Multi-License Discount Quote

Change Region

English
Threat Database Cracks Hacktool.Crack.MahjongSolitaire

Hacktool.Crack.MahjongSolitaire

By CagedTech in Cracks, Hacktool

Threat Scorecard

Popularity Rank: 1,486
Threat Level: 50 % (Medium)
Infected Computers: 18,509
First Seen: July 27, 2021
Last Seen: July 20, 2026
OS(es) Affected: Windows

Your system has been detected with a threat identified as Hacktool.Crack.MahjongSolitaire. This detection suggests that your computer may be compromised by a potentially malicious tool, and it's essential to understand the nature of this threat and take immediate action to remove it. The presence of Hacktool.Crack.MahjongSolitaire may indicate that your system's security has been breached, and your personal data could be at risk.

What Is Hacktool.Crack.MahjongSolitaire?

Hacktool.Crack.MahjongSolitaire is a type of malicious software that has been designed to compromise the security of your computer. The name itself suggests that it may be related to cracking or bypassing security measures, potentially to gain unauthorized access to software, data, or systems. It's crucial to note that the presence of such a tool on your system can lead to various security risks, including data theft, unauthorized access, and further malware infections.

How Hacktool.Crack.MahjongSolitaire Operates

Malicious tools like Hacktool.Crack.MahjongSolitaire typically operate by exploiting vulnerabilities in software or using social engineering tactics to trick users into installing them. Once installed, they can perform a variety of malicious actions, such as stealing sensitive information, installing additional malware, or providing unauthorized access to your system. These tools can be particularly dangerous because they can be used to gain control over your computer, allowing attackers to use it for their malicious purposes.

Symptoms of Infection

The symptoms of a Hacktool.Crack.MahjongSolitaire infection can vary, but common indicators include slow system performance, unexpected pop-ups or advertisements, and unfamiliar programs or icons on your desktop. You may also notice that your browser settings have been changed or that your system is behaving erratically. In some cases, the infection may not exhibit any noticeable symptoms, making it difficult to detect without the use of antivirus software.

How to Remove Hacktool.Crack.MahjongSolitaire

  1. Boot your computer in Safe Mode with Networking to prevent the malware from loading and to allow for a more effective removal process.
  2. Perform a full scan of your system using a reputable antivirus tool, such as SpyHunter, to detect and remove all instances of the malware.
  3. Uninstall any suspicious programs or applications that you do not recognize or that were installed around the time of the infection.
  4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any malicious extensions or settings changes.
  5. Reboot your computer and perform another full scan to ensure that the malware has been completely removed.

Conclusion

Removing Hacktool.Crack.MahjongSolitaire from your system is crucial to preventing further damage and protecting your personal data. By following the steps outlined above, you can help ensure the removal of this malicious tool and restore your system's security. It's also essential to practice good security habits, such as regularly updating your software, using strong passwords, and being cautious when clicking on links or downloading attachments, to prevent future infections. Remember, staying vigilant and proactive is key to maintaining the security and integrity of your computer system.

Analysis Report

General information

Family Name: Hacktool.Crack.MahjongSolitaire
Signature status: No Signature

Known Samples

MD5: 6436443fcb8fc337410dfef6cc5a73ef
SHA1: 8e9c20303bc5fa2130c0003e6935381a5e4751ce
File Size: 3.01 MB, 3010090 bytes
MD5: 46959ec0a1aa01cb0f29158880b9eeb8
SHA1: 6c53a3d936bbc662aded7eedc5ddaefb9c56c858
SHA256: 4EFC1CE22504C3ACF922D8062D81D5EFCADE5EFBBC9D5B120A4BC00A5A54CAE3
File Size: 4.27 MB, 4272682 bytes
MD5: 72b3260f791506421b79da672294be32
SHA1: 36a06e7a3adff8402ea940c660f7f00b351037b4
SHA256: 43869E470E59BFCDFE260E8F8B1738671E6856F145F7292ED8AE36B3E86471F3
File Size: 1.59 MB, 1592320 bytes
MD5: 4262204a03037f467a29e70eec28edf7
SHA1: 705aa309dd46d62fe99d0cc5c3e7b822a49198db
SHA256: 509496C3DBB5E2F097E4E116E63A843E9307DCD77EF1B2053472A14225F69FB2
File Size: 6.64 MB, 6635520 bytes
MD5: 678b3df4ce29672de6c21c0a3c67a00e
SHA1: 17056f39afff7f9bf39330c5c2e0d516ed66a71b
SHA256: 1FE5EAFD01D2B0F3CDC29B4B85284F91C16781346F4D8525ABCF505A669C65A0
File Size: 2.24 MB, 2240853 bytes
Show More
MD5: 6e7691e197e3a95267bccefbf7efffd0
SHA1: f6798c8b10055c1717e80cf9c374c892233bf823
SHA256: E7D30134A9DCC6B8009CD1F26FF490E02F1E1BC82D46F21CF7EBC7632BFAF768
File Size: 868.76 KB, 868756 bytes
MD5: bef4509fe09c3cbc76887ba6acf8a8e4
SHA1: 31fb7a4bf053754801e8e572d862f6e099a1ae41
SHA256: D39007E980427D322A893150251696421D8241B750D5ED6CCEFB93ECF9DCD143
File Size: 2.38 MB, 2380288 bytes
MD5: c96b74b51640b3b2d7ee9c1364c7a5cb
SHA1: fb933dfa95d614707c94669de7e560edbbc8e862
SHA256: 8EE4ACFA4176C2E882526DA686CDA66A548C4AAB540AA6D41839C43C08DFE063
File Size: 888.99 KB, 888988 bytes
MD5: 0cd4a314645a413b491d67a71b5fad30
SHA1: 1b1af606bafe3f7fef686c35f6bd3bd5694997c9
SHA256: B0B31894C1D53F6A7A6337DBAA023684DD2B8C05B433B3C949873D50814BD561
File Size: 2.56 MB, 2561066 bytes
MD5: d7918a90b23521ab489ae0a077dd6e0c
SHA1: c16a9a3c895134a124455298049f1cbc888d3a66
SHA256: FC34298F3CE4DA79330C7D2848DADDA7D0B460058782F3B94F6EA7B0E61F385C
File Size: 1.67 MB, 1666048 bytes
MD5: 6857d4f3e9436161d35e6fcd5144ad6b
SHA1: 4aa577f81bbd0ae82c68d47f2a31c9bff9804282
SHA256: 018C0D3BA9240F3918A75A17DB22FFA80D20C16DC3F28F2A3D6F7479A98FBCE8
File Size: 344.06 KB, 344064 bytes
MD5: 01fccd0ae87f2cc9b2842d81835a6c2c
SHA1: a2d6c83f53335bd4a181d5c004aaeb8597c5726f
SHA256: EE9F9B8E6A663709690927E2FC5D7B36A5338B4168BCAD0E6E66973AD0459A1D
File Size: 3.45 MB, 3451130 bytes
MD5: 9dcbbba51c1931075eb3bc75a84bb0da
SHA1: 59b2046e2d9fafb549f2228cee1b4fb165bd4b83
SHA256: 6B8AA871DFC12938FFBAC5D91B1E2495106C8B5BB390AA18BA6A463CDEEE0B64
File Size: 1.27 MB, 1271266 bytes
MD5: a2dd6bdfa65c1de172ba0b9232b8965b
SHA1: f59816c98736d141db45ec70d524e62478cce6d1
SHA256: D98B1D73B47120E69CFAE95F564F23E887B90D278B36C3381E49545ECC9F372B
File Size: 7.24 MB, 7242065 bytes
MD5: 78ad9842676967880f672285faa279b2
SHA1: 277634fe7397c47d012785b2ba523cf01fdb72e2
SHA256: 376309BA8B03F2362D4769916FED858D08D00215D005902B1E18663802E0E7DA
File Size: 2.14 MB, 2138453 bytes
MD5: 284b8f3c2c886ea573eb5105568822f7
SHA1: fb3e4c0ccde3ecda992ce367460ca3f5ccf4d319
SHA256: 2201168E0C5CF1C21C1AA062D2A4F0885A466B524BCD1D6AAF4B596872C7A44B
File Size: 2.00 MB, 1998168 bytes
MD5: 445899ada8acd6bd2a6e7db0d78a3c0e
SHA1: 738a46fe1ad5a3a684ee5d204d8061451a5dc7ef
SHA256: 53076646B72A4BA70D0790621E7BC0B178C5FE0A4B53563A43990CBC806A4AD4
File Size: 6.64 MB, 6635520 bytes
MD5: d07473d39518999801b76872d55be12a
SHA1: 0a57f7d835707560f1c66bdb9559d3d486c443b0
SHA256: E2E6BDA1108C59F10A3480C0A1D6344EC15674C091AD11037AF7857E8E51E6A7
File Size: 6.64 MB, 6635520 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have relocations information
  • File doesn't have security information
  • File has exports table
  • File has TLS information
  • File is 32-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show More
  • File is Native application (NOT .NET application)
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

Windows PE Version Information

Name Value
Build Date 21 December 2012 10:05:40
Comments
  • August 1, 2007
  • New World Computing®
  • Thank you for using RAD Game Tools!
Company Website http://www.labcenter.com
Company Name
  • CONTPAQ i©
  • Labcenter Electronics Ltd.
  • Microsoft Corporation
  • RAD Game Tools, Inc.
  • Silky's PLUS
  • Softnyx
  • The 3DO Company
  • WillPlus
  • 株式会社ウィルプラス
File Description
  • ADVPlayerHD
  • ADVプレイヤHD
  • Age of Empires HD
  • Direct3D 9 Extensions
  • GunBound
  • Heroes of Might and Magic® III Map Editor
  • Proteus 8 Application Framework
  • RAD Video Tools
  • Servidor de Aplicaciones CONTPAQ i©
  • Visual Basic Virtual Machine
Show More
  • 流景之海的艾佩理雅
File Version
  • 18.5.1.1
  • 18.1.0.1
  • 18.0.0.1
  • 17.0.9.1
  • 9.29.952.3111
  • 8.0.15417
  • 6.00.9802
  • 3.50
  • 2.2a/1.992a
  • 1.9.9.3
Show More
  • 1.0.3.0
  • 0, 0, 2, 40
Internal Name
  • AdvHD
  • apeiria.exe
  • CONTPAQ_I_SERVIDOR
  • D3DX9D.dll
  • Empires
  • GunBound
  • Heroes III Map Editor
  • MSVBVM60.DLL
Legal Copyright
  • Copyright (C) 1994-2013, RAD Game Tools, Inc.
  • Copyright (C) 2012-2021 WillPlus ltd.
  • Copyright (C) 2017 Silky's PLUS
  • Copyright © 1987-2000 Microsoft Corp.
  • Copyright © 2009 CONTPAQ i
  • Copyright © Microsoft Corp. 1994-2007
  • Copyright © Microsoft Corp. 1997-1998
  • Copyright ⓒ Softnyx, 2002
  • © 2000 The 3DO Company. All Rights Reserved.
  • © Labcenter Electronics 1990 - 2012
Legal Trademarks
  • 3DO, Heroes, Heroes of Might and Magic, New World Computing, The Shadow of Death, and their respective logos are trademarks and/or service marks of The 3DO Company in the U.S. and other countries. All other trademarks belong to their respective owners.
  • Bink and Smacker are trademarks of RAD Game Tools, Inc.
  • Microsoft® is a registered trademark of Microsoft Corporation. Windows(TM) is a trademark of Microsoft Corporation
Original Filename
  • AdvHD.exe
  • apeiria.exe
  • CONTPAQ_I_SERVIDOR.exe
  • D3DX9D.dll
  • empiresx.exe
  • GunBound.gme
  • H3WMAPED.EXE
Product Name
  • ADVPlayerHD
  • ADVプレイヤHD
  • Age of Empires: The Rise of Rome
  • Bink and Smacker
  • Heroes of Might and Magic® III Map Editor
  • Microsoft® DirectX for Windows®
  • Proteus 8
  • Servidor CONTPAQ i©
  • Softnyx GunBound Project
  • Visual Basic
Show More
  • 流景之海的艾佩理雅
Product Version
  • 18.5.1.1
  • 18.1.0.1
  • 18.0.0.1
  • 17.0.9.1
  • 9.29.952.3111
  • 8.0
  • 6.00.9802
  • 3.50
  • 2.2a/1.992a
  • 1.9.9.3
Show More
  • 1.0.3.0
  • 1.0
  • 1, 0, 0, 1

File Traits

  • .adata
  • 2+ executable sections
  • dll
  • Enigma
  • HighEntropy
  • imgui
  • No Version Info
  • ntdll
  • themida
  • themida section variant
Show More
  • WriteProcessMemory
  • x86

Block Information

Total Blocks: 5,780
Potentially Malicious Blocks: 0
Whitelisted Blocks: 5,772
Unknown Blocks: 8

Visual Map

0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 1 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
... Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

  • Agent.FRC
  • ClipBanker.J
  • HeavensGate.A
  • Ramnit.HD
  • Rugmi.JF
Show More
  • Rugmi.KA
  • Trojan.Downloader.Gen.IB
  • Trojan.Downloader.Gen.JR
  • Trojan.Downloader.Gen.ME

Windows API Usage

Category API
Syscall Use
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtAssociateWaitCompletionPacket
  • ntdll.dll!NtClose
  • ntdll.dll!NtCreateFile
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtGetCompleteWnfStateSubscription
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
Show More
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDebugFilterState
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationFile
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWaitForWorkViaWorkerFactory
  • ntdll.dll!NtWorkerFactoryWorkerReady
  • ntdll.dll!NtWriteFile
  • ntdll.dll!NtWriteVirtualMemory
  • win32u.dll!NtUserGetKeyboardLayout
  • win32u.dll!NtUserGetThreadState
Process Shell Execute
  • CreateProcess
Anti Debug
  • NtQuerySystemInformation
Process Manipulation Evasion
  • NtUnmapViewOfSection

Shell Command Execution

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\705aa309dd46d62fe99d0cc5c3e7b822a49198db_0006635520.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\fb933dfa95d614707c94669de7e560edbbc8e862_0000888988.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\4aa577f81bbd0ae82c68d47f2a31c9bff9804282_0000344064.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\fb3e4c0ccde3ecda992ce367460ca3f5ccf4d319_0001998168.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\738a46fe1ad5a3a684ee5d204d8061451a5dc7ef_0006635520.,LiQMAxHB
Show More
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\0a57f7d835707560f1c66bdb9559d3d486c443b0_0006635520.,LiQMAxHB

Related Posts

Trending

Most Viewed

Loading...