xred | a4a98c21e59906959e20d4a3e7125cfb637fee93d195f60c1cacb91e2503c3dd

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
submitted
07/09/2024, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0b95311ae7f66a65cd81cccf42f5b810N.exe
Size

1.5MB
MD5

0b95311ae7f66a65cd81cccf42f5b810
SHA1

4cc872770e027f393e430bc15b8a7d82853484bb
SHA256

a4a98c21e59906959e20d4a3e7125cfb637fee93d195f60c1cacb91e2503c3dd
SHA512

1c02d42dccc91ab2beacaae8bccf5375022da7df343747df11f16810461ddd17fc1729f3616b19bdc6edff6dc70744bb48afcfbdab2b93cfca2cf579b204bc33
SSDEEP

24576:ensJ39LyjbJkQFMhmC+6GD9Cal1RjbLoFvYgoVfxnP9CsQ34R7CF/m98vr:ensHyjtk2MYC5GDLbLoBYnxPg+p8D

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Executes dropped EXE 11 IoCs

pid	Process
2856	._cache_0b95311ae7f66a65cd81cccf42f5b810N.exe
2112	svchost.exe
2020	._cache_0b95311ae7f66a65cd81cccf42f5b810N.exe
2416	svchost.exe
624	Synaptics.exe
3044	._cache_Synaptics.exe
2896	BlueStacksInstaller.exe
2208	svchost.exe
2752	._cache_Synaptics.exe
2960	BlueStacksInstaller.exe
1096	HD-Hvutl.exe

Loads dropped DLL 16 IoCs

pid	Process
1960	0b95311ae7f66a65cd81cccf42f5b810N.exe
2112	svchost.exe
1960	0b95311ae7f66a65cd81cccf42f5b810N.exe
1960	0b95311ae7f66a65cd81cccf42f5b810N.exe
2020	._cache_0b95311ae7f66a65cd81cccf42f5b810N.exe
2020	._cache_0b95311ae7f66a65cd81cccf42f5b810N.exe
2020	._cache_0b95311ae7f66a65cd81cccf42f5b810N.exe
2020	._cache_0b95311ae7f66a65cd81cccf42f5b810N.exe
624	Synaptics.exe
624	Synaptics.exe
2208	svchost.exe
2752	._cache_Synaptics.exe
2752	._cache_Synaptics.exe
2752	._cache_Synaptics.exe
2752	._cache_Synaptics.exe
2896	BlueStacksInstaller.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	0b95311ae7f66a65cd81cccf42f5b810N.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	._cache_Synaptics.exe
File created	C:\Windows\svchost.exe	._cache_0b95311ae7f66a65cd81cccf42f5b810N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0b95311ae7f66a65cd81cccf42f5b810N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_0b95311ae7f66a65cd81cccf42f5b810N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_0b95311ae7f66a65cd81cccf42f5b810N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	BlueStacksInstaller.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	BlueStacksInstaller.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	BlueStacksInstaller.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	BlueStacksInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	BlueStacksInstaller.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	BlueStacksInstaller.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	BlueStacksInstaller.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	BlueStacksInstaller.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3064	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2960	BlueStacksInstaller.exe
2896	BlueStacksInstaller.exe
2896	BlueStacksInstaller.exe
2896	BlueStacksInstaller.exe
2896	BlueStacksInstaller.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2960	BlueStacksInstaller.exe
Token: SeDebugPrivilege	2896	BlueStacksInstaller.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3064	EXCEL.EXE

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2856	1960	0b95311ae7f66a65cd81cccf42f5b810N.exe	30
PID 1960 wrote to memory of 2856	1960	0b95311ae7f66a65cd81cccf42f5b810N.exe	30
PID 1960 wrote to memory of 2856	1960	0b95311ae7f66a65cd81cccf42f5b810N.exe	30
PID 1960 wrote to memory of 2856	1960	0b95311ae7f66a65cd81cccf42f5b810N.exe	30
PID 1960 wrote to memory of 2856	1960	0b95311ae7f66a65cd81cccf42f5b810N.exe	30
PID 1960 wrote to memory of 2856	1960	0b95311ae7f66a65cd81cccf42f5b810N.exe	30
PID 1960 wrote to memory of 2856	1960	0b95311ae7f66a65cd81cccf42f5b810N.exe	30
PID 2856 wrote to memory of 2112	2856	._cache_0b95311ae7f66a65cd81cccf42f5b810N.exe	31
PID 2856 wrote to memory of 2112	2856	._cache_0b95311ae7f66a65cd81cccf42f5b810N.exe	31
PID 2856 wrote to memory of 2112	2856	._cache_0b95311ae7f66a65cd81cccf42f5b810N.exe	31
PID 2856 wrote to memory of 2112	2856	._cache_0b95311ae7f66a65cd81cccf42f5b810N.exe	31
PID 2112 wrote to memory of 2020	2112	svchost.exe	32
PID 2112 wrote to memory of 2020	2112	svchost.exe	32
PID 2112 wrote to memory of 2020	2112	svchost.exe	32
PID 2112 wrote to memory of 2020	2112	svchost.exe	32
PID 2112 wrote to memory of 2020	2112	svchost.exe	32
PID 2112 wrote to memory of 2020	2112	svchost.exe	32
PID 2112 wrote to memory of 2020	2112	svchost.exe	32
PID 1960 wrote to memory of 624	1960	0b95311ae7f66a65cd81cccf42f5b810N.exe	34
PID 1960 wrote to memory of 624	1960	0b95311ae7f66a65cd81cccf42f5b810N.exe	34
PID 1960 wrote to memory of 624	1960	0b95311ae7f66a65cd81cccf42f5b810N.exe	34
PID 1960 wrote to memory of 624	1960	0b95311ae7f66a65cd81cccf42f5b810N.exe	34
PID 2020 wrote to memory of 2896	2020	._cache_0b95311ae7f66a65cd81cccf42f5b810N.exe	35
PID 2020 wrote to memory of 2896	2020	._cache_0b95311ae7f66a65cd81cccf42f5b810N.exe	35
PID 2020 wrote to memory of 2896	2020	._cache_0b95311ae7f66a65cd81cccf42f5b810N.exe	35
PID 2020 wrote to memory of 2896	2020	._cache_0b95311ae7f66a65cd81cccf42f5b810N.exe	35
PID 624 wrote to memory of 3044	624	Synaptics.exe	36
PID 624 wrote to memory of 3044	624	Synaptics.exe	36
PID 624 wrote to memory of 3044	624	Synaptics.exe	36
PID 624 wrote to memory of 3044	624	Synaptics.exe	36
PID 624 wrote to memory of 3044	624	Synaptics.exe	36
PID 624 wrote to memory of 3044	624	Synaptics.exe	36
PID 624 wrote to memory of 3044	624	Synaptics.exe	36
PID 3044 wrote to memory of 2208	3044	._cache_Synaptics.exe	37
PID 3044 wrote to memory of 2208	3044	._cache_Synaptics.exe	37
PID 3044 wrote to memory of 2208	3044	._cache_Synaptics.exe	37
PID 3044 wrote to memory of 2208	3044	._cache_Synaptics.exe	37
PID 2208 wrote to memory of 2752	2208	svchost.exe	38
PID 2208 wrote to memory of 2752	2208	svchost.exe	38
PID 2208 wrote to memory of 2752	2208	svchost.exe	38
PID 2208 wrote to memory of 2752	2208	svchost.exe	38
PID 2208 wrote to memory of 2752	2208	svchost.exe	38
PID 2208 wrote to memory of 2752	2208	svchost.exe	38
PID 2208 wrote to memory of 2752	2208	svchost.exe	38
PID 2752 wrote to memory of 2960	2752	._cache_Synaptics.exe	39
PID 2752 wrote to memory of 2960	2752	._cache_Synaptics.exe	39
PID 2752 wrote to memory of 2960	2752	._cache_Synaptics.exe	39
PID 2752 wrote to memory of 2960	2752	._cache_Synaptics.exe	39
PID 2896 wrote to memory of 1096	2896	BlueStacksInstaller.exe	41
PID 2896 wrote to memory of 1096	2896	BlueStacksInstaller.exe	41
PID 2896 wrote to memory of 1096	2896	BlueStacksInstaller.exe	41

C:\Users\Admin\AppData\Local\Temp\0b95311ae7f66a65cd81cccf42f5b810N.exe
"C:\Users\Admin\AppData\Local\Temp\0b95311ae7f66a65cd81cccf42f5b810N.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Users\Admin\AppData\Local\Temp\._cache_0b95311ae7f66a65cd81cccf42f5b810N.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_0b95311ae7f66a65cd81cccf42f5b810N.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\svchost.exe
    "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\._cache_0b95311ae7f66a65cd81cccf42f5b810N.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2112
  - - C:\Users\Admin\AppData\Local\Temp\._cache_0b95311ae7f66a65cd81cccf42f5b810N.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_0b95311ae7f66a65cd81cccf42f5b810N.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E7909C6\BlueStacksInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS4E7909C6\BlueStacksInstaller.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\7zS4E7909C6\HD-Hvutl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS4E7909C6\HD-Hvutl.exe" --cmd checkHypervEnabled
        6⤵
        Executes dropped EXE
        
        PID:1096
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3044
  - - C:\Windows\svchost.exe
      "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2208
    - - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\7zS0CAD55E6\BlueStacksInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS0CAD55E6\BlueStacksInstaller.exe" InjUpdate
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2960

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2416

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
1.5MB

MD5
0b95311ae7f66a65cd81cccf42f5b810

SHA1
4cc872770e027f393e430bc15b8a7d82853484bb

SHA256
a4a98c21e59906959e20d4a3e7125cfb637fee93d195f60c1cacb91e2503c3dd

SHA512
1c02d42dccc91ab2beacaae8bccf5375022da7df343747df11f16810461ddd17fc1729f3616b19bdc6edff6dc70744bb48afcfbdab2b93cfca2cf579b204bc33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7eb4f9ba9206e28d1d9d9fb270040844

SHA1
55e99dd3db125e893a5f76d80a3c5cb140ddc10a

SHA256
695866ffc47f0731ca1a6581297f865dba3c3d98ab703528866daec8eb2f06da

SHA512
d43d1ede723d9293d4fa1430906ceb54ec94c7ef661e3543d4e477664309adc60432818b46db9623cd1e4bfdc5c86c13775d2b4a5102fcedeb925744c7dc32ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b93724f190dbb3a791ca629ad7593b4

SHA1
ec5114afd2c92a405aa22563c6294195629f6db5

SHA256
21e2139101fc001d5aa9d7d922b0b400f56c814fddbf8d5a601e1a8d55470447

SHA512
7e5dcca75de04036e8e4cd933c72c9cbe191360e8bd87618caea8b9a98113cd862a02ce24d418608b2ef06ab66ca25b940d5a143a63bc41116a6e11cd38cb708

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eee8a0f1045e500a3405df6f64e75af2

SHA1
644df14991b3fadeaba2e8060dc6246c4ad406e2

SHA256
adc2345548b7240b9aaed1644a51863df4b9554486057622928f93e876913c16

SHA512
a5dda49301f97832f924c4d93b178a4a9061804f97eaecb2c308424fa659939ef35ee1c3f275c2740a729c0a90b81beb50b5d06cf1115d02220ade7e413fcd07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
707e8918c21917de8b55f22f6971b995

SHA1
513b8989af6339510c8a9280cd2210eb83893c54

SHA256
aca268b82d6f3ecec5f048366224ee74e7f390484662c6378eb1dbe6c34e9a43

SHA512
9c6ecc3e853c3c13235b493704f5e66f4d5f49f9f70795761e911f6f4d291365cff29e7cb6106429fdb9ba806fd34803fc81712a1677b6e67970a739f3628dbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c2d1f360a7274474a3e17b1685fe541

SHA1
2784d32252ec0378f4415ba56ad72ae70f961c77

SHA256
591f78411cae3d71f29d01b1c48bc1ab029fb9b4e7fed1c18336112137b0361b

SHA512
14ba2365bb66303a90eb48aa1b30857c3d6f221f585c73178a0f065d024fa5a4a81666a16ebe8aa2e95aa9c414cd2f5ac846f18694875debc01e2adecc972bb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35d4b45bc302b18324f406ec7f7db73e

SHA1
1114a58a1f63e768b9f07395b61cb9c1436dd140

SHA256
9df9f9a299ec159824abdf38ce76a282b8a532314ef78e2445bc6033b647350d

SHA512
c44d995690109b1fda12417dd4ea69ab7266fbc3aa4f2cdbb028d4a78a23e23dab4bf9ea62e1fab765406da7e13ba7e94b67686e3c24076965149beb2c81ba26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
acc07afbf6306a5474aee6f8e1e26e08

SHA1
2bce069da59bbf00e7d1ebbd13607f12ba694c38

SHA256
b0f30fb8eb6fcf00b5dee995de9d41cd9138424d1a93b7c15c75796280942d49

SHA512
82bed12984ca09685b391d10cfbca706ac0b9caa3169bbe0f80a045e8469499b3b084de3c94effeefc8715c0b36f51b330d3dd78d7ff516054d18ee75aae3106

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12e70e36ccc823b83bf6e610c8ec9467

SHA1
c289b5707a047ed75964f4c857ab4ae93c9a75a2

SHA256
0f420dff14195c3f0b713d7f40222d075b8608dceda29bad88b7fb2a969b51d6

SHA512
89448e10557652a9e8cda17a6403bdd69c0d5bc8554fa7a562db030632db80ef0da1954f160015fb06f1e693b02d13a53585764d3e3a1c5931dcc844ac4b5709

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3413a0035f3c64cdc54b8db8eb363d9

SHA1
9b448f4a7508eda60c6a5acbb8456ca163b8c5db

SHA256
7d44fe4701dc20fddc930285667f13d8455c77c3512ed22f20fc8eb8babcc83e

SHA512
32ead0ede89a9090cc71afdcf26861aa541f1b3cf47332c167ed7339c25870b5782cd0d6fe328e166e6aa9d49e42d2b4c9a68d8b4751d950107b1d1790dfc61b

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_0b95311ae7f66a65cd81cccf42f5b810N.exe

Filesize
756KB

MD5
38879db2c80f3de4a790da1ddf096025

SHA1
8f7794861949350204213aeaee91cfa2349af62a

SHA256
fc774b995a45e2ffefbd9932677a97ad4de07742fc7cef7fb9b7f5e95e85a33b

SHA512
7417b23d023d7a11d5575995e4ecb02728ea983ea6a35469ec887178bc3868f02d8137f9b127976f7d165152a5e15d5ca72019bf117d9b56b7c979b2456eabaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_0b95311ae7f66a65cd81cccf42f5b810N.exe

Filesize
756KB

MD5
7aa38272620ad35ac8eeef0946a9657c

SHA1
6daaf90b64a36ec17c3913d6a5df8eaff134baef

SHA256
2826ca9a7d1ac52bc823349558957d48211d8ae49e1724c2839aef5b0092313b

SHA512
0964901a1be8c595e35e6393f66677b2974d17dc86fd22b8f5632888c2426ea27fae491b4e9b5f8e1d5960304f629fb75fed079938bbbfc553c29062bcf6121c

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_0b95311ae7f66a65cd81cccf42f5b810N.exe

Filesize
756KB

MD5
1bba48c5b5cc96675450f2cc074fecfb

SHA1
bd8f07ec075ba827c5f8101b922ecfcdc0209073

SHA256
9d649dc7a5fcc340a8b82221c4709ad3aeba8f0a40e755b408698315bbd889cb

SHA512
71a10579ef7ee846b718a3aef0b44a3b96bbc53c08d04aa6ca48357716513e5fdc9f69604abc051e9f97a1e6131c8feca86f8fe469f4e62cf783cc0e30e60fdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0CAD55E6\Assets\exit_close.png

Filesize
670B

MD5
26eb04b9e0105a7b121ea9c6601bbf2a

SHA1
efc08370d90c8173df8d8c4b122d2bb64c07ccd8

SHA256
7aaef329ba9fa052791d1a09f127551289641ea743baba171de55faa30ec1157

SHA512
9df3c723314d11a6b4ce0577eb61488061f2f96a9746a944eb6a4ee8c0c4d29131231a1b20988ef5454b79f9475b43d62c710839ecc0a9c98324f977cab6db68

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0CAD55E6\Assets\minimize_progress.png

Filesize
212B

MD5
1504b80f2a6f2d3fefc305da54a2a6c2

SHA1
432a9d89ebc2f693836d3c2f0743ea5d2077848d

SHA256
2f62d4e8c643051093f907058dddc78cc525147d9c4f4a0d78b4d0e5c90979f6

SHA512
675db04baf3199c8d94af30a1f1c252830a56a90f633c3a72aa9841738b04242902a5e7c56dd792626338e8b7eabc1f359514bb3a2e62bc36c16919e196cfd94

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0CAD55E6\ThemeFile

Filesize
80KB

MD5
c3e6bab4f92ee40b9453821136878993

SHA1
94493a6b3dfb3135e5775b7d3be227659856fbc4

SHA256
de1a2e6b560e036da5ea6b042e29e81a5bfcf67dde89670c332fc5199e811ba6

SHA512
a64b6b06b3a0f3591892b60e59699682700f4018b898efe55d6bd5fb417965a55027671c58092d1eb7e21c2dbac42bc68dfb8c70468d98bed45a8cff0e945895

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4E7909C6\Assets\backicon.png

Filesize
15KB

MD5
7ff5dc8270b5fa7ef6c4a1420bd67a7f

SHA1
b224300372feaa97d882ca2552b227c0f2ef4e3e

SHA256
fa64884054171515e97b78aaa1aad1ec5baa9d1daf9c682e0b3fb4a41a9cb1c1

SHA512
f0d5a842a01b99f189f3d46ab59d2c388a974951b042b25bbce54a15f5a3f386984d19cfca22ba1440eebd79260066a37dfeff6cb0d1332fca136add14488eef

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4E7909C6\Assets\checked_gray.png

Filesize
538B

MD5
ce144d2aab3bf213af693d4e18f87a59

SHA1
df59dc3dbba88bdc5ffc25f2e5e7b73ac3de5afa

SHA256
d8e502fab00b0c6f06ba6abede6922ab3b423fe6f2d2f56941dabc887b229ad3

SHA512
0f930edd485a0d49ef157f6cc8856609c087c91b77845adeb5cc8c8a80ebc7ec5416df351ffa1af780caad884dbb49dcc778b0b30de6fb7c85ffef22d7220ebe

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4E7909C6\Assets\close_red.png

Filesize
15KB

MD5
93216b2f9d66d423b3e1311c0573332d

SHA1
5efaebec5f20f91f164f80d1e36f98c9ddaff805

SHA256
d0b6d143642d356b40c47459a996131a344cade6bb86158f1b74693426b09bfb

SHA512
922a7292de627c5e637818556d25d9842a88e89f2b198885835925679500dfd44a1e25ce79e521e63c4f84a6b0bd6bf98e46143ad8cee80ecdbaf3d3bc0f3a32

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4E7909C6\Assets\custom.png

Filesize
17KB

MD5
03b17f0b1c067826b0fcc6746cced2cb

SHA1
e07e4434e10df4d6c81b55fceb6eca2281362477

SHA256
fbece8bb5f4dfa55dcfbf41151b10608af807b9477e99acf0940954a11e68f7b

SHA512
67c78ec01e20e9c8d9cdbba665bb2fd2bb150356f30b88d3d400bbdb0ae92010f5d7bcb683dcf6f895722a9151d8e669d8bef913eb6e728ba56bb02f264573b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4E7909C6\Assets\installer_bg.jpg

Filesize
42KB

MD5
162c23f5962381efba79be503b41089c

SHA1
fc5a95e6eb2bb015fe27457873528c24b3bc459d

SHA256
04d70d0968675290294df78800ed48fe4a681a72803405fbdc541b927b445457

SHA512
9bd6e634d6cb362ab40f2646ca59a865f05e6049ac55b9d03b3df1f8e853715119438771196a351ca98c6cb61a212bbc0bedb7bf2d306563f6198353a7680c54

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4E7909C6\Assets\installer_logo.png

Filesize
7KB

MD5
d6f746b61d5c91d6688faab54ecc74c3

SHA1
9581cafbc93d6189c7e0633bd43dfd017510f731

SHA256
ed7e205b0ccdd454d4fa47c48834ad36a6e9fb51f4042a2dcd39a7fe01244d95

SHA512
0139711388976628ebd46a2f1dc7e0c38184d3b4ab63a8f2b6c8cd9e6032cddcd2dafb8ce4ab3ba8008beba9d6c3e444577cd7953bb48e39635e5c9666fdf478

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4E7909C6\Assets\installer_minimize.png

Filesize
113B

MD5
38b539a1e4229738e5c196eedb4eb225

SHA1
f027b08dce77c47aaed75a28a2fce218ff8c936c

SHA256
a064f417e3c2b8f3121a14bbded268b2cdf635706880b7006f931de31476bbc2

SHA512
2ce433689a94fae454ef65e0e9ec33657b89718bbb5a038bf32950f6d68722803922f3a427278bad432395a1716523e589463fcce4279dc2a895fd77434821cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4E7909C6\Assets\loader.png

Filesize
279B

MD5
03903fd42ed2ee3cb014f0f3b410bcb4

SHA1
762a95240607fe8a304867a46bc2d677f494f5c2

SHA256
076263cc65f9824f4f82eb6beaa594d1df90218a2ee21664cf209181557e04b1

SHA512
8b0e717268590e5287c07598a06d89220c5e9a33cd1c29c55f8720321f4b3efc869d20c61fcc892e13188d77f0fdc4c73a2ee6dece174bf876fcc3a6c5683857

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4E7909C6\Assets\setpath.png

Filesize
15KB

MD5
b2e7f40179744c74fded932e829cb12a

SHA1
a0059ab8158a497d2cf583a292b13f87326ec3f0

SHA256
5bbb2f41f9f3a805986c3c88a639bcc22d90067d4b8de9f1e21e3cf9e5c1766b

SHA512
b95b7ebdb4a74639276eaa5c055fd8d9431e2f58a5f7c57303f7cf22e8b599f6f2a7852074cf71b19b49eb31cc9bf2509aedf41d608981d116e49a00030c797c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4E7909C6\Assets\unchecked_gray.png

Filesize
192B

MD5
e50df2a0768f7fc4c3fe8d784564fea3

SHA1
d1fc4db50fe8e534019eb7ce70a61fd4c954621a

SHA256
671f26795b12008fbea1943143f660095f3dca5d925f67d765e2352fd7ee2396

SHA512
c87a8308a73b17cbdd179737631fb1ba7fdaeb65e82263f6617727519b70a81266bb695867b9e599c1306ee2cf0de525452f77ce367ca89bf870ea3ae7189998

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4E7909C6\BlueStacksInstaller.exe

Filesize
547KB

MD5
6e649a25d5cc4922c49fd6f63522e8c1

SHA1
77628b8f93d4d751e108a01c4d8fca0385635d13

SHA256
2bbc833a2b3d23b6990d400c0064c909f22c50259531046f6e3b407a46f70bbd

SHA512
630165ecad1ef06fc88b4a699e70888f7136a3f60523715015bc06ba407e736e45c75a4f75bca3a2185f03c7599d4201e691b78ead28dab79b0e20b1d3129238

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4E7909C6\BlueStacksInstaller.exe.config

Filesize
324B

MD5
1b456d88546e29f4f007cd0bf1025703

SHA1
e5c444fcfe5baf2ef71c1813afc3f2c1100cab86

SHA256
d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb

SHA512
c545e416c841b8786e4589fc9ca2b732b16cdd759813ec03f558332f2436f165ec1ad2fbc65012b5709fa19ff1e8396639c17bfad150cabeb51328a39ea556e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4E7909C6\JSON.dll

Filesize
411KB

MD5
f5fd966e29f5c359f78cb61a571d1be4

SHA1
a55e7ed593b4bc7a77586da0f1223cfd9d51a233

SHA256
d2c8d26f95f55431e632c8581154db7c19547b656380e051194a9d2583dd2156

SHA512
d99e6fe250bb106257f86135938635f6e7ad689b2c11a96bb274f4c4c5e9a85cfacba40122dbc953f77b5d33d886c6af30bff821f10945e15b21a24b66f6c8be

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4E7909C6\Locales\i18n.en-US.txt

Filesize
14KB

MD5
11a1ed0cd63272586ad687e031fb249d

SHA1
d79f0f69b0939002cfc19f83d42a184653b4678c

SHA256
7f950d0a5382c8326427b87a0fdeca0ea6eee6bb73c13b5d4364041de64fc718

SHA512
1bb0d78a9cac231406eb85399103991fe4f172f02dda95f5137b0ce88c8f21bbdcb5cd4de1a7eaa75614bf9fb5bf459b60ad6b9a9a6a8209e1944b95082a2d3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\8gvQxnu6.xlsm

Filesize
20KB

MD5
92536f0e48ec6d0a3eb103e4e3480cbb

SHA1
7d5a1ebd5b909c16f66d9a19dae542ab6d7cfa38

SHA256
ab8da75e5f0032e07c8e40efdaaff90e58c24611627f9908f960a0d455a071f8

SHA512
cf286601d9f220aa7f6b371239de42de551a1be2ea8557d1f9dcce69ec3b01463411058f228c4b75b709451465c81f14260de452a0140fac2b0cda34f3f6f065

Download Submit
C:\Users\Admin\AppData\Local\Temp\8gvQxnu6.xlsm

Filesize
28KB

MD5
ae21da1d5a240b33772305fdf319bda8

SHA1
bee98de51d18d4b76b4afd5b218bfe6070af57e0

SHA256
d9717c97d8909c356178f57fa7594f9ce62ba3e4922ec8920504dec2e71e1527

SHA512
a9e0c903fbb0373f3f62d93ba4f2bb7fd236c1070b48989d9d31ec87f231ffc33ded1585218d8b3d395c8d8795961ab22f59c365c3143455fa9815f62476ee60

Download Submit
C:\Users\Admin\AppData\Local\Temp\8gvQxnu6.xlsm

Filesize
21KB

MD5
0771c7936cdcd557baaab50aca77795e

SHA1
d3a2947668d184949841fefd1acc29ef5a9f7804

SHA256
6d3936e6140addafff86479b6ad9d8f419b40b67bb0f22a2f80e2eb0f22adf3f

SHA512
a1f39a3b0b1c59f71eca7421f8f5d2b5fd668df1fbecc7f0cf7b34cfce59b34c2755f074256de724be31ef38660b3699d1e489f7ebe12906d3464a27c1b69bcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\8gvQxnu6.xlsm

Filesize
22KB

MD5
c32e86cd0f23e59813508d67b9b4f58f

SHA1
3b000382db3275132e042738b86beb58c5eff849

SHA256
80b1976bc4274246bda5a28cb2996c80f72cd7318c71fe267a389720ef760500

SHA512
c65fd236d0aeb83d6bee4fafaa3cd32efba386af279c51c762aa58c76a7d206f918824fe3db58b595dd6d394c0cd20bfd645a63a0f6a5f60584210fff9189efe

Download Submit
C:\Users\Admin\AppData\Local\Temp\8gvQxnu6.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD663.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD6E2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\~$8gvQxnu6.xlsm

Filesize
165B

MD5
ff09371174f7c701e75f357a187c06e8

SHA1
57f9a638fd652922d7eb23236c80055a91724503

SHA256
e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

SHA512
e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

Download Submit
C:\Windows\svchost.exe

Filesize
35KB

MD5
9e3c13b6556d5636b745d3e466d47467

SHA1
2ac1c19e268c49bc508f83fe3d20f495deb3e538

SHA256
20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8

SHA512
5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_0b95311ae7f66a65cd81cccf42f5b810N.exe

Filesize
791KB

MD5
51dcb9401857617e47cc17b3677ff410

SHA1
4a13844cbddf50a282a138489c234857b9ff52d1

SHA256
85ba41b87b1146079f539b869d6110c909ea347b9bbafaa7e69a47a1e694eb97

SHA512
b2aec057d29fb0d43431473f0a82fbfe1f5f878dd12e2e6a3d5c26bb0433a7ea8bed966451689fe64f0da8e506cc8346b74043bddae01aada7f3ffed5674d380

Download Submit
\Users\Admin\AppData\Local\Temp\7zS4E7909C6\HD-Hvutl.exe

Filesize
236KB

MD5
4cc86d695c4d1c1b2afddf1d4730b670

SHA1
5b91bd0d9b4c699393a041a2bae8b4192c01781b

SHA256
179bb310762df382a5a0201651251429bf45283d7088aeecd6d42af4bd9fa399

SHA512
65e7d7c88eb2300231b22279441c64b84e6f3d0091ecf317f997504b43c7e0088a3edb447c15198fbeabe6a11e904d89a28a24736417aade0b3590cfc105c1c9

Download Submit
memory/624-1053-0x0000000000400000-0x0000000000588000-memory.dmp

Filesize
1.5MB

Download
memory/624-1011-0x0000000000400000-0x0000000000588000-memory.dmp

Filesize
1.5MB

Download
memory/624-1009-0x0000000000400000-0x0000000000588000-memory.dmp

Filesize
1.5MB

Download
memory/624-928-0x0000000000400000-0x0000000000588000-memory.dmp

Filesize
1.5MB

Download
memory/1960-151-0x0000000000400000-0x0000000000588000-memory.dmp

Filesize
1.5MB

Download
memory/1960-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2112-76-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2208-182-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2416-1058-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2416-927-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2856-14-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2896-220-0x0000000000380000-0x000000000040C000-memory.dmp

Filesize
560KB

Download
memory/2896-411-0x0000000001FA0000-0x0000000001FAA000-memory.dmp

Filesize
40KB

Download
memory/2896-1007-0x0000000001FA0000-0x0000000001FAA000-memory.dmp

Filesize
40KB

Download
memory/2896-313-0x0000000001F10000-0x0000000001F78000-memory.dmp

Filesize
416KB

Download
memory/2960-307-0x0000000001010000-0x000000000109C000-memory.dmp

Filesize
560KB

Download
memory/2960-929-0x0000000000550000-0x000000000055A000-memory.dmp

Filesize
40KB

Download
memory/2960-312-0x0000000000B30000-0x0000000000B98000-memory.dmp

Filesize
416KB

Download
memory/2960-409-0x0000000000550000-0x000000000055A000-memory.dmp

Filesize
40KB

Download
memory/2960-410-0x0000000000550000-0x000000000055A000-memory.dmp

Filesize
40KB

Download
memory/3044-175-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3064-930-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/3064-1006-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download