PUP.Gamehack.NI
PUP.Gamehack.NI is a detection for a game hack or cheat tool — software that promises to give players unfair advantages such as aimbots, wallhacks, unlimited in-game currency, or license bypasses. Tools in this category are classified as potentially unwanted programs (PUPs) because they routinely come bundled with adware, data-harvesting components, or outright malware.
Behavioral analysis of a sample flagged under this detection shows keyboard-access and anti-debugging activity — behavior that is unusual for harmless software and consistent with cheat tools that hook into games and try to avoid analysis.
Table of Contents
What Is a Game Hack PUP?
Game hacks are distributed through forums, video descriptions, and file-sharing sites, almost always outside official app stores. To function they often ask users to disable antivirus protection and run with elevated privileges — exactly the conditions that let bundled malware install freely. Even when a cheat "works," it may quietly deliver additional unwanted software.
How It Spreads
These tools spread through their own appeal: users seek them out and install them deliberately from untrusted sources. Download portals and cracked-software sites frequently repackage cheats with extra payloads, and some cheats are simply malware in disguise with no real game functionality at all.
Risks of PUP.Gamehack.NI
- Bundled malware: may install adware, information stealers, or trojans alongside the cheat.
- Account theft: gaming and payment credentials are common targets.
- Weakened defenses: instructions to disable antivirus leave the whole system exposed.
- Bans: using cheats can also get gaming accounts permanently banned.
Symptoms of Infection
- New adware, toolbars, or unknown programs after installing a cheat.
- Antivirus disabled or repeatedly alerting on the tool.
- Gaming or other account credentials compromised.
Why This Detection Matters
The "advantage" a game hack offers is rarely worth the cost: a compromised system, stolen accounts, and possible bans. The Threat Scorecard on this page reflects how SpyHunter's research systems assess tools in this category.
How to Remove PUP.Gamehack.NI
Because this threat runs as a file-based Windows infection, removal has two goals: stop the malicious process and delete every component it dropped, then confirm nothing was left behind to reinstall it.
Manual Steps
- Disconnect the computer from the internet to cut the malware off from its command-and-control server.
- Restart Windows in Safe Mode with Networking so the threat is not loaded at startup.
- Open Task Manager and end any unfamiliar or suspicious background processes.
- Check Settings → Apps and uninstall any program you do not recognize or did not intentionally install.
- Review startup entries (Task Manager → Startup) and the
Runregistry keys for entries that point to random file names in temporary folders. - Re-enable any antivirus protection the cheat asked you to turn off, and change the passwords for any gaming or payment accounts used on the device.
- Clear temporary files to remove staging copies of the payload.
Recommended: Run a Full Malware Scan
Manual removal is difficult because modern threats hide components and can restore themselves. The most reliable way to fully remove PUP.Gamehack.NI and any additional malware it may have downloaded is to scan the system with a professional, up-to-date anti-malware tool such as SpyHunter. A complete scan will detect and remove the threat's files, registry entries, and related infections, helping restore the device to a clean, secure state.
Conclusion
PUP.Gamehack.NI represents the real risk hiding behind game cheats: bundled malware, stolen accounts, and a weakened system. Remove the tool, restore your security software, and run a full scan to clear any additional threats it may have introduced.
Analysis Report
General information
| Family Name: | PUP.Gamehack.NI |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
29068c2c61321e5455088940533f452d
SHA1:
33d7c8a9e1e0438373c6ccdf01688bfd8636b8a4
SHA256:
B8385858AE72E14359E783A56DCCBF2F62F2FCD3F108389ACCDCB7C99DC6C27F
File Size:
3.03 MB, 3026432 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have security information
- File has TLS information
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
Show More
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Traits
- dll
- imgui
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 8,714 |
|---|---|
| Potentially Malicious Blocks: | 2,864 |
| Whitelisted Blocks: | 5,407 |
| Unknown Blocks: | 443 |
Visual Map
0
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
?
x
x
?
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
?
?
?
?
?
?
?
?
x
x
x
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
0
x
x
x
x
x
x
x
x
x
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
?
0
x
0
x
x
x
0
x
0
0
0
0
0
0
0
x
x
0
0
x
0
0
0
x
x
x
x
x
0
0
x
x
0
x
0
x
x
0
x
0
x
0
x
0
x
0
0
x
0
0
x
0
0
x
x
x
0
0
0
x
0
x
x
x
0
x
x
x
x
x
0
0
0
0
0
x
0
x
x
0
x
x
0
0
x
0
x
0
x
0
x
x
x
0
x
0
x
x
x
0
0
0
x
x
0
0
x
x
0
x
0
x
0
x
0
x
0
0
0
0
x
0
x
0
x
0
x
0
x
0
x
0
x
x
0
x
x
0
0
x
0
x
0
x
0
x
0
x
0
x
0
x
x
x
0
0
0
x
x
x
x
x
x
0
0
0
x
0
x
0
x
0
x
0
x
x
x
x
x
0
0
0
x
x
x
x
x
x
0
0
0
x
0
x
0
0
0
0
x
0
x
x
x
x
x
x
x
x
0
0
0
0
0
0
0
x
x
x
0
0
x
0
x
x
x
x
x
x
0
0
0
x
x
x
x
x
x
x
0
x
x
x
x
x
x
0
0
0
x
0
x
x
0
x
0
x
0
x
x
0
x
x
x
x
x
0
0
0
0
x
0
0
x
0
x
0
x
0
0
x
0
0
x
0
0
0
0
0
x
0
x
x
x
x
x
x
x
0
0
0
x
x
x
0
x
x
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
x
0
0
0
0
x
0
x
0
x
x
x
x
0
0
0
x
x
0
x
x
x
x
x
x
0
0
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
1
0
0
0
0
0
0
0
0
0
0
1
0
0
x
0
0
0
x
0
0
x
0
0
0
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
0
1
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
x
0
0
0
x
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
1
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
x
x
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
x
0
x
0
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
x
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
x
x
x
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
1
0
0
1
0
0
0
0
0
0
0
0
0
0
0
1
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
1
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
x
0
0
0
0
0
0
0
0
x
0
0
0
0
0
x
x
x
x
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
1
0
0
0
1
0
0
0
1
0
0
0
0
1
0
0
1
0
0
1
0
0
1
0
0
1
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
x
0
0
0
0
x
0
0
x
1
0
0
0
x
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
x
x
x
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
x
0
0
0
0
0
0
0
x
x
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
1
x
0
x
x
x
0
0
0
0
x
0
0
0
0
0
x
0
0
0
x
0
0
0
0
0
0
0
x
0
0
0
0
x
x
0
0
0
0
0
x
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
x
x
0
x
0
0
0
0
0
0
0
0
0
1
0
x
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Gamehack.NI
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| Anti Debug |
|
| Keyboard Access |
|
