MD5:
53f46ab814f1fcccc01e93d95041483b
SHA1:
bc893c444a696a5901dc150cdbb2a915a155eee5
SHA256:
08EACC73CDC70BEC64CA99EF9DE25B3B772BBCCEEBA995428230EB1BF4FA4BE9
File Size:
7.68 MB, 7682048 bytes
|
|
MD5:
64a3f3c428e8052c7c29f27beda2a6c7
SHA1:
7e1e90f37e923863f280ae76d64cab308e087742
SHA256:
D9F7F86822AE94ADF078EE8E482A3B3E0F4096F83A1D4ADD728BDCDE51886634
File Size:
7.85 MB, 7850632 bytes
|
|
MD5:
97fa29ba911c9c83b8d1f72269654b7e
SHA1:
73e6980995c87cd40bf08c27780e0e48881fe06b
SHA256:
B16E007AC53BEFA67F3EE039759796E136CD71845AE6FBB2415AFF34DA34DE04
File Size:
7.16 MB, 7155712 bytes
|
|
MD5:
a37a54004422ce0353a1dfde1181ab5b
SHA1:
a96ab3154d5c145bd61a3b55947baaedb2d44942
SHA256:
653FDB5991589447589AB5F98523E0B2783644408C462DA1998589F7E9365812
File Size:
7.68 MB, 7683072 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have resources
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 32-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
Show More
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Company Name |
|
| File Description |
|
| File Version |
|
| Legal Copyright |
|
| Product Name |
|
| Product Version |
|
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| Facepunch Studios Ltd | SSL.com Code Signing Intermediate CA RSA R1 | Self Signed |
File Traits
- dll
- fptable
- HighEntropy
- imgui
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 22,137 |
|---|---|
| Potentially Malicious Blocks: | 54 |
| Whitelisted Blocks: | 10,137 |
| Unknown Blocks: | 11,946 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
?
?
?
0
0
0
0
?
?
x
0
0
0
0
0
0
0
?
0
?
?
0
?
?
?
?
0
0
0
?
?
x
0
0
0
0
?
?
?
0
0
0
?
0
?
0
?
0
1
0
?
?
0
0
0
0
0
0
?
0
0
?
0
0
?
?
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
?
?
?
?
0
?
?
0
?
?
?
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
?
0
0
0
?
0
0
0
0
?
?
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
?
0
0
0
0
?
?
?
?
?
0
?
?
0
?
?
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
0
0
0
0
0
0
?
0
0
?
0
0
1
1
0
0
0
0
?
?
0
?
?
0
0
0
0
?
?
?
?
?
?
?
?
0
?
0
0
0
?
0
?
?
0
0
0
0
0
?
?
0
?
0
?
?
?
?
?
?
?
?
?
0
?
0
0
0
0
0
0
?
?
?
?
0
?
?
?
0
?
?
?
?
?
?
?
?
0
0
?
0
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
0
?
?
0
?
0
?
?
?
?
?
0
0
0
0
0
?
?
?
0
?
?
?
?
?
0
?
?
?
?
?
0
?
?
0
0
0
?
?
?
?
?
?
0
?
?
?
?
?
0
?
0
0
?
?
?
?
?
?
?
0
?
?
0
?
?
?
?
0
0
?
?
?
?
0
?
?
?
0
0
0
?
?
0
?
0
?
?
?
0
0
0
1
0
0
0
0
0
0
?
?
?
?
?
0
?
0
?
?
0
?
?
0
0
?
?
0
0
0
?
?
?
?
?
?
?
?
0
?
?
?
?
0
?
?
?
?
?
?
?
0
0
?
?
0
0
?
?
?
0
0
?
?
?
0
0
0
0
0
?
?
?
?
?
?
0
0
?
x
?
x
0
?
0
0
0
?
?
?
?
?
?
0
?
0
?
?
?
?
0
?
?
?
?
0
0
?
0
?
?
?
0
0
0
0
0
0
0
0
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
1
?
?
?
?
0
0
0
?
?
?
?
?
?
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
0
?
?
?
?
0
0
?
0
0
0
0
0
0
0
0
0
?
?
0
0
?
?
?
?
0
0
0
0
?
0
?
?
?
0
?
?
0
?
0
x
0
?
?
?
?
?
?
0
?
0
?
?
?
?
?
?
?
?
0
?
?
0
0
0
?
?
?
?
?
0
0
0
0
0
0
?
0
0
0
0
0
?
0
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
0
0
?
0
0
?
?
?
0
0
0
0
?
0
0
0
?
?
?
?
0
?
0
?
?
0
?
?
0
?
?
0
0
?
0
?
?
?
?
?
0
?
0
?
?
?
0
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
0
?
?
?
?
0
?
?
0
?
?
0
0
0
?
?
?
?
0
?
0
?
0
?
?
?
?
0
0
?
0
?
0
?
0
?
?
?
0
0
0
?
0
?
1
?
?
0
?
?
?
?
?
0
?
0
?
?
?
?
0
?
0
0
0
?
?
0
?
?
0
0
?
0
?
0
?
1
?
?
?
?
?
0
0
?
?
?
?
?
0
?
?
?
?
0
0
?
?
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
0
0
?
0
0
?
0
?
0
0
?
0
0
?
?
?
?
0
0
?
0
?
?
?
0
0
?
?
1
?
?
?
?
0
?
?
0
0
0
?
0
?
0
0
0
0
?
?
?
0
?
?
?
?
0
?
0
?
?
?
0
?
0
0
0
0
0
?
0
0
?
0
?
0
?
0
?
?
0
0
0
0
1
?
?
0
0
0
?
0
?
?
?
?
0
?
?
?
?
0
?
0
?
0
?
?
?
0
?
0
0
0
0
0
?
0
?
0
?
?
?
0
?
?
?
?
0
0
?
0
?
?
?
?
0
?
?
?
?
?
?
?
0
?
?
0
0
0
0
0
?
0
0
?
?
?
?
0
0
0
?
?
?
0
0
?
0
?
0
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
0
0
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
x
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
0
0
?
0
0
0
?
0
0
0
0
?
?
0
?
?
?
?
?
?
0
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
0
0
?
?
0
?
?
0
?
?
?
?
?
?
?
0
?
?
?
?
?
?
0
0
0
?
?
0
?
0
?
?
?
?
?
0
?
0
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
0
0
0
0
?
0
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
0
?
?
?
?
?
?
?
?
0
0
0
0
?
?
?
?
?
?
?
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
0
?
?
?
0
?
0
?
0
?
0
?
?
0
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
x
0
?
?
?
?
0
0
?
?
?
?
?
?
?
?
?
?
?
0
0
?
?
?
0
?
?
0
?
?
?
0
?
0
0
0
?
0
?
0
0
0
?
0
0
?
0
0
?
0
0
0
0
0
?
0
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
0
0
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
0
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
?
?
?
0
?
0
?
?
?
?
0
?
?
?
?
?
?
?
0
?
?
?
?
?
?
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
?
?
?
0
?
?
?
?
?
0
?
0
0
?
?
?
?
0
0
?
?
?
?
?
?
?
0
0
0
0
0
?
?
?
0
?
0
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
0
?
?
?
0
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
0
0
0
?
?
?
0
?
?
0
?
?
?
?
0
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| Process Shell Execute |
|
| Anti Debug |
|
| Process Manipulation Evasion |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\c8134b2977eb4b8c4d0ccf0c96861b4678ae5e12_0007889544.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\2eedc4cc30a09d06eedf5bf4c6b86e1960169400_0007856208.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\a2e4081f6c3a338e87d4ff55550569103fed5f27_0000573952.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\57682148358aac407e56b66cae7ccc1ee765f3d8_0006144000.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\ac3472776b5332492b09b453fc8f6a0a7e2737e3_0007902344.,LiQMAxHB
|
Show More
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\5a4a60b8fcbf9fd8000455bf7690c75f65101509_0006387200.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\d76702086095a734c6816282f98adec838513ff9_0007864968.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\142409c76a1ef2c0b6e81fae27a484d4c07e8579_0007853704.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\1cc9f7692e687833156751b0898a4bb982480a66_0007853704.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\39a995f049f64c6da16d2b856165a24a0e5acc2d_0006057984.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\da5f73bb0e17947b80df269dabe204d7cf783140_0007852680.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\a1be30809e9c47e938647606ab5767efc7dca347_0007854728.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\0c2fcffde17316d910d3d698edb8b5fd46d5df6c_0007856776.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\329f890d4455571bd86d940a9a865b83db749b80_0007857800.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\51e9c4778c444315b89d2498faa9071db5ee4969_0007861384.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\c1bf775c7e8ac2dd24770024d5283b3ee3f5d451_0007859336.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\2df42209b578f2f45088b055299dd14c1fd0053e_0007856776.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\7478b5ed8b6664bd39a52b2aca5ce880047a4932_0007856264.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\6498c01c9e1c50af180d6e44b7e95d21ab48a58b_0007856264.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\f502d15a5553a7d99a4b3dd1498a48de16c9d6c2_0007390720.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\bc893c444a696a5901dc150cdbb2a915a155eee5_0007682048.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\7e1e90f37e923863f280ae76d64cab308e087742_0007850632.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\73e6980995c87cd40bf08c27780e0e48881fe06b_0007155712.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\a96ab3154d5c145bd61a3b55947baaedb2d44942_0007683072.,LiQMAxHB
|
