Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/04/2024, 20:07

General

  • Target

    Stardock WindowFX 6.13/Readme.txt

  • Size

    298B

  • MD5

    6dae0f5f7fd4a95f8a77fb5ae7aa5ecd

  • SHA1

    a8bc204ef4259949b6b1a123a9c0d47f026c47a3

  • SHA256

    b0b4aa373798b4294a59b2ce3be425f35c97a806872f69c7131b68244d7a91f2

  • SHA512

    723a65867ff4191831c40a1212e3552a9f54907d0c4fc8612ca71432fab7e107f11b8dc66b54787df81fa6d44c815eead6339ba9fc318ae20312d816717a1b76

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 19 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies system certificate store 2 TTPs 15 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 62 IoCs
  • Suspicious use of SetWindowsHookEx 19 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Windows\system32\NOTEPAD.EXE
    C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\Stardock WindowFX 6.13\Readme.txt"
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:3132
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4892
    • C:\Users\Admin\AppData\Local\Temp\Stardock WindowFX 6.13\Stardock WindowFX v6.13.exe
      "C:\Users\Admin\AppData\Local\Temp\Stardock WindowFX 6.13\Stardock WindowFX v6.13.exe"
      1⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3912
      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
        "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:2189346 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\Stardock WindowFX 6.13\Stardock WindowFX v6.13.exe" "__IRCT:3" "__IRTSS:0" "__IRSID:S-1-5-21-355664440-2199602304-1223909400-1000"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4364
        • C:\Windows\SysWOW64\reg.exe
          "C:\Windows\system32\reg.exe" export HKLM\Software\Stardock C:\Users\Admin\AppData\Local\Temp\registry_export.txt /y /reg:32
          3⤵
            PID:4276
          • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.exe
            "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.exe" C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.tmp
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:4896
          • C:\Program Files (x86)\Stardock\WindowFX\WindowFXConfig.exe
            "C:\Program Files (x86)\Stardock\WindowFX\WindowFXConfig.exe" NVIDIA
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies system certificate store
            • Suspicious use of SetWindowsHookEx
            PID:1552
          • C:\Program Files (x86)\Stardock\WindowFX\WindowFXSRV.exe
            "C:\Program Files (x86)\Stardock\WindowFX\WindowFXSRV.exe" -install
            3⤵
            • Executes dropped EXE
            PID:224
          • C:\Program Files (x86)\Stardock\WindowFX\DeElevate64.exe
            "C:\Program Files (x86)\Stardock\WindowFX\DeElevate64.exe" "C:\Program Files (x86)\Stardock\WindowFX\WindowFXConfig.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            PID:3572
      • C:\Program Files (x86)\Stardock\WindowFX\WindowFXSRV.exe
        "C:\Program Files (x86)\Stardock\WindowFX\WindowFXSRV.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5116
        • C:\Program Files (x86)\Stardock\WindowFX\wfx32.exe
          "C:\Program Files (x86)\Stardock\WindowFX\wfx32.exe" START
          2⤵
          • Executes dropped EXE
          PID:3812
      • C:\Program Files (x86)\Stardock\WindowFX\WindowFXConfig.exe
        "C:\Program Files (x86)\Stardock\WindowFX\WindowFXConfig.exe"
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system certificate store
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1540
        • C:\Program Files (x86)\Stardock\WindowFX\SdDisplay.exe
          "C:\Program Files (x86)\Stardock\WindowFX\SdDisplay.exe" -prodId=2245 -ProdName="WindowFX" -company="Stardock" -forceUi="Welcome" -parentPid=1540 -prodVer="6.13" -ResponsePipe=1832 -ownerWnd=0008025E
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:396
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 2784
            3⤵
            • Program crash
            PID:2028
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 396 -ip 396
        1⤵
          PID:3900
        • C:\Program Files (x86)\Stardock\WindowFX\WindowFX_6.13_Jasi2169_Patch.exe
          "C:\Program Files (x86)\Stardock\WindowFX\WindowFX_6.13_Jasi2169_Patch.exe"
          1⤵
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3764
          • C:\Windows\SysWOW64\cmd.exe
            "cmd" /c net stop WindowFX
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4384
            • C:\Windows\SysWOW64\net.exe
              net stop WindowFX
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4896
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop WindowFX
                4⤵
                  PID:1552
          • C:\Program Files (x86)\Stardock\WindowFX\WindowFXConfig.exe
            "C:\Program Files (x86)\Stardock\WindowFX\WindowFXConfig.exe"
            1⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            PID:1544
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 1504
              2⤵
              • Program crash
              PID:2540
          • C:\Windows\system32\taskmgr.exe
            "C:\Windows\system32\taskmgr.exe" /4
            1⤵
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:920
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1544 -ip 1544
            1⤵
              PID:2652
            • C:\Program Files (x86)\Stardock\WindowFX\WindowFXConfig.exe
              "C:\Program Files (x86)\Stardock\WindowFX\WindowFXConfig.exe"
              1⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              PID:460

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\Stardock\WindowFX\DeElevate64.exe

              Filesize

              10KB

              MD5

              77f4f5243e1f2eab70e253e138488754

              SHA1

              6f91e14d7c5a7d2bc865cf0928dc9be9a2cef55a

              SHA256

              22869e3326fe1de011cd500e666769027126c5c440b76837baf55139f30094e4

              SHA512

              64a2be3bbc720f66264238aca89daa1214d96e5566838ba49c4b5ec32f3ab1bdd83a9bcc59d965c6fbbc7c171ac20f07e9118908064b5006503f343074b28bf5

            • C:\Program Files (x86)\Stardock\WindowFX\DeElevator64.dll

              Filesize

              17KB

              MD5

              a5878bb90ab95633ddb5a954425a248d

              SHA1

              3f688a5e78d4e5586193a60220e6adff486b73f3

              SHA256

              59bb5ea89db2627b13e12c500dfea20c1ea951947d7d02569b0b93361a3c3c08

              SHA512

              05f1bf43f707fd8a26fd8fe9cfa0878d597bf5234e8679e1bf4f1cff36d17ebfa65f3e09a9f7db279353d0d6dc760a2329236c38ea231ebe6c7485e0e0dc2eb5

            • C:\Program Files (x86)\Stardock\WindowFX\Default.spak

              Filesize

              298KB

              MD5

              93f0f3302d5c36114e92868a2d3412c8

              SHA1

              cbfb00fc140e9de1eaead9a6d9921c718644a33b

              SHA256

              e31bd1e442ebbdc31a86f8dcfeb7754298bee3c2d42b59aceb7049e4d25954bf

              SHA512

              140f714bd05c77d391c5d2841480e4b46a24e0b20ef568f3ac887e88f84de2a2d6468eecaf32d983818e4a065dceec01d851450ae6f530ae2c38861e49b4c4e9

            • C:\Program Files (x86)\Stardock\WindowFX\SdAppServices.dll

              Filesize

              1004KB

              MD5

              b65471992fbc7841c264037ec46f5891

              SHA1

              76417b30d280230a9856e6b57fe8eb13f33f0f09

              SHA256

              659ab4ededaf9364ee87165c3c97642171dc07cd00f77153d5f5a7c7435d6d86

              SHA512

              56de621aeae33c719a1d0494219c5ac5be54050806ceacc31d4c3fc8d7bc26aa8205f80526dad18345668caa85df0a4da702c6f126ab8fb5f3b05b4f2b595fb2

            • C:\Program Files (x86)\Stardock\WindowFX\UI\abstract.png

              Filesize

              19KB

              MD5

              050f06531f57d50027dca15b3394aeee

              SHA1

              98f1716a3d84da64003f3a2d608fb64b82dadda2

              SHA256

              d7332b0eb689f3004d8745ee09c865efb274ae118088e6edc1ecd2755bec9b31

              SHA512

              1586097a1f949d2ca3103739b987654512b5f82f4ee3b5dde50ce589f3e6f1bc4c4de5e036b2644f9bd10f02a04eb7fedd8c63b3904f833655fe8c6279e66dc7

            • C:\Program Files (x86)\Stardock\WindowFX\UI\clock.png

              Filesize

              4KB

              MD5

              f49cea9cb371ec67e39303dc5f3e0b49

              SHA1

              f943193924be248010886851410370af152c3bcc

              SHA256

              405d234c96545ad40bd7dae1d884163a3217153a2ab7570652f8d4f2f765dd17

              SHA512

              fc4180a416cb3d4d44f81b55dd949a10712ef0baff928b1f5dc40b9353cd2241496aa72f46eae7038e2e3ac138deb625d506d6cdf29899bba43007b9ab851700

            • C:\Program Files (x86)\Stardock\WindowFX\UI\frame2.png

              Filesize

              39KB

              MD5

              e35c9c18a870225b0b504510170808ef

              SHA1

              47ffffc240c6730945bfca11f5062eeca5b72222

              SHA256

              7302373a89114606a697eac117f97ca3ddcdd2b1ce17bf7c0e04c2c68628fb4f

              SHA512

              8adfb32c27837b3b8dcfbae88544cfa8be2591ac003252ff2d46cb58000729263a4c8518e27c14a641bcc48688b7f57a01fc2e3c15f9deeb2cfd1adf0f5b877d

            • C:\Program Files (x86)\Stardock\WindowFX\UI\frame2a.png

              Filesize

              27KB

              MD5

              dcc0ac069a3839ddff9804feecd8289e

              SHA1

              bcca4739846cc41937b45ccea09dc27e14ed11d9

              SHA256

              ecac3ab1973a01079f232c033e5f62e029f376d947115eba020aade01d44b09c

              SHA512

              f2f205ccdddb2754bdaf3cf2bf52fb144f4f601f3c4233f781a5e7b820c26537f0ff084aa6d0996980d8627fc111ca31f1b221ba60869747db525bccf6cd9bab

            • C:\Program Files (x86)\Stardock\WindowFX\UI\frame3.png

              Filesize

              42KB

              MD5

              58cfc7a7b12c328d95594680500866ac

              SHA1

              6227065392f95e73eb124688c3d6324776c2337f

              SHA256

              1b065de2e900f4b7600fda493e3098f456ae887002e83abbdf5234f97ba91cef

              SHA512

              0c8e2d5cae5d7526af5846701aba1854c205132c764a4bbbb4837179256577f4cef5519457c000615b206a520799828a48bd88a0369b0d2180af2c30d2186ddc

            • C:\Program Files (x86)\Stardock\WindowFX\UI\frame4.png

              Filesize

              48KB

              MD5

              eb05e3b20fabae9bee6a5a22ac0b44a5

              SHA1

              206668dc4d9f0ba929589879cf9ff06c7084113d

              SHA256

              eb9372337d15b32568375253b829fdc1963eb614f978b9886cd6a888c78010bd

              SHA512

              0bfb83399fc46b939d999b20f04d30815234559bbde1252e09dccf88a7386543a467d3a1c336a5b93953de220545682b30dd63d2595ea23ab9fa1c7eacf83357

            • C:\Program Files (x86)\Stardock\WindowFX\UI\frame5.png

              Filesize

              40KB

              MD5

              925a15559c35440490533e4942ec6092

              SHA1

              8ddd30bfdf34b93e5c9dbeac2bbab87b9af4da72

              SHA256

              b73ec0e2a2c498c52fce063b3d9b70ef0ad3ec7ae85e974772f3d2c43c1d395d

              SHA512

              5c4410182559212cd7db813352ffc51a7c84f5e8925ca5f4705b9291725174869b797d1373bce50eb0a5bc3ba057d3b695f99a6ebd7d3119048d346f0bf761f3

            • C:\Program Files (x86)\Stardock\WindowFX\UI\frame6.png

              Filesize

              38KB

              MD5

              4d430d97cfb4d0d208bd857b185edb7d

              SHA1

              748ba2df53e102c67bfa4d8ed56f97925fd60d58

              SHA256

              05d67215a682008205dace3c0ae84bcfebbd714818eb008e4328fd57661cdeb1

              SHA512

              47d56124dc6ef613ec1b3c990931869fdcb4d071fa56a693b07a30e78392e11fc999cce067ba630486cd842548a719a464480585a89db915699a40ae7b361df3

            • C:\Program Files (x86)\Stardock\WindowFX\UI\frame7.png

              Filesize

              36KB

              MD5

              cc13b6dfd381b370c38464874ac90ed4

              SHA1

              497c5cf16f00ad664330c92c5c6be2c09b2c4855

              SHA256

              7b60abdd44d00388e48c49893ea3a9a4758ead37e748791d3b258e12ce6cd41d

              SHA512

              2b7c2e3d4d981c361f95693dde97fa60c40bbc6c2cca1b1d184b244f8fc705420aafe47d439f4f657c26bae3ad470636f34e363bac063ee411bb155968fab915

            • C:\Program Files (x86)\Stardock\WindowFX\UI\frame8.png

              Filesize

              41KB

              MD5

              5706997d4bc739e0d5ef03a455100cfd

              SHA1

              81e617857f7d4f69069934d999334ba98424663b

              SHA256

              d3240433c60eefdc3371b2447d294f5565e8192d2d94ecf91b54d7c3fdd3c9f0

              SHA512

              cc6591ad0295a40a1951c7a03cd14a78826929638ce6fe2d6fc488322e274d9d865b0d9bae63c8758778c6870042defe24270be0039fd8c4e3f0865ec357ac9e

            • C:\Program Files (x86)\Stardock\WindowFX\UI\frame9.png

              Filesize

              31KB

              MD5

              754a2411045a6c8a25b918fde4e24507

              SHA1

              dbdf2cd22ddbfa5b2bc6044a91b216ba3188a8f1

              SHA256

              482907618179f93b539f260cdec6a81aa92d8fa337be346e1e7d5477b7636fd9

              SHA512

              21ca14ecd7ca65a672d9166abcccc276a70bf7c79b61a79a9c731d5401cfe67890921a8913644decbbd58c41dc34c06f16ff641cf9ccbaa748efb5c2fcb4c7b0

            • C:\Program Files (x86)\Stardock\WindowFX\UI\home_horiz_separator.png

              Filesize

              5KB

              MD5

              771d6d50b3787ec58427cfc6a38411d2

              SHA1

              343353250f7cbfa832cf97a31d0be3cb24a7ec9e

              SHA256

              2106e49107b03d4566352c64c112bf54af6278c3286f4966fe27723bda70124a

              SHA512

              2c86eb95a5bfd034499f2f0d8e5d33226cfd7e60036c44ee8491dc2210fc593239bb5e883c59eb34e18968f00d26cc13488b7cdcbef507db843b6197281d1814

            • C:\Program Files (x86)\Stardock\WindowFX\UI\home_switch_button_v2.png

              Filesize

              854B

              MD5

              c4c844c1d829f73094aa6f155faf18bc

              SHA1

              f7e2615de9a809c47e623e565184ba9ef244f7e3

              SHA256

              c0a594565d25510e7969ec54e465c447afbb6a39bc63c01402285038d0207c8f

              SHA512

              abf6a5c8e57769563988a9b017a4dec6ea649e04e0d68b885ab93938667bc68a2af0193f8ce4324dfea5fbae61c6f89112c32618670ef27ea43decf9ab1a91b2

            • C:\Program Files (x86)\Stardock\WindowFX\UI\home_switch_track.png

              Filesize

              333B

              MD5

              ba41d98ae1f8e05af50058228908454a

              SHA1

              5e3bc1e8edef9c55261013959a027a9d17220fca

              SHA256

              6c51e1d4d27a777a0c4425337824d5956ca17e57263f98951dadc0b374c97d7e

              SHA512

              ddb8f1f62b64b5e8bf7ffc1c879c04de219f5c38c4cae19a7f208c2622dfc8f82546e26184b9287005588e4483cd71fb1f5534e3c810461cccf1a74209876d54

            • C:\Program Files (x86)\Stardock\WindowFX\UI\info.png

              Filesize

              3KB

              MD5

              41b1d948b90608d4e73bfaa81caad417

              SHA1

              f476ffde49e07336b8f3211dff92a5b291b82bdb

              SHA256

              2053991b6d10ae9acc171f3973c2af70e5747ae38327d97a4e17f9fbfa55a1dd

              SHA512

              bee68e0503dd5202a6d33dbbca6e8a7ca20853976652ade62ccce3fe1eb77a4069384601043bc765876ac09ed4a3e67da95ca5a0e278be258b46e384369be817

            • C:\Program Files (x86)\Stardock\WindowFX\UI\label_plus_03.png

              Filesize

              1KB

              MD5

              377c0fef82928a0eef8e25d6059c6790

              SHA1

              605bc89385b8ab0d0d31e35a4e2c1ea10c50dd0a

              SHA256

              ef4694dd53c16852d689797a60ca2eab2096b9147660e3a3e2741a517da923fc

              SHA512

              d3d2bf5e23270b2dffff23a415f59ef8470ed0c63f568b85f54c28002af26ae3a99aec6889643e5f89e59cfae04b8b55221faadbb4b0b7898e9209ce5a158bab

            • C:\Program Files (x86)\Stardock\WindowFX\UI\onoff.png

              Filesize

              1KB

              MD5

              f75520aff24086cdd3d235ab340064f9

              SHA1

              5bba2ff7069d09a19f776ad3a260fce9876ba393

              SHA256

              2280f13278178c2ba2a4b54bf4bab3971b6d8a94fe6ad07dbe3a01a22374db9a

              SHA512

              c0c542d117f2220afb51cc0c5a54008b2e08f3132494ecf7ce9c8113e6720e30e266f15c1b070fc25454d4c4cfbe8a868442e86a3a7cb505ca7a18bb0c3e55b9

            • C:\Program Files (x86)\Stardock\WindowFX\UI\topBar.png

              Filesize

              2KB

              MD5

              0f0728747122673628a33547805a9bdc

              SHA1

              8d1d7b3f0b8298f95f6a9dcb636f71b4bc7054a0

              SHA256

              8423dd18dcd6820fcacc286a4a2074d0478563e1117852076d45dba314339681

              SHA512

              5f610b0f09766448895a2b13b6d3b0a73ff4c4833ed9d8742ba79732a072f77d51d9e58a0142f5ae286588c1773f412c8eaed51c7f7e8c24ff5c98a791829f1f

            • C:\Program Files (x86)\Stardock\WindowFX\UI\wb_check_m_over.png

              Filesize

              2KB

              MD5

              bac6e9e1eb784e8cec475dbdff97d786

              SHA1

              80156ad89136c58f9d79e4a185c300188edc5b76

              SHA256

              a657c9122117e3105130fc8c3bb93a1c84088bf61948d39bdb357e0ec6793deb

              SHA512

              8d4f62462c06024035bedef1b586f4d605cf77a6f82b1770e0916ff7a5abed727adb2b85b5bcdfe79cba3b1d6ff990e9aa03f9c9a59a0501a92a6a5a293b5804

            • C:\Program Files (x86)\Stardock\WindowFX\UI\wfx5UI_section_selection.png

              Filesize

              3KB

              MD5

              b49bf3da24aff08f425ba64c797dc57a

              SHA1

              64033b72daf9751acad2225ad0efebacd28c9700

              SHA256

              1c3546f27ca2804add0347b0c8a4faf6f74f8235d6f7c3bc3431f1256ad567b1

              SHA512

              dd8cc7fe239b5e91e940d187ac8128d620095a4c5b33b3b1e63c7ffc06d5edd227b3495f97acbad23dda87a6d5459f26c74269e49fbbfafbcea55b112d0ede98

            • C:\Program Files (x86)\Stardock\WindowFX\UI\wfx_disable_flip_3d_dark.png

              Filesize

              1KB

              MD5

              1b4425b9e6c41116c6a436cbb3e53441

              SHA1

              411a55ac1d46ddbca075475734e7a1893a60112c

              SHA256

              cd66c2dc28540174c84a5ab72bb537032a4e9a58ec1f2428d84541d63db148fa

              SHA512

              9f90bd0660f176b53e05aeef985a282e267beaf39a25363860fa94ecebae35b834d5385023e90309f37c9dab186b6b683e8292e4893e7a7debb51119e03656fd

            • C:\Program Files (x86)\Stardock\WindowFX\UI\wfx_disable_peek_dark.png

              Filesize

              1KB

              MD5

              e46aac6db61c8121961ddac4a38280e1

              SHA1

              2fe161c7083e7f46f4a77065212496bfcc11f235

              SHA256

              a343500ac141eaca7a0f6f87c9959e71f24f144b4305be1379abc013230d370d

              SHA512

              520839c65b5cb8724aafd243e68af6699e7c3de60f4a80703d8671cee71d7b6b5d5c1bfcbf51b1718acbde352976f9ed6500a1187e19708c0fbc4761f84e0f1b

            • C:\Program Files (x86)\Stardock\WindowFX\UI\wfx_pin_on_dark.png

              Filesize

              1KB

              MD5

              966de20f2c50342918ee725c471ac600

              SHA1

              d50630953e08afc4440c36cdaeb1d841313f555d

              SHA256

              11bfabfe0757184b6ac5c2c605f6fe04b070a2cc699329035f5b3b4e3739c900

              SHA512

              3cbb98f7f8121d78d754fb8bdf8cd41f4cf2809081ed5de51dbcd824cce5db1b54eb22478d9a570590289f7c07722a10af9302063fd11abc551e3ba6e70d4083

            • C:\Program Files (x86)\Stardock\WindowFX\UI\wfx_window_max_control_dark.png

              Filesize

              1KB

              MD5

              f3d67e7abe7043d3f251d83c2d653a09

              SHA1

              128bf73ae2ef7e52ba84eba31f00d63f2b36a52e

              SHA256

              558a91e8c1f07a362cf0911f82642564e509587d0f4f689e522f8cf0f0a1af4f

              SHA512

              5c74d21edeb8a441639c474c1b8735ec57a2876aed4323d5fa5ee1657eef223b64f5ba446070ade86b1775b9a190799b7306f985ed7e4650ab65257436afd882

            • C:\Program Files (x86)\Stardock\WindowFX\UI\wfx_window_size_control_dark.png

              Filesize

              1KB

              MD5

              580ca461b6623dd000851d91a01bb62d

              SHA1

              5e9979d06cd33a8274b830aa5f14884d58a6300b

              SHA256

              7e350a7c1eda31d93d962f4f13757cd52774a941e245379d18ce95650b1a7a95

              SHA512

              bacbec89c3944590e61c7727f4ad3783b369e28760f100d5e95161c88e2c17e79c421ba8c343dabf5ed38e93ac56daa127070040306a8152b8fa0715c5ed33d5

            • C:\Program Files (x86)\Stardock\WindowFX\UI\wfx_window_trasnp_dark.png

              Filesize

              1KB

              MD5

              466fa0e4d9644b4dbaf85dfff80d1862

              SHA1

              b41e5dd631fc9868be24ce1b0f855a4ee30d7b73

              SHA256

              010aebb83004b4466e6632dd6f85da2d3d39d27c3e2d6d5849a6b5d76ad46a96

              SHA512

              e2e119c6207dc477b91dcc49ce9393155864cfb114955fa8604cae1b29e1c3e260b6cf5d8f35df6e85899bf41c570e733fee21516c7037b0a166dff028c6345c

            • C:\Program Files (x86)\Stardock\WindowFX\Uninstall\uninstall.xml

              Filesize

              64KB

              MD5

              740625a42ceb8607ccc69acc18d81efc

              SHA1

              ac1d10b9f77d03bad8c0fc5abf701c65ba158aff

              SHA256

              b9b83c157535b7d761e4df0fafb1c858aeff99ca432981e52d87d07279cb8a7b

              SHA512

              9289fe06b59cbe8f94e203dc6b4565da5d8f5a87b3ee0bb15bd01a71c3eb8285102b6558f07bded71f3d5749ebe1719499a3cace0f9fe44fa1f0414b9eb54f3e

            • C:\Program Files (x86)\Stardock\WindowFX\Uninstall\uninstall.xml

              Filesize

              73KB

              MD5

              8fc2ea6929b98a84f307bb4feaf72109

              SHA1

              cbc87b52672acfe15b49226f98cf1ae040db4043

              SHA256

              a9097f1eecafa1a4992e9b6ec5c10d1cae0136d749bb0f79bb83ea8218c97e4b

              SHA512

              c4e5d81c51bb5d9051c27f85635af9af1d3f03f8bcff2a574719f6bf53f70f6de8a162d2d5ce17d224758366b11acf49ae11c4e842b9571e7687fba93fa87e5c

            • C:\Program Files (x86)\Stardock\WindowFX\WindowFXConfig.exe

              Filesize

              4.9MB

              MD5

              20ca972de8d394da30221819279d831c

              SHA1

              c0dd599d1649c2421eea7dc71fbe7c27c93b80f6

              SHA256

              7c65a8dd7865af504ec932460e85f372237357a607c23e632ed80b8526cdc47b

              SHA512

              3218a872239d4f60cb454dd6b0b9fe8cd3c5a1db66df5792cec28cdf1a6c56cedc802cb0a4c41c17cb0bcf12de44511ab1ed153f0f1e54a35e14c4c1273940c7

            • C:\Program Files (x86)\Stardock\WindowFX\WindowFXSRV.exe

              Filesize

              189KB

              MD5

              d5add5bd7afc1315afcdbbf1b5aa56a2

              SHA1

              8a89bbcf4e3f4a841aa59a2a6703a4e53106054e

              SHA256

              3081308d55df3c99413182601ecf1cac30f3d463c7123945e16d57ab2a857755

              SHA512

              c4171cfb97bf06db97dba6dae8ad50171f84c8969a17321dae71ec1bb5eb1bac6802d048119c767b56de15e973c75e62f4ef5f933793fb759f0f81a6926ff487

            • C:\Program Files (x86)\Stardock\WindowFX\wfx32.exe

              Filesize

              594KB

              MD5

              0309bec6380bbd248cc2e221fa631f51

              SHA1

              a2ff11cccb5dffd96949e56a7340c2894393a0cc

              SHA256

              d9339602f58d65a1b0902997e41f520c25afa75d64ea60b3b3c4a1fc89e18c01

              SHA512

              ed9fb0aa2346c7f7150f097221631ddbeee1b51c80ef6f008662b7915f5b7c586e456de9984d7689d5f316cc72dbcbdb3dcad263332596c5ce64fd4e7d0aa6f2

            • C:\Program Files (x86)\Stardock\WindowFX\wfx4.dll

              Filesize

              1.3MB

              MD5

              9e4d5486650ebecfa9a6844b0ca66121

              SHA1

              eb279485bb02e2a56d06d5e7416a772a687daa24

              SHA256

              2ce7ba69e0fb874994dacd4035ec03fa992217133753a0cdad08fc81c4c188a8

              SHA512

              b28e70b0e14e7e5baa7319d1ee97a8662917a9e42d43940dbd9da5baeb767a28c97b4b421b3f47736262a387e9ca95f4a903001d77591153676123e91168c2bd

            • C:\Program Files (x86)\Stardock\WindowFX\wfx4_64.dll

              Filesize

              1.5MB

              MD5

              e5db0dc8744deaa2282926c3e8fc57d9

              SHA1

              fd930951544fa1b6e0fee6d4545b22fb8bba15d8

              SHA256

              0a0ff295f87bbbc4bd9c771967626e5f7ee855413818f3ef8469bbd1a10fd50f

              SHA512

              3df7108fd7afa4c50abfc72b1e58c782b791f40b9566059f220c97d4719c389ac5d96bbbcda80f527c19082bfc3b44e193f04cb144a303e0407e5f3b13d4b5c5

            • C:\Program Files (x86)\Stardock\WindowFX\wfx64.exe

              Filesize

              672KB

              MD5

              6901f5583b3123639a5d0b3eb00fde75

              SHA1

              e6c842ddc7e79e39c47c68f8bf32499a236df2c3

              SHA256

              8bd99c4af0ae131a63bfe308dbc96faf0801f21e3eb01a7015fc388baaad8e38

              SHA512

              ce2578fcbd42e06d9ab1a13f152eae0a04c1c73aad24793480f44d0ed8680a633cb533b1db4a3d8b627d45f26a6b996ce61442d0f3b88388caf5193cc89df1ce

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\40C68D5626484A90937F0752C8B950AB

              Filesize

              834B

              MD5

              cbed24fd2b55aea95367efca5ee889de

              SHA1

              946f48b5c344fd57113845cd483fed5fb9fa3e54

              SHA256

              1dc8a0fcbe260b77adfe5ad9aaac543239b2a0d9f4e1f3c2657beee4376ffee4

              SHA512

              c504a11ea576f8ce14de26a0617e22e71e14db0f1dadefc187ce94e4a35a83743c743824e3629899c262aae4772bb86a0ee5bb643db20645483f0c376215ec6b

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE

              Filesize

              5B

              MD5

              4842e206e4cfff2954901467ad54169e

              SHA1

              80c9820ff2efe8aa3d361df7011ae6eee35ec4f0

              SHA256

              2acab1228e8935d5dfdd1756b8a19698b6c8b786c90f87993ce9799a67a96e4e

              SHA512

              ff537b1808fcb03cfb52f768fbd7e7bd66baf6a8558ee5b8f2a02f629e021aa88a1df7a8750bae1f04f3b9d86da56f0bdcba2fdbc81d366da6c97eb76ecb6cba

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_DF4CA81DC775CDA9B3214BDB5B55900E

              Filesize

              5B

              MD5

              5bfa51f3a417b98e7443eca90fc94703

              SHA1

              8c015d80b8a23f780bdd215dc842b0f5551f63bd

              SHA256

              bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

              SHA512

              4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_F683C52DB732919867B8733E61B240B4

              Filesize

              1KB

              MD5

              6a56e41d03a365926170dd38e2885aa7

              SHA1

              30a4975c8ee7e61cb717957e58a8588fd352374c

              SHA256

              7ac395351c651911dbc023aa8ee1a57697d99e63974fda5325e8eb490f281fd3

              SHA512

              cbcb7e2a48ae25c89f3320b7f045fc8af1e2119eccec918b6b940ac11fd47ffd8449009f3fa2cc4b67433e8456561d8e19426c7caeb81c6b0249ff25c75fae8c

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\40C68D5626484A90937F0752C8B950AB

              Filesize

              180B

              MD5

              24e93d125e1edeeae907ae3ac320e4a1

              SHA1

              e3d9741573e7dcc2cf0a629b2904a69d7be2cd88

              SHA256

              34c898e6efb4b4a0ded42b05e794111c29a55ec0648b3c216de0d666441ba244

              SHA512

              3455209f8f960f8c629783fe31d93fe2b51b8688a58d89eb7a796672e5aeb56ed50a4b3564a9c6a2fb1f0402671315099c6853b5670af9b9313f02af3f378e82

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE

              Filesize

              398B

              MD5

              b5919d59d33c7380fb994974cc007004

              SHA1

              707cecb9dffe6f85aba144bf3d024ad16d23b323

              SHA256

              5721b7c380b899973441c164ccaafb5f97cfd49b4b1febaf8fa66919fda1c7db

              SHA512

              881e5750e1a6b782f28356991d1561dc8320fe8d3cfddb10bca7549f19c5fd627d3197b49e8a994ab4b5461de75f947140b2cfe16b84152dc51774efbb029009

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_DF4CA81DC775CDA9B3214BDB5B55900E

              Filesize

              476B

              MD5

              fe9d7d3c6c09e6c840c5af8725fa20c1

              SHA1

              5f596dfbe846847a3549f814ec2c26ec3c89d5de

              SHA256

              41286b9d96d02920b4397d31f06338791b1a3487b8f33b426eff8cab1ac1f247

              SHA512

              3e675a5ad07381d161ef784c87df125485c83323feb512e386e9866335a9d96e381d4265bbb1fc739638a84bd6198e92f0af41a3b30c3c4701ce997100ff4ae6

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_F683C52DB732919867B8733E61B240B4

              Filesize

              398B

              MD5

              511c55cb44bb3ac58ec11ab030ec8a35

              SHA1

              e62021f01914d60608e1a928e4097e308edf82b8

              SHA256

              eada54b501b12abbc915496778b0f43e3b512718a7f1d9de08ad9a9c3367b541

              SHA512

              c084e19797f7a0b8d2ca4434a4dc3c8e762fadce5b1ed63ed43f6690010f5596e6180f494c0d59a22c6934f981bfb6d046d73170b179efcdcb2e48ebd1313913

            • C:\Users\Admin\AppData\Local\Stardock\WindowFX\SasLog.txt

              Filesize

              658B

              MD5

              3f5685c1a095b410caa693eac7c388c0

              SHA1

              f734a7fd51d2a00640fcd9d46d8a036c65291f2a

              SHA256

              ef3a2e1e2034c6f91a80c4e0375006f06898dc429a59e3118bc2035367b201d5

              SHA512

              ee8bbec6702f3eb9198fb49ad33ee563610cf3b0bee4cdfe2918687646b8fb10749e384d99aa743de24f64822002be5a2913466d7320196b24e5449ca19dcc60

            • C:\Users\Admin\AppData\Local\Temp\WindowFX Setup Log.txt

              Filesize

              72KB

              MD5

              e14d895fa48f103d7aed2652838767e3

              SHA1

              391632464b89e4cddda87684e60948c860158425

              SHA256

              28e1fc239adeb2ea3bdfcdef7e75be5bfe558d5c649a522cd15faf7729718926

              SHA512

              1edc9e1703c50134f523646281832471e369ad8d2cecd92817f1325dabb87ba739c2fce5e774dbb2c3da6e1679d2e3851bfe270edbc9d57c9785079fe6975c41

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Encoding.lmd

              Filesize

              393KB

              MD5

              6eec47ab86d212fe3ed0f56985c8e817

              SHA1

              06da90bcc06c73ce2c7e112818af65f66fcae6c3

              SHA256

              d0b2fa60e707982899ecd8c4dc462721c82491245b26721a7c0e840c5f557aed

              SHA512

              36d6ef8a3fecb2c423079cadbfcbe2b044095f641c9a6ce0f9d0e96c6400f00a089aa26cc9d361bfdbcfdc3a8487d18d64956b36f39320648d1ddb565221a9cb

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.exe

              Filesize

              58KB

              MD5

              55bbf335f75f2a2fe0a5daf603964d41

              SHA1

              f1b9686e8a9f10682722fc5e08c02c016b597804

              SHA256

              723adae0e69127a6bfbc65c5ef552a351264205ea5e2bc3b80e505feaa5d0e43

              SHA512

              af49055234cb4a0ddbc68212db094c7a7a1058ccf6a1a5830238fe3ff96fa35390d242322436839d6d7e419bd9e4ad8962e213222470625cffb46423dec44db6

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.tmp

              Filesize

              40B

              MD5

              281f0a6d59b8b8693a1e82d83d8331c0

              SHA1

              157cbbfe004da5de723578a1b054823e823e09da

              SHA256

              99dec3ef0d261985992daa82f017dd464c7820df135eebc43e332713e5505986

              SHA512

              f879c77b0f79b80fc3fc32173e2fe02fa70cae9684f9ea51daa8d37820450e1889f6c75891fd9a54f6a2d5cbaf23571d40ffeafc7967b3ac9f31cd8ebb83d360

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.JPG

              Filesize

              2KB

              MD5

              3220a6aefb4fc719cc8849f060859169

              SHA1

              85f624debcefd45fdfdf559ac2510a7d1501b412

              SHA256

              988cf422cbf400d41c48fbe491b425a827a1b70691f483679c1df02fb9352765

              SHA512

              5c45ea8f64b3cdfb262c642bd36b08c822427150d28977af33c9021a6316b6efed83f3172c16343fd703d351af3966b06926e5b33630d51b723709712689881d

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

              Filesize

              1.3MB

              MD5

              68ac216f38a5f7c823712c216ca4b060

              SHA1

              f6ad96e91103c40eb33fd3f1324d99093e5d014e

              SHA256

              748d48d246526e2a79edcde87255ffa5387e3bcc94f6ca5e59589e07e683cd80

              SHA512

              9b7dce4ed6e2caee1cdb33e490e7062344d95d27ba48e96f66094a3413da27fb32680dd2e9a5b2091489780929c27fe36914210793fbef81dfb5b4fb1a9b469b

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

              Filesize

              326KB

              MD5

              80d93d38badecdd2b134fe4699721223

              SHA1

              e829e58091bae93bc64e0c6f9f0bac999cfda23d

              SHA256

              c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

              SHA512

              9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

            • memory/396-793-0x0000000005420000-0x000000000542A000-memory.dmp

              Filesize

              40KB

            • memory/396-796-0x00000000087D0000-0x0000000008F76000-memory.dmp

              Filesize

              7.6MB

            • memory/396-798-0x0000000071580000-0x0000000071D30000-memory.dmp

              Filesize

              7.7MB

            • memory/396-785-0x0000000000050000-0x0000000000062000-memory.dmp

              Filesize

              72KB

            • memory/396-786-0x0000000071580000-0x0000000071D30000-memory.dmp

              Filesize

              7.7MB

            • memory/396-787-0x0000000002400000-0x000000000240E000-memory.dmp

              Filesize

              56KB

            • memory/396-788-0x0000000005480000-0x0000000005A24000-memory.dmp

              Filesize

              5.6MB

            • memory/396-791-0x0000000005380000-0x0000000005412000-memory.dmp

              Filesize

              584KB

            • memory/396-792-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

              Filesize

              64KB

            • memory/396-797-0x0000000008F80000-0x00000000094AC000-memory.dmp

              Filesize

              5.2MB

            • memory/396-794-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

              Filesize

              64KB

            • memory/396-795-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

              Filesize

              64KB

            • memory/460-829-0x0000000000100000-0x00000000005DC000-memory.dmp

              Filesize

              4.9MB

            • memory/920-822-0x0000025F2BF60000-0x0000025F2BF61000-memory.dmp

              Filesize

              4KB

            • memory/920-823-0x0000025F2BF60000-0x0000025F2BF61000-memory.dmp

              Filesize

              4KB

            • memory/920-828-0x0000025F2BF60000-0x0000025F2BF61000-memory.dmp

              Filesize

              4KB

            • memory/920-827-0x0000025F2BF60000-0x0000025F2BF61000-memory.dmp

              Filesize

              4KB

            • memory/920-826-0x0000025F2BF60000-0x0000025F2BF61000-memory.dmp

              Filesize

              4KB

            • memory/920-825-0x0000025F2BF60000-0x0000025F2BF61000-memory.dmp

              Filesize

              4KB

            • memory/920-824-0x0000025F2BF60000-0x0000025F2BF61000-memory.dmp

              Filesize

              4KB

            • memory/920-818-0x0000025F2BF60000-0x0000025F2BF61000-memory.dmp

              Filesize

              4KB

            • memory/920-817-0x0000025F2BF60000-0x0000025F2BF61000-memory.dmp

              Filesize

              4KB

            • memory/920-816-0x0000025F2BF60000-0x0000025F2BF61000-memory.dmp

              Filesize

              4KB

            • memory/1544-812-0x0000000000100000-0x00000000005DC000-memory.dmp

              Filesize

              4.9MB

            • memory/3764-811-0x0000000073D50000-0x0000000074500000-memory.dmp

              Filesize

              7.7MB

            • memory/3764-802-0x0000000008920000-0x0000000009230000-memory.dmp

              Filesize

              9.1MB

            • memory/3764-801-0x00000000053D0000-0x00000000053E0000-memory.dmp

              Filesize

              64KB

            • memory/3764-800-0x00000000007E0000-0x0000000000C06000-memory.dmp

              Filesize

              4.1MB

            • memory/3764-799-0x0000000073D50000-0x0000000074500000-memory.dmp

              Filesize

              7.7MB

            • memory/4364-12-0x0000000000530000-0x0000000000918000-memory.dmp

              Filesize

              3.9MB

            • memory/4364-30-0x0000000010000000-0x0000000010144000-memory.dmp

              Filesize

              1.3MB

            • memory/4364-31-0x00000000059A0000-0x00000000059A3000-memory.dmp

              Filesize

              12KB

            • memory/4364-742-0x0000000000530000-0x0000000000918000-memory.dmp

              Filesize

              3.9MB