The file WINHUFP32.EXE is identified as a virus dropper.
The dropper WINHUFP32.EXE is used for downloading and installing other malware, Trojans, viruses by the commands received from the Command Center.
The file WINHUFP32.EXE loads into the computer memory and tries to connect to the dangerous web site.
Usually the WINHUFP32.EXE dropper does not infect the files on the computer and does not replicate itself on other computers.
Kill the WINHUFP32.EXE process and delete the file WINHUFP32.EXE.
Malware Analysis of WINHUFP32.EXE
Full path on a computer: %SysDir%\WinHufp32.exe
Detected by UnHackMe:
WINHUFP32.EXE
Default location: %SysDir%\WinHufp32.exe
Removal Results: Success
Number of reboot: 1
WINHUFP32.EXE is known as:
Trojan.SystemHijack, Trojan.Yoddos.aa, W32.NewMalware-Rootkit-I-based.Maximus, Adware.Purityscan, Trojan.Yoddos.JNMHEcNKQHs, Trojan.AMN (A), Trojan.MulDrop4.6666, VirTool.Obfuscator.XZ (v), Sus.ComPack-L, BScope.Trojan.Inject.2, Adware.Purityscan.rem, a variant of Win32.Yoddos.AA, W32.SRVSTRT.SMD.tr
WINHUFP32.EXE hash:
- MD5: 12f5fa6afbdfc5f6a4096e26c6c6f651
Registry:- HKLM\System\CurrentControlSet\Services\WinHiyl32\Security\Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 00 00 18 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00
- HKLM\System\CurrentControlSet\Services\WinHiyl32\Type: 0×00000010
- HKLM\System\CurrentControlSet\Services\WinHiyl32\Start: 0×00000002
- HKLM\System\CurrentControlSet\Services\WinHiyl32\ErrorControl: 0×00000000
- HKLM\System\CurrentControlSet\Services\WinHiyl32\ImagePath: “%SysDir%\WinHufp32.exe”
- HKLM\System\CurrentControlSet\Services\WinHiyl32\DisplayName: “Windows Heqs System”
- HKLM\System\CurrentControlSet\Services\WinHiyl32\ObjectName: “LocalSystem”
- HKLM\System\CurrentControlSet\Services\WinHiyl32\SYSTEM\CurrentControlSet\Services\WinHiyl32: “Windows Hmel System for X32 windows desktop”
Files:- %SysDir%\WinHufp32.exe