Analysis

  • max time kernel
    33s
  • max time network
    39s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    13/07/2023, 00:01

General

  • Target

    BlueStacks10Installer_10.2.10.1002_native_87a19360a908a263b35c32e44aee7762_MzsxNSwwOzUsMTsxNSw0OzE1.exe

  • Size

    897KB

  • MD5

    f7e5464eb87a09f9831e5154512004b6

  • SHA1

    04a35bfd2bd2dd96da428df3de78d5d22fe30271

  • SHA256

    328cc1ada1bc88ecf8ffa10525069123ac5b027121326fc51aaf6798f09636c5

  • SHA512

    500795616e448b34b3d608d4dd897a35891eda5f85d3ce189d7a58245a903ef177a81ee01e7a35052504fb5d3bc8a7935ecf20a6e2f453f72f1567b3b0e158d5

  • SSDEEP

    12288:GivtCXQd0gjKX7zuqGKhFGPDy1xBVG2xsvNdeuCad2YteFph8iMeKMD7pY4JqG76:GivtCXWeGKhFGCG2xs6eQGGpTlNbJq6i

Score
4/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BlueStacks10Installer_10.2.10.1002_native_87a19360a908a263b35c32e44aee7762_MzsxNSwwOzUsMTsxNSw0OzE1.exe
    "C:\Users\Admin\AppData\Local\Temp\BlueStacks10Installer_10.2.10.1002_native_87a19360a908a263b35c32e44aee7762_MzsxNSwwOzUsMTsxNSw0OzE1.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2184
    • C:\Users\Admin\AppData\Local\Temp\7zS8886F3D6\BlueStacksInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS8886F3D6\BlueStacksInstaller.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2744
      • C:\Users\Admin\AppData\Local\Temp\7zS8886F3D6\HD-CheckCpu.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS8886F3D6\HD-CheckCpu.exe" --cmd checkHypervEnabled
        3⤵
        • Executes dropped EXE
        PID:1060
      • C:\Users\Admin\AppData\Local\Temp\7zS8886F3D6\HD-CheckCpu.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS8886F3D6\HD-CheckCpu.exe" --cmd checkSSE4
        3⤵
        • Executes dropped EXE
        PID:1928
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:1808

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      e4999b2db93de7eaf76f4e96619c320e

      SHA1

      230893016de7a022a8afba768201d28105e34715

      SHA256

      e062a733c4110eb311f83ac3f77f99d633d3c3b699ff843c073fe849709e9712

      SHA512

      a2eb8ce1f8b018f42ccb2e549e86c4bd662ff9c01f8e59c85ab7140da9b9e1449f93164907d4506d3add4bb912ef6272781d81cc952d60366dc9506b90b424a3

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      fe3fb529b863b4773f565e445b70793d

      SHA1

      f76fd4ee62bdd9fb45771d7295e4f09c7ea2a8b8

      SHA256

      45d509856c51ac35dcef10f9d97a3f00f321899bf3ad9316526ff10a7719b37f

      SHA512

      3e9f0170e97743710c5e36acc41a5f41f5ca493bc76a6e2fbdb72fba5be04052c53a56a9ac272f07562fef293f049f5be2573984a20fb6c74d4d5de27f36d458

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      2b842c0f434bb38363294eb82b4a7f66

      SHA1

      55d3af3b836785caee80e17a1d655aabd67bed3d

      SHA256

      3968e909c58c99fb649b45ebf98c1a64be47093daf5aaf37adf38c777e45f454

      SHA512

      a125dcfdae50956ad01be8b7cd0959043961f6d699de48a62a1f3bd4697ca0e8aa2ae5648d7cee1ad059295e8daf6a6df73f8ffdb5a5b234d3841788b64a3450

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      0cf0598ca60bff28605b73a2dede32ee

      SHA1

      53c6df68a52baea252445d6b7fadbf664a135ace

      SHA256

      8cbf332c833981cfcfea8ba7feb249ab050e422a2a31912fbc5ef1cc2028f6b5

      SHA512

      9bca57fa2b87088932e4ae4e8cde6cc72f1064ff681747769c14a996f4ed36e364e6209bc849a14506e993dadae09db85d43789971ca821bb7250916da0d58f3

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      92d750559fe6695c9a3147ba9e340f83

      SHA1

      c9f26225e15d95b46dd1f295e55f5f1b4b9b6993

      SHA256

      26f8930c2e5a9f2f330293afc71f9c1b4964485fb6ba4c288391e6fc87e458af

      SHA512

      ce2f2cd175e18e870f81eb12a955926019b70b6a5a125884e1fc638e5b4ab0cb0a04c32bad508fce039552f139dbc064dc118b0a8b05623fa4a7cc5c58e337ce

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      5b527e9b35df7a25096e1bb39829204f

      SHA1

      a0e363b6f2b7fb0ac1862ac32ad5126540e94f7f

      SHA256

      55975d2a3a6f606e9e55c4d32ec900b8f15549006d0f2631c58314be68c7f43b

      SHA512

      8b60cb42b2dd88e48ab04cfc0f698f70a5d8e8a77e1f0f69a9250cef7af4490d950755c4747177aa36226fb74a87dfc4c1c308177703673ae3b598485cb3135f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      82c8a83594f885044b06d0223277e2c8

      SHA1

      15a50bc3354477b478e29009b52161839daee29c

      SHA256

      2b0ede6260d9d8b6da464beada8abcf166dfc1bfd1e23c73e073d08417fb1043

      SHA512

      4d2582c355751e51a1deb0cd1eecf320bfc3594fce005a4807c0b2cd1b30b68d13f895250be1daebbc536e60e294263c0c8715f67e542e013f64116f077f1e5a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      36bb728dd32089f984aa36b064230ebd

      SHA1

      b4da8cbdf8370c6534325f5f8fe691630524d739

      SHA256

      f0f782a96a6a00a1255c658a1daa17c160088939e3bf90cd80ddd4c37e780926

      SHA512

      ddc4a60fd2d4410ed214666bbfcc745c148b020ff3ac4e253167462b8a42a9ac7073aadd984006ed6e3eba500ee6d2dded85bfa354b38b378a680ba3dc26de77

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      3c0a2b6ffb3be144b37c97be174dd998

      SHA1

      057d33d24900123c8a1f966ff83dde53636104ba

      SHA256

      bb3607cd0007ae40cbf6d22691dbc31d681c4cf0cf243fbd8cad2e9901339b82

      SHA512

      e8bbd11b25469f9b09ce2b8743823d39c42f18df98dcbabc55b120110761d58724a612e023ac3196d0b174fa44f4d461267fdcc72f1e635b87714497e28d0ed8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      040c17fee6ffd450477fe166767fffa9

      SHA1

      7e217c9bd1659f41ffdcba465fbeb3350046b2f3

      SHA256

      e468f7a56cf78a787b9675b7940ccb5b434e72f1ec4c170af85e54f53f3ebaea

      SHA512

      603f7ca49a7dcc484d5cdc854fe00405c941e2a0438abe914bb4281bfceec59dff434a53b14c97e12e56fb7ed5b0568571dc52cbffc34895ed8793ca64fd750f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      640008dbcacb1ba430fc0f753cf99bac

      SHA1

      446904e3adeba21a992fc18e9ed2e5b01f22192b

      SHA256

      ebcfe73fa1c163872c7d48b30bd73ff58b80845e3a3eb90824dbe2cd235baca3

      SHA512

      e7bd21389878969f2287f5160d4dd5b7b5fb9df5b94efbe4b67931010d8c0f939d222a486b9fd464ef4371a46e87b643f9bb91cf2bbc60f1e2ca963a8ec12ef8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      4cef832ec40593c10590b4469fad7883

      SHA1

      e8a3c349b5b4c6b79808c717ed9eb8944e19c6d9

      SHA256

      7119bc189bcf071dc8e1cc53f74ad4223653ebed9d1aaf42bb0255e32fc4cd86

      SHA512

      51598cdbb7466ad124ccc433874b3898efa62078c699c7887e416f4c58c7f4aac921c8d9aabe3c7e2638c11699a28e1ea6e888d7adbd33066cc6787d94800bc2

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      d292d6c0e7abe4ac95c549895428d83a

      SHA1

      b453185cd569c18024b38c818cfc2f59ab937506

      SHA256

      8a7ffa36e4498fd5df16982a03a72dd282dbb3fa007f7d389cbb0afcb33e179c

      SHA512

      9f7954db3c75dc5b7df39b5775d639b81b0b1c8879bde7792db0532255bf0d10b7b77295aae3f181a78a37d6c90f0714853a063dfdc8bb901d1d76ad3f747cd3

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      c6cfb9f25add378f07c5457e709c0be2

      SHA1

      4e95c7861718d964dca00e17e981b65f436dd6a7

      SHA256

      128c2059cf97c6bde3a407caf694718a16cd91124745a5df7fd89c3a5cdc324a

      SHA512

      e99e61726eb9ff64b86d50b503536fa528b77b1d7c317a1488c770e888fc66e6e63e67095a0b3d6aa0dc5340e07bd94e1f05eb8637c12567e619c041c8f72be3

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      9dfbc138d94bed0673bbfcddbadb4b6f

      SHA1

      fbf0fdeba969a37c7acc447016fd42cba402f611

      SHA256

      ec7ddab7ba6b594ef7d1a4c6c3f564aa5292204abd6c17881753464ca7e23e94

      SHA512

      31a2e493a413a32f08ba2a2bca5261507628bf03a958849e61e02edeaff8e24b1888df63c3d75b2df7ea100e91eeba2da247709522fee466073aecc9c02edd57

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      f621b3a355b93441814c67930ef873db

      SHA1

      749cb26a65a302de5b3c3766ecd79f1007f49a8f

      SHA256

      f9a0a3f104f6f396b89d620e5f3079232ae9f0bd82e6093867c62183c0d068d4

      SHA512

      070169f490fb341a8eef54989d33db9b8ddb7caaf70c84285c16e866dbb03e06bbecdd2f8b1c909a9383cc5f1315352c86fe57f7f9013c2e162eb1803e45d769

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      693a84622ece6d2fb4f1178e024692d4

      SHA1

      790138c09b9563fcd3561b7eb5656a4314ecd320

      SHA256

      14e605cb2bc29a9772283f54540c6445e1235e09431618bea970b0bc98383822

      SHA512

      7c65fec3fd95ef7e77ace47f859b0721aa2a157150029a16a726cedc01d1d91973456b83d24eaf52cea80b3e8148916b9a49dd15fa0d4779442e38ffddf83fc5

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      0eeb672abc27716b26f03fb9356b1f96

      SHA1

      5cd9fff5ef6775a967506ac80a4f0e23b351c1ee

      SHA256

      b2544e6678b348f46b3b36735b28130e90f0fcf691e8985a6bfc3fcd07afcb94

      SHA512

      982e381c838bc8db50b0b52dccbfe531af4a52aa6ca37920b8163a5ad1caf08df5c3f2a08b2ef6fc8dd3a6d8caec738798941dc212544695c5813455ed2bf653

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      ea893430da40b5434f96a29ca4d35f45

      SHA1

      8be1a2868d2270080d2ca56357d784df93d5f76c

      SHA256

      8f297e40159a500109402b2ca4b0619d94283d5a0466c9f502935a2c3bb45974

      SHA512

      e2efe840e0b47b9b815a83d640a3542a89c9aacb71ed59a4c5953a6676cc8647712705609b02a7e015185766ca0ba4619ae090287555c006e137938e691d8e81

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      5fbe6b1423af6e24d0b1b84576b7fb96

      SHA1

      776ae545ce96461afb4a88461dfb5061cd705c5b

      SHA256

      b55e464bb5bfad30b629c735f497334277af6861a4058334c394fc9ff7a55469

      SHA512

      90627386301b769dfe62a346f353e222004f4b8ba51187c472288fac9dfc9d840cf45ba676ada19c2a561790a01d1781df7a03c1fe8920060eae39007cd2cf62

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      d36797f76f4bfc412cf52cda086e7f0e

      SHA1

      942fe9011f6ed3147d416eef327279d46b5f77fa

      SHA256

      a529902ca7cec279a8a03b8f488e022a85e2de74e6d3fe0013bf56b79832a48a

      SHA512

      cb24f229dfaf836c31dfdf0473857d4b4f0d83214a5fd1838eb8c7df946e6668f01e89e66d56ba8d433adcedaf6d062e52d669139979a5b5290966d18084f453

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      48c9baeda262b506bb909ad50690d781

      SHA1

      5af6e7f995309c1f4d757d6a91834f3798283a36

      SHA256

      c86725dcaee4e9d5deded975a29d4d7960176accbe69aa4de1494f36b3f3d18c

      SHA512

      cca4ea9e62bc8fea6fd80ef2f7742e0e24a56bafbd5f265132e4cbe8b0b125df522305a6fc4f728c6a97e03efb2756ef7368054ddf5e1b0623c8de107eb0050f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      e99e614c726bd22459c81a620319a0c2

      SHA1

      34a97df5d14a119e075df8bd54c1d74e09dd784f

      SHA256

      0908aceb6bddb6a5c8348fc2d76bdbd044a07052d53b12c6cb2be03f90760eac

      SHA512

      8c0d4bfb2ca416531bd5f1d6d1461201779ca3a001b64da8ecf4ed763de39f469f94a0bbc3b3b2c9845f640d5527c3fbac156745503e26f8af457e67e05ef8a9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      7454242d73bb6fad7675a6340d0891dd

      SHA1

      cf3f9dbdef0a298f0eb8c887ce3ba2de315feaa3

      SHA256

      86c645807733b7fe5a86c07d9f24b18a2e8904151672d101ddf346442825224f

      SHA512

      e700c63177e68f45ededf83efa3d614b750881b8fbb0deccb2869ffe8dba797cdb7ca54e881ed72736af740e58aeb250dce70b97ee02c8601c78a4373e5196be

    • C:\Users\Admin\AppData\Local\Temp\7zS8886F3D6\Assets\exit_close.png

      Filesize

      670B

      MD5

      26eb04b9e0105a7b121ea9c6601bbf2a

      SHA1

      efc08370d90c8173df8d8c4b122d2bb64c07ccd8

      SHA256

      7aaef329ba9fa052791d1a09f127551289641ea743baba171de55faa30ec1157

      SHA512

      9df3c723314d11a6b4ce0577eb61488061f2f96a9746a944eb6a4ee8c0c4d29131231a1b20988ef5454b79f9475b43d62c710839ecc0a9c98324f977cab6db68

    • C:\Users\Admin\AppData\Local\Temp\7zS8886F3D6\Assets\loader.png

      Filesize

      279B

      MD5

      03903fd42ed2ee3cb014f0f3b410bcb4

      SHA1

      762a95240607fe8a304867a46bc2d677f494f5c2

      SHA256

      076263cc65f9824f4f82eb6beaa594d1df90218a2ee21664cf209181557e04b1

      SHA512

      8b0e717268590e5287c07598a06d89220c5e9a33cd1c29c55f8720321f4b3efc869d20c61fcc892e13188d77f0fdc4c73a2ee6dece174bf876fcc3a6c5683857

    • C:\Users\Admin\AppData\Local\Temp\7zS8886F3D6\Assets\minimize_progress.png

      Filesize

      212B

      MD5

      1504b80f2a6f2d3fefc305da54a2a6c2

      SHA1

      432a9d89ebc2f693836d3c2f0743ea5d2077848d

      SHA256

      2f62d4e8c643051093f907058dddc78cc525147d9c4f4a0d78b4d0e5c90979f6

      SHA512

      675db04baf3199c8d94af30a1f1c252830a56a90f633c3a72aa9841738b04242902a5e7c56dd792626338e8b7eabc1f359514bb3a2e62bc36c16919e196cfd94

    • C:\Users\Admin\AppData\Local\Temp\7zS8886F3D6\BlueStacksInstaller.exe

      Filesize

      604KB

      MD5

      8fb32dffe84b6282e1e67296c4380510

      SHA1

      7dc43dbb76df9c681b4c9e331c0f1377505104bf

      SHA256

      c4fa55342169789e601314813369c8ad49c802d32d0ab9c7e343bdc4e13d8a63

      SHA512

      d1437fe1e459b7f84f40628b5d5c902ab9b7a86f517935f225a114dcc106ff9ebba82f5ef78fc249422a73a38ed7aefbacaefca31a613accd8c2a97c4754ca96

    • C:\Users\Admin\AppData\Local\Temp\7zS8886F3D6\BlueStacksInstaller.exe

      Filesize

      604KB

      MD5

      8fb32dffe84b6282e1e67296c4380510

      SHA1

      7dc43dbb76df9c681b4c9e331c0f1377505104bf

      SHA256

      c4fa55342169789e601314813369c8ad49c802d32d0ab9c7e343bdc4e13d8a63

      SHA512

      d1437fe1e459b7f84f40628b5d5c902ab9b7a86f517935f225a114dcc106ff9ebba82f5ef78fc249422a73a38ed7aefbacaefca31a613accd8c2a97c4754ca96

    • C:\Users\Admin\AppData\Local\Temp\7zS8886F3D6\BlueStacksInstaller.exe

      Filesize

      604KB

      MD5

      8fb32dffe84b6282e1e67296c4380510

      SHA1

      7dc43dbb76df9c681b4c9e331c0f1377505104bf

      SHA256

      c4fa55342169789e601314813369c8ad49c802d32d0ab9c7e343bdc4e13d8a63

      SHA512

      d1437fe1e459b7f84f40628b5d5c902ab9b7a86f517935f225a114dcc106ff9ebba82f5ef78fc249422a73a38ed7aefbacaefca31a613accd8c2a97c4754ca96

    • C:\Users\Admin\AppData\Local\Temp\7zS8886F3D6\BlueStacksInstaller.exe.config

      Filesize

      324B

      MD5

      1b456d88546e29f4f007cd0bf1025703

      SHA1

      e5c444fcfe5baf2ef71c1813afc3f2c1100cab86

      SHA256

      d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb

      SHA512

      c545e416c841b8786e4589fc9ca2b732b16cdd759813ec03f558332f2436f165ec1ad2fbc65012b5709fa19ff1e8396639c17bfad150cabeb51328a39ea556e6

    • C:\Users\Admin\AppData\Local\Temp\7zS8886F3D6\HD-CheckCpu.exe

      Filesize

      200KB

      MD5

      81234fd9895897b8d1f5e6772a1b38d0

      SHA1

      80b2fec4a85ed90c4db2f09b63bd8f37038db0d3

      SHA256

      2e14887f3432b4a313442247fc669f891dbdad7ef1a2d371466a2afa88074a4c

      SHA512

      4c924d6524dc2c7d834bfc1a0d98b21753a7bf1e94b1c2c6650f755e6f265512d3a963bc7bc745351f79f547add57c37e29ba9270707edbf62b60df3a541bc16

    • C:\Users\Admin\AppData\Local\Temp\7zS8886F3D6\HD-CheckCpu.exe

      Filesize

      200KB

      MD5

      81234fd9895897b8d1f5e6772a1b38d0

      SHA1

      80b2fec4a85ed90c4db2f09b63bd8f37038db0d3

      SHA256

      2e14887f3432b4a313442247fc669f891dbdad7ef1a2d371466a2afa88074a4c

      SHA512

      4c924d6524dc2c7d834bfc1a0d98b21753a7bf1e94b1c2c6650f755e6f265512d3a963bc7bc745351f79f547add57c37e29ba9270707edbf62b60df3a541bc16

    • C:\Users\Admin\AppData\Local\Temp\7zS8886F3D6\HD-CheckCpu.exe

      Filesize

      200KB

      MD5

      81234fd9895897b8d1f5e6772a1b38d0

      SHA1

      80b2fec4a85ed90c4db2f09b63bd8f37038db0d3

      SHA256

      2e14887f3432b4a313442247fc669f891dbdad7ef1a2d371466a2afa88074a4c

      SHA512

      4c924d6524dc2c7d834bfc1a0d98b21753a7bf1e94b1c2c6650f755e6f265512d3a963bc7bc745351f79f547add57c37e29ba9270707edbf62b60df3a541bc16

    • C:\Users\Admin\AppData\Local\Temp\7zS8886F3D6\JSON.dll

      Filesize

      411KB

      MD5

      f5fd966e29f5c359f78cb61a571d1be4

      SHA1

      a55e7ed593b4bc7a77586da0f1223cfd9d51a233

      SHA256

      d2c8d26f95f55431e632c8581154db7c19547b656380e051194a9d2583dd2156

      SHA512

      d99e6fe250bb106257f86135938635f6e7ad689b2c11a96bb274f4c4c5e9a85cfacba40122dbc953f77b5d33d886c6af30bff821f10945e15b21a24b66f6c8be

    • C:\Users\Admin\AppData\Local\Temp\7zS8886F3D6\Locales\i18n.en-US.txt

      Filesize

      18KB

      MD5

      2e67781c074a702af42f2c2259a9e94d

      SHA1

      c40ec186835abd9e8cd1976b0005e57e17c672f2

      SHA256

      858f09be7e462198c0e77b2b84de544158789f53eff200be78eab70a6acadd1a

      SHA512

      4adbf7cb6f1621ed1d3904beaad55eb5229475c9007c7ba41720d9dcc9b3f63c849b9a5cd9aaf86c5a063693b80c1b39fdf41eb2b026f35cd15a5d92d5ce843a

    • C:\Users\Admin\AppData\Local\Temp\7zS8886F3D6\ThemeFile

      Filesize

      80KB

      MD5

      c3e6bab4f92ee40b9453821136878993

      SHA1

      94493a6b3dfb3135e5775b7d3be227659856fbc4

      SHA256

      de1a2e6b560e036da5ea6b042e29e81a5bfcf67dde89670c332fc5199e811ba6

      SHA512

      a64b6b06b3a0f3591892b60e59699682700f4018b898efe55d6bd5fb417965a55027671c58092d1eb7e21c2dbac42bc68dfb8c70468d98bed45a8cff0e945895

    • C:\Users\Admin\AppData\Local\Temp\CabE1C9.tmp

      Filesize

      62KB

      MD5

      3ac860860707baaf32469fa7cc7c0192

      SHA1

      c33c2acdaba0e6fa41fd2f00f186804722477639

      SHA256

      d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

      SHA512

      d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

    • C:\Users\Admin\AppData\Local\Temp\TarE249.tmp

      Filesize

      164KB

      MD5

      4ff65ad929cd9a367680e0e5b1c08166

      SHA1

      c0af0d4396bd1f15c45f39d3b849ba444233b3a2

      SHA256

      c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

      SHA512

      f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

    • \Users\Admin\AppData\Local\Temp\7zS8886F3D6\BlueStacksInstaller.exe

      Filesize

      604KB

      MD5

      8fb32dffe84b6282e1e67296c4380510

      SHA1

      7dc43dbb76df9c681b4c9e331c0f1377505104bf

      SHA256

      c4fa55342169789e601314813369c8ad49c802d32d0ab9c7e343bdc4e13d8a63

      SHA512

      d1437fe1e459b7f84f40628b5d5c902ab9b7a86f517935f225a114dcc106ff9ebba82f5ef78fc249422a73a38ed7aefbacaefca31a613accd8c2a97c4754ca96

    • \Users\Admin\AppData\Local\Temp\7zS8886F3D6\BlueStacksInstaller.exe

      Filesize

      604KB

      MD5

      8fb32dffe84b6282e1e67296c4380510

      SHA1

      7dc43dbb76df9c681b4c9e331c0f1377505104bf

      SHA256

      c4fa55342169789e601314813369c8ad49c802d32d0ab9c7e343bdc4e13d8a63

      SHA512

      d1437fe1e459b7f84f40628b5d5c902ab9b7a86f517935f225a114dcc106ff9ebba82f5ef78fc249422a73a38ed7aefbacaefca31a613accd8c2a97c4754ca96

    • \Users\Admin\AppData\Local\Temp\7zS8886F3D6\BlueStacksInstaller.exe

      Filesize

      604KB

      MD5

      8fb32dffe84b6282e1e67296c4380510

      SHA1

      7dc43dbb76df9c681b4c9e331c0f1377505104bf

      SHA256

      c4fa55342169789e601314813369c8ad49c802d32d0ab9c7e343bdc4e13d8a63

      SHA512

      d1437fe1e459b7f84f40628b5d5c902ab9b7a86f517935f225a114dcc106ff9ebba82f5ef78fc249422a73a38ed7aefbacaefca31a613accd8c2a97c4754ca96

    • \Users\Admin\AppData\Local\Temp\7zS8886F3D6\BlueStacksInstaller.exe

      Filesize

      604KB

      MD5

      8fb32dffe84b6282e1e67296c4380510

      SHA1

      7dc43dbb76df9c681b4c9e331c0f1377505104bf

      SHA256

      c4fa55342169789e601314813369c8ad49c802d32d0ab9c7e343bdc4e13d8a63

      SHA512

      d1437fe1e459b7f84f40628b5d5c902ab9b7a86f517935f225a114dcc106ff9ebba82f5ef78fc249422a73a38ed7aefbacaefca31a613accd8c2a97c4754ca96

    • memory/2744-175-0x000000001ADB0000-0x000000001AE30000-memory.dmp

      Filesize

      512KB

    • memory/2744-174-0x0000000000B40000-0x0000000000BA8000-memory.dmp

      Filesize

      416KB

    • memory/2744-347-0x000000001A840000-0x000000001A841000-memory.dmp

      Filesize

      4KB

    • memory/2744-172-0x00000000011A0000-0x000000000123A000-memory.dmp

      Filesize

      616KB

    • memory/2744-762-0x000000001ADB0000-0x000000001AE30000-memory.dmp

      Filesize

      512KB

    • memory/2744-255-0x00000000004E0000-0x00000000004EA000-memory.dmp

      Filesize

      40KB

    • memory/2744-1133-0x000000001ADB0000-0x000000001AE30000-memory.dmp

      Filesize

      512KB

    • memory/2744-1134-0x00000000004E0000-0x00000000004EA000-memory.dmp

      Filesize

      40KB

    • memory/2744-254-0x00000000004E0000-0x00000000004EA000-memory.dmp

      Filesize

      40KB

    • memory/2744-253-0x000000001ADB0000-0x000000001AE30000-memory.dmp

      Filesize

      512KB