Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

23/02/2024, 21:48

240223-1nvq9aae3z 5

23/02/2024, 21:44

240223-1lzx7ahe79 5

Analysis

  • max time kernel
    9s
  • max time network
    52s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/02/2024, 21:44

General

  • Target

    BlueStacks10Installer_10.10.7.1004_native_ce7831f0822d7ceda4024b72f1ac8b5b_MDs1LDM7MTUsMTsxNSw0OzE1.exe

  • Size

    910KB

  • MD5

    137ba5b3972ec34519a73c9ce33fa437

  • SHA1

    dd9dc2d0fb7e9554d24bb023fbf198dcaae1591e

  • SHA256

    3e708816fbbc73b2b3de8b8fdad8d0e5328e55d8f91f6acf6673d0c517a5a732

  • SHA512

    1614b37628cdb2112617bf5f65adfe63675285303db00f9ed36ea5f48fcef687e7462c452d01219b684ed21623353000796128e43e76dcdba69322f0d743b465

  • SSDEEP

    24576:ZivtCXWeGKk9Txt9OkcfOT5+3S8L24ier33laL:EtCXWPtvz5cfid81iI1aL

Score
5/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BlueStacks10Installer_10.10.7.1004_native_ce7831f0822d7ceda4024b72f1ac8b5b_MDs1LDM7MTUsMTsxNSw0OzE1.exe
    "C:\Users\Admin\AppData\Local\Temp\BlueStacks10Installer_10.10.7.1004_native_ce7831f0822d7ceda4024b72f1ac8b5b_MDs1LDM7MTUsMTsxNSw0OzE1.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4276
    • C:\Users\Admin\AppData\Local\Temp\7zS4B0248A7\BlueStacksInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS4B0248A7\BlueStacksInstaller.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2576
      • C:\Users\Admin\AppData\Local\Temp\7zS4B0248A7\HD-CheckCpu.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS4B0248A7\HD-CheckCpu.exe" --cmd checkHypervEnabled
        3⤵
          PID:3828
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cloud.bluestacks.com/bs3/help_articles?article=RawMode_help&oem=nxt&locale=en-US&image_name=Nougat32
          3⤵
            PID:3584
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffd50446f8,0x7fffd5044708,0x7fffd5044718
              4⤵
                PID:4996
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,17382937331789945010,4157309815950489084,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
                4⤵
                  PID:3568
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,17382937331789945010,4157309815950489084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
                  4⤵
                    PID:1256
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,17382937331789945010,4157309815950489084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
                    4⤵
                      PID:648
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17382937331789945010,4157309815950489084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:1
                      4⤵
                        PID:3604
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17382937331789945010,4157309815950489084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
                        4⤵
                          PID:3024
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17382937331789945010,4157309815950489084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
                          4⤵
                            PID:3828
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2144,17382937331789945010,4157309815950489084,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5464 /prefetch:8
                            4⤵
                              PID:1260
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17382937331789945010,4157309815950489084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
                              4⤵
                                PID:1028
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17382937331789945010,4157309815950489084,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
                                4⤵
                                  PID:4024
                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,17382937331789945010,4157309815950489084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6556 /prefetch:8
                                  4⤵
                                    PID:1912
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,17382937331789945010,4157309815950489084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6556 /prefetch:8
                                    4⤵
                                      PID:412
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17382937331789945010,4157309815950489084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
                                      4⤵
                                        PID:2964
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17382937331789945010,4157309815950489084,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
                                        4⤵
                                          PID:1012
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:4420
                                    • C:\Windows\System32\CompPkgSrv.exe
                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                      1⤵
                                        PID:4724
                                      • C:\Windows\System32\CompPkgSrv.exe
                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                        1⤵
                                          PID:4276
                                        • C:\Windows\system32\AUDIODG.EXE
                                          C:\Windows\system32\AUDIODG.EXE 0x424 0x4e8
                                          1⤵
                                            PID:3840

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                            Filesize

                                            152B

                                            MD5

                                            6fbbaffc5a50295d007ab405b0885ab5

                                            SHA1

                                            518e87df81db1dded184c3e4e3f129cca15baba1

                                            SHA256

                                            b9cde79357b550b171f70630fa94754ca2dcd6228b94f311aefe2a7f1ccfc7b6

                                            SHA512

                                            011c69bf56eb40e7ac5d201c1a0542878d9b32495e94d28c2f3b480772aa541bfd492a9959957d71e66f27b3e8b1a3c13b91f4a21756a9b8263281fd509c007b

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                            Filesize

                                            152B

                                            MD5

                                            360dd5debf8bf7b89c4d88d29e38446c

                                            SHA1

                                            65afff8c78aeb12c577a523cb77cd58d401b0f82

                                            SHA256

                                            3d9debe659077c04b288107244a22f1b315bcf7495bee75151a9077e71b41eef

                                            SHA512

                                            0ee5b81f0acc82befa24a4438f2ca417ae6fac43fa8c7f264b83b4c792b1bb8d4cecb94c6cbd6facc120dc10d7e4d67e014cdb6b4db83b1a1b60144bb78f7542

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                            Filesize

                                            7KB

                                            MD5

                                            6d4102c2e9af2a84fa16b2845aa93f8a

                                            SHA1

                                            388b1e6b47fae2c4940304de8d77e18bb9391ea8

                                            SHA256

                                            bd9b848fe3cfb020ec82bad5637241388986c17c726151503e4a238ad17c314d

                                            SHA512

                                            0f9ad76462f30f73ced1708eb0acb8b3c3c9599e534609e23ec47ff4f77179223d1ed4fa199c90a90e78539cb1307dc20326a71297c5866d2feb3f74559f0962

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                            Filesize

                                            6KB

                                            MD5

                                            555eeccb48c89d35966d33410c015a9b

                                            SHA1

                                            e31a60dd3105bad36dd5d501ea81e5f801ae681c

                                            SHA256

                                            4c5f15d0fedcac40ba5c583bd22d240f42d95741c1c85c9bf60ac3c5b66a4e3b

                                            SHA512

                                            4c046cd1f51bcd2cd5419edebdc4c0c50cf799f82d073f788a2525873d0a01435fd04b161e96e73db10f38ed7416f6d04e5baa618399bec2fb4452a14aef4afb

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt

                                            Filesize

                                            35B

                                            MD5

                                            343859b4ad03856a60d076c8cd8f22c3

                                            SHA1

                                            7954a27de3329b4c5eefd4bdcb8450823881aad6

                                            SHA256

                                            8c79b653c087618aa7395d5e75198da7d3b04c08654c39e56b1027f9ef269c2f

                                            SHA512

                                            58014a4e7f2b4b0d446fae3570196b8fb95d0d1b70bdab0dd34a74d6c62cd8d7ca494a486f19c1a829988a3af83a08d401f18d1769ce1799a02ee09807234254

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt~RFe5878d5.TMP

                                            Filesize

                                            99B

                                            MD5

                                            6c1259a91ef901808813f2be8c4f44d2

                                            SHA1

                                            c3a9d3370652576bb672e32959e44cdbed181405

                                            SHA256

                                            2ae317770815cd0faeb3a198c91438d886a1efe54c30ce759c17e11deab8214d

                                            SHA512

                                            fd965279ff3641670daaa8bbce4d3561f83913355c104f213b6a8ec284482d0a9efe83f99d41d2f79cdfdda4cc9763ff3d9654b34ec737b62a8f77bd8b950d1a

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                            Filesize

                                            16B

                                            MD5

                                            6752a1d65b201c13b62ea44016eb221f

                                            SHA1

                                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                            SHA256

                                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                            SHA512

                                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                            Filesize

                                            11KB

                                            MD5

                                            ffdc88af3fb9839fe6115c9b72834c67

                                            SHA1

                                            46200c7ad0e465b21df561bf368a4ddc6643ecbd

                                            SHA256

                                            4711ae1294e3ec2087ffefeefe0fd300b559c631348272ea0b283f5bf294e29a

                                            SHA512

                                            a4786d79ac024a745ac718bd3d970dc344951e298d4077f9b752471a84d567e337258d6db7d145157698e3389af87b759414fdc301aed794cdf21101d6dbe8b0

                                          • C:\Users\Admin\AppData\Local\Temp\7zS4B0248A7\Assets\error_icon_72.png

                                            Filesize

                                            1KB

                                            MD5

                                            4aaf83d2b3fd56ad806708e60474df39

                                            SHA1

                                            144777a265879b69fadea3eb3ac6939458918578

                                            SHA256

                                            84e59d14d9433e6c3d92daeb8c443063b5e3be6c0b297f0403dbde473a05cb3f

                                            SHA512

                                            3b8485f054fe6ed2374bc81cb1786f09741219fbfcb22503707b11cf5db1ab262ba4349633597d5d9ddabc3415b170fa8eebc932f58d211d7092b8fb96fa1304

                                          • C:\Users\Admin\AppData\Local\Temp\7zS4B0248A7\Assets\exit_close.png

                                            Filesize

                                            670B

                                            MD5

                                            26eb04b9e0105a7b121ea9c6601bbf2a

                                            SHA1

                                            efc08370d90c8173df8d8c4b122d2bb64c07ccd8

                                            SHA256

                                            7aaef329ba9fa052791d1a09f127551289641ea743baba171de55faa30ec1157

                                            SHA512

                                            9df3c723314d11a6b4ce0577eb61488061f2f96a9746a944eb6a4ee8c0c4d29131231a1b20988ef5454b79f9475b43d62c710839ecc0a9c98324f977cab6db68

                                          • C:\Users\Admin\AppData\Local\Temp\7zS4B0248A7\Assets\loader.png

                                            Filesize

                                            279B

                                            MD5

                                            03903fd42ed2ee3cb014f0f3b410bcb4

                                            SHA1

                                            762a95240607fe8a304867a46bc2d677f494f5c2

                                            SHA256

                                            076263cc65f9824f4f82eb6beaa594d1df90218a2ee21664cf209181557e04b1

                                            SHA512

                                            8b0e717268590e5287c07598a06d89220c5e9a33cd1c29c55f8720321f4b3efc869d20c61fcc892e13188d77f0fdc4c73a2ee6dece174bf876fcc3a6c5683857

                                          • C:\Users\Admin\AppData\Local\Temp\7zS4B0248A7\Assets\minimize_progress.png

                                            Filesize

                                            212B

                                            MD5

                                            1504b80f2a6f2d3fefc305da54a2a6c2

                                            SHA1

                                            432a9d89ebc2f693836d3c2f0743ea5d2077848d

                                            SHA256

                                            2f62d4e8c643051093f907058dddc78cc525147d9c4f4a0d78b4d0e5c90979f6

                                            SHA512

                                            675db04baf3199c8d94af30a1f1c252830a56a90f633c3a72aa9841738b04242902a5e7c56dd792626338e8b7eabc1f359514bb3a2e62bc36c16919e196cfd94

                                          • C:\Users\Admin\AppData\Local\Temp\7zS4B0248A7\BlueStacksInstaller.exe

                                            Filesize

                                            622KB

                                            MD5

                                            d806c620a28904ec2af48c213a562dc6

                                            SHA1

                                            878594aa27189f4b6703c0e8e3bffa3dc810faa7

                                            SHA256

                                            d2f0a40bf13d35a39b311cafa40653dc3c3da335bf5179e74babe79482e929c5

                                            SHA512

                                            5d980c3edbad0ad2ac010e65dcc14e81a8154c59d56cec4e98bc04e9f14f65dc4cf6ddfcd29f82ab020d6ea311dc0df1519a61092dcb9aee1df8f3e3c8c0d288

                                          • C:\Users\Admin\AppData\Local\Temp\7zS4B0248A7\BlueStacksInstaller.exe

                                            Filesize

                                            192KB

                                            MD5

                                            884fd22d52f3b8656a15eae919f578e4

                                            SHA1

                                            ea8d57bae4cd9ef63053a0088fdcb7d662b08eda

                                            SHA256

                                            db05735f3bfd23681b3c3c6004f48020a4b9aef5d4e725847f54b97f823b0543

                                            SHA512

                                            9c602f47642358b40b3ae06d737d5434aeaf16daf8071d281c1287b67b69f4e3f03c6fd34ba11bb571ee2a20667fad6ffa3578d94c8df3bdb00e2e770a4bbf2e

                                          • C:\Users\Admin\AppData\Local\Temp\7zS4B0248A7\BlueStacksInstaller.exe

                                            Filesize

                                            86KB

                                            MD5

                                            4248614b6785e423687edea01f7e084b

                                            SHA1

                                            06291c3ad21a8b0b77a259f0fbc03418e935dfe9

                                            SHA256

                                            49c0befaa68efaa7069d6b120e9244776826267789144d64c40f21e7c9cd3bf5

                                            SHA512

                                            ef8c94828ef7d091b4d182b20c79eb33c56a612411922ec44ecedeafaf565c31c694264d07285b646cb9105c75f516e48bec4d7ffd0c23bd2e12b6df53a34186

                                          • C:\Users\Admin\AppData\Local\Temp\7zS4B0248A7\BlueStacksInstaller.exe.config

                                            Filesize

                                            324B

                                            MD5

                                            1b456d88546e29f4f007cd0bf1025703

                                            SHA1

                                            e5c444fcfe5baf2ef71c1813afc3f2c1100cab86

                                            SHA256

                                            d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb

                                            SHA512

                                            c545e416c841b8786e4589fc9ca2b732b16cdd759813ec03f558332f2436f165ec1ad2fbc65012b5709fa19ff1e8396639c17bfad150cabeb51328a39ea556e6

                                          • C:\Users\Admin\AppData\Local\Temp\7zS4B0248A7\HD-CheckCpu.exe

                                            Filesize

                                            65KB

                                            MD5

                                            387c65b875ba01ee2c7d46da57abb311

                                            SHA1

                                            95443e5a5c76c40f69df1367aba5207eb1639eef

                                            SHA256

                                            d8fa5d96981fdaf3867f68d82330cee8c1fe8853c09905d3f2243cd3bb3ff179

                                            SHA512

                                            3fa6f920c1e3eb9661de4b137c0ca1c919a1416f70880806b3df9dc906ba78d97de9a2dacc338d1ebea894c3a92d61f79346e808062d0ac6067fa97b819649dc

                                          • C:\Users\Admin\AppData\Local\Temp\7zS4B0248A7\HD-CheckCpu.exe

                                            Filesize

                                            61KB

                                            MD5

                                            ba484ee232c6cc418396574b3e5a3525

                                            SHA1

                                            775e27418481ade49d15eb0a3d89bfad385944c3

                                            SHA256

                                            c93f2995a33661b175e0aafdd1be21820cc76e80a83bd3ca8b71be10615c6b4a

                                            SHA512

                                            e2c560de630b3d9aefb060ae2a86c5244a1d5622385c7ad06ecfc2581e3843a9220404dce5b935a1c352a9b846bb29c408738f4e542cdd7271e3a21849997347

                                          • C:\Users\Admin\AppData\Local\Temp\7zS4B0248A7\JSON.dll

                                            Filesize

                                            209KB

                                            MD5

                                            27d5a33bfdcb772b72d780001fd07351

                                            SHA1

                                            73cabed6dc69bef5985eebcdb4c0c9837c13ecf0

                                            SHA256

                                            3e25be32504be70685ccfb233cab4330454e1d32699c3b177a4996336bd58517

                                            SHA512

                                            ad50ceee1baf38cc797d97004a5b2fc1ed71d889592e6e1fb4bc0c5c7b89991e1cd2266e68942e4b6483d2ea7205cbea7a665893bb162a2b7be064e3f41c8c42

                                          • C:\Users\Admin\AppData\Local\Temp\7zS4B0248A7\Locales\i18n.en-US.txt

                                            Filesize

                                            19KB

                                            MD5

                                            206562eed57e938afe21fc6942fa8e59

                                            SHA1

                                            779e90fec866c0fd2f47da020651db71c89ec3dd

                                            SHA256

                                            27d611a71edf36307a7ed0651f6c5910292ac7e2b68074a7e33d306b3d93ec45

                                            SHA512

                                            275c3192a7aee28fad31beb521cf5e7c66010e7562ce244ba9fc4de352f35b4ab63180ed12a56ea0b1458c185e076e2d07ba6d8797467177d3c5b2ac14371b26

                                          • C:\Users\Admin\AppData\Local\Temp\7zS4B0248A7\ThemeFile

                                            Filesize

                                            76KB

                                            MD5

                                            6fcd109403eb80d7b52c72ea894ad6a5

                                            SHA1

                                            a0fdec8217d668012cadb010df98b9d61ee555c9

                                            SHA256

                                            20f71e64528d438b439052422ffd53f0ec6b92006f5f7b9946e14fabc8c0c474

                                            SHA512

                                            eb365a4e1a6df03dcf92d37803358068749c3f6755b2426b9da3dbc1dc12aa9746eb4978f08e77312c8397a528997e827d022e559b017e85e7abbf0c4d813261

                                          • memory/2576-135-0x0000000003010000-0x0000000003020000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/2576-142-0x00007FFFD4090000-0x00007FFFD4B51000-memory.dmp

                                            Filesize

                                            10.8MB

                                          • memory/2576-143-0x0000000003010000-0x0000000003020000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/2576-137-0x000000001C870000-0x000000001C87E000-memory.dmp

                                            Filesize

                                            56KB

                                          • memory/2576-152-0x00007FFFD4090000-0x00007FFFD4B51000-memory.dmp

                                            Filesize

                                            10.8MB

                                          • memory/2576-136-0x000000001D110000-0x000000001D148000-memory.dmp

                                            Filesize

                                            224KB

                                          • memory/2576-131-0x000000001D200000-0x000000001D728000-memory.dmp

                                            Filesize

                                            5.2MB

                                          • memory/2576-125-0x0000000003010000-0x0000000003020000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/2576-123-0x000000001BDF0000-0x000000001BE58000-memory.dmp

                                            Filesize

                                            416KB

                                          • memory/2576-121-0x0000000003010000-0x0000000003020000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/2576-120-0x00007FFFD4090000-0x00007FFFD4B51000-memory.dmp

                                            Filesize

                                            10.8MB

                                          • memory/2576-119-0x0000000000ED0000-0x0000000000F6E000-memory.dmp

                                            Filesize

                                            632KB