PUP.Gamehack.NR
The detection of PUP.Gamehack.NR on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It's essential to understand the nature of this threat and take appropriate steps to remove it and prevent future infections.
Table of Contents
What Is PUP.Gamehack.NR?
PUP.Gamehack.NR is a type of malware that is categorized as a potentially unwanted program. This means that it may not be as malicious as other types of malware, such as viruses or Trojans, but it can still cause problems with your system and compromise your personal data. PUPs are often installed unintentionally, and they can be difficult to remove without the right tools and knowledge.
How PUP.Gamehack.NR Operates
PUP.Gamehack.NR, like other PUPs, operates by exploiting vulnerabilities in your system and using deceptive tactics to install itself. It may be bundled with other software, or it may be downloaded from untrusted sources. Once installed, it can modify system settings, collect personal data, and display unwanted advertisements. PUPs can also slow down your system, cause crashes, and interfere with other programs.
It's worth noting that PUPs are often designed to be persistent and can be challenging to remove. They may use rootkit techniques to hide themselves, or they may install multiple components that need to be removed separately. This is why it's crucial to use a reputable anti-malware tool and follow a thorough removal process.
Symptoms of Infection
If your system is infected with PUP.Gamehack.NR, you may notice a range of symptoms, including slow system performance, unwanted advertisements, and modified system settings. You may also experience crashes, freezes, and errors, especially when trying to launch certain programs or access specific features. Additionally, you may notice suspicious activity, such as unfamiliar programs running in the background or unexpected changes to your system configuration.
- Unwanted advertisements and pop-ups
- Modified system settings and configuration
- Slow system performance and crashes
- Suspicious activity and unfamiliar programs
How to Remove PUP.Gamehack.NR
- Boot your system in Safe Mode with Networking to prevent the PUP from loading and to allow for a more effective removal process.
- Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and detect all components of the PUP.
- Uninstall any suspicious programs or applications that may be related to the PUP.
- Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any modifications made by the PUP.
- Reboot your system and perform a follow-up scan to ensure that all components of the PUP have been removed.
Conclusion
Removing PUP.Gamehack.NR requires a thorough and careful approach to ensure that all components of the malware are removed and that your system is restored to a safe and healthy state. By following the steps outlined above and using a reputable anti-malware tool, you can effectively remove this PUP and prevent future infections. Remember to always be cautious when downloading software and to use strong security measures to protect your system and personal data.
Analysis Report
General information
| Family Name: | PUP.Gamehack.NR |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
68cbee4e1ec5e4cf6d120775be4e8602
SHA1:
b557c7fc330a693e8df60d44342c1696abde1173
SHA256:
0BA086379A7B5D3B7D737EE32AB758B25794072429B2D87B2658DF35901E3E00
File Size:
9.58 MB, 9575424 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have security information
- File has TLS information
- File is 64-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
Show More
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Traits
- dll
- imgui
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 17,861 |
|---|---|
| Potentially Malicious Blocks: | 2,878 |
| Whitelisted Blocks: | 13,072 |
| Unknown Blocks: | 1,911 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
x
0
0
0
?
?
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
x
x
x
x
?
x
?
x
0
x
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
?
0
?
x
0
0
0
0
0
?
0
0
0
0
0
0
?
x
?
x
?
0
0
0
x
0
x
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
x
0
0
0
0
0
0
0
0
0
x
x
x
x
x
x
?
0
0
?
0
0
0
0
0
0
0
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
?
0
?
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
?
0
x
0
0
?
1
0
0
x
0
0
0
0
0
?
1
x
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
?
?
?
?
?
0
0
0
0
0
x
0
0
0
0
0
?
0
?
0
0
0
0
0
0
0
?
?
0
0
0
0
0
0
0
0
?
0
0
0
?
0
0
?
0
?
x
?
0
?
0
?
x
x
?
?
x
0
x
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
?
0
0
0
?
?
0
0
0
0
?
0
x
?
0
0
0
0
0
0
?
x
0
0
0
0
0
0
x
0
0
0
0
0
x
x
?
0
0
0
0
?
0
0
0
0
?
0
0
0
0
0
0
0
0
x
x
0
0
x
0
0
x
x
0
0
0
0
0
0
0
0
x
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
?
?
x
x
x
0
0
0
?
0
0
0
?
0
?
0
0
0
x
0
0
0
x
0
0
x
?
0
x
x
x
x
x
0
x
x
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
x
?
0
0
0
0
0
0
0
0
x
0
?
0
0
0
?
0
0
?
?
x
0
0
0
0
0
?
x
?
?
0
x
x
x
x
?
x
x
x
x
?
x
0
x
x
?
?
?
?
0
0
0
x
0
0
0
0
x
x
0
0
x
0
x
?
0
0
0
x
x
0
x
x
x
0
0
0
0
0
?
0
0
0
0
0
0
?
0
?
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
0
0
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
x
x
?
?
0
0
0
0
0
0
0
0
0
0
x
?
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
x
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
x
?
x
x
x
?
x
0
x
x
?
0
?
0
0
?
?
?
?
?
?
?
x
?
?
0
0
0
0
0
?
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
?
0
0
0
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
x
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
?
?
x
?
?
?
?
0
?
0
x
x
?
x
0
0
0
0
0
0
?
?
?
?
?
?
0
0
0
0
0
0
?
?
?
?
?
?
?
?
0
?
0
0
0
0
0
0
?
0
0
?
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
?
0
0
?
?
0
0
x
x
?
?
0
x
0
1
0
0
0
x
0
0
0
?
?
x
?
0
0
0
0
0
0
0
0
?
0
0
0
0
x
x
?
?
0
0
?
0
0
0
?
0
0
?
0
0
?
0
0
0
0
0
0
x
?
0
?
x
?
?
?
?
?
x
0
0
x
0
?
0
0
?
?
0
x
?
x
0
0
0
0
0
0
x
0
0
0
0
?
0
?
?
?
0
0
?
0
?
0
0
0
0
0
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
0
?
?
0
?
0
?
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
?
x
0
0
0
?
0
0
?
0
?
0
0
x
x
?
0
0
0
0
0
0
0
x
0
0
0
0
0
0
?
0
0
0
0
0
?
0
?
0
x
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
?
?
x
x
?
?
?
0
0
0
0
?
0
0
?
x
x
?
x
0
0
0
0
?
0
0
0
0
0
0
0
x
0
0
0
x
0
x
x
0
?
0
x
x
x
x
x
0
?
0
0
0
0
0
0
0
0
?
?
0
x
?
x
x
0
x
0
x
0
0
x
0
0
?
0
0
0
0
0
?
0
?
0
0
x
?
0
x
?
?
?
0
0
?
?
0
x
x
?
x
?
?
x
0
x
?
?
x
0
x
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
?
x
0
0
0
?
0
0
?
0
?
?
0
?
0
?
0
0
0
0
0
?
?
?
?
0
?
0
?
x
0
?
x
0
0
0
0
0
0
?
0
0
?
0
0
0
0
0
0
x
?
x
0
?
x
x
x
x
x
0
0
0
0
0
0
0
0
0
x
0
x
0
x
?
0
?
?
0
0
?
0
x
x
x
0
0
x
0
0
0
0
x
?
x
x
x
0
x
0
0
0
0
0
?
?
?
?
?
0
x
x
?
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
?
0
0
0
x
x
?
0
0
?
?
?
0
0
0
0
0
?
0
0
0
0
0
0
0
?
?
0
0
0
?
x
0
0
0
0
0
x
?
0
?
x
0
0
x
0
x
0
0
0
0
0
?
x
0
?
0
?
x
0
0
x
?
?
x
x
0
x
0
0
0
0
0
0
0
x
?
0
0
x
x
x
0
x
0
0
0
0
?
?
?
?
0
0
0
?
0
?
0
0
0
0
x
0
x
?
0
0
x
0
x
0
?
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
?
x
x
0
x
0
x
x
x
0
x
x
0
x
0
x
x
x
x
0
0
?
?
0
0
x
0
?
1
0
?
?
x
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
?
0
0
?
?
0
0
0
0
0
?
?
?
0
0
x
x
x
0
?
0
x
0
?
0
0
0
x
?
x
?
0
0
0
x
x
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
x
0
0
?
x
x
x
x
0
0
x
x
?
?
x
x
0
0
0
0
0
0
0
?
?
?
0
0
?
0
?
0
0
?
0
0
x
?
?
0
?
0
0
0
0
0
0
0
0
?
0
0
x
?
0
0
0
0
0
x
0
x
0
?
?
x
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
?
0
0
0
0
0
0
?
?
?
x
?
?
x
x
?
0
?
x
0
0
0
0
0
0
0
0
0
?
1
0
x
0
0
0
0
?
0
0
0
0
x
x
?
?
0
0
0
0
0
0
0
?
x
0
0
0
x
0
x
x
?
0
?
0
?
0
0
x
0
x
0
x
x
?
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\develop\ai\code\spyhunter5\sandboxtool\builds\releasenologencrypt-x64\injected-x64.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\hp\yimmenuv2\build\yimmenuv2.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\advapi32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\apphelp.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\bcrypt.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\bcryptprimitives.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\combase.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\crypt32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\cryptsp.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\d3dcompiler_47.pdb | Read Attributes,Synchronize,Write Attributes |
Show More
| c:\windows\system32\dbghelp.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\advapi32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\apphelp.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\bcrypt.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\bcryptprimitives.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\combase.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\crypt32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\cryptsp.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\d3dcompiler_47.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\dbghelp.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\dwmapi.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\gdi32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\gdi32full.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\imagehlp.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\imm32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\injected-x64.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\kernel32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\kernelbase.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\msvcp140.amd64.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\msvcp_win.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\msvcrt.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\ntdll.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\rpcrt4.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\sechost.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\shcore.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\shell32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\ucrtbase.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\user32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\vcruntime140.amd64.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\vcruntime140_1.amd64.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\win32u.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dll\ws2_32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\dwmapi.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\exe\rundll32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\exe\yimmenuv2.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\gdi32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\gdi32full.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\imagehlp.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\imm32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\injected-x64.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\kernel32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\kernelbase.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\msvcp140.amd64.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\msvcp_win.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\msvcrt.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\ntdll.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\rpcrt4.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\rundll32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\sechost.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\shcore.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\shell32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\advapi32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\apphelp.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\bcrypt.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\bcryptprimitives.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\combase.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\crypt32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\cryptsp.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\d3dcompiler_47.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\dbghelp.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\dwmapi.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\gdi32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\gdi32full.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\imagehlp.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\imm32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\injected-x64.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\kernel32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\kernelbase.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\msvcp140.amd64.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\msvcp_win.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\msvcrt.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\ntdll.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\rpcrt4.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\sechost.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\shcore.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\shell32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\ucrtbase.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\user32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\vcruntime140.amd64.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\vcruntime140_1.amd64.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\win32u.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\dll\ws2_32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\exe\rundll32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\symbols\exe\yimmenuv2.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\ucrtbase.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\user32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\vcruntime140.amd64.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\vcruntime140_1.amd64.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\win32u.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\ws2_32.pdb | Read Attributes,Synchronize,Write Attributes |
| c:\windows\system32\yimmenuv2.pdb | Read Attributes,Synchronize,Write Attributes |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| Anti Debug |
|
| Process Terminate |
|
