b089fe79e2bdfbc0c33bafe84160f70e7a84864dc61c5920d856743cf3ad003a

Analysis

max time kernel
156s
max time network
160s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02/04/2023, 22:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BlueStacksInstaller_5.10.210.1003_native_15c489f4ac80f00e794f253876bc2048_MzsxNSwwOzUsMTsxNSw0OzE1.exe
Size

798KB
MD5

2bf659fc81797de381e5b3dfe1099f89
SHA1

d201435cbebbbe8714510a9582c188e2c522910b
SHA256

b089fe79e2bdfbc0c33bafe84160f70e7a84864dc61c5920d856743cf3ad003a
SHA512

7f5d12a12a835f6309725bddd6d081ef4b786d976d3e104dce17d3909410b61557ad12f4a0696fef183ed4dfda1bf17174c3d7cb7df68e8466131daeb5bd2d8b
SSDEEP

24576:givtCXF1jv6qQOqqPYx2Q/XmElHA80Wisc:ltCXH6JOBY5FRFlc

Score

8^/10

discovery evasion

Malware Config

Signatures

Downloads MZ/PE file

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Modify Existing Service

T1031

pid	Process
1604	netsh.exe
1592	netsh.exe

Executes dropped EXE 6 IoCs

pid	Process
1000	BlueStacksInstaller.exe
1460	HD-CheckCpu.exe
656	HD-CheckCpu.exe
1724	BSX-Setup-5.10.210.1003.exe
2472	BlueStacksInstaller.exe
2584	HD-CheckCpu.exe

Loads dropped DLL 64 IoCs

pid	Process
1232	BlueStacksInstaller_5.10.210.1003_native_15c489f4ac80f00e794f253876bc2048_MzsxNSwwOzUsMTsxNSw0OzE1.exe
1232	BlueStacksInstaller_5.10.210.1003_native_15c489f4ac80f00e794f253876bc2048_MzsxNSwwOzUsMTsxNSw0OzE1.exe
1232	BlueStacksInstaller_5.10.210.1003_native_15c489f4ac80f00e794f253876bc2048_MzsxNSwwOzUsMTsxNSw0OzE1.exe
1232	BlueStacksInstaller_5.10.210.1003_native_15c489f4ac80f00e794f253876bc2048_MzsxNSwwOzUsMTsxNSw0OzE1.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\BlueStacks X\cef\locales\fa.pak	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\translations\qt_he.qm	BSX-Setup-5.10.210.1003.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\mux\libmux_dummy_plugin.dll	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\video_output\libdirect3d9_plugin.dll	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\platforms	BSX-Setup-5.10.210.1003.exe
File created	C:\Program Files (x86)\BlueStacks X\image\account\Choose_img1.png	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\Gallery\pre_hover.svg	BSX-Setup-5.10.210.1003.exe
File created	C:\Program Files (x86)\BlueStacks X\image\Search\Result_NoResult.svg	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\translations\qt_ar.qm	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\codec\libvorbis_plugin.dll	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\audio_filter\libgain_plugin.dll	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\audio_filter\libremap_plugin.dll	BSX-Setup-5.10.210.1003.exe
File created	C:\Program Files (x86)\BlueStacks X\styles\qwindowsvistastyle.dll	BSX-Setup-5.10.210.1003.exe
File created	C:\Program Files (x86)\BlueStacks X\image\Search\GooglePlay.svg	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\SideBar\add_pressed.svg	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\toast_icon.svg	BSX-Setup-5.10.210.1003.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\access\libaccess_realrtsp_plugin.dll	BSX-Setup-5.10.210.1003.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\audio_mixer\libinteger_mixer_plugin.dll	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\cef\locales\hi.pak	BSX-Setup-5.10.210.1003.exe
File created	C:\Program Files (x86)\BlueStacks X\image\TypeIndicator\AndroidGame_on.svg	BSX-Setup-5.10.210.1003.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\audio_output\libadummy_plugin.dll	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\wallet	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\cef\v8_context_snapshot.bin	BSX-Setup-5.10.210.1003.exe
File created	C:\Program Files (x86)\BlueStacks X\image\minimize_normal.svg	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\MyGames\mygames_Android_on.svg	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\language\th.qm	BSX-Setup-5.10.210.1003.exe
File created	C:\Program Files (x86)\BlueStacks X\translations\qtwebengine_locales\da.pak	BSX-Setup-5.10.210.1003.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\access\libsatip_plugin.dll	BSX-Setup-5.10.210.1003.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\audio_output\libamem_plugin.dll	BSX-Setup-5.10.210.1003.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\codec\libaes3_plugin.dll	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\video_filter\libvhs_plugin.dll	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\xplugins\SettingPlugin.dll	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\checkBox\uncheck_pressed.svg	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\maximize_normal.svg	BSX-Setup-5.10.210.1003.exe
File created	C:\Program Files (x86)\BlueStacks X\Cloud Game.exe	BSX-Setup-5.10.210.1003.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\video_output\libdirect3d9_plugin.dll	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\cef	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\account\facebook.svg	BSX-Setup-5.10.210.1003.exe
File created	C:\Program Files (x86)\BlueStacks X\image\TypeIndicator\Setting_hover.svg	BSX-Setup-5.10.210.1003.exe
File created	C:\Program Files (x86)\BlueStacks X\language\en.qm	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\translations\qtwebengine_locales\ml.pak	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\translations\qtwebengine_locales\sr.pak	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\msvcp140_atomic_wait.dll	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\stream_filter\libinflate_plugin.dll	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\printsupport\windowsprintersupport.dll	BSX-Setup-5.10.210.1003.exe
File created	C:\Program Files (x86)\BlueStacks X\xplugins\SimulatorMgrPlugin.dll	BSX-Setup-5.10.210.1003.exe
File created	C:\Program Files (x86)\BlueStacks X\cef\locales\cs.pak	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\account\google.svg	BSX-Setup-5.10.210.1003.exe
File created	C:\Program Files (x86)\BlueStacks X\image\checkBox\uncheck_pressed.svg	BSX-Setup-5.10.210.1003.exe
File created	C:\Program Files (x86)\BlueStacks X\image\Gallery\close_normal.svg	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\www\js\index.js	BSX-Setup-5.10.210.1003.exe
File created	C:\Program Files (x86)\BlueStacks X\api-ms-win-crt-convert-l1-1-0.dll	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\msvcp140_1.dll	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\video_filter\libscale_plugin.dll	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\video_output\libwinhibit_plugin.dll	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\settings\Image_Broken.svg	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\translations\qt_it.qm	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\video_chroma\libi420_rgb_mmx_plugin.dll	BSX-Setup-5.10.210.1003.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\video_filter\libripple_plugin.dll	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\Qt5Svg.dll	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\video_filter	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\resources\icudtl.dat	BSX-Setup-5.10.210.1003.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\access\libtimecode_plugin.dll	BSX-Setup-5.10.210.1003.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\video_output	BSX-Setup-5.10.210.1003.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X\shell\	BSX-Setup-5.10.210.1003.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X	BSX-Setup-5.10.210.1003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X\ = "URL:BlueStacks X Protocol Handler"	BSX-Setup-5.10.210.1003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X\URL Protocol	BSX-Setup-5.10.210.1003.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X\shell	BSX-Setup-5.10.210.1003.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X\shell\open\command	BSX-Setup-5.10.210.1003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X\shell\open\command\ = "\"C:\\Program Files (x86)\\BlueStacks X\\BlueStacks X.exe\" -open \"%1\""	BSX-Setup-5.10.210.1003.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X\DefaultIcon	BSX-Setup-5.10.210.1003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X\DefaultIcon\ = "C:\\Program Files (x86)\\BlueStacks X\\BlueStacks X.exe,0"	BSX-Setup-5.10.210.1003.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X\shell\open	BSX-Setup-5.10.210.1003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X\shell\open\	BSX-Setup-5.10.210.1003.exe

Modifies system certificate store 2 TTPs 9 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	BlueStacksInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	BlueStacksInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	BlueStacksInstaller.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	BlueStacksInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	BlueStacksInstaller.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	BlueStacksInstaller.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	BlueStacksInstaller.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	BlueStacksInstaller.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	BlueStacksInstaller.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1000	BlueStacksInstaller.exe
1000	BlueStacksInstaller.exe
1000	BlueStacksInstaller.exe
1000	BlueStacksInstaller.exe
1000	BlueStacksInstaller.exe
1000	BlueStacksInstaller.exe
1724	BSX-Setup-5.10.210.1003.exe
1724	BSX-Setup-5.10.210.1003.exe
2472	BlueStacksInstaller.exe
2472	BlueStacksInstaller.exe
2472	BlueStacksInstaller.exe
2472	BlueStacksInstaller.exe
2472	BlueStacksInstaller.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1000	BlueStacksInstaller.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1000	BlueStacksInstaller.exe
Token: SeSecurityPrivilege	1724	BSX-Setup-5.10.210.1003.exe
Token: SeDebugPrivilege	2472	BlueStacksInstaller.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 1000	1232	BlueStacksInstaller_5.10.210.1003_native_15c489f4ac80f00e794f253876bc2048_MzsxNSwwOzUsMTsxNSw0OzE1.exe	28
PID 1232 wrote to memory of 1000	1232	BlueStacksInstaller_5.10.210.1003_native_15c489f4ac80f00e794f253876bc2048_MzsxNSwwOzUsMTsxNSw0OzE1.exe	28
PID 1232 wrote to memory of 1000	1232	BlueStacksInstaller_5.10.210.1003_native_15c489f4ac80f00e794f253876bc2048_MzsxNSwwOzUsMTsxNSw0OzE1.exe	28
PID 1232 wrote to memory of 1000	1232	BlueStacksInstaller_5.10.210.1003_native_15c489f4ac80f00e794f253876bc2048_MzsxNSwwOzUsMTsxNSw0OzE1.exe	28
PID 1000 wrote to memory of 1460	1000	BlueStacksInstaller.exe	29
PID 1000 wrote to memory of 1460	1000	BlueStacksInstaller.exe	29
PID 1000 wrote to memory of 1460	1000	BlueStacksInstaller.exe	29
PID 1000 wrote to memory of 1460	1000	BlueStacksInstaller.exe	29
PID 1000 wrote to memory of 656	1000	BlueStacksInstaller.exe	31
PID 1000 wrote to memory of 656	1000	BlueStacksInstaller.exe	31
PID 1000 wrote to memory of 656	1000	BlueStacksInstaller.exe	31
PID 1000 wrote to memory of 656	1000	BlueStacksInstaller.exe	31
PID 1000 wrote to memory of 1724	1000	BlueStacksInstaller.exe	34
PID 1000 wrote to memory of 1724	1000	BlueStacksInstaller.exe	34
PID 1000 wrote to memory of 1724	1000	BlueStacksInstaller.exe	34
PID 1000 wrote to memory of 1724	1000	BlueStacksInstaller.exe	34
PID 1000 wrote to memory of 1724	1000	BlueStacksInstaller.exe	34
PID 1000 wrote to memory of 1724	1000	BlueStacksInstaller.exe	34
PID 1000 wrote to memory of 1724	1000	BlueStacksInstaller.exe	34
PID 1724 wrote to memory of 5052	1724	BSX-Setup-5.10.210.1003.exe	35
PID 1724 wrote to memory of 5052	1724	BSX-Setup-5.10.210.1003.exe	35
PID 1724 wrote to memory of 5052	1724	BSX-Setup-5.10.210.1003.exe	35
PID 1724 wrote to memory of 5052	1724	BSX-Setup-5.10.210.1003.exe	35
PID 5052 wrote to memory of 1776	5052	WScript.exe	37
PID 5052 wrote to memory of 1776	5052	WScript.exe	37
PID 5052 wrote to memory of 1776	5052	WScript.exe	37
PID 5052 wrote to memory of 1776	5052	WScript.exe	37
PID 1776 wrote to memory of 1592	1776	cmd.exe	39
PID 1776 wrote to memory of 1592	1776	cmd.exe	39
PID 1776 wrote to memory of 1592	1776	cmd.exe	39
PID 1776 wrote to memory of 1592	1776	cmd.exe	39
PID 1776 wrote to memory of 1604	1776	cmd.exe	40
PID 1776 wrote to memory of 1604	1776	cmd.exe	40
PID 1776 wrote to memory of 1604	1776	cmd.exe	40
PID 1776 wrote to memory of 1604	1776	cmd.exe	40
PID 1000 wrote to memory of 1696	1000	BlueStacksInstaller.exe	41
PID 1000 wrote to memory of 1696	1000	BlueStacksInstaller.exe	41
PID 1000 wrote to memory of 1696	1000	BlueStacksInstaller.exe	41
PID 1000 wrote to memory of 1696	1000	BlueStacksInstaller.exe	41
PID 1000 wrote to memory of 1696	1000	BlueStacksInstaller.exe	41
PID 1000 wrote to memory of 1696	1000	BlueStacksInstaller.exe	41
PID 1000 wrote to memory of 1696	1000	BlueStacksInstaller.exe	41
PID 1696 wrote to memory of 2472	1696	BlueStacksInstaller_5.10.210.1003_native_15c489f4ac80f00e794f253876bc2048_MzsxNSwwOzUsMTsxNSw0OzE1.exe	42
PID 1696 wrote to memory of 2472	1696	BlueStacksInstaller_5.10.210.1003_native_15c489f4ac80f00e794f253876bc2048_MzsxNSwwOzUsMTsxNSw0OzE1.exe	42
PID 1696 wrote to memory of 2472	1696	BlueStacksInstaller_5.10.210.1003_native_15c489f4ac80f00e794f253876bc2048_MzsxNSwwOzUsMTsxNSw0OzE1.exe	42
PID 1696 wrote to memory of 2472	1696	BlueStacksInstaller_5.10.210.1003_native_15c489f4ac80f00e794f253876bc2048_MzsxNSwwOzUsMTsxNSw0OzE1.exe	42
PID 2472 wrote to memory of 2584	2472	BlueStacksInstaller.exe	43
PID 2472 wrote to memory of 2584	2472	BlueStacksInstaller.exe	43
PID 2472 wrote to memory of 2584	2472	BlueStacksInstaller.exe	43
PID 2472 wrote to memory of 2584	2472	BlueStacksInstaller.exe	43

C:\Users\Admin\AppData\Local\Temp\BlueStacksInstaller_5.10.210.1003_native_15c489f4ac80f00e794f253876bc2048_MzsxNSwwOzUsMTsxNSw0OzE1.exe
"C:\Users\Admin\AppData\Local\Temp\BlueStacksInstaller_5.10.210.1003_native_15c489f4ac80f00e794f253876bc2048_MzsxNSwwOzUsMTsxNSw0OzE1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Users\Admin\AppData\Local\Temp\7zS0D45A3FB\BlueStacksInstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS0D45A3FB\BlueStacksInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1000
- - C:\Users\Admin\AppData\Local\Temp\7zS0D45A3FB\HD-CheckCpu.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS0D45A3FB\HD-CheckCpu.exe" --cmd checkHypervEnabled
    3⤵
    - Executes dropped EXE
    PID:1460
- - C:\Users\Admin\AppData\Local\Temp\7zS0D45A3FB\HD-CheckCpu.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS0D45A3FB\HD-CheckCpu.exe" --cmd checkSSE4
    3⤵
    - Executes dropped EXE
    PID:656
- - C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.210.1003.exe
    "C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.210.1003.exe" -s
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1724
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\BlueStacks X\green.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5052
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c green.bat
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1776
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="BlueStacksWeb" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\BlueStacksWeb.exe"
        6⤵
        Modifies Windows Firewall
        
        PID:1592
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="Cloud Game" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\Cloud Game.exe"
        6⤵
        Modifies Windows Firewall
        
        PID:1604
- - C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.10.210.1003_native_15c489f4ac80f00e794f253876bc2048_MzsxNSwwOzUsMTsxNSw0OzE1.exe
    "C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.10.210.1003_native_15c489f4ac80f00e794f253876bc2048_MzsxNSwwOzUsMTsxNSw0OzE1.exe" -versionMachineID=6a1d903d-b6fe-4818-a2b8-89dfc2023cc6 -machineID=bd6f8d47-ff78-4463-8878-000fba27bb68 -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Nougat32 -imageToLaunch=Nougat32 -isSSE4Available=1 -appToLaunch=bs5 -bsxVersion=0.19.51.1001 -country=US
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\7zS0A6A5F1E\BlueStacksInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS0A6A5F1E\BlueStacksInstaller.exe" -versionMachineID=6a1d903d-b6fe-4818-a2b8-89dfc2023cc6 -machineID=bd6f8d47-ff78-4463-8878-000fba27bb68 -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Nougat32 -imageToLaunch=Nougat32 -isSSE4Available=1 -appToLaunch=bs5 -bsxVersion=0.19.51.1001 -country=US
      4⤵
      Executes dropped EXE
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\7zS0A6A5F1E\HD-CheckCpu.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS0A6A5F1E\HD-CheckCpu.exe" --cmd checkHypervEnabled
        5⤵
        Executes dropped EXE
        
        PID:2584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\BlueStacks X\BlueStacks X.exe

Filesize
464KB

MD5
004d98417f17858f29d15ebec7445a7b

SHA1
a36647b93d44fc90997068bb327b824526853bad

SHA256
267f0b5fbbd4a8951dece90bbb9807ab38419094943aac0191ff52dc3eb0d668

SHA512
580192289b72305f6b9e983e81cfe616429a26de72a1c1e622c29c0c85cab8e76b13c2e38911aeb8979a2da394f451d95a1438f5338550fb44ec428a2d661d04

Download Submit
C:\Program Files (x86)\BlueStacks X\BlueStacksXUninstaller.exe

Filesize
1.9MB

MD5
c6aa8a8da082fe65bbafd6e80fbb1440

SHA1
326e5b5a7c20e508452e2778f4a74dfd4fea960f

SHA256
e807a695ce0ba27791c069f7aa04f55b93c00d603de58e56ef4cfa1f91b6cc21

SHA512
7d293ed4c9859c9c533e04842f207393d6072bc363299665460588d2e3fa68a82dfab8996cf9870ba7e34e7d2af00ef168c6ff133dbb51530d4df90cfb8e33ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6c807f2d5e31c353f59f755cf32a44e

SHA1
a763bd02dc35b4bb882a92242ed532500045ebf0

SHA256
b287906c69c87f41faf534a53138c03df1f9e6068947e7051fd1932380f5ee0a

SHA512
0e8b43c0457ac4457c46a3ce0c42ca3d0d96175dff8b9403b47935155f6b8c0987b6056eeaa9bfe7162b66ae0130889723f12a8bd0276ab97208a71cf38a3128

Download Submit
C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.210.1003.exe

Filesize
158.6MB

MD5
6a398f5e1d07f599ca515428ebcb5508

SHA1
641ee34bf22c6bf4667045cf5f55de1c7424104c

SHA256
1ca387b83bfe2546411ed7bd4ca5de03531a43438e99e079f84213257c83a87e

SHA512
1807443881858716d2981424b2ddc1fa5b5ff970a2c9a27a2973d01a4fbd712a8115037900717f0d0b78691db80e7e64924e8a86b1c8a688b2c61f443cd08c6b

Download Submit
C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.210.1003.exe

Filesize
158.6MB

MD5
6a398f5e1d07f599ca515428ebcb5508

SHA1
641ee34bf22c6bf4667045cf5f55de1c7424104c

SHA256
1ca387b83bfe2546411ed7bd4ca5de03531a43438e99e079f84213257c83a87e

SHA512
1807443881858716d2981424b2ddc1fa5b5ff970a2c9a27a2973d01a4fbd712a8115037900717f0d0b78691db80e7e64924e8a86b1c8a688b2c61f443cd08c6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0A6A5F1E\Assets\exit_close.png

Filesize
670B

MD5
26eb04b9e0105a7b121ea9c6601bbf2a

SHA1
efc08370d90c8173df8d8c4b122d2bb64c07ccd8

SHA256
7aaef329ba9fa052791d1a09f127551289641ea743baba171de55faa30ec1157

SHA512
9df3c723314d11a6b4ce0577eb61488061f2f96a9746a944eb6a4ee8c0c4d29131231a1b20988ef5454b79f9475b43d62c710839ecc0a9c98324f977cab6db68

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0A6A5F1E\Assets\minimize_progress.png

Filesize
212B

MD5
1504b80f2a6f2d3fefc305da54a2a6c2

SHA1
432a9d89ebc2f693836d3c2f0743ea5d2077848d

SHA256
2f62d4e8c643051093f907058dddc78cc525147d9c4f4a0d78b4d0e5c90979f6

SHA512
675db04baf3199c8d94af30a1f1c252830a56a90f633c3a72aa9841738b04242902a5e7c56dd792626338e8b7eabc1f359514bb3a2e62bc36c16919e196cfd94

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0D45A3FB\Assets\backicon.png

Filesize
15KB

MD5
7ff5dc8270b5fa7ef6c4a1420bd67a7f

SHA1
b224300372feaa97d882ca2552b227c0f2ef4e3e

SHA256
fa64884054171515e97b78aaa1aad1ec5baa9d1daf9c682e0b3fb4a41a9cb1c1

SHA512
f0d5a842a01b99f189f3d46ab59d2c388a974951b042b25bbce54a15f5a3f386984d19cfca22ba1440eebd79260066a37dfeff6cb0d1332fca136add14488eef

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0D45A3FB\Assets\checked_gray.png

Filesize
538B

MD5
ce144d2aab3bf213af693d4e18f87a59

SHA1
df59dc3dbba88bdc5ffc25f2e5e7b73ac3de5afa

SHA256
d8e502fab00b0c6f06ba6abede6922ab3b423fe6f2d2f56941dabc887b229ad3

SHA512
0f930edd485a0d49ef157f6cc8856609c087c91b77845adeb5cc8c8a80ebc7ec5416df351ffa1af780caad884dbb49dcc778b0b30de6fb7c85ffef22d7220ebe

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0D45A3FB\Assets\close_red.png

Filesize
15KB

MD5
93216b2f9d66d423b3e1311c0573332d

SHA1
5efaebec5f20f91f164f80d1e36f98c9ddaff805

SHA256
d0b6d143642d356b40c47459a996131a344cade6bb86158f1b74693426b09bfb

SHA512
922a7292de627c5e637818556d25d9842a88e89f2b198885835925679500dfd44a1e25ce79e521e63c4f84a6b0bd6bf98e46143ad8cee80ecdbaf3d3bc0f3a32

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0D45A3FB\Assets\custom.png

Filesize
17KB

MD5
03b17f0b1c067826b0fcc6746cced2cb

SHA1
e07e4434e10df4d6c81b55fceb6eca2281362477

SHA256
fbece8bb5f4dfa55dcfbf41151b10608af807b9477e99acf0940954a11e68f7b

SHA512
67c78ec01e20e9c8d9cdbba665bb2fd2bb150356f30b88d3d400bbdb0ae92010f5d7bcb683dcf6f895722a9151d8e669d8bef913eb6e728ba56bb02f264573b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0D45A3FB\Assets\installer_bg.jpg

Filesize
42KB

MD5
162c23f5962381efba79be503b41089c

SHA1
fc5a95e6eb2bb015fe27457873528c24b3bc459d

SHA256
04d70d0968675290294df78800ed48fe4a681a72803405fbdc541b927b445457

SHA512
9bd6e634d6cb362ab40f2646ca59a865f05e6049ac55b9d03b3df1f8e853715119438771196a351ca98c6cb61a212bbc0bedb7bf2d306563f6198353a7680c54

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0D45A3FB\Assets\installer_logo.png

Filesize
7KB

MD5
d6f746b61d5c91d6688faab54ecc74c3

SHA1
9581cafbc93d6189c7e0633bd43dfd017510f731

SHA256
ed7e205b0ccdd454d4fa47c48834ad36a6e9fb51f4042a2dcd39a7fe01244d95

SHA512
0139711388976628ebd46a2f1dc7e0c38184d3b4ab63a8f2b6c8cd9e6032cddcd2dafb8ce4ab3ba8008beba9d6c3e444577cd7953bb48e39635e5c9666fdf478

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0D45A3FB\Assets\installer_minimize.png

Filesize
113B

MD5
38b539a1e4229738e5c196eedb4eb225

SHA1
f027b08dce77c47aaed75a28a2fce218ff8c936c

SHA256
a064f417e3c2b8f3121a14bbded268b2cdf635706880b7006f931de31476bbc2

SHA512
2ce433689a94fae454ef65e0e9ec33657b89718bbb5a038bf32950f6d68722803922f3a427278bad432395a1716523e589463fcce4279dc2a895fd77434821cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0D45A3FB\Assets\loader.png

Filesize
279B

MD5
03903fd42ed2ee3cb014f0f3b410bcb4

SHA1
762a95240607fe8a304867a46bc2d677f494f5c2

SHA256
076263cc65f9824f4f82eb6beaa594d1df90218a2ee21664cf209181557e04b1

SHA512
8b0e717268590e5287c07598a06d89220c5e9a33cd1c29c55f8720321f4b3efc869d20c61fcc892e13188d77f0fdc4c73a2ee6dece174bf876fcc3a6c5683857

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0D45A3FB\Assets\setpath.png

Filesize
15KB

MD5
b2e7f40179744c74fded932e829cb12a

SHA1
a0059ab8158a497d2cf583a292b13f87326ec3f0

SHA256
5bbb2f41f9f3a805986c3c88a639bcc22d90067d4b8de9f1e21e3cf9e5c1766b

SHA512
b95b7ebdb4a74639276eaa5c055fd8d9431e2f58a5f7c57303f7cf22e8b599f6f2a7852074cf71b19b49eb31cc9bf2509aedf41d608981d116e49a00030c797c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0D45A3FB\Assets\unchecked_gray.png

Filesize
192B

MD5
e50df2a0768f7fc4c3fe8d784564fea3

SHA1
d1fc4db50fe8e534019eb7ce70a61fd4c954621a

SHA256
671f26795b12008fbea1943143f660095f3dca5d925f67d765e2352fd7ee2396

SHA512
c87a8308a73b17cbdd179737631fb1ba7fdaeb65e82263f6617727519b70a81266bb695867b9e599c1306ee2cf0de525452f77ce367ca89bf870ea3ae7189998

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0D45A3FB\BlueStacksInstaller.exe

Filesize
561KB

MD5
15a1ecf2c6c6ab3f457bdc0dd6f0ee5c

SHA1
250f1dc7fbb0d067ba696e9d3341e24f63ed3603

SHA256
f7240bf41e75c23b43c42ab03a070b373688ff36ee23954af237fe6c10b30f56

SHA512
9c2e4aea6d412f0cdee43d12c0910ec133779fc63b4262645eb1db2e141eb4df7e68a5b2fbf6a0ab4fd47c762efaeff4287fa21a4bc86f5c292ca10f98d31db2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0D45A3FB\BlueStacksInstaller.exe

Filesize
561KB

MD5
15a1ecf2c6c6ab3f457bdc0dd6f0ee5c

SHA1
250f1dc7fbb0d067ba696e9d3341e24f63ed3603

SHA256
f7240bf41e75c23b43c42ab03a070b373688ff36ee23954af237fe6c10b30f56

SHA512
9c2e4aea6d412f0cdee43d12c0910ec133779fc63b4262645eb1db2e141eb4df7e68a5b2fbf6a0ab4fd47c762efaeff4287fa21a4bc86f5c292ca10f98d31db2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0D45A3FB\BlueStacksInstaller.exe

Filesize
561KB

MD5
15a1ecf2c6c6ab3f457bdc0dd6f0ee5c

SHA1
250f1dc7fbb0d067ba696e9d3341e24f63ed3603

SHA256
f7240bf41e75c23b43c42ab03a070b373688ff36ee23954af237fe6c10b30f56

SHA512
9c2e4aea6d412f0cdee43d12c0910ec133779fc63b4262645eb1db2e141eb4df7e68a5b2fbf6a0ab4fd47c762efaeff4287fa21a4bc86f5c292ca10f98d31db2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0D45A3FB\BlueStacksInstaller.exe.config

Filesize
324B

MD5
1b456d88546e29f4f007cd0bf1025703

SHA1
e5c444fcfe5baf2ef71c1813afc3f2c1100cab86

SHA256
d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb

SHA512
c545e416c841b8786e4589fc9ca2b732b16cdd759813ec03f558332f2436f165ec1ad2fbc65012b5709fa19ff1e8396639c17bfad150cabeb51328a39ea556e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0D45A3FB\HD-CheckCpu.exe

Filesize
211KB

MD5
764ac83167adcd8d2273f6bff7d769b2

SHA1
bf6a46b8c03d7efb16fdd6e4ce0a5e4362f41957

SHA256
e81e0444ba2deb4056872d1c4f9b01971bb4fb376c6434c942718da7c39190bf

SHA512
a3a484aaf5cfdff1c198c37f3055409dc066646db3d61e74bfef2b4ce212d95fd43d3e3b239e080ba9fab62eae23cd4b54b6b466fad3192845b43d4212ccd667

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0D45A3FB\HD-CheckCpu.exe

Filesize
211KB

MD5
764ac83167adcd8d2273f6bff7d769b2

SHA1
bf6a46b8c03d7efb16fdd6e4ce0a5e4362f41957

SHA256
e81e0444ba2deb4056872d1c4f9b01971bb4fb376c6434c942718da7c39190bf

SHA512
a3a484aaf5cfdff1c198c37f3055409dc066646db3d61e74bfef2b4ce212d95fd43d3e3b239e080ba9fab62eae23cd4b54b6b466fad3192845b43d4212ccd667

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0D45A3FB\HD-CheckCpu.exe

Filesize
211KB

MD5
764ac83167adcd8d2273f6bff7d769b2

SHA1
bf6a46b8c03d7efb16fdd6e4ce0a5e4362f41957

SHA256
e81e0444ba2deb4056872d1c4f9b01971bb4fb376c6434c942718da7c39190bf

SHA512
a3a484aaf5cfdff1c198c37f3055409dc066646db3d61e74bfef2b4ce212d95fd43d3e3b239e080ba9fab62eae23cd4b54b6b466fad3192845b43d4212ccd667

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0D45A3FB\JSON.dll

Filesize
411KB

MD5
f5fd966e29f5c359f78cb61a571d1be4

SHA1
a55e7ed593b4bc7a77586da0f1223cfd9d51a233

SHA256
d2c8d26f95f55431e632c8581154db7c19547b656380e051194a9d2583dd2156

SHA512
d99e6fe250bb106257f86135938635f6e7ad689b2c11a96bb274f4c4c5e9a85cfacba40122dbc953f77b5d33d886c6af30bff821f10945e15b21a24b66f6c8be

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0D45A3FB\Locales\i18n.en-US.txt

Filesize
17KB

MD5
d8316371294c2e3fd9cded40261e0e17

SHA1
39a33c431d2a5085fa421f7183cd705d8282d010

SHA256
2b8f16a7ba900b7d5602697c2a028cf4a55f451394ef36ad1b83fe94aa5f534d

SHA512
98e55fdaec682e1ac92386115862a17df2ba14f6991125b548bcd1699ecf88043ba26ad28772434a9e25e50f46ed24ffd03414ce4f01be630b2daf15e4ad55e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0D45A3FB\ThemeFile

Filesize
80KB

MD5
c3e6bab4f92ee40b9453821136878993

SHA1
94493a6b3dfb3135e5775b7d3be227659856fbc4

SHA256
de1a2e6b560e036da5ea6b042e29e81a5bfcf67dde89670c332fc5199e811ba6

SHA512
a64b6b06b3a0f3591892b60e59699682700f4018b898efe55d6bd5fb417965a55027671c58092d1eb7e21c2dbac42bc68dfb8c70468d98bed45a8cff0e945895

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA02E.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstF47E.tmp\BgWorker.dll

Filesize
11KB

MD5
4908fd4ede7b20e3bddb898a4b1dfe87

SHA1
9eb6b8adea38282ea5e113d86179b15d71f270d7

SHA256
b7997801ed63a13e23b0f93f1efd36e8b1d0259a3da7f1932c90a869c2295d58

SHA512
478f868c5f72dc54ce31f89eaec6539d0c149bc272ad300d83b61296589ad847001e5c31cf0d5c3f831bfbba3bca3e8469e0c84edf1ef625ef0486ebf6a69c43

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstF47E.tmp\nsDui.dll

Filesize
2.5MB

MD5
4edafff231c7f658bbedba0f9b0ad874

SHA1
3693e3767049f729cddce32bc51fc03cde64ca3e

SHA256
5f9d6738713478978aa5b7d2fd6e765eeae4a3801b36ce299e88135a86ae47c3

SHA512
65ae748ba9ab8febe78db98a74c5d19fe5d2c8c9d6afab8c2cdc11d703dd6aeab92e430103997bdc999afdb2d2b4ab872e7d230ca82d883b425824b5d2156d51

Download Submit
\Users\Admin\AppData\Local\Temp\7zS0D45A3FB\BlueStacksInstaller.exe

Filesize
561KB

MD5
15a1ecf2c6c6ab3f457bdc0dd6f0ee5c

SHA1
250f1dc7fbb0d067ba696e9d3341e24f63ed3603

SHA256
f7240bf41e75c23b43c42ab03a070b373688ff36ee23954af237fe6c10b30f56

SHA512
9c2e4aea6d412f0cdee43d12c0910ec133779fc63b4262645eb1db2e141eb4df7e68a5b2fbf6a0ab4fd47c762efaeff4287fa21a4bc86f5c292ca10f98d31db2

Download Submit
\Users\Admin\AppData\Local\Temp\7zS0D45A3FB\BlueStacksInstaller.exe

Filesize
561KB

MD5
15a1ecf2c6c6ab3f457bdc0dd6f0ee5c

SHA1
250f1dc7fbb0d067ba696e9d3341e24f63ed3603

SHA256
f7240bf41e75c23b43c42ab03a070b373688ff36ee23954af237fe6c10b30f56

SHA512
9c2e4aea6d412f0cdee43d12c0910ec133779fc63b4262645eb1db2e141eb4df7e68a5b2fbf6a0ab4fd47c762efaeff4287fa21a4bc86f5c292ca10f98d31db2

Download Submit
\Users\Admin\AppData\Local\Temp\7zS0D45A3FB\BlueStacksInstaller.exe

Filesize
561KB

MD5
15a1ecf2c6c6ab3f457bdc0dd6f0ee5c

SHA1
250f1dc7fbb0d067ba696e9d3341e24f63ed3603

SHA256
f7240bf41e75c23b43c42ab03a070b373688ff36ee23954af237fe6c10b30f56

SHA512
9c2e4aea6d412f0cdee43d12c0910ec133779fc63b4262645eb1db2e141eb4df7e68a5b2fbf6a0ab4fd47c762efaeff4287fa21a4bc86f5c292ca10f98d31db2

Download Submit
\Users\Admin\AppData\Local\Temp\7zS0D45A3FB\BlueStacksInstaller.exe

Filesize
561KB

MD5
15a1ecf2c6c6ab3f457bdc0dd6f0ee5c

SHA1
250f1dc7fbb0d067ba696e9d3341e24f63ed3603

SHA256
f7240bf41e75c23b43c42ab03a070b373688ff36ee23954af237fe6c10b30f56

SHA512
9c2e4aea6d412f0cdee43d12c0910ec133779fc63b4262645eb1db2e141eb4df7e68a5b2fbf6a0ab4fd47c762efaeff4287fa21a4bc86f5c292ca10f98d31db2

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\BgWorker.dll

Filesize
11KB

MD5
4908fd4ede7b20e3bddb898a4b1dfe87

SHA1
9eb6b8adea38282ea5e113d86179b15d71f270d7

SHA256
b7997801ed63a13e23b0f93f1efd36e8b1d0259a3da7f1932c90a869c2295d58

SHA512
478f868c5f72dc54ce31f89eaec6539d0c149bc272ad300d83b61296589ad847001e5c31cf0d5c3f831bfbba3bca3e8469e0c84edf1ef625ef0486ebf6a69c43

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\BgWorker.dll

Filesize
11KB

MD5
4908fd4ede7b20e3bddb898a4b1dfe87

SHA1
9eb6b8adea38282ea5e113d86179b15d71f270d7

SHA256
b7997801ed63a13e23b0f93f1efd36e8b1d0259a3da7f1932c90a869c2295d58

SHA512
478f868c5f72dc54ce31f89eaec6539d0c149bc272ad300d83b61296589ad847001e5c31cf0d5c3f831bfbba3bca3e8469e0c84edf1ef625ef0486ebf6a69c43

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\nsDialogs.dll

Filesize
18KB

MD5
a687ad6a55a325cf425fc3d0119a018c

SHA1
40d32e19ca4943a22f92203d70467911c9a286f3

SHA256
9933f4a2f589b874e782eee6fd0518529bdcb9baf2bc72eb6166ff664fdfcb8f

SHA512
99b5a9a7762b325b4f8ae355eafbc65b68b73db686fee285f26285fbabcff5caeed77d7ea867133e5160f714f0329e0555faf85ae36a17a874eab175e3630020

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\nsDui.dll

Filesize
2.5MB

MD5
4edafff231c7f658bbedba0f9b0ad874

SHA1
3693e3767049f729cddce32bc51fc03cde64ca3e

SHA256
5f9d6738713478978aa5b7d2fd6e765eeae4a3801b36ce299e88135a86ae47c3

SHA512
65ae748ba9ab8febe78db98a74c5d19fe5d2c8c9d6afab8c2cdc11d703dd6aeab92e430103997bdc999afdb2d2b4ab872e7d230ca82d883b425824b5d2156d51

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\nsDui.dll

Filesize
2.5MB

MD5
4edafff231c7f658bbedba0f9b0ad874

SHA1
3693e3767049f729cddce32bc51fc03cde64ca3e

SHA256
5f9d6738713478978aa5b7d2fd6e765eeae4a3801b36ce299e88135a86ae47c3

SHA512
65ae748ba9ab8febe78db98a74c5d19fe5d2c8c9d6afab8c2cdc11d703dd6aeab92e430103997bdc999afdb2d2b4ab872e7d230ca82d883b425824b5d2156d51

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\nsDui.dll

Filesize
2.5MB

MD5
4edafff231c7f658bbedba0f9b0ad874

SHA1
3693e3767049f729cddce32bc51fc03cde64ca3e

SHA256
5f9d6738713478978aa5b7d2fd6e765eeae4a3801b36ce299e88135a86ae47c3

SHA512
65ae748ba9ab8febe78db98a74c5d19fe5d2c8c9d6afab8c2cdc11d703dd6aeab92e430103997bdc999afdb2d2b4ab872e7d230ca82d883b425824b5d2156d51

Download Submit
\Users\Admin\AppData\Local\Temp\nstF47E.tmp\nsis7z.dll

Filesize
432KB

MD5
509715e6a06460142f777ac80652f50b

SHA1
52ffc1f903015467dc28d7707e6e6f558526e20a

SHA256
56cb147d8ada5d266f1e0f7e8745b00cd4756d426ab043bb66a045f98898032f

SHA512
afc620f0a007e8055426e971e16d498a030ef8cc7e34f4218b6baed0e204a6da5719751d504033b51f03f803e54f6675d61e1d53996903a73e1f52b4f09f4d0e

Download Submit
memory/1000-185-0x000000001AF20000-0x000000001AFA0000-memory.dmp

Filesize
512KB

Download
memory/1000-200-0x000000001AF20000-0x000000001AFA0000-memory.dmp

Filesize
512KB

Download
memory/1000-176-0x0000000000340000-0x00000000003A8000-memory.dmp

Filesize
416KB

Download
memory/1000-177-0x000000001AF20000-0x000000001AFA0000-memory.dmp

Filesize
512KB

Download
memory/1000-174-0x0000000001240000-0x00000000012D0000-memory.dmp

Filesize
576KB

Download
memory/1000-186-0x0000000000280000-0x000000000028A000-memory.dmp

Filesize
40KB

Download
memory/1000-198-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/1000-202-0x000000001AF20000-0x000000001AFA0000-memory.dmp

Filesize
512KB

Download
memory/1000-201-0x000000001AF20000-0x000000001AFA0000-memory.dmp

Filesize
512KB

Download
memory/1000-199-0x000000001AF20000-0x000000001AFA0000-memory.dmp

Filesize
512KB

Download
memory/2472-9916-0x00000000008F0000-0x0000000000980000-memory.dmp

Filesize
576KB

Download
memory/2472-9917-0x00000000003E0000-0x0000000000448000-memory.dmp

Filesize
416KB

Download
memory/2472-9918-0x000000001AF00000-0x000000001AF80000-memory.dmp

Filesize
512KB

Download
memory/2472-9919-0x000000001AF00000-0x000000001AF80000-memory.dmp

Filesize
512KB

Download
memory/2472-9921-0x000000001AF00000-0x000000001AF80000-memory.dmp

Filesize
512KB

Download
memory/2472-9920-0x00000000020B0000-0x00000000020BA000-memory.dmp

Filesize
40KB

Download
memory/2472-9922-0x000000001AF00000-0x000000001AF80000-memory.dmp

Filesize
512KB

Download