Threat Database Potentially Unwanted Programs PUP.OpenBullet

PUP.OpenBullet

By CagedTech in Potentially Unwanted Programs

The detection of PUP.OpenBullet on your system indicates the presence of a potentially unwanted program (PUP) that may be compromising your computer's security and performance. It's essential to understand the nature of this threat and take immediate action to remove it to prevent potential harm.

What Is PUP.OpenBullet?

PUP.OpenBullet is a type of malware that is classified as a potentially unwanted program. This means it may not be as overtly malicious as other types of malware, such as viruses or Trojans, but it can still cause significant issues with your system. PUPs often find their way onto computers through bundled software downloads, infected websites, or deceptive installation processes. They can lead to a range of problems, including unwanted advertisements, data collection without consent, and changes to your browser settings or homepage.

How PUP.OpenBullet Operates

Once installed, PUP.OpenBullet can operate in various ways to achieve its goals, which typically involve generating revenue for its creators through advertisements, collecting user data, or redirecting users to specific websites. It may integrate itself into your web browser, altering settings without your permission, or it may run in the background, consuming system resources and potentially slowing down your computer. The specific operations of PUP.OpenBullet can vary, but the common denominator is the potential to disrupt your computing experience and compromise your privacy.

Symptoms of Infection

Identifying a PUP infection can be challenging, as symptoms may be subtle or resemble issues caused by other factors. However, common signs include an increase in pop-up advertisements, unexpected changes to your browser's homepage or search engine, sluggish system performance, and unfamiliar programs or toolbars installed on your computer. If you've noticed any of these symptoms, it's crucial to investigate further to determine if PUP.OpenBullet or another malware is the cause.

How to Remove PUP.OpenBullet

  1. Enter Safe Mode with Networking to limit the malware's ability to interfere with the removal process. This mode allows you to use the internet to download removal tools while minimizing system activity.
  2. Conduct a full scan of your system using a reputable anti-malware tool, such as SpyHunter. This will help identify and remove all components of PUP.OpenBullet and any other malware that may be present.
  3. Uninstall any suspicious programs or applications that you do not recognize or no longer need. Be cautious and ensure you are removing the correct programs to avoid disrupting legitimate system functions.
  4. Reset your web browsers (Chrome, Firefox, Edge, etc.) to their default settings. This will remove any changes made by PUP.OpenBullet, such as altered homepages or search engines, and eliminate any malicious extensions.
  5. Reboot your computer and perform another full scan with your anti-malware tool to ensure all remnants of PUP.OpenBullet have been removed. This step is crucial for verifying the effectiveness of the removal process.

Conclusion

Removing PUP.OpenBullet from your system is a critical step in protecting your privacy, securing your data, and restoring your computer's performance. By understanding what PUP.OpenBullet is, how it operates, and the symptoms it may cause, you can take proactive measures to eliminate this threat. Following the removal steps outlined above, you can effectively remove PUP.OpenBullet and prevent future infections by being cautious with software downloads, keeping your operating system and security software up to date, and regularly scanning your system for malware. Remember, vigilance and prompt action are key to maintaining a secure and efficient computing environment.

Analysis Report

General information

Family Name: PUP.OpenBullet
Signature status: No Signature

Known Samples

MD5: 09dc2611d3ed88cc60e5f10e2b1553f5
SHA1: 4df28797a5d1832005561d1ea6c56ec19f833bd3
File Size: 1.59 MB, 1592320 bytes
MD5: bf0b3cdd4e219de2359a62f9b7a3fe28
SHA1: 3dfdc74e8c922e9a5dc60aa25cd50842f08c797d
SHA256: 498190947C96CBD27C9079E27D61D902AEC3ED2479A17D716DEAE48F080941A5
File Size: 107.01 KB, 107008 bytes
MD5: 24c2194e55bfca53f3f8313c538ee256
SHA1: 21afb39aa01316862fac718ac7b600ecd4235009
SHA256: 5284CF639A321350009470CFD96134FA4EA09C344788FF31FF1F5E4530E37C93
File Size: 152.58 KB, 152576 bytes
MD5: f0763223b4d8e97df5b581fc243898b1
SHA1: 3bb9a74289002c9c56a8976d5ca1d7044df9bad3
SHA256: 8B04F4F4507B5C41895572C1119EA95970A0C813C271E6BE28A898A17FE50002
File Size: 1.54 MB, 1538560 bytes
MD5: edd43f8ec103d6c54631f1e45ddb30ef
SHA1: cd069f3931b653ecd985d62818c32368c256a23d
SHA256: A9402084598A15BEAA1547E5D95A576A2B942B89BAA9193A45F2618CE6133AF2
File Size: 3.32 MB, 3317760 bytes
Show More
MD5: 480fd4ade1872f7ccb4b85d1b5179237
SHA1: b44e424225e89140b7079a5c6842a2ff8f8bdb6d
SHA256: 2F8C63876333A84127B139E1F494DCD1602831AD7A725FBD446F9FC39A7FECB2
File Size: 905.80 KB, 905800 bytes
MD5: 93c4d9519708dca503dae55444d360cd
SHA1: f368911f6f84f2411ca65d1e5483fad163e99a4b
SHA256: 0D970A13D1C8A0EFF565679940B7D256121812E55CD3AED551C055DFB560C1DB
File Size: 144.38 KB, 144384 bytes
MD5: b6eb18812499c6ce08d4b7454eea4b54
SHA1: d49151b716417b8d9da7c26e995d6ee9d6fd90d0
SHA256: 30427AC31EDE67C84E5776B8F592CF24D11144741AB00080F4525F0325E751F0
File Size: 172.03 KB, 172032 bytes
MD5: 8b53e5e9c6e4bbee06613fea843784dc
SHA1: 1a65268c640091e47ca5221af665dc4aeac2e4b5
SHA256: 5B7F45A9ED9DB645DBD201C0A7D8444879A453578BE052AB22FCD4A823E25541
File Size: 1.73 MB, 1733632 bytes
MD5: 4463e4d02c38259ad01b9a44dce69e01
SHA1: 39fea8028cbfff535159c95e72bc2a4673591ab6
SHA256: 01B532DE1BA5E703ED267A3EF18923FF97D48DC1BF24D1C13E99E10679105CBF
File Size: 6.07 MB, 6071296 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have security information
  • File has exports table
  • File has TLS information
  • File is .NET application
  • File is 32-bit executable
  • File is 64-bit executable
  • File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
Show More
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

Windows PE Version Information

Name Value
Assembly Version
  • 4.0.1.0
  • 1.1.6.0
  • 1.0.8854.9198
  • 1.0.7755.22352
  • 1.0.29.0
  • 1.0.0.0
Company Name
  • INTELBRAS
  • OpenBullet2
  • OpenBullet2.Native
File Description
  • OpenBullet
  • OpenBullet2
  • OpenBullet2.Native
  • RPD 7000
File Version
  • 6000.0.51.115711
  • 4.0.1.0
  • 1.1.6
  • 1.0.29
  • 1.0.0.0
  • 1.0.*
Internal Name
  • OB M2 BrowninG.dll
  • OpenBullet.exe
  • OpenBullet2.dll
  • OpenBullet2.Native.dll
  • OpenBullet2.resources.dll
  • RM 7000.exe
  • RPD 7000.exe
Legal Copyright
  • (c) 2005-2025 Unity Technologies. All rights reserved.
  • Copyright © 2018
  • Copyright © INTELBRAS 2019
  • Copyright © INTELBRAS 2020
Legal Trademarks INTELBRAS
Original Filename
  • OB M2 BrowninG.dll
  • OpenBullet.exe
  • OpenBullet2.dll
  • OpenBullet2.Native.dll
  • OpenBullet2.resources.dll
  • RM 7000.exe
  • RPD 7000.exe
Product Name
  • OpenBullet
  • OpenBullet2
  • OpenBullet2.Native
  • RM 7000
  • RPD 7000
Product Version
  • 6000.0.51f1 (01c3ff5872c5)
  • 4.0.1
  • 1.1
  • 1.0.0.0
  • 1.0.0+eece1772d7e86f4a8862b25068234528971b17cd
  • 1.0.0
  • 1.0

File Traits

  • .NET
  • 2+ executable sections
  • CryptUnprotectData
  • dll
  • GenKrypt
  • HighEntropy
  • Reactor
  • Reflective
  • RijndaelManaged
  • x64
Show More
  • x86

Block Information

Total Blocks: 2,346
Potentially Malicious Blocks: 38
Whitelisted Blocks: 2,254
Unknown Blocks: 54

Visual Map

0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? x ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? 0 ? ? x 0 x x x ? x 0 0 x ? ? ? ? 0 x x x x x x x x x ? ? x x x x 0 0 x x x x x x 0 x x x ? x x 0 x 0 0 0 0 x x x 0 0 x 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
... Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

  • MSIL.Agent.NFA
  • MSIL.DLLInject.I
  • MSIL.DllInject.B
  • MSIL.Krypt.ECG
  • MSIL.PSW.Agent.ZD

Windows API Usage

Category API
User Data Access
  • GetComputerNameEx
  • GetUserDefaultLocaleName
  • GetUserObjectInformation
Encryption Used
  • BCryptOpenAlgorithmProvider
Anti Debug
  • IsDebuggerPresent
  • NtQuerySystemInformation
  • OutputDebugString
Syscall Use
  • ntdll.dll!NtAccessCheck
  • ntdll.dll!NtAlpcConnectPortEx
  • ntdll.dll!NtAlpcCreateSecurityContext
  • ntdll.dll!NtAlpcDeleteSecurityContext
  • ntdll.dll!NtAlpcQueryInformation
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtApphelpCacheControl
  • ntdll.dll!NtAssociateWaitCompletionPacket
  • ntdll.dll!NtClearEvent
  • ntdll.dll!NtClose
Show More
  • ntdll.dll!NtConnectPort
  • ntdll.dll!NtCreateEvent
  • ntdll.dll!NtCreateIoCompletion
  • ntdll.dll!NtCreateMutant
  • ntdll.dll!NtCreatePrivateNamespace
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtCreateThreadEx
  • ntdll.dll!NtCreateTimer2
  • ntdll.dll!NtCreateWaitCompletionPacket
  • ntdll.dll!NtCreateWorkerFactory
  • ntdll.dll!NtDuplicateObject
  • ntdll.dll!NtDuplicateToken
  • ntdll.dll!NtEnumerateKey
  • ntdll.dll!NtEnumerateValueKey
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenDirectoryObject
  • ntdll.dll!NtOpenEvent
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenKeyEx
  • ntdll.dll!NtOpenProcess
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenProcessTokenEx
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtOpenSemaphore
  • ntdll.dll!NtOpenThreadToken
  • ntdll.dll!NtOpenThreadTokenEx
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDebugFilterState
  • ntdll.dll!NtQueryDefaultLocale
  • ntdll.dll!NtQueryDirectoryFileEx
  • ntdll.dll!NtQueryFullAttributesFile
  • ntdll.dll!NtQueryInformationFile
  • ntdll.dll!NtQueryInformationJobObject
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryKey
  • ntdll.dll!NtQueryLicenseValue
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQuerySecurityObject
  • ntdll.dll!NtQuerySystemInformation
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtQueryWnfStateData
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtReadRequestData
  • ntdll.dll!NtReleaseMutant
  • ntdll.dll!NtReleaseSemaphore
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtRequestWaitReplyPort
  • ntdll.dll!NtResumeThread
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationKey
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationThread
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtSetTimer2
  • ntdll.dll!NtSubscribeWnfStateChange
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtUnmapViewOfSectionEx
  • ntdll.dll!NtWaitForAlertByThreadId
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWaitForWorkViaWorkerFactory
  • ntdll.dll!NtWaitLowEventPair
  • ntdll.dll!NtWriteFile
  • ntdll.dll!NtWriteVirtualMemory
  • UNKNOWN
  • win32u.dll!NtGdiBitBlt
  • win32u.dll!NtGdiCreateBitmap
  • win32u.dll!NtGdiCreateCompatibleDC
  • win32u.dll!NtGdiCreateDIBitmapInternal
  • win32u.dll!NtGdiCreateSolidBrush
  • win32u.dll!NtGdiDeleteObjectApp
  • win32u.dll!NtGdiExtGetObjectW
  • win32u.dll!NtGdiGetDCforBitmap
  • win32u.dll!NtGdiGetDCObject
  • win32u.dll!NtGdiGetDeviceCaps
  • win32u.dll!NtGdiRestoreDC
  • win32u.dll!NtGdiSaveDC
  • win32u.dll!NtGdiSelectBitmap
  • win32u.dll!NtGdiSetDIBitsToDeviceInternal

34 additional items are not displayed above.