Multi-License Discount Quote

Change Region

English
Threat Database Potentially Unwanted Programs SpeedMaxPC

SpeedMaxPC

By Domesticus in Potentially Unwanted Programs

Threat Scorecard

Popularity Rank: 891
Threat Level: 10 % (Normal)
Infected Computers: 14,129
First Seen: September 1, 2011
Last Seen: October 15, 2025
OS(es) Affected: Windows

SpeedMaxPC Image

SpeedMaxPC is a rogue computer optimizer and utilized to abduct money from newcomer computer users. Like other rogue security programs, SpeedMaxPC claims to be a legitimate solution to problems on a computer. However, SpeedMaxPC will actually be responsible for problems such as a decreased system performance and an enormous number of bogus error messages. ESG malware researchers strongly advise computer users to avoid installing SpeedMaxPC on their computer. Criminals profit from SpeedMaxPC by convincing inexperienced computer users that they need to purchase an expensive 'full version' of SpeedMaxPC in order to remove nonexistent problems on the infected computer. It is important to ignore all claims made by SpeedMaxPC and not to purchase a 'full version' of this fake system optimizer. Instead, SpeedMaxPC should be removed with the help of a real security application.

SpeedMaxPC has the capacity to display realistic looking error messages and system alerts on the infected computer. These error messages are very similar to the ones that may be displayed by a legitimate security program. However, they may contain grammatical errors or strange elements that betray the fact that they are not real. The similarity between real security programs and SpeedMaxPC ends here; this fake system optimizer displays completely false information in its error messages, detecting corrupted files or malware that is simply not present on the victim's computer. One important thing to remember about SpeedMaxPC is that SpeedMaxPC will often report problems with legitimate Windows files. Computer users who try to fix this 'problem' by removing the supposedly infected files will suddenly find that their Windows operating system cannot continue normally without them.

Although SpeedMaxPC is marketed as a program that can help a computer become faster and more efficient, SpeedMaxPC actually does the opposite. SpeedMaxPC may cause the affected computer to become slower and crash frequently. This is because SpeedMaxPC does not interact well with other, legitimate programs. It is also important to note that SpeedMaxPC may stop your normal activities by displaying fake error messages quite frequently, making it difficult to use the infected computer normally. This, of course, more than negates any supposed speed increases that should come from using SpeedMaxPC.
SpeedMaxPC Image 2SpeedMaxPC Image 3SpeedMaxPC Image 4SpeedMaxPC Image 5SpeedMaxPC Image 6

SpyHunter Detects & Remove SpeedMaxPC

File System Details

SpeedMaxPC may create the following file(s):
Expand All | Collapse All
# File Name MD5 Detections
1. Update3.exe.vir 3371ec12af3e3098d1336f28f7029781 2,525
2. Update3.exe 16fa148b70058415d3bf4888abb5bc3e 10
3. SpeedMaxPc.exe 61ec304023c79b65fec63cf816254dca 0
More files

Registry Details

SpeedMaxPC may create the following registry entry or registry entries:
File name without path
SpeedMaxPc.lnk
HKEY..\..\..\..{RegistryKeys}
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SpeedMaxPc
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SpeedMaxPc Registration3
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SpeedMaxPc Update3
Software\SpeedMaxPc\SpeedMaxPc
SOFTWARE\Wow6432Node\Microsoft\Tracing\speedmaxpc_RASAPI32
SOFTWARE\Wow6432Node\Microsoft\Tracing\speedmaxpc_RASMANCS
SOFTWARE\Wow6432Node\SpeedMaxPc
HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}
{EF4F8650-7710-4CA0-831D-4AA9C1CF6D87}

Directories

SpeedMaxPC may create the following directory or directories:

%ALLUSERSPROFILE%\SpeedMaxPc\SpeedMaxPc
%APPDATA%\Microsoft\Windows\Start Menu\Programs\SpeedMaxPc\SpeedMaxPc
%APPDATA%\SpeedMaxPc\SpeedMaxPc
%COMMONPROGRAMFILES%\SpeedMaxPc\UUS3
%COMMONPROGRAMFILES(x86)%\SpeedMaxPc\UUS3
%PROGRAMFILES%\SpeedMaxPc\SpeedMaxPc
%PROGRAMFILES(x86)%\SpeedMaxPc\SpeedMaxPc

Analysis Report

General information

Family Name: PUP.SpeedMaxPc
Packers: UPX
Signature status: Root Not Trusted

Known Samples

MD5: d4b65dc35b137b2427319948a8fcaeec
SHA1: e27b265ffa3bd467c51bb6f53dedd104e73f4172
File Size: 6.30 MB, 6298880 bytes
MD5: af6a79ba4733f4d16698397d0a416452
SHA1: 91ccb7a16d8dabb56b67b6c08271cbe9759067e8
SHA256: 266CA948B7B93F472D7D8DE5508459FA9AB548C3F5C3078AF2542BC0503C34E5
File Size: 2.94 MB, 2941493 bytes
MD5: 8b4aeee9f8f4c1c90d12e4d447a29c59
SHA1: 57af2896f40238ae1f0167f07e3edeb65d51b66f
SHA256: D80A692D3CD2037904A3D5AAD6ECE646C62A882C6CB932BBD509181376087D2E
File Size: 3.41 MB, 3405885 bytes
MD5: a9d34af06225d27d3520c9b56d82fc5e
SHA1: 30db502adc9e32f033c9c2078ff36e907c8a250c
SHA256: 04FFC018C6F22DD8077CDBC2F9DC7F3E67BD3D0DBB1D0C5ADBE7E899F06EE8FB
File Size: 28.67 KB, 28672 bytes
MD5: a0743f2550c09fef5b2a50cd90a527c1
SHA1: 6f69009f03106f3ca67cef608673327c42027b1f
SHA256: A951A165044D56CBBF7EC9459C1E2E8BD38DB330C71A87F6AC96F5CE2441F432
File Size: 53.25 KB, 53248 bytes
Show More
MD5: 9a62a76e6dcdc54cdfd6ea88e1c12ecb
SHA1: c3bca3d102886ce93f40238d352df7b63a16176c
SHA256: E37961277C6E0BECDE8589B399D0548EE2564DEAB37FABBCE89A10A3E9D70172
File Size: 597.50 KB, 597504 bytes
MD5: 4aca31b558a10153e722a7bcf7f0d390
SHA1: ccb0f2dc36bc336920e201e64af9754258872b1f
SHA256: 4AB5BC1DA2147B60E6CE46240C6A79D068B55BC64BCAAD1B61D3D08644D20506
File Size: 485.89 KB, 485888 bytes
MD5: 89f9f7a8c8f83cb07cbf928da778c117
SHA1: 491eb3ab18594fc94539334ca5907f37efe223cd
SHA256: D2237ECB7D08BD217645AD38B2C413478068C69BB6731EC6FD50D263454582D9
File Size: 449.54 KB, 449536 bytes
MD5: 03828cc19dbb99b9a06fab96e87e4605
SHA1: 1fc5823a01e9875460283bfa6eca5f64356377b1
SHA256: FD6E0D270FE8818A6C51D69FCC15137C2C31675DD6C150439872D5605DEA76EE
File Size: 2.94 MB, 2941519 bytes
MD5: ada2cb39e40de88051b589010a26acdc
SHA1: f35eadf8723853464ca0a76782db29f37ac7cb24
SHA256: B87D7AEF960B95CF3A9EA798C2DFA8674A6DCA8AC4308C41947893C2C6FF0B08
File Size: 548.86 KB, 548864 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have relocations information
  • File doesn't have security information
  • File has been packed
  • File has exports table
  • File has TLS information
  • File is .NET application
  • File is 32-bit executable
Show More
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

Show More

Windows PE Version Information

Name Value
Assembly Version 2013.11.22.0
Comments
  • IC.NF.SYC Français
  • This installation was built with Inno Setup.
  • This program modifies H&D2 profile.sav files to change the difficulty level. No warranty is expressed or implied for this program, use at your own risk. I am not connected in any way to the publishers of H&D2, this is an unofficial utility program. "Hidden and Dangerous" is a trademark of Illusion Softworks.
Company Name
  • AG Repacks™
  • Exeldro
  • Hecht Contactlinsen GmbH / Jens Fröhner
  • Macrovision Corporation
  • MajorDisaster
  • OSDWeb
  • PC SOFT
File Description
  • 21.1
  • BGB emulator
  • Diagnostic WinDev (32 bits)
  • H&D2 Profile Changer
  • InstallShield
  • OBS Shaderfilter Setup
  • Setup/Uninstall
File Version
  • 2013.11.22.0
  • 51.1052.0.0
  • 21.1.0.0
  • 12.0.58849
  • 5.55Y
  • 2.5.0
  • 1.0.4.0
Internal Name
  • APEX 1.1.0.1
  • Hnd2ProfileChanger.exe
  • _IsIcoRes.exe
Legal Copyright
  • Copyright (C) 2006 Macrovision Corporation
  • Copyright © PC SOFT 1993-1999
  • Freeware by MajorDisaster
  • Hecht Contactlinsen GmbH / Jens Fröhner
  • junho de 2025
Original Filename
  • Hnd2ProfileChanger.exe
  • WDDiag.exe
  • _IsIcoRes.exe
Product Name
  • APEX-UPDATER
  • H&D2 Profile Changer
  • InstallShield
  • Kerbal Space Program 2
  • NFL Pro Era
  • OBS Shaderfilter
  • WinDev
Product Version
  • 2013.11.22.0
  • 21.1
  • 12.0
  • 7.2.21
  • 5.5
  • 2.5.0
  • 1.6.6
  • 1.0.4.0
  • 1.0
Version V I xxxxxxxxxx

Digital Signatures

Signer Root Status
Exeldro SSL.com Root Certification Authority ECC Root Not Trusted

File Traits

  • .NET
  • 2+ executable sections
  • Inno
  • InnoSetup Installer
  • Installer Manifest
  • Installer Version
  • packed
  • VirtualQueryEx
  • x86

Block Information

Total Blocks: 4,469
Potentially Malicious Blocks: 9
Whitelisted Blocks: 2,945
Unknown Blocks: 1,515

Visual Map

0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
... Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

  • Banker.R
  • Emotet.CCA
  • Emotet.CDD
  • Injector.AK
  • Injector.KPP
Show More
  • Lumma.GFD
  • Rugmi.IA
  • Sheloader.A

Files Modified

File Attributes
c:\users\user\appdata\local\temp\is-9lpfv.tmp\_isetup\_setup64.tmp Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-l29s0.tmp\e27b265ffa3bd467c51bb6f53dedd104e73f4172_0006298880.tmp Generic Write,Read Attributes
c:\users\user\downloads\apexupdate.log Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\downloads\bgb.ini Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\appcompat\programs\amcache.hve Read Data,Read Control,Write Data
c:\windows\appcompat\programs\amcache.hve.log1 Read Data,Write Data
c:\windows\appcompat\programs\amcache.hve.log2 Read Data,Write Data

Windows API Usage

Category API
Process Shell Execute
  • CreateProcess
User Data Access
  • GetUserObjectInformation
Keyboard Access
  • GetKeyState
Syscall Use
  • ntdll.dll!NtAccessCheck
  • ntdll.dll!NtAdjustPrivilegesToken
  • ntdll.dll!NtAlpcConnectPort
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtApphelpCacheControl
  • ntdll.dll!NtAssociateWaitCompletionPacket
  • ntdll.dll!NtClearEvent
  • ntdll.dll!NtClose
  • ntdll.dll!NtConnectPort
  • ntdll.dll!NtCreateEvent
Show More
  • ntdll.dll!NtCreateFile
  • ntdll.dll!NtCreateIoCompletion
  • ntdll.dll!NtCreateKey
  • ntdll.dll!NtCreateMutant
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtCreateSemaphore
  • ntdll.dll!NtCreateTimer2
  • ntdll.dll!NtCreateWaitCompletionPacket
  • ntdll.dll!NtCreateWorkerFactory
  • ntdll.dll!NtDelayExecution
  • ntdll.dll!NtDeleteValueKey
  • ntdll.dll!NtDeviceIoControlFile
  • ntdll.dll!NtDuplicateObject
  • ntdll.dll!NtDuplicateToken
  • ntdll.dll!NtEnumerateKey
  • ntdll.dll!NtEnumerateValueKey
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtFsControlFile
  • ntdll.dll!NtLoadKeyEx
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtNotifyChangeKey
  • ntdll.dll!NtOpenDirectoryObject
  • ntdll.dll!NtOpenEvent
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenKeyEx
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenProcessTokenEx
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtOpenSemaphore
  • ntdll.dll!NtOpenSymbolicLinkObject
  • ntdll.dll!NtOpenThread
  • ntdll.dll!NtOpenThreadToken
  • ntdll.dll!NtOpenThreadTokenEx
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDefaultLocale
  • ntdll.dll!NtQueryDirectoryFileEx
  • ntdll.dll!NtQueryFullAttributesFile
  • ntdll.dll!NtQueryInformationFile
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryKey
  • ntdll.dll!NtQueryLicenseValue
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQuerySecurityObject
  • ntdll.dll!NtQuerySymbolicLinkObject
  • ntdll.dll!NtQuerySystemInformation
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryWnfStateData
  • ntdll.dll!NtReadVirtualMemory
  • ntdll.dll!NtReleaseMutant
  • ntdll.dll!NtReleaseSemaphore
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtRequestWaitReplyPort
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationKey
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationThread
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtSubscribeWnfStateChange
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtTraceEvent
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtUnmapViewOfSectionEx
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWaitForWorkViaWorkerFactory
  • ntdll.dll!NtWaitLowEventPair
  • ntdll.dll!NtWorkerFactoryWorkerReady
  • ntdll.dll!NtWriteFile
  • ntdll.dll!NtWriteVirtualMemory
  • UNKNOWN
  • win32u.dll!NtUserGetKeyboardLayout
  • win32u.dll!NtUserGetObjectInformation
  • win32u.dll!NtUserGetProcessWindowStation
  • win32u.dll!NtUserGetThreadDesktop
  • win32u.dll!NtUserGetThreadState
Anti Debug
  • IsDebuggerPresent
Encryption Used
  • BCryptOpenAlgorithmProvider
Process Manipulation Evasion
  • ReadProcessMemory
Network Winsock2
  • WSAStartup

Shell Command Execution

"C:\Users\Esupdqol\AppData\Local\Temp\is-L29S0.tmp\e27b265ffa3bd467c51bb6f53dedd104e73f4172_0006298880.tmp" /SL5="$601DE,5335659,891904,c:\users\user\downloads\e27b265ffa3bd467c51bb6f53dedd104e73f4172_0006298880.exe"
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\\dw20.exe dw20.exe -x -s 864

Trending

Most Viewed

Loading...