Analysis
-
max time kernel
589s -
max time network
574s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
01-04-2023 20:08
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://getintopc.com/softwares/3d-modelling/sketchup-pro-2018-final-x64-plugins-pack-download-1254755/
Resource
win10v2004-20230220-en
General
-
Target
https://getintopc.com/softwares/3d-modelling/sketchup-pro-2018-final-x64-plugins-pack-download-1254755/
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
setup.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation setup.exe -
Executes dropped EXE 10 IoCs
Processes:
SketchUp.exeSketchUpPro-en.exepresetup.exesetup.exevcredist_x64.exevcredist_x64.exeMSI6877.tmpMSI6897.tmpMSI68A8.tmpSketchUp.exepid process 2776 SketchUp.exe 4760 SketchUpPro-en.exe 4168 presetup.exe 3964 setup.exe 5064 vcredist_x64.exe 2024 vcredist_x64.exe 1980 MSI6877.tmp 4304 MSI6897.tmp 2560 MSI68A8.tmp 3812 SketchUp.exe -
Loads dropped DLL 17 IoCs
Processes:
vcredist_x64.exeMsiExec.exeSketchUp.exepid process 2024 vcredist_x64.exe 5032 MsiExec.exe 3812 SketchUp.exe 3812 SketchUp.exe 3812 SketchUp.exe 3812 SketchUp.exe 3812 SketchUp.exe 3812 SketchUp.exe 3812 SketchUp.exe 3812 SketchUp.exe 3812 SketchUp.exe 3812 SketchUp.exe 3812 SketchUp.exe 3812 SketchUp.exe 3812 SketchUp.exe 3812 SketchUp.exe 3812 SketchUp.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
Processes:
MsiExec.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2C64DE6-305A-4961-A385-E6328DB6D669}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2C64DE6-305A-4961-A385-E6328DB6D669}\InprocServer32\ = "C:\\Program Files\\SketchUp\\SketchUp 2018\\ThumbsUp.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2C64DE6-305A-4961-A385-E6328DB6D669}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
MSI6897.tmpMSI68A8.tmpMSI6877.tmpdescription ioc process File opened for modification \??\PhysicalDrive0 MSI6897.tmp File opened for modification \??\PhysicalDrive0 MSI68A8.tmp File opened for modification \??\PhysicalDrive0 MSI6877.tmp -
Drops file in Program Files directory 64 IoCs
Processes:
msiexec.exedescription ioc process File created C:\Program Files\SketchUp\SketchUp 2018\Tools\RubyStdLib\rubygems\version_option.rb msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Tools\RubyStdLib\fiddle\import.rb msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Tools\RubyStdLib\rake\invocation_exception_mixin.rb msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\ShippedExtensions\su_trimble_connect\tc_common\client\images\dlg_assign_user.svg msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Tools\RubyStdLib\webrick\httpservlet\cgi_runner.rb msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Tools\RubyStdLib\platform_specific\enc\iso_8859_8.so msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Images\dlg_eyedropper.svg msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Images\dlg_display_settings_backedges.svg msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Tools\RubyStdLib\platform_specific\enc\iso_8859_11.so msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Tools\RubyStdLib\platform_specific\enc\iso_8859_3.so msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\LayOut\Images\cursor_move_edge_diag_right.svg msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\ShippedExtensions\su_sandbox\images\cursor_drawfromscratch_1.png msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\ShippedExtensions\su_trimble_connect\tc_common\client\js\templates-ko.js msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\LayOut\Images\page_startpage.svg msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Tools\RubyStdLib\fiddle.rb msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\ShippedExtensions\su_advancedcameratools\images\lock_camera.pdf msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Exporters\RecomputeDimBlock_4.01_14.tx msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Resources\en-US\helpcontent\tool\21065\index.html msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Layout\Infragistics4.Win.UltraWinToolbars.v14.2.dll msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Images\dlg_slideshow_play.svg msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\ShippedExtensions\su_sandbox\images\cursor_drape_1.svg msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Tools\RubyStdLib\json\add\regexp.rb msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\LayOut\BugSplatRc.dll msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\ShippedExtensions\su_dynamiccomponents\images\cursor_interact_tool_active.svg msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\ifcplugin\TKTopAlgo680.dll msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Resources\en-US\welcomescreen\licenseinfo.html msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\ShippedExtensions\su_trimble_connect\tc_common\client\images\dlg_chevron.svg msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Tools\RubyStdLib\rubygems\core_ext\kernel_gem.rb msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Tools\RubyStdLib\platform_specific\stringio.so msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Images\cursor_orbit3d.svg msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\LayOut\Images\dimension_textabove.svg msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\ShippedExtensions\su_dynamiccomponents\js\manager.js msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Dialogs\ExtensionManager\fonts\bootstrap\glyphicons-halflings-regular.woff msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\LayOut\cef\locales\nl.pak msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Images\tb_axes.svg msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\ShippedExtensions\su_dynamiccomponents\images\manager_tool_small.png msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\ShippedExtensions\su_advancedcameratools\images\frustum_volume_small.png msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Tools\RubyStdLib\psych\nodes\scalar.rb msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Tools\RubyStdLib\platform_specific\enc\utf_16le.so msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Style Builder\cef\locales\et.pak msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\LayOut\Images\cursor_lozenge.svg msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\icudtl.dat msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Tools\RubyStdLib\rubygems\exceptions.rb msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\LayOut\Images\cursor_openhand.svg msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Tools\RubyStdLib\platform_specific\json\ext\parser.so msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Images\dlg_style_face_monochrome.svg msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\LayOut\Images\tb_lefttoright.svg msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Tools\RubyStdLib\platform_specific\enc\koi8_u.so msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Resources\en-US\helpcontent\tool\10525\index.html msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\cef\locales\es.pak msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Images\cursor_PointHand.svg msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\ShippedExtensions\su_dynamiccomponents\images\attribute-table.gif msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Tools\RubyStdLib\rinda\ring.rb msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Resources\en-US\helpcontent\tool\24223\images\animation-rotated-rectangle.gif msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Images\login_active.svg msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Images\cursor_classifiable_remove.svg msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Resources\en-US\dae_importer.strings msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Resources\en-US\Material.strings msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\ShippedExtensions\su_dynamiccomponents\images\manager_tool.pdf msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Tools\RubyStdLib\rss\maker\base.rb msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Images\tb_ewh.svg msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\Tools\RubyStdLib\rubygems\request_set.rb msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\ShippedExtensions\su_sandbox\stamptool.rbe msiexec.exe File created C:\Program Files\SketchUp\SketchUp 2018\LayOut\Images\cursor_table.svg msiexec.exe -
Drops file in Windows directory 19 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI8CCB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI68A8.tmp msiexec.exe File created C:\Windows\Installer\{C702DD60-EBF4-4961-8B7D-F209B361F985}\SketchUpIcon.1BDFFE07_27F3_4443_B5F0_CC6BDC32DE29 msiexec.exe File created C:\Windows\Installer\e5b7c31.msi msiexec.exe File created C:\Windows\Installer\SourceHash{C702DD60-EBF4-4961-8B7D-F209B361F985} msiexec.exe File created C:\Windows\Installer\{C702DD60-EBF4-4961-8B7D-F209B361F985}\SketchUpARPIcon msiexec.exe File opened for modification C:\Windows\Installer\{C702DD60-EBF4-4961-8B7D-F209B361F985}\SketchUpARPIcon msiexec.exe File opened for modification C:\Windows\Installer\{C702DD60-EBF4-4961-8B7D-F209B361F985}\LayOutIcon.A6F03ABD_736E_41BE_83EC_7E5F0B548850 msiexec.exe File created C:\Windows\Installer\e5b7c33.msi msiexec.exe File opened for modification C:\Windows\Installer\e5b7c31.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI6877.tmp msiexec.exe File created C:\Windows\Installer\{C702DD60-EBF4-4961-8B7D-F209B361F985}\LayOutIcon.A6F03ABD_736E_41BE_83EC_7E5F0B548850 msiexec.exe File created C:\Windows\Installer\{C702DD60-EBF4-4961-8B7D-F209B361F985}\StyleBuilderIcon.E8C4E687_29CB_4B1E_8F01_A7DC60A00AB8 msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\{C702DD60-EBF4-4961-8B7D-F209B361F985}\SketchUpIcon.1BDFFE07_27F3_4443_B5F0_CC6BDC32DE29 msiexec.exe File opened for modification C:\Windows\Installer\{C702DD60-EBF4-4961-8B7D-F209B361F985}\StyleBuilderIcon.E8C4E687_29CB_4B1E_8F01_A7DC60A00AB8 msiexec.exe File opened for modification C:\Windows\Installer\MSI6897.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vssvc.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a577c74c521b2f150000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a577c74c0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900a577c74c000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a577c74c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a577c74c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\sketchup.exe = "11000" msiexec.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\sketchup.exe = "11000" msiexec.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
chrome.exemsiexec.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133248605492655526" chrome.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f msiexec.exe -
Modifies registry class 64 IoCs
Processes:
msiexec.exeMsiExec.exeMSI6897.tmpdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SketchUp_SKM\ = "SketchUp Materials" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SketchUp.exe\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.layout\shell\open.LayOut 2018\command\ = "\"C:\\Program Files\\SketchUp\\SketchUp 2018\\LayOut\\LayOut.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\06DD207C4FBE1694B8D72F903B169F58\StyleBuilderModule msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\SketchUp.Document\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.skm\ = "SketchUp_SKM" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\06DD207C4FBE1694B8D72F903B169F58\LicenseFile msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\06DD207C4FBE1694B8D72F903B169F58\ProductIcon = "C:\\Windows\\Installer\\{C702DD60-EBF4-4961-8B7D-F209B361F985}\\SketchUpARPIcon" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.style\ = "style.Document" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\style.Document\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rbz\Content Type = "application/rbz" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SketchUp.Document\shellex\{e357fccd-a995-4576-b01f-234630154e96}\ = "{D2C64DE6-305A-4961-A385-E6328DB6D669}" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\layout.Document\shellex\{e357fccd-a995-4576-b01f-234630154e96} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SketchUp_RBZ\DefaultIcon\ = "\"C:\\ruby_doc.ico\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\style.Document\shellex\{e357fccd-a995-4576-b01f-234630154e96}\ = "{D2C64DE6-305A-4961-A385-E6328DB6D669}" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\06DD207C4FBE1694B8D72F903B169F58 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\LayOut.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2C64DE6-305A-4961-A385-E6328DB6D669}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F13DE656-63DD-4B0C-96D6-2B4D3623C076} MSI6897.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.skp\shell\open.SketchUp 2018\ = "Open with SketchUp 2018" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\layout.Document MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID MSI6897.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SketchUp.Document\shell\open\command\ = "\"C:\\Program Files\\SketchUp\\SketchUp 2018\\SketchUp.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\layout.Document\shellex MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\06DD207C4FBE1694B8D72F903B169F58\MetaSupport msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\06DD207C4FBE1694B8D72F903B169F58\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.skp\ = "SketchUp.Document" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\layout.Document\ = "LayOut Document" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\layout.Document\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SketchUp_SKM\DefaultIcon\ = "\"C:\\material_doc.ico\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.style\shell\open.Style Builder 2018\ = "Open with Style Builder 2018" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SketchUp_SKM\shellex\{e357fccd-a995-4576-b01f-234630154e96}\ = "{D2C64DE6-305A-4961-A385-E6328DB6D669}" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\06DD207C4FBE1694B8D72F903B169F58\SourceList\PackageName = "SketchUp2018-x64.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SketchUp_SKM\shellex MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.layout\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\Style Builder.exe\shell\open msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.style\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2C64DE6-305A-4961-A385-E6328DB6D669} MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2C64DE6-305A-4961-A385-E6328DB6D669}\ = "SketchUp Thumbnail Provider Class" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SketchUp.Document\shellex MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.skb\shellex\{e357fccd-a995-4576-b01f-234630154e96}\ = "{D2C64DE6-305A-4961-A385-E6328DB6D669}" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\06DD207C4FBE1694B8D72F903B169F58\ACTModule msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.style msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SketchUp.exe msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\LayOut.exe\shell\open\FriendlyAppName = "LayOut 2018" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\06DD207C4FBE1694B8D72F903B169F58\PackageCode = "40A96B90EC3E1024C94540F8AC3DED1C" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SketchUp.exe\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SketchUp.Document\ = "SketchUp Model" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.skm msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.skp\shell\open.SketchUp 2018\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\layout.Document\shellex\{e357fccd-a995-4576-b01f-234630154e96}\ = "{D2C64DE6-305A-4961-A385-E6328DB6D669}" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SketchUp_SKM MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\style.Document MsiExec.exe Key created \REGISTRY\MACHINE\Software\Classes\style.Document\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\SketchUp_RBZ msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D2C64DE6-305A-4961-A385-E6328DB6D669}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.skb\shellex\{e357fccd-a995-4576-b01f-234630154e96} MsiExec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\06DD207C4FBE1694B8D72F903B169F58\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F13DE656-63DD-4B0C-96D6-2B4D3623C076}\Version = "d09cba4d-276d-4ddc-aa89-e40d45346fad" MSI6897.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SketchUp.Document msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\layout.Document\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.skb MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\06DD207C4FBE1694B8D72F903B169F58\SourceList\Media msiexec.exe -
NTFS ADS 1 IoCs
Processes:
MSI6897.tmpdescription ioc process File created C:\ProgramData\Reprise\:wupeogjxlctlfudivq`qsp`29hfm MSI6897.tmp -
Opens file in notepad (likely ransom note) 2 IoCs
Processes:
NOTEPAD.EXENOTEPAD.EXEpid process 4776 NOTEPAD.EXE 1908 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
chrome.exechrome.exemsiexec.exepid process 4508 chrome.exe 4508 chrome.exe 2068 chrome.exe 2068 chrome.exe 4116 msiexec.exe 4116 msiexec.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
Processes:
chrome.exepid process 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe Token: SeShutdownPrivilege 4508 chrome.exe Token: SeCreatePagefilePrivilege 4508 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
chrome.exepid process 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe -
Suspicious use of SendNotifyMessage 26 IoCs
Processes:
chrome.exepid process 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe 4508 chrome.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
Processes:
OpenWith.exeSketchUpPro-en.exepresetup.exesetup.exevcredist_x64.exevcredist_x64.exeOpenWith.exeSketchUp.exepid process 4720 OpenWith.exe 4760 SketchUpPro-en.exe 4168 presetup.exe 3964 setup.exe 5064 vcredist_x64.exe 2024 vcredist_x64.exe 772 OpenWith.exe 3812 SketchUp.exe 3812 SketchUp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 4508 wrote to memory of 1436 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 1436 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3880 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 2436 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 2436 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3496 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3496 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3496 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3496 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3496 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3496 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3496 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3496 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3496 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3496 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3496 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3496 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3496 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3496 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3496 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3496 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3496 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3496 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3496 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3496 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3496 4508 chrome.exe chrome.exe PID 4508 wrote to memory of 3496 4508 chrome.exe chrome.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://getintopc.com/softwares/3d-modelling/sketchup-pro-2018-final-x64-plugins-pack-download-1254755/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7fff30df9758,0x7fff30df9768,0x7fff30df97782⤵PID:1436
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1824 --field-trial-handle=1840,i,3129391021807879593,14182496829785168361,131072 /prefetch:22⤵PID:3880
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1840,i,3129391021807879593,14182496829785168361,131072 /prefetch:82⤵PID:2436
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2160 --field-trial-handle=1840,i,3129391021807879593,14182496829785168361,131072 /prefetch:82⤵PID:3496
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3188 --field-trial-handle=1840,i,3129391021807879593,14182496829785168361,131072 /prefetch:12⤵PID:2104
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3196 --field-trial-handle=1840,i,3129391021807879593,14182496829785168361,131072 /prefetch:12⤵PID:3084
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4568 --field-trial-handle=1840,i,3129391021807879593,14182496829785168361,131072 /prefetch:12⤵PID:5080
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5000 --field-trial-handle=1840,i,3129391021807879593,14182496829785168361,131072 /prefetch:12⤵PID:3988
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4968 --field-trial-handle=1840,i,3129391021807879593,14182496829785168361,131072 /prefetch:12⤵PID:3792
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4900 --field-trial-handle=1840,i,3129391021807879593,14182496829785168361,131072 /prefetch:12⤵PID:4380
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5472 --field-trial-handle=1840,i,3129391021807879593,14182496829785168361,131072 /prefetch:12⤵PID:1124
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5636 --field-trial-handle=1840,i,3129391021807879593,14182496829785168361,131072 /prefetch:12⤵PID:640
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5244 --field-trial-handle=1840,i,3129391021807879593,14182496829785168361,131072 /prefetch:82⤵PID:3828
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6280 --field-trial-handle=1840,i,3129391021807879593,14182496829785168361,131072 /prefetch:82⤵PID:3268
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 --field-trial-handle=1840,i,3129391021807879593,14182496829785168361,131072 /prefetch:82⤵PID:4260
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=6340 --field-trial-handle=1840,i,3129391021807879593,14182496829785168361,131072 /prefetch:12⤵PID:1688
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5724 --field-trial-handle=1840,i,3129391021807879593,14182496829785168361,131072 /prefetch:12⤵PID:464
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=6488 --field-trial-handle=1840,i,3129391021807879593,14182496829785168361,131072 /prefetch:12⤵PID:4668
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6616 --field-trial-handle=1840,i,3129391021807879593,14182496829785168361,131072 /prefetch:82⤵PID:1496
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6740 --field-trial-handle=1840,i,3129391021807879593,14182496829785168361,131072 /prefetch:82⤵PID:2572
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=212 --field-trial-handle=1840,i,3129391021807879593,14182496829785168361,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2068 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 --field-trial-handle=1840,i,3129391021807879593,14182496829785168361,131072 /prefetch:82⤵PID:1584
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1768 --field-trial-handle=1840,i,3129391021807879593,14182496829785168361,131072 /prefetch:82⤵PID:3084
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1536 --field-trial-handle=1840,i,3129391021807879593,14182496829785168361,131072 /prefetch:82⤵PID:4780
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:732
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3300
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\_Getintopc.com_SketchUp_Pro_2018_v18.0.16975x64\" -spe -an -ai#7zMap26166:156:7zEvent23601⤵PID:1632
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:4720
-
C:\Users\Admin\Downloads\_Getintopc.com_SketchUp_Pro_2018_v18.0.16975x64\SketchUp_Pro_2018_v18.0.16975x64\SketchUp_Pro_2018_v18.0.16975x64\Cracked 2018.0\SketchUp.exe"C:\Users\Admin\Downloads\_Getintopc.com_SketchUp_Pro_2018_v18.0.16975x64\SketchUp_Pro_2018_v18.0.16975x64\SketchUp_Pro_2018_v18.0.16975x64\Cracked 2018.0\SketchUp.exe"1⤵
- Executes dropped EXE
PID:2776
-
C:\Users\Admin\Downloads\_Getintopc.com_SketchUp_Pro_2018_v18.0.16975x64\SketchUp_Pro_2018_v18.0.16975x64\SketchUp_Pro_2018_v18.0.16975x64\SketchUpPro-en.exe"C:\Users\Admin\Downloads\_Getintopc.com_SketchUp_Pro_2018_v18.0.16975x64\SketchUp_Pro_2018_v18.0.16975x64\SketchUp_Pro_2018_v18.0.16975x64\SketchUpPro-en.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\7zSF534.tmp\presetup.exe.\presetup.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\sketchup_install\setup.exeC:\Users\Admin\AppData\Local\Temp\7zSF534.tmp\..\sketchup_install\setup.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\VSD77D1.tmp\vcredist_x64\vcredist_x64.exe"C:\Users\Admin\AppData\Local\Temp\VSD77D1.tmp\vcredist_x64\vcredist_x64.exe" /quiet /q:a /norestart4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\VSD77D1.tmp\vcredist_x64\vcredist_x64.exe"C:\Users\Admin\AppData\Local\Temp\VSD77D1.tmp\vcredist_x64\vcredist_x64.exe" /quiet /q:a /norestart -burn.unelevated BurnPipe.{F273C6DB-27D4-4DFD-81D4-8092E35A13D9} {8B06797E-89BD-4222-B869-7E470C3DF35F} 50645⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2024 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe" -I "C:\Users\Admin\AppData\Local\Temp\sketchup_install\SketchUp2018-x64.msi"4⤵
- Enumerates connected drives
PID:4368
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4116 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4304
-
C:\Windows\Installer\MSI6877.tmp"C:\Windows\Installer\MSI6877.tmp"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:1980 -
C:\Windows\Installer\MSI68A8.tmp"C:\Windows\Installer\MSI68A8.tmp"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:2560 -
C:\Windows\Installer\MSI6897.tmp"C:\Windows\Installer\MSI6897.tmp"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- NTFS ADS
PID:4304 -
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\SketchUp\SketchUp 2018\ThumbsUp.dll"2⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:5032
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4856
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\_Getintopc.com_SketchUp_Pro_2018_v18.0.16975x64\SketchUp_Pro_2018_v18.0.16975x64\SketchUp_Pro_2018_v18.0.16975x64\Cracked 2018.0\Лечение.txt1⤵
- Opens file in notepad (likely ransom note)
PID:4776
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:772
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\_Getintopc.com_SketchUp_Pro_2018_v18.0.16975x64\SketchUp_Pro_2018_v18.0.16975x64\SketchUp_Pro_2018_v18.0.16975x64\Cracked 2018.0\Лечение.txt1⤵
- Opens file in notepad (likely ransom note)
PID:1908
-
C:\Program Files\SketchUp\SketchUp 2018\SketchUp.exe"C:\Program Files\SketchUp\SketchUp 2018\SketchUp.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3812
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Config.Msi\e5b7c32.rbsFilesize
843KB
MD50f3356b378380ffef94917dde51ed5be
SHA13766cfee2844aaff1eb1f8b5a69370261c030738
SHA2564422fde01f1cb58a0828ceea0482f7984520a85e2a1bed55b9687d407599c97f
SHA5126d9a32de654270cadf5ccf414efa28e18433d0f805355323d65dcc13f34b94796fd1ff214553a9c85fb22f1b37e8bd65783c47b8a35afbfddff133b2cc4b92dc
-
C:\Program Files\SketchUp\SketchUp 2018\BugSplat64.dllFilesize
362KB
MD52b6397f2b3ba7b7612478d838fc1fa4b
SHA1d92f6ca56363af7424ba0fb74fc20a9845c8ad66
SHA25657166b9fcd88f53121fc34f7e39f21e8b0c5422921ea524b94bffdbf2681877a
SHA512f8ca0312995ee07372ea5afaeeedf35868c4c862338da295a539e60994fd9dda8722dddc42c2f0c078ead1371ee31a8e8191144774cf944060131cd427af42fd
-
C:\Program Files\SketchUp\SketchUp 2018\BugSplat64.dllFilesize
362KB
MD52b6397f2b3ba7b7612478d838fc1fa4b
SHA1d92f6ca56363af7424ba0fb74fc20a9845c8ad66
SHA25657166b9fcd88f53121fc34f7e39f21e8b0c5422921ea524b94bffdbf2681877a
SHA512f8ca0312995ee07372ea5afaeeedf35868c4c862338da295a539e60994fd9dda8722dddc42c2f0c078ead1371ee31a8e8191144774cf944060131cd427af42fd
-
C:\Program Files\SketchUp\SketchUp 2018\SketchUp.exeFilesize
34.4MB
MD536964dc06b441305e2c55eb9f330a566
SHA1a19259751ed0dbafdbe43a2f075d6da460c13705
SHA256f2ba91d3d3ef27a8042271b70e3fc5c718587a1dec8f235b9762301732c65a12
SHA512690572674279a65023cf0f650fc1c1ef2b85bc647064d28b37c1ab75c2f562fd8b14c91319d98e9036bc77f522635b55641bbe9eb4f517e3629d4e7e2e657056
-
C:\Program Files\SketchUp\SketchUp 2018\SketchUp.exeFilesize
34.4MB
MD536964dc06b441305e2c55eb9f330a566
SHA1a19259751ed0dbafdbe43a2f075d6da460c13705
SHA256f2ba91d3d3ef27a8042271b70e3fc5c718587a1dec8f235b9762301732c65a12
SHA512690572674279a65023cf0f650fc1c1ef2b85bc647064d28b37c1ab75c2f562fd8b14c91319d98e9036bc77f522635b55641bbe9eb4f517e3629d4e7e2e657056
-
C:\Program Files\SketchUp\SketchUp 2018\SketchUpCommonPreferences.dllFilesize
432KB
MD57c177c0196cadbfaf68e8c6118dca93f
SHA1e78ddf63ad4d208579d681ed1a6e95d5ed7a8697
SHA2567d0d9632321484651edd4b5026901d7965402f1215f068536abda5a4a23ad2e0
SHA51279930637672ab10704973495f3019cc74ff4a004d4e6237b4317e860e1ff0e906ed663cc858325dd34a9cbe17b180a111d893c6d9b49beb3437f916f2e377ac0
-
C:\Program Files\SketchUp\SketchUp 2018\Style Builder\icudtl.datFilesize
9.7MB
MD51b0ec60f1caf5ecc5e2a16c83ba0fcb8
SHA11b8b6c882ce33a1911581ef2108e42b66abb57b1
SHA2566747c6682cb478bb187c6ef856e0e79bcdc746c9c3d865aafd6182e62ca3f2ce
SHA5129319782859c5edb791b86d6b3447650564ce9295f69a41dd87c4f327f2c9fb0e06af6e10d31168078093a9f9f264d9bd15e67427be3257fd4ddb61594018f772
-
C:\Program Files\SketchUp\SketchUp 2018\ThumbsUp.dllFilesize
7.4MB
MD5dbb35f760579f640ea2826cbb10d27a6
SHA146d9e2f52e47a82d3ddf7075c6cf985c171f85ab
SHA256466e763e183c799ce71cb05e200590cbfa175c26310c32a662a30f071e4c3197
SHA5124c0ef9d81ec733cf7710d435c76581570fc7bd4add7fe4f65b302bd21e04179d795e1e7732666c0d92917e0719a41b27668ba9c3842ad16e1e41efddf4372c6d
-
C:\Program Files\SketchUp\SketchUp 2018\ThumbsUp.dllFilesize
7.4MB
MD5dbb35f760579f640ea2826cbb10d27a6
SHA146d9e2f52e47a82d3ddf7075c6cf985c171f85ab
SHA256466e763e183c799ce71cb05e200590cbfa175c26310c32a662a30f071e4c3197
SHA5124c0ef9d81ec733cf7710d435c76581570fc7bd4add7fe4f65b302bd21e04179d795e1e7732666c0d92917e0719a41b27668ba9c3842ad16e1e41efddf4372c6d
-
C:\Program Files\SketchUp\SketchUp 2018\common_application.dllFilesize
40KB
MD5c547a929366db754333ca67816d82b18
SHA1c8d606f5cf6bb946f2317f63755c86d5cb704577
SHA256513504bed2a2bc33b0d6a7d3db9de42e08afa9b10b695789be1b3e0464d99c19
SHA5128d55883ba8c9df38473abbc68de4c4ffd15f24ca347ef6cd0f51950def2072c984c3b56357a70259aea0984643dc3289f7176755897b646e712f98557e537b9e
-
C:\Program Files\SketchUp\SketchUp 2018\common_application.dllFilesize
40KB
MD5c547a929366db754333ca67816d82b18
SHA1c8d606f5cf6bb946f2317f63755c86d5cb704577
SHA256513504bed2a2bc33b0d6a7d3db9de42e08afa9b10b695789be1b3e0464d99c19
SHA5128d55883ba8c9df38473abbc68de4c4ffd15f24ca347ef6cd0f51950def2072c984c3b56357a70259aea0984643dc3289f7176755897b646e712f98557e537b9e
-
C:\ProgramData\Reprise\wupeogjxlctlfudivq`qsp`29hfmFilesize
168B
MD51b90eb8dbe2cea52c67a5905b240f4ae
SHA189e59a9711cb799b0957182e6bc5c965b45c0d68
SHA2564d68aeacdea4343a4777ca04fd6f88505827e77187c7246f5fb453d49f679ff3
SHA512b7f5bcb71d893bfde72522e276b459e7be10e23b21c4a0e629b6c22aa266fe246f44a13ac452f6995bdb15843747e4a31542a50613da0a65a02c764044d32dd4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
1KB
MD5e553423ddd6ab668cd65310b9119d2bb
SHA12885e33b7bd943248bbdea5052643ca6522908d0
SHA256cf87aa1feea21c2a116454f506cc6def1df2503e3bc81bc461cf5d0b6a81c9ef
SHA5120dad3fac8b8fcda296484fa907f8af8ec1d8ea0fc0c3fa5942524ec5e8e167b7165123a236d4866a249a5d9f6b2ac8996d9b5eee56e33121d89d0113e5d22438
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
7KB
MD5b61da12d40100e28cbdccef721b7f6ad
SHA1477ee962759a626f83a1725f6ec48c06c25f6034
SHA256c4ac97efd89ae14e0164aa7af97ab25b0c9ac8ea5d87f0c112a04e9c6d82c068
SHA5129f1a3815f82348af7f03a3c428e56721653c9c67ffc887ae123663ac731036fd9216f77023286fe6ca38a2f00561aed9898cc3d663ee72f92efefc606d7aaf08
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
6KB
MD5f4c2cb49db81577d933818c44ac8db65
SHA1fdcfffcd2144a8e5b8bedb1b2b602528786809d7
SHA25670323194addcbd3c45896d7f905b7645819f675d1d4be581e891cc5316b26500
SHA512f2388eadcd2acea144d0e8b7dbd236651800f2fd71138d9706f9f6f375ef750bff242f4fb9db4b9807eef9b69fb1e605e668049b732a01224520318ac1eda18a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD5137669334a9287d94903b56a8d8b1290
SHA1e4a918815dfc1ef123dd8cc235e76bdb88e7082d
SHA256f915c5c29c6e5b1017185379007ec7c6ff0a641df89531d1733e6d85e6bc16f9
SHA512e3a2ccf0c8493247419bfdebfeaf33fbc2f8dea783ae9c60bc09b027e9761ffe3cdab4ee30b6f8931951c690baa5085ab98aaf5a36cfd8b589b68369f81aa8cf
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
2KB
MD5340a626069d58867696e7930a0bdd948
SHA1007d0ad0a449d3ff65e99599ca51ac7fcb11bf2f
SHA256a14f946fd6ee0d05cc290a59a5c4801e39d52d243146c12625fd0f7033bcc826
SHA5124ede3898393d697f4e0feff626b405c25e9d89f8b37137a782f4375285e0713ed40200b826bc2d6778a1d42ba6863d7501cdadaae3fe253ff23b75a9c4c46695
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
2KB
MD50cdf2dd6bceb823974178c7b5f69957c
SHA176ab85fca210d6ce4b500cdcbca335df67e23f09
SHA256ab50986123bb690912b3ad07a6658599e4dbd141a7a774d288f6fd9f1b084ad8
SHA512f1be4c6cfc6705b5d4b64a89900dfa4b8d251e0a22ad48beabd06436880cf5ad4d42fd07728274fc7e2aefdd1ea3dc0ac4ab18221c6683179a0f910b4dec7ab4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD57642cbacd3e55376b80d85a4ac792696
SHA108f6abea4acffeb3f9e19630eb99a53a4325dbb2
SHA25629d8a3011cf5e8d4a98aaf3d8857a44b49e008756cea30e2748202439fbfc3ba
SHA51233064a613281fba132802aa5757e11c5df17f344209094204deea098352216a0c6dea36f1f163cc3c5bf16853406ac020d2aa65bfd3bcafa11bf2eb2d6ee4118
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5bcd984c0e086e73198eb0ee7b8963b05
SHA16d8dc1d229692cb570ca3209c92add6b2fb9550f
SHA2562bdd930e09712ac945ded0feb254e46d66a9b9c373705bb2713f711bc67b0e42
SHA5128c73bf926018a300fadbe02591a1124266f224ea11ea60f00087b8d689870766958a6e893d1621236c7274c76d55d19132140f1d8abd7f2689922b93ccc639f2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD542a2ad7e5f291336de2fa5957f4e2f72
SHA163678273f4d410799950afe6c20a40ab310c468c
SHA256955fc0f0d69cc7102ece992cc303bf434c76f699ca0d7d1e875247e4e3ae4d6a
SHA5129a3d643073681da69e75a5c443be2ab424a736c486698d164699c43fc293f75da361d595a57e102f09a675023b4218f8004a40fe55455962d7fa2ab606f3d89f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD56dae2593a0eb81ab0e574e9c99195901
SHA165cf50010092dd45e4cd4563357b37b82721bb60
SHA256cd9be48f8060a39f109a7e35b23852ac62de15c7d8e8e1d3e70c1de82d017975
SHA512bbe356b0a2612de33d9d8a0474abd7ecfd3bccd46da6c05202dec44c4a7c6fe00bb30744f7c7ad073d0a6995259dcc87db02b3d5521db3b9afcef91260ec0974
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
15KB
MD5437a966fab5fdb952a600d8fd9029216
SHA181da9dc434e5d44a51d8bca441558811e9aa512c
SHA25619380e31fbce24947b5f65dffbdfc47683ba5eb5e5251e2fc1f8578abe4ad818
SHA512036f116d43106fae6dd061310e1b0d106ad66f373810ea6e0c87d033f1dec12b3875d9a966420636925d850cd5910a2fa9a6a41dc20da76092303f13d743044b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
173KB
MD57d6faa1d5f72344b12c5ee46ee68521d
SHA1a0e718ecc086305b63a35e9b8c4e83f89bc1da05
SHA256efa8785e94c0827502654ee19ad9ef3b099db1df5bf880cc5edd8306434c4264
SHA5126306fabc705d91fc132785b63363a673b13d4dabf584c7966123c30a6fb36b14bb19578993bfdd9fcccf4d33ca8b937a345e066341a85a10dbdb3bd8c5537d84
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
173KB
MD5e69f74a757f28759ce2bf1044a222b71
SHA1ac0054aa388e6e7aa455d7ad67e0e6b7d6348698
SHA256c574321f0576ff754b7ec8f5b4061568f5f4f4c8946e65590e52e667bb7c8d58
SHA51280cfd8f7a309ab749d2ed5b104f44e6441edd1cdbc56124d57ddbb4997c9d511257b83a1f20b26c86f26ce6227b020e495c50bddfbfe69bd794e1b243ae39746
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
173KB
MD510e0d64ec1bce9d3ec54936d3edbe4b2
SHA17e40b9bcf2b8d32b769d525470d04faf0a00e10e
SHA2568fbc11a5bec1c0d7b8d5beacbfd89f96fc0e1735b1d56b5737964e8ffaab57f0
SHA51248c0e4bd3175fdaf089e67d5a674de274908ad4622a7b6634869eb00e944f02881a1c37e2ea938284507bada4e1c724b0c4d1c46e6b74797ed61ce871fd86c26
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info CacheFilesize
113KB
MD581d632c57b3001b4e7010412f579e844
SHA1069d6cb3a741ba75786db7142382fec75b68d945
SHA2569c796f026ffed05844a4ebd225ce6cf3219fa12a655cc4d644891501a102e5d9
SHA512e9f59a42d9b04014c1a029924979450fb619a2c8f78dd1c938792f3b458c94149c65ff0aabbc6e0e52c745f2111dc18980e3bc2d41d7ca6d0c0122a81d3c4969
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info CacheFilesize
112KB
MD54d410b2f0b87283170f17a769b74612d
SHA14b8309dc60c1071d799604baeac60e5f58a864c0
SHA2566d17884feb37a2542aaedab07412f3123823abc60a6acf4aa4966ed5b3fe2e45
SHA5128e1b4d5ffb261666dfa90a59a7c52b8c33a3a5e88acdf54c975dcc20fe72dffece270d4d31d65404b70d544926b5197f95c1a864cea229442bffb1eb2da585e7
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info CacheFilesize
108KB
MD5e378e7f1bf45e90937fa7c44d229b7e5
SHA17a3b9faa766c8033836ecf1d8f6e2e1689c44698
SHA256ea3f912423513fcae95496d63c0ee8b939eebeec9e379038c0f3c40c7a4c316c
SHA5127f51c715be20ecd8ff5e5341ec516f2cc3f3db9fc4a8d181d007d29210367ecfd9ae5a51c346fd1a269766a134b868d6aefc899d198b150324f2a408e5be280f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe571fdc.TMPFilesize
103KB
MD5dabb8c5dc0ba55532379f048285867a0
SHA1bf68d7a56046425bc76dd8bbf8cca797a18f2dcd
SHA256729dd854e8e8e7d1ec6e927369d4e1b459fe269539d82eee9d953471e537a2e7
SHA5127cdd297c54d53d39caa40616a6f8d23c292db9a71f0498200849ca8af6a76ef9ecf5f5d05072c93ab8aa91cef65f9c4a5fe08cbd9f54ffa8e5c45c5a02d6872e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
C:\Users\Admin\AppData\Local\Temp\7zSF534.tmp\SketchUp2018-x64.msiFilesize
196.7MB
MD51a45dd1124d01f01c31746d983f4c8b9
SHA17ccc5cde8860082213a8fe9000cfba073eb007df
SHA256ffad902f1948f32f19189e59b33f8fc9516b73b5f1f4d8a96954f0519f00c275
SHA51256b36903f2ff083e04111edaf0e81fbcf37b917f73c2acbbd37010e3b3c34584a85b5ae33a3acc012c63e2c3d5c06148497abb31c8d15f79865a4ecd33d00da0
-
C:\Users\Admin\AppData\Local\Temp\7zSF534.tmp\SketchUpPrerequisites\InstallPrerequisites.exeFilesize
100KB
MD5ddcef619412a49ca748d3c2cf30f7287
SHA1c511ecf5f983e0a6153d379687dcc0d6e0dbc77f
SHA25643a028c7ae3cbbd3c41f36586477bcc44f1523d571810bf6da5340bf2ed26e71
SHA512cc40b1065a97a63163955986d5a883b9637b0e92ca394b0119d12f343621f3e3eb450e55f48eee585a9cffb8a25f64f80ca76c942b31ca67cd420550c77ed512
-
C:\Users\Admin\AppData\Local\Temp\7zSF534.tmp\SketchUpPrerequisites\Windows6.1-KB2999226-x64.msuFilesize
1010KB
MD5ad7f5c851f6387e424ab206effb21354
SHA154050a5f8ae7f0c56e553f0090146c17a1d2bf8d
SHA25643234d2986ca9b0de75d5183977964d161a8395c3396279ddfc9b20698e5bc34
SHA5123ab0a5eb48c7e5aec55640171acec4e3449dd5e5e90345a39c214be16858d5e66892b01fb4a792405c9fcef9a6286c85e5411c79d38d49930d9edfa40e535093
-
C:\Users\Admin\AppData\Local\Temp\7zSF534.tmp\SketchUpPrerequisites\Windows8-RT-KB2999226-x64.msuFilesize
1.3MB
MD5c511bb7f1b2c0e20860a7e653035a43c
SHA1b5943b2700b56f5f8dc307a9e237f23fca5d8b70
SHA25650cae25da33fa950222d1a803e42567291eb7feb087fa119b1c97fe9d41cd9f8
SHA512832188ee8a9f98ab349e0dc078a91f995774470bfb5b33fa2b782bd02a1cc14f91a7546f889192cf0b0270521c22791581b17ae973569c69b81a0ac481089ec6
-
C:\Users\Admin\AppData\Local\Temp\7zSF534.tmp\SketchUpPrerequisites\Windows8.1-KB2999226-x64.msuFilesize
981KB
MD5d0728878f9c6799046b43aeece4f3aca
SHA13acbf3890fc9c8a6f3d2155ecf106028e5f55164
SHA2569f707096c7d279ed4bc2a40ba695efac69c20406e0ca97e2b3e08443c6381d15
SHA512e5cecaca86779a281bf5c396d7fa3a5f322bc6423e2250d617a6fab229e86d2c9d3b784c1fa3fa2be5513fcd3ba87695b3934d13802ee15cabae62f84c2c3668
-
C:\Users\Admin\AppData\Local\Temp\7zSF534.tmp\presetup.exeFilesize
205KB
MD5300bda82d3e21000c9d9fdd884ce1527
SHA1b5cd6abd32a1fb6bd30346d950ba51c766cc7052
SHA256aa21f24d6f317222969007cd4ee2f509f3792e4bfb75070327531f3a8d426069
SHA51262e192293a8f75e01ece11342141a1ef44d5051121ae9bc5e4597e8b6badc895c3d4844e6b92625cc6d6b915025ec990ad4e348407faa17cbcf2958fbe938b7c
-
C:\Users\Admin\AppData\Local\Temp\7zSF534.tmp\presetup.exeFilesize
205KB
MD5300bda82d3e21000c9d9fdd884ce1527
SHA1b5cd6abd32a1fb6bd30346d950ba51c766cc7052
SHA256aa21f24d6f317222969007cd4ee2f509f3792e4bfb75070327531f3a8d426069
SHA51262e192293a8f75e01ece11342141a1ef44d5051121ae9bc5e4597e8b6badc895c3d4844e6b92625cc6d6b915025ec990ad4e348407faa17cbcf2958fbe938b7c
-
C:\Users\Admin\AppData\Local\Temp\7zSF534.tmp\setup.exeFilesize
703KB
MD573263776233b7ce4dbb4456fd4e49313
SHA128af1066e201948a7c4bffb59e0ee70aa41ff44a
SHA256414e68f7ae512aab8ee1617431a2289925b45fcec50472132025e8ed59dd6d7b
SHA51265e10976cff19b9ada5654821014a371d5aeb19f71acf8ddd275167259c84925c17780655c14dafded8bea88ae50cf268110d4f13ae520f9b9ccea27278c77d1
-
C:\Users\Admin\AppData\Local\Temp\7zSF534.tmp\vcredist_x64\vcredist_x64.exeFilesize
14.6MB
MD545b47f4214ddc9f4782363a38504c9d2
SHA110b1683ea3ff5f36f225769244bf7e7813d54ad0
SHA256da66717784c192f1004e856bbcf7b3e13b7bf3ea45932c48e4c9b9a50ca80965
SHA512c87955c5542e39fbb44c6edf9ea0c6671693e7cd93b2bbb3988bd51c4e0bfc4c46fbd968ba9bc6327b21f2e52dd1dfe8d0d077aa27a8619bcf61edc3f58b246a
-
C:\Users\Admin\AppData\Local\Temp\SketchUpLog-2023-04-01-22_18_03.logFilesize
2KB
MD57a87ca517f78455cfe7c4bd22d5c95a6
SHA143b0aadcfa8f7d2966d4da8a1dd4e0b7b1542293
SHA2565a11d895edf7f20beabbaee52ef13460eea8c6017af6c6c052a00b8f954cb28c
SHA512f87d56950a3e897fccdeb8ba544744ab5b4266a7b6decfa78df026b2d9ba25a7d742603b47699faf5c7c60997100970d2fb1ad19788fce3e9fabc833cae26df3
-
C:\Users\Admin\AppData\Local\Temp\VSD77D1.tmp\setup.exeFilesize
703KB
MD573263776233b7ce4dbb4456fd4e49313
SHA128af1066e201948a7c4bffb59e0ee70aa41ff44a
SHA256414e68f7ae512aab8ee1617431a2289925b45fcec50472132025e8ed59dd6d7b
SHA51265e10976cff19b9ada5654821014a371d5aeb19f71acf8ddd275167259c84925c17780655c14dafded8bea88ae50cf268110d4f13ae520f9b9ccea27278c77d1
-
C:\Users\Admin\AppData\Local\Temp\VSD77D1.tmp\vcredist_x64\vcredist_x64.exeFilesize
14.6MB
MD545b47f4214ddc9f4782363a38504c9d2
SHA110b1683ea3ff5f36f225769244bf7e7813d54ad0
SHA256da66717784c192f1004e856bbcf7b3e13b7bf3ea45932c48e4c9b9a50ca80965
SHA512c87955c5542e39fbb44c6edf9ea0c6671693e7cd93b2bbb3988bd51c4e0bfc4c46fbd968ba9bc6327b21f2e52dd1dfe8d0d077aa27a8619bcf61edc3f58b246a
-
C:\Users\Admin\AppData\Local\Temp\VSD77D1.tmp\vcredist_x64\vcredist_x64.exeFilesize
14.6MB
MD545b47f4214ddc9f4782363a38504c9d2
SHA110b1683ea3ff5f36f225769244bf7e7813d54ad0
SHA256da66717784c192f1004e856bbcf7b3e13b7bf3ea45932c48e4c9b9a50ca80965
SHA512c87955c5542e39fbb44c6edf9ea0c6671693e7cd93b2bbb3988bd51c4e0bfc4c46fbd968ba9bc6327b21f2e52dd1dfe8d0d077aa27a8619bcf61edc3f58b246a
-
C:\Users\Admin\AppData\Local\Temp\VSD77D1.tmp\vcredist_x64\vcredist_x64.exeFilesize
14.6MB
MD545b47f4214ddc9f4782363a38504c9d2
SHA110b1683ea3ff5f36f225769244bf7e7813d54ad0
SHA256da66717784c192f1004e856bbcf7b3e13b7bf3ea45932c48e4c9b9a50ca80965
SHA512c87955c5542e39fbb44c6edf9ea0c6671693e7cd93b2bbb3988bd51c4e0bfc4c46fbd968ba9bc6327b21f2e52dd1dfe8d0d077aa27a8619bcf61edc3f58b246a
-
C:\Users\Admin\AppData\Local\Temp\VSD77D1.tmp\vcredist_x64\vcredist_x64.exeFilesize
14.6MB
MD545b47f4214ddc9f4782363a38504c9d2
SHA110b1683ea3ff5f36f225769244bf7e7813d54ad0
SHA256da66717784c192f1004e856bbcf7b3e13b7bf3ea45932c48e4c9b9a50ca80965
SHA512c87955c5542e39fbb44c6edf9ea0c6671693e7cd93b2bbb3988bd51c4e0bfc4c46fbd968ba9bc6327b21f2e52dd1dfe8d0d077aa27a8619bcf61edc3f58b246a
-
C:\Users\Admin\AppData\Local\Temp\sketchup_install\SketchUp2018-x64.msiFilesize
196.7MB
MD51a45dd1124d01f01c31746d983f4c8b9
SHA17ccc5cde8860082213a8fe9000cfba073eb007df
SHA256ffad902f1948f32f19189e59b33f8fc9516b73b5f1f4d8a96954f0519f00c275
SHA51256b36903f2ff083e04111edaf0e81fbcf37b917f73c2acbbd37010e3b3c34584a85b5ae33a3acc012c63e2c3d5c06148497abb31c8d15f79865a4ecd33d00da0
-
C:\Users\Admin\AppData\Local\Temp\sketchup_install\setup.exeFilesize
703KB
MD573263776233b7ce4dbb4456fd4e49313
SHA128af1066e201948a7c4bffb59e0ee70aa41ff44a
SHA256414e68f7ae512aab8ee1617431a2289925b45fcec50472132025e8ed59dd6d7b
SHA51265e10976cff19b9ada5654821014a371d5aeb19f71acf8ddd275167259c84925c17780655c14dafded8bea88ae50cf268110d4f13ae520f9b9ccea27278c77d1
-
C:\Users\Admin\AppData\Local\Temp\sketchup_install\setup.exeFilesize
703KB
MD573263776233b7ce4dbb4456fd4e49313
SHA128af1066e201948a7c4bffb59e0ee70aa41ff44a
SHA256414e68f7ae512aab8ee1617431a2289925b45fcec50472132025e8ed59dd6d7b
SHA51265e10976cff19b9ada5654821014a371d5aeb19f71acf8ddd275167259c84925c17780655c14dafded8bea88ae50cf268110d4f13ae520f9b9ccea27278c77d1
-
C:\Users\Admin\AppData\Local\Temp\sketchup_install\vcredist_x64\vcredist_x64.exeFilesize
14.6MB
MD545b47f4214ddc9f4782363a38504c9d2
SHA110b1683ea3ff5f36f225769244bf7e7813d54ad0
SHA256da66717784c192f1004e856bbcf7b3e13b7bf3ea45932c48e4c9b9a50ca80965
SHA512c87955c5542e39fbb44c6edf9ea0c6671693e7cd93b2bbb3988bd51c4e0bfc4c46fbd968ba9bc6327b21f2e52dd1dfe8d0d077aa27a8619bcf61edc3f58b246a
-
C:\Users\Admin\AppData\Local\Temp\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\.ba1\logo.pngFilesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
C:\Users\Admin\AppData\Local\Temp\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\.ba1\wixstdba.dllFilesize
118KB
MD54d20a950a3571d11236482754b4a8e76
SHA1e68bd784ac143e206d52ecaf54a7e3b8d4d75c9c
SHA256a9295ad4e909f979e2b6cb2b2495c3d35c8517e689cd64a918c690e17b49078b
SHA5128b9243d1f9edbcbd6bdaf6874dc69c806bb29e909bd733781fde8ac80ca3fff574d786ca903871d1e856e73fd58403bebb58c9f23083ea7cd749ba3e890af3d2
-
C:\Users\Admin\Downloads\_Getintopc.com_SketchUp_Pro_2018_v18.0.16975x64.rarFilesize
286.8MB
MD5ebd443fa9510daab1c5f09508bedeac8
SHA1d71859c84ae2973c757e11bced0928903d050ae8
SHA2568561f469f06aefecc77ee0d8fb240267f3de04c4bd7de820475632df14235f89
SHA512c9c33bf15becc2bf044a440cc071a362d2f3fa12dc1c3b7b41b93b6c542a893cf335e164bcd2babbd21caa1157c976a5481ae48ea7f44b40d6ca28e32e214ad8
-
C:\Users\Admin\Downloads\_Getintopc.com_SketchUp_Pro_2018_v18.0.16975x64\SketchUp_Pro_2018_v18.0.16975x64\SketchUp_Pro_2018_v18.0.16975x64\Cracked 2018.0\SketchUp.exeFilesize
34.4MB
MD5b7615de6be0077de78179e305b644b20
SHA1d18a3d8486bed99b3d0af72336851b50c42d4fb0
SHA256fbbf71d9601861190271749ca0cd79c918df056d6ee8b9e8e0a1232d67c459e3
SHA512e5cbcd7e391eaed8a032407b584ba3ab03b9e0e6f80075480fe91a7f772c1fa39a57459d412132e26e9fd741828197851505558b7b84f3fdee551df85324341f
-
C:\Users\Admin\Downloads\_Getintopc.com_SketchUp_Pro_2018_v18.0.16975x64\SketchUp_Pro_2018_v18.0.16975x64\SketchUp_Pro_2018_v18.0.16975x64\Cracked 2018.0\SketchUp.exeFilesize
34.4MB
MD5b7615de6be0077de78179e305b644b20
SHA1d18a3d8486bed99b3d0af72336851b50c42d4fb0
SHA256fbbf71d9601861190271749ca0cd79c918df056d6ee8b9e8e0a1232d67c459e3
SHA512e5cbcd7e391eaed8a032407b584ba3ab03b9e0e6f80075480fe91a7f772c1fa39a57459d412132e26e9fd741828197851505558b7b84f3fdee551df85324341f
-
C:\Users\Admin\Downloads\_Getintopc.com_SketchUp_Pro_2018_v18.0.16975x64\SketchUp_Pro_2018_v18.0.16975x64\SketchUp_Pro_2018_v18.0.16975x64\Cracked 2018.0\Лечение.txtFilesize
629B
MD5adb8dcd5c6370288210e58c8863a1155
SHA1c76ce2460323395baf5a8f27cd745b339ee22bd6
SHA256801885117e1814da8ae1308f7f5e87ae7d34f10e23905084787dddfa9008a8f6
SHA5126ccfe60f727d50cd6caad878a77abae71815968fffa72dcc5c077d6f899ac0bf06d3a312bbe5d0e60c599d05fae0720aaec49989f1d170370317872ae14b230d
-
C:\Users\Admin\Downloads\_Getintopc.com_SketchUp_Pro_2018_v18.0.16975x64\SketchUp_Pro_2018_v18.0.16975x64\SketchUp_Pro_2018_v18.0.16975x64\SketchUpPro-en.exeFilesize
163.3MB
MD5d6552e4a822151794e464dd25eaa1348
SHA1af2f362026f0afc19b6719adb39377a825820e04
SHA2560211f2a8c1ec6ef8ef2b66e4bf33fea95be0c04c2b00eac4cb4abd3da95ec92e
SHA512528df1871dfb111ec5456000cab6c801eda0afa47360d23bda47500d6d46c5efd423cca9dd6bcf47cbed5d7af5b0b3a82b93089cb56dedb080a202e76b6a15b6
-
C:\Users\Admin\Downloads\_Getintopc.com_SketchUp_Pro_2018_v18.0.16975x64\SketchUp_Pro_2018_v18.0.16975x64\SketchUp_Pro_2018_v18.0.16975x64\SketchUpPro-en.exeFilesize
163.3MB
MD5d6552e4a822151794e464dd25eaa1348
SHA1af2f362026f0afc19b6719adb39377a825820e04
SHA2560211f2a8c1ec6ef8ef2b66e4bf33fea95be0c04c2b00eac4cb4abd3da95ec92e
SHA512528df1871dfb111ec5456000cab6c801eda0afa47360d23bda47500d6d46c5efd423cca9dd6bcf47cbed5d7af5b0b3a82b93089cb56dedb080a202e76b6a15b6
-
C:\Windows\Installer\MSI6877.tmpFilesize
522KB
MD5804b5e8936d9703b8ae111a70a7b908b
SHA10706b11a6eaf6323cf64d738fed1152edcb558a1
SHA256b894f66c6bbd919eff5c005f6e02e0b5718da7d8623071a30789b1a370db1345
SHA512830391884b4357f05e71f0cbbb26ca9cb677299f58e52e5e2e5d686147bbc13a55e410a3954c25b804bc33b5c001d0606dc014a5a9571e2e07326436b9faa5b8
-
C:\Windows\Installer\MSI6877.tmpFilesize
522KB
MD5804b5e8936d9703b8ae111a70a7b908b
SHA10706b11a6eaf6323cf64d738fed1152edcb558a1
SHA256b894f66c6bbd919eff5c005f6e02e0b5718da7d8623071a30789b1a370db1345
SHA512830391884b4357f05e71f0cbbb26ca9cb677299f58e52e5e2e5d686147bbc13a55e410a3954c25b804bc33b5c001d0606dc014a5a9571e2e07326436b9faa5b8
-
C:\Windows\Installer\MSI6877.tmpFilesize
522KB
MD5804b5e8936d9703b8ae111a70a7b908b
SHA10706b11a6eaf6323cf64d738fed1152edcb558a1
SHA256b894f66c6bbd919eff5c005f6e02e0b5718da7d8623071a30789b1a370db1345
SHA512830391884b4357f05e71f0cbbb26ca9cb677299f58e52e5e2e5d686147bbc13a55e410a3954c25b804bc33b5c001d0606dc014a5a9571e2e07326436b9faa5b8
-
C:\Windows\Installer\MSI6897.tmpFilesize
522KB
MD5804b5e8936d9703b8ae111a70a7b908b
SHA10706b11a6eaf6323cf64d738fed1152edcb558a1
SHA256b894f66c6bbd919eff5c005f6e02e0b5718da7d8623071a30789b1a370db1345
SHA512830391884b4357f05e71f0cbbb26ca9cb677299f58e52e5e2e5d686147bbc13a55e410a3954c25b804bc33b5c001d0606dc014a5a9571e2e07326436b9faa5b8
-
C:\Windows\Installer\MSI6897.tmpFilesize
522KB
MD5804b5e8936d9703b8ae111a70a7b908b
SHA10706b11a6eaf6323cf64d738fed1152edcb558a1
SHA256b894f66c6bbd919eff5c005f6e02e0b5718da7d8623071a30789b1a370db1345
SHA512830391884b4357f05e71f0cbbb26ca9cb677299f58e52e5e2e5d686147bbc13a55e410a3954c25b804bc33b5c001d0606dc014a5a9571e2e07326436b9faa5b8
-
C:\Windows\Installer\MSI68A8.tmpFilesize
522KB
MD5804b5e8936d9703b8ae111a70a7b908b
SHA10706b11a6eaf6323cf64d738fed1152edcb558a1
SHA256b894f66c6bbd919eff5c005f6e02e0b5718da7d8623071a30789b1a370db1345
SHA512830391884b4357f05e71f0cbbb26ca9cb677299f58e52e5e2e5d686147bbc13a55e410a3954c25b804bc33b5c001d0606dc014a5a9571e2e07326436b9faa5b8
-
C:\Windows\Installer\MSI68A8.tmpFilesize
522KB
MD5804b5e8936d9703b8ae111a70a7b908b
SHA10706b11a6eaf6323cf64d738fed1152edcb558a1
SHA256b894f66c6bbd919eff5c005f6e02e0b5718da7d8623071a30789b1a370db1345
SHA512830391884b4357f05e71f0cbbb26ca9cb677299f58e52e5e2e5d686147bbc13a55e410a3954c25b804bc33b5c001d0606dc014a5a9571e2e07326436b9faa5b8
-
C:\Windows\Installer\e5b7c31.msiFilesize
196.7MB
MD51a45dd1124d01f01c31746d983f4c8b9
SHA17ccc5cde8860082213a8fe9000cfba073eb007df
SHA256ffad902f1948f32f19189e59b33f8fc9516b73b5f1f4d8a96954f0519f00c275
SHA51256b36903f2ff083e04111edaf0e81fbcf37b917f73c2acbbd37010e3b3c34584a85b5ae33a3acc012c63e2c3d5c06148497abb31c8d15f79865a4ecd33d00da0
-
C:\Windows\Installer\{C702DD60-EBF4-4961-8B7D-F209B361F985}\LayOutIcon.A6F03ABD_736E_41BE_83EC_7E5F0B548850Filesize
15.1MB
MD50939ffad4f5a4af69a011f96b2002308
SHA1262fc92881b536368de71f04e409c967d45bb087
SHA2566793011710d1627fc05ab8f90c45fa7f1a24550b6bd2be6a6841e24c7d5b2ef6
SHA5126dacf190d23f8ce1644691db04ea9136fd6d4eec06e634a6e9e18d6d962c167c5890fab2cdfb30b8d1653c473099a10e84f356078b286fbc3fc2927268763480
-
C:\Windows\Installer\{C702DD60-EBF4-4961-8B7D-F209B361F985}\SketchUpIcon.1BDFFE07_27F3_4443_B5F0_CC6BDC32DE29Filesize
34.4MB
MD536964dc06b441305e2c55eb9f330a566
SHA1a19259751ed0dbafdbe43a2f075d6da460c13705
SHA256f2ba91d3d3ef27a8042271b70e3fc5c718587a1dec8f235b9762301732c65a12
SHA512690572674279a65023cf0f650fc1c1ef2b85bc647064d28b37c1ab75c2f562fd8b14c91319d98e9036bc77f522635b55641bbe9eb4f517e3629d4e7e2e657056
-
C:\Windows\Installer\{C702DD60-EBF4-4961-8B7D-F209B361F985}\StyleBuilderIcon.E8C4E687_29CB_4B1E_8F01_A7DC60A00AB8Filesize
6.7MB
MD53edbdf2f1787f3eadc4eb6de16adaf1d
SHA14a2b70766628f3219834691fb48c46c2b92151dc
SHA25647e834cafeb26f2731da20cab4cdf4cb288358325fa37463e6cec87837337c79
SHA51218f94e054522e3aa3442350164ff0529d386d8caaa7a80771cc72c5a5125d01093dfa89f94ef7eb1ed584e36d3e48278f1afef3def1cbda24a3ec493f2617415
-
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2Filesize
23.0MB
MD5f8acfac46b61260ccb2f096efb92183d
SHA1a36ea28dd1422f84926d99c5b92e660c4eb2e09a
SHA2566e7b82617f62aa4dc43cdfa4c9649781f27766610ea7a75a7c0e07d1f01b69af
SHA51267d8e7d79df42b7211c1c5e36552e8de74f328eb6fd43d735ee615766366dca69527b74fafaefbf8e1850a31b96cbb55dd5e9549f6d12c3326850d2a6fd7f3fc
-
\??\Volume{4cc777a5-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{f71cf3ba-99f5-440c-a3c9-94846545fe8c}_OnDiskSnapshotPropFilesize
5KB
MD5bacb74b52cde258486871a716c242f57
SHA160689f4d006b6c7d92499663f6071032b981c8da
SHA256ca20bb399b97d97d48c4d8b1750df28b982781a1d30fffa144db0c9e39c0d368
SHA512641145ca14d92bdfe05eaf282fa542475cab6512f10ede77ff53f1730d016da2fab3668ed562c99c6053a2bc754a0aa12e7c288b8b09d486821f3c4e299b69ce
-
\??\pipe\crashpad_4508_ONXMVNBLNQQNEHFSMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/3812-3972-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3991-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3952-0x000000006AB40000-0x000000006BAD6000-memory.dmpFilesize
15.6MB
-
memory/3812-3953-0x000000006AB40000-0x000000006BAD6000-memory.dmpFilesize
15.6MB
-
memory/3812-3954-0x000000006AB40000-0x000000006BAD6000-memory.dmpFilesize
15.6MB
-
memory/3812-3955-0x000000006AB40000-0x000000006BAD6000-memory.dmpFilesize
15.6MB
-
memory/3812-3957-0x0000000064800000-0x0000000064AAC000-memory.dmpFilesize
2.7MB
-
memory/3812-3958-0x000000006BAE0000-0x000000006BB38000-memory.dmpFilesize
352KB
-
memory/3812-3956-0x000000006AB40000-0x000000006BAD6000-memory.dmpFilesize
15.6MB
-
memory/3812-3963-0x0000000065B40000-0x0000000065B69000-memory.dmpFilesize
164KB
-
memory/3812-3960-0x000000006AB40000-0x000000006BAD6000-memory.dmpFilesize
15.6MB
-
memory/3812-3962-0x000000006A970000-0x000000006A9E0000-memory.dmpFilesize
448KB
-
memory/3812-3961-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3964-0x000000006AB40000-0x000000006BAD6000-memory.dmpFilesize
15.6MB
-
memory/3812-3966-0x0000000070680000-0x000000007069F000-memory.dmpFilesize
124KB
-
memory/3812-3968-0x0000023163F30000-0x0000023163FBE000-memory.dmpFilesize
568KB
-
memory/3812-3967-0x000000006AB40000-0x000000006BAD6000-memory.dmpFilesize
15.6MB
-
memory/3812-3970-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3971-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3950-0x00007FF77FC90000-0x00007FF781F2A000-memory.dmpFilesize
34.6MB
-
memory/3812-3973-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3974-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3975-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3977-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3978-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3979-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3981-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3983-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3984-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3986-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3988-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3951-0x000000006AB40000-0x000000006BAD6000-memory.dmpFilesize
15.6MB
-
memory/3812-3994-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3996-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3999-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-4002-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-4005-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-4008-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-4012-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-4011-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-4010-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-4009-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-4007-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-4006-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-4004-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-4003-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-4001-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-4000-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3998-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3997-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3995-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3993-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3992-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3990-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3989-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3987-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3985-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3982-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3980-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3976-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3969-0x000000006A9E0000-0x000000006AB3F000-memory.dmpFilesize
1.4MB
-
memory/3812-3965-0x0000000063100000-0x0000000063150000-memory.dmpFilesize
320KB
-
memory/3812-3949-0x00007FF77FC90000-0x00007FF781F2A000-memory.dmpFilesize
34.6MB