Threat Database Potentially Unwanted Programs PUP.Gamehack.LCXA

PUP.Gamehack.LCXA

By CagedTech in Potentially Unwanted Programs

The detection of PUP.Gamehack.LCXA on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It's essential to understand the nature of this threat and take immediate action to remove it to prevent any potential harm.

What Is PUP.Gamehack.LCXA?

PUP.Gamehack.LCXA is a type of potentially unwanted program that may have been installed on your system without your knowledge or consent. PUPs are software applications that may not be malicious in nature but can still cause problems with your computer's performance, stability, and security. They often come bundled with other software or are downloaded from untrusted sources, and can be difficult to remove once installed.

How PUP.Gamehack.LCXA Operates

PUPs like PUP.Gamehack.LCXA typically operate by installing themselves on your system and then running in the background, often without your knowledge or consent. They may collect data about your browsing habits, system configuration, and other sensitive information, which can be used for targeted advertising, data theft, or other malicious purposes. PUPs can also slow down your system, cause crashes, and interfere with other software applications.

Symptoms of Infection

If your system is infected with PUP.Gamehack.LCXA, you may experience a range of symptoms, including slow system performance, frequent crashes, and unwanted pop-ups or advertisements. You may also notice that your browser settings have been changed, or that new toolbars or extensions have been installed without your consent. In some cases, PUPs can also cause problems with your system's security, making it more vulnerable to other types of malware and cyber threats.

  • Unwanted pop-ups or advertisements
  • Slow system performance
  • Frequent crashes or system freezes
  • Changed browser settings or new toolbars/extensions
  • Increased risk of malware or cyber threats

How to Remove PUP.Gamehack.LCXA

  1. Boot your system in Safe Mode with Networking to prevent the PUP from running and to allow for a more thorough removal process.
  2. Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and detect any malware or PUPs that may be present.
  3. Uninstall any suspicious programs or applications that may be related to the PUP.
  4. Reset your browser settings to their default values, including Chrome, Firefox, and Edge, to remove any unwanted changes or extensions.
  5. Reboot your system and perform a follow-up scan to ensure that the PUP has been completely removed.

Conclusion

Removing PUP.Gamehack.LCXA from your system is essential to prevent any potential harm and to restore your computer's performance and security. By following the steps outlined above, you can effectively remove this PUP and protect your system from future threats. Remember to always be cautious when downloading software or clicking on links, and to use reputable anti-malware tools to scan your system regularly and stay safe online.

Analysis Report

General information

Family Name: PUP.Gamehack.LCXA
Signature status: No Signature

Known Samples

MD5: dc0ef542668041f724a7aa9ce4502627
SHA1: 56f9e8d364e95e6ec2bc59a11aa72e8b4345daa1
SHA256: 2ED2C7B950760580B91882A36957DD74E95F30BBF6AA4A2609DCFB9A131CFF77
File Size: 5.91 MB, 5906104 bytes
MD5: eb4c497e3bb84284460a3a565ead9d3e
SHA1: ede5976f281e60dc38055376b039d5cb4cf3edbc
SHA256: 8C8F50AF844A26B787194FD0CF20940F5F519E7B3ED83669D30A7FAE7DA3516F
File Size: 6.79 MB, 6786736 bytes
MD5: 2510a4a11dab55eebe1f3aa62c279450
SHA1: 798538a9f319003d5834ec97c21c0b80ebc658b5
SHA256: 6CC83A58615D54E9C5C128DBC50090B898E470C6D35448A1A7E84DE078C3EB99
File Size: 1.58 MB, 1583104 bytes
MD5: 28a02f07e9376ae71c1f3a8c505fd739
SHA1: 896ce1760259e817118371a870a92a2e98ede889
SHA256: 4E10FA8D03FD61A8CDC8448501F47CA5E8021E7F7BF2BD73DE67F7517CDC5772
File Size: 6.79 MB, 6786560 bytes
MD5: 8fc90b118e73939c10e66a6a9e16b791
SHA1: 8c001ed1ef2f5648ce9cc1fe33fe9b9018e43a95
SHA256: A2108B2F46BAD1556D18737B57ED2EF46D69522423E430D442232FCFCAF464C5
File Size: 6.53 MB, 6532608 bytes
Show More
MD5: 0773a0ae2de94be2872dae787bb42dc3
SHA1: da22148594922be94738b20bc598d8bf2816cf85
SHA256: 38C8B373BDD5C026EC757C4FB33DA95A6731F13382367937135A6DB5ED63B6B4
File Size: 7.02 MB, 7019008 bytes
MD5: b49a15904b6621d2267c00fd02f32136
SHA1: f1ba8093f46f82615504ca16a9c177a65c56c03d
SHA256: BCFF468362B96C001DC3177D820AB6D9F7AF0D1ABEB284AF4B6BC673887E2708
File Size: 7.02 MB, 7021056 bytes
MD5: fa981ac4d3cec17085a6b5d3ca804a2d
SHA1: c10760e23cc0a8c09f07ba6dadb9e80a272b7fcd
SHA256: A501D93316DA7D41B26652643C212577451A3B61673917C1C1778D502BD90EBA
File Size: 7.07 MB, 7068824 bytes
MD5: 7b81870ca03d3067c5d0f9bf61517529
SHA1: 8f9b95a9e133b08a2a95f2f9fe8c46c31f715518
SHA256: C2F7B1E206800BFF8A2CAE19F892AC686D93EFC47DC246EADEF0DF7843EF9F64
File Size: 7.04 MB, 7043224 bytes
MD5: 5491f6a854ea592fb01a569221de4a93
SHA1: 01115233e2a74da91d7fa66204bf6cf049257bc4
SHA256: 1FAA2782706215D757991CA9F790D3D3CF243FE96BF0511D0607E009EDD2722D
File Size: 7.30 MB, 7303856 bytes
MD5: ad1298ee27b37fe7c8f1b7ccbdebf7d7
SHA1: ceefd7bb86244abc6233061054e2d93e55412624
SHA256: F155FA4D37497CC0756D5C74875991ADFF12CF65D6ADE90D0AD77B9203F4C3CC
File Size: 7.13 MB, 7130112 bytes
MD5: 86cab4b1b2639d7eb5cac742d3bb8807
SHA1: 1855b94fc689bdb2e6ef9fd6212db28a2d0156a3
SHA256: 6ACA62142B51452CE98553879AAF8B7CE80698C11F7DBE84A20BF24B54E497F1
File Size: 9.39 MB, 9390256 bytes
MD5: ebea0ed34b8cf354edac9274e8495695
SHA1: f8ddc38303469ad276deb7f98c38aa6e1d28baec
SHA256: B847468585E49655B967F5649882CB1053B05F2D8DFED85DEB8827CF6C97E806
File Size: 6.14 MB, 6135808 bytes
MD5: 7e5bfc4dcaba0fc615acedbf6cbbd929
SHA1: 90663e027b38995a76b875d018cdd9283f1bc9b6
SHA256: E1699A93849257DC1410F9C6E3B9A1C22C0CD95E8E5ABC56DDAF3F14574D7C5F
File Size: 7.02 MB, 7020544 bytes
MD5: 1b6eca31b90a8d5b4f2d23dd7643cb79
SHA1: 81cfeced778e23f3e60f7fce4e53fd7e467d2d09
SHA256: 57EA64324FA89BDD571A8F04E4FDE19BA40267DDA126E84B04A287F9D3A009E4
File Size: 3.97 MB, 3970560 bytes
MD5: 6af6d1d1cf626a136a356fec7be8d80c
SHA1: b7c0a8b26980974aa8ba917784c13678ac41bc94
SHA256: EC49AA856C548B74F186DAE448D43912CE471FA345B71276D38980CA06DADC27
File Size: 2.06 MB, 2061824 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have exports table
  • File doesn't have security information
  • File has exports table
  • File has TLS information
  • File is 64-bit executable
  • File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
Show More
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

Digital Signatures

Signer Root Status
Areeb Ahmed Code Signing LLC Areeb Ahmed Code Signing LLC Self Signed
Microsoft Corporation Microsoft Code Signing PCA 2011 Hash Mismatch
Microsoft Windows Software Compatibility Publisher Microsoft Windows Third Party Component CA 2013 Hash Mismatch

File Traits

  • dll
  • fptable
  • GetConsoleWindow
  • HighEntropy
  • imgui
  • No Version Info
  • ntdll
  • WriteProcessMemory
  • x64

Block Information

Total Blocks: 2,422
Potentially Malicious Blocks: 202
Whitelisted Blocks: 1,998
Unknown Blocks: 222

Visual Map

0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x 0 0 0 0 0 0 0 1 x x x 0 x 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 0 x 0 0 x 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x 0 0 0 0 0 0 x 0 x x 0 x x x 0 0 0 x x x 0 x 0 0 x x x 1 0 0 0 0 0 0 0 0 0 x 0 x x 0 x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 x ? x 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 x 0 x x x x x 0 0 0 x x x 0 x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x ? 0 0 0 0 0 0 0 0 x 0 x x 0 0 x ? 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 x 0 x 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 x 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 x x 0 0 0 0 0 x x 0 0 x x x 0 0 0 0 0 0 0 0 0 0 0 0 x x x 0 0 x 0 0 0 x x 0 0 1 0 0 0 0 0 x 0 0 1 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 x 0 x 0 0 0 0 0 x 0 0 0 1 x 0 0 x x 0 0 0 0 x 0 x 0 0 x x 0 0 x 0 0 x 0 x x 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x 1 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 1 0 0 0 1 0 0 0 0 0 0 1 ? 0 0 0 0 1 0 0 1 0 0 1 0 0 1 0 0 1 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x x x 0 0 0 0 0 0 0 0 0 x 0 0 x x 0 ? x 0 0 0 0 0 x x 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 x x x x 0 0 0 0 0 0 0 0 x 0 0 1 0 0 0 0 x 0 0 0 0 x x 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 1 0 0 0 0 0 0 x 0 0 0 0 0 x x 0 0 x 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x 0 0 0 0 0 0 0 0 x 0 0 0 1 0 0 0 0 1 x x 0 0 0 0 0 0 x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 x 0 0 0 0 0 x x 0 0 0 0 0 0 0 0 0 x 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 x 0 x 0 0 0 0 0 0 x 0 0 0 0 0 0 0 x 0 x 0 0 x x 0 0 x 0 0 0 x 0 0 0 0 x x 0 0 x 0 0 0 x x x 0 0 0 x x x 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 ? ? x 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 ? 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 x x x x x 0 0 0 0 0 0 x 0 x 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 x x x x 0 0 1 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 x 0 0 0 0 0 0 x 0 0 0 0 0 1 0 ? x x 0 0 0 0 0 1 0 0 0 0 0 0 0 0 x 1 0 0 0 ? x 0 0 0 0 0 x 0 x 0 0 0 x 0 0 1 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 x ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? x 0 ? 0 ? 0 ? ? 0 0 ? 0 ? ? ? 0 ? ? ? 0 ? 0 ? ? 0 0 0 ? ? ? ? ? 0 0 0 ? 0 0 0 0 0 0 0 ? ? 0 ? ? ? ? ? 0 ? ? ? ? ? 0 0 ? ? ? ? 0 0 ? 0 ? ? 0 ? 0 ? ? ? ? ? ? ? ? ? ? 0 0 0 0 0 ? ? ? 0 ? 0 0 0 ? ? ? ? ? ? ? ? ? 0 0 ? ? ? 0 0 ? ? ? ? ? ? ? ? ? x ? ? ? ? 0 ? ? ? 0 ? 0 0 ? ? 0 ? ? ? ? ? ? 0 ? ? 0 ? ? ? 0 ? ? ? ? ? ? 0 ? 0 ? ? ? ? ? ? ? x ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? 0 ? 0 ? ? ? ? ? ? 0 ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 1 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 ? 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? ? ? ? 0 0 0 x 0 ? 0 0 0 0 0 ? ? x 0 x 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0
... Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Registry Modifications

Key::Value Data API Name
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 �k4 �v �ZT�����Bx#�#��(�(X�,��1`1�1HO@V�H�pN$_�z`b.g�k`k�ql(�o�o�ww�m{b��P��jI��!� ���3��~������������T��.��*�m�Ù��gi�V����$�8�fწ���l��&MA�~�=�S.SLB1 RegNtPreCreateKey

Windows API Usage

Category API
Syscall Use
  • ntdll.dll!NtAccessCheck
  • ntdll.dll!NtAddAtomEx
  • ntdll.dll!NtAlertThreadByThreadId
  • ntdll.dll!NtAlpcConnectPort
  • ntdll.dll!NtAlpcConnectPortEx
  • ntdll.dll!NtAlpcCreateResourceReserve
  • ntdll.dll!NtAlpcCreateSecurityContext
  • ntdll.dll!NtAlpcQueryInformation
  • ntdll.dll!NtAlpcQueryInformationMessage
  • ntdll.dll!NtAlpcSendWaitReceivePort
Show More
  • ntdll.dll!NtAlpcSetInformation
  • ntdll.dll!NtApphelpCacheControl
  • ntdll.dll!NtAssociateWaitCompletionPacket
  • ntdll.dll!NtClose
  • ntdll.dll!NtConnectPort
  • ntdll.dll!NtCreateEvent
  • ntdll.dll!NtCreateFile
  • ntdll.dll!NtCreateIoCompletion
  • ntdll.dll!NtCreateKey
  • ntdll.dll!NtCreateMutant
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtCreateThreadEx
  • ntdll.dll!NtCreateTimer2
  • ntdll.dll!NtCreateWaitCompletionPacket
  • ntdll.dll!NtCreateWorkerFactory
  • ntdll.dll!NtDelayExecution
  • ntdll.dll!NtDeviceIoControlFile
  • ntdll.dll!NtDuplicateObject
  • ntdll.dll!NtDuplicateToken
  • ntdll.dll!NtEnumerateKey
  • ntdll.dll!NtEnumerateValueKey
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtGetCompleteWnfStateSubscription
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtNotifyChangeKey
  • ntdll.dll!NtOpenEvent
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenKeyEx
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenProcessTokenEx
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtOpenSemaphore
  • ntdll.dll!NtOpenThreadToken
  • ntdll.dll!NtOpenThreadTokenEx
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDebugFilterState
  • ntdll.dll!NtQueryFullAttributesFile
  • ntdll.dll!NtQueryInformationFile
  • ntdll.dll!NtQueryInformationJobObject
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryKey
  • ntdll.dll!NtQueryLicenseValue
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQuerySecurityObject
  • ntdll.dll!NtQuerySystemInformation
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtQueryWnfStateData
  • ntdll.dll!NtQueryWnfStateNameInformation
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtReadRequestData
  • ntdll.dll!NtReadVirtualMemory
  • ntdll.dll!NtReleaseMutant
  • ntdll.dll!NtReleaseSemaphore
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtRequestWaitReplyPort
  • ntdll.dll!NtResumeThread
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationKey
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationThread
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtSetSystemInformation
  • ntdll.dll!NtSubscribeWnfStateChange
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtTraceEvent
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtUnmapViewOfSectionEx
  • ntdll.dll!NtUpdateWnfStateData
  • ntdll.dll!NtWaitForAlertByThreadId
  • ntdll.dll!NtWaitForMultipleObjects
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWaitForWorkViaWorkerFactory
  • ntdll.dll!NtWaitLowEventPair
  • ntdll.dll!NtWorkerFactoryWorkerReady
  • ntdll.dll!NtWriteFile
  • UNKNOWN
Encryption Used
  • BCryptOpenAlgorithmProvider
  • CryptAcquireContext
Network Winsock2
  • WSAStartup
Network Wininet
  • InternetOpen
  • InternetOpenUrl
  • InternetReadFile