hxxps://deltaaxecutor[.]com/

Analysis

user interaction
yes
max time kernel
298s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/05/2026, 17:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://deltaaxecutor.com/
Sample260502-vzksjacx21

Score

8^/10

adware defense_evasion discovery persistence privilege_escalation spyware

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
256	5040	BlueStacksInstaller.exe
243	4012	chrome.exe

Modifies Windows Firewall 2 TTPs 4 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
11012	netsh.exe
11232	netsh.exe
6980	netsh.exe
6968	netsh.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	Bootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	BlueStacksServices.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	BlueStacksServices.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	BlueStacksInstaller_5.22.168.1001_native_cc0dce156389fbe2ea581177b1cc27ff_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	BSX-Setup-5.22.168.1001_nxt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	BlueStacksInstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	BlueStacksInstaller_5.22.168.1001_native_cc0dce156389fbe2ea581177b1cc27ff_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe

Executes dropped EXE 21 IoCs

pid	Process
5620	BlueStacksInstaller_5.22.168.1001_native_cc0dce156389fbe2ea581177b1cc27ff_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe
5040	BlueStacksInstaller.exe
2376	HD-CheckCpu.exe
2240	HD-CheckCpu.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
7188	BlueStacksInstaller_5.22.168.1001_native_cc0dce156389fbe2ea581177b1cc27ff_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe
7908	BlueStacksServicesSetup.exe
7956	Bootstrapper.exe
8060	BlueStacksInstaller.exe
3232	7zr.exe
3644	HD-ForceGPU.exe
6268	HD-GLCheck.exe
6592	HD-GLCheck.exe
6664	HD-GLCheck.exe
6792	HD-GLCheck.exe
8220	HD-GLCheck.exe
8324	HD-GLCheck.exe
8372	BlueStacksServices.exe
8520	BlueStacksServices.exe
8636	BlueStacksServices.exe
9432	BlueStacksServices.exe

Loads dropped DLL 64 IoCs

pid	Process
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\electron.app.BlueStacks Services = "C:\\Users\\Admin\\AppData\\Local\\Programs\\bluestacks-services\\BlueStacksServices.exe --hidden"	BlueStacksServices.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	BlueStacksInstaller.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\storage.json	BlueStacksServices.exe
File created	C:\Windows\system32\storage.json	BlueStacksServices.exe

Enumerates processes with tasklist 1 TTPs 17 IoCs

discovery

Process Discovery

T1057

pid	Process
5720	tasklist.exe
10888	tasklist.exe
7712	tasklist.exe
4076	tasklist.exe
4628	tasklist.exe
10436	tasklist.exe
4440	tasklist.exe
7968	tasklist.exe
8140	tasklist.exe
5876	tasklist.exe
2724	tasklist.exe
8164	tasklist.exe
224	tasklist.exe
5416	tasklist.exe
6876	tasklist.exe
2428	tasklist.exe
7792	tasklist.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\close_hover.svg	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\Guide\Mask_BG.png	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\MyGames\up.svg	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\translations\qt_en.qm	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\access\libaccess_concat_plugin.dll	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\codec\libvorbis_plugin.dll	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\settings\remove_disabled.svg	BSX-Setup-5.22.168.1001_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\image\Tutorial\PremiumGames\Icon_tip1.svg	BSX-Setup-5.22.168.1001_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\audio_filter\libugly_resampler_plugin.dll	BSX-Setup-5.22.168.1001_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\audio_output\libamem_plugin.dll	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\video_filter\libantiflicker_plugin.dll	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\iconengines	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\audio_mixer	BSX-Setup-5.22.168.1001_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\image\Guide\previous.svg	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\translations\qtwebengine_locales\am.pak	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\translations\qt_ja.qm	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\video_chroma\libi422_i420_plugin.dll	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\video_filter\libripple_plugin.dll	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\xplugins\StrategyPlugin.dll	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\Guide\Step2_Video_Frame_Line.png	BSX-Setup-5.22.168.1001_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\image\Icon_Warning.svg	BSX-Setup-5.22.168.1001_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\image\checkBox\uncheck_normal.svg	BSX-Setup-5.22.168.1001_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\image\default_app.svg	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\NowBuxUser\GiftCardSuccessBG.png	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\NowBuxUser\nowBux.png	BSX-Setup-5.22.168.1001_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\image\Offers\Down.svg	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\api-ms-win-crt-time-l1-1-0.dll	BSX-Setup-5.22.168.1001_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\image\booting_logo.svg	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\www\js\localize.js	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\stream_filter\libadf_plugin.dll	BSX-Setup-5.22.168.1001_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\video_chroma\libchain_plugin.dll	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\video_filter\libscene_plugin.dll	BSX-Setup-5.22.168.1001_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\video_output\libcaca_plugin.dll	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\7z.dll	BSX-Setup-5.22.168.1001_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\audio_filter\libaudiobargraph_a_plugin.dll	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\video_chroma\libchain_plugin.dll	BSX-Setup-5.22.168.1001_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\video_filter\librotate_plugin.dll	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\video_output\libdirectdraw_plugin.dll	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\web3\tutorial.png	BSX-Setup-5.22.168.1001_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\translations\qt_zh_CN.qm	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\audio_filter\libnormvol_plugin.dll	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\IconWarning2.svg	BSX-Setup-5.22.168.1001_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\translations\qt_pt_BR.qm	BSX-Setup-5.22.168.1001_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\audio_filter\libscaletempo_pitch_plugin.dll	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\mux\libmux_avi_plugin.dll	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\video_chroma\librv32_plugin.dll	BSX-Setup-5.22.168.1001_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\video_output\libvmem_plugin.dll	BSX-Setup-5.22.168.1001_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\position\qtposition_serialnmea.dll	BSX-Setup-5.22.168.1001_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\www\images\msi5-noNetwork.svg	BSX-Setup-5.22.168.1001_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\access\libhttps_plugin.dll	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\HvDialog_Tips.svg	BSX-Setup-5.22.168.1001_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\image\MyGames\NavigatorForward_Disable.svg	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\NowBuxUser\Caret Right-Default.svg	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\Search\History_ButtonDelete_normal.svg	BSX-Setup-5.22.168.1001_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\audio\qtaudio_windows.dll	BSX-Setup-5.22.168.1001_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll	BSX-Setup-5.22.168.1001_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\codec\libtheora_plugin.dll	BSX-Setup-5.22.168.1001_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\playlistformats	BSX-Setup-5.22.168.1001_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\image\Offers\Up.svg	BSX-Setup-5.22.168.1001_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\image\radioButton\unselected_hover.svg	BSX-Setup-5.22.168.1001_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\translations\qtwebengine_locales\fil.pak	BSX-Setup-5.22.168.1001_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\access\libaccess_imem_plugin.dll	BSX-Setup-5.22.168.1001_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\audio_filter\libscaletempo_plugin.dll	BSX-Setup-5.22.168.1001_nxt.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BlueStacksServicesSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD-CheckCpu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BSX-Setup-5.22.168.1001_nxt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BlueStacksInstaller_5.22.168.1001_native_cc0dce156389fbe2ea581177b1cc27ff_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD-CheckCpu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BlueStacksInstaller_5.22.168.1001_native_cc0dce156389fbe2ea581177b1cc27ff_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4012	chrome.exe
3328	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134222163551556115"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\\ = "apk_auto_file"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX	BSX-Setup-5.22.168.1001_nxt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\shell\open\command\ = "\"C:\\Program Files (x86)\\BlueStacks X\\BlueStacks X.exe\" -open \"%1\""	BSX-Setup-5.22.168.1001_nxt.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\睱蠀塘翸	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\apk_auto_file\shell\Read	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\shell	BSX-Setup-5.22.168.1001_nxt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\shell\	BSX-Setup-5.22.168.1001_nxt.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\bstsrvs\shell\open	BlueStacksServices.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\shell\open	BSX-Setup-5.22.168.1001_nxt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\bstsrvs\ = "URL:bstsrvs"	BlueStacksServices.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\.apk\ = "apk_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\apk_auto_file\shell\Read\command	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\URL Protocol	BSX-Setup-5.22.168.1001_nxt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\DefaultIcon\ = "C:\\Program Files (x86)\\BlueStacks X\\BlueStacks X.exe,0"	BSX-Setup-5.22.168.1001_nxt.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\.apk	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\䱤ẗ觲ၜ뻻ā	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\嫄ƫ\ = "apk_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	BSX-Setup-5.22.168.1001_nxt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\shell\open\command	BSX-Setup-5.22.168.1001_nxt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\bstsrvs\URL Protocol	BlueStacksServices.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\apk_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\䱤ẗ觲ၜ뻻ā\ = "apk_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\ = "URL:BlueStacksX Protocol Handler"	BSX-Setup-5.22.168.1001_nxt.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\bstsrvs	BlueStacksServices.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\bstsrvs\shell	BlueStacksServices.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\嫄ƫ	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\apk_auto_file\shell	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\shell\open\	BSX-Setup-5.22.168.1001_nxt.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	BSX-Setup-5.22.168.1001_nxt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\bstsrvs\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\bluestacks-services\\BlueStacksServices.exe\" \"%1\""	BlueStacksServices.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\睱蠀塘翸\ = "apk_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\apk_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\" \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\bstsrvs\shell\open\command	BlueStacksServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\DefaultIcon	BSX-Setup-5.22.168.1001_nxt.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
4640	chrome.exe
4640	chrome.exe
5040	BlueStacksInstaller.exe
5040	BlueStacksInstaller.exe
5040	BlueStacksInstaller.exe
5040	BlueStacksInstaller.exe
5040	BlueStacksInstaller.exe
5040	BlueStacksInstaller.exe
5040	BlueStacksInstaller.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
5424	BSX-Setup-5.22.168.1001_nxt.exe
7956	Bootstrapper.exe
7956	Bootstrapper.exe
7956	Bootstrapper.exe
7956	Bootstrapper.exe
7956	Bootstrapper.exe
7956	Bootstrapper.exe
7956	Bootstrapper.exe
7956	Bootstrapper.exe
7908	BlueStacksServicesSetup.exe
7908	BlueStacksServicesSetup.exe
8060	BlueStacksInstaller.exe
8060	BlueStacksInstaller.exe
5720	tasklist.exe
5720	tasklist.exe
8060	BlueStacksInstaller.exe
8060	BlueStacksInstaller.exe
8060	BlueStacksInstaller.exe
8060	BlueStacksInstaller.exe
8060	BlueStacksInstaller.exe
8060	BlueStacksInstaller.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3968	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
1840	msedge.exe
1840	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe
Token: SeShutdownPrivilege	2740	chrome.exe
Token: SeCreatePagefilePrivilege	2740	chrome.exe

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
5040	BlueStacksInstaller.exe
8372	BlueStacksServices.exe
8372	BlueStacksServices.exe
8372	BlueStacksServices.exe
8372	BlueStacksServices.exe
1840	msedge.exe

Suspicious use of SendNotifyMessage 37 IoCs

pid	Process
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
2740	chrome.exe
8372	BlueStacksServices.exe
8372	BlueStacksServices.exe
8372	BlueStacksServices.exe
8372	BlueStacksServices.exe
8372	BlueStacksServices.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
3968	OpenWith.exe
4724	AcroRd32.exe
4724	AcroRd32.exe
4724	AcroRd32.exe
4724	AcroRd32.exe
8220	HD-GLCheck.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 4496	2740	chrome.exe	86
PID 2740 wrote to memory of 4636	2740	chrome.exe	87
PID 2740 wrote to memory of 4636	2740	chrome.exe	87
PID 2740 wrote to memory of 4012	2740	chrome.exe	88
PID 2740 wrote to memory of 1700	2740	chrome.exe	89
PID 2740 wrote to memory of 1700	2740	chrome.exe	89
PID 2740 wrote to memory of 3248	2740	chrome.exe	92
PID 2740 wrote to memory of 3248	2740	chrome.exe	92
PID 2740 wrote to memory of 4856	2740	chrome.exe	91
PID 2740 wrote to memory of 4856	2740	chrome.exe	91
PID 2740 wrote to memory of 568	2740	chrome.exe	93
PID 2740 wrote to memory of 568	2740	chrome.exe	93
PID 2740 wrote to memory of 2036	2740	chrome.exe	94
PID 2740 wrote to memory of 2036	2740	chrome.exe	94
PID 2740 wrote to memory of 3056	2740	chrome.exe	96
PID 2740 wrote to memory of 3056	2740	chrome.exe	96
PID 2740 wrote to memory of 4072	2740	chrome.exe	98
PID 2740 wrote to memory of 4872	2740	chrome.exe	101
PID 2740 wrote to memory of 4872	2740	chrome.exe	101
PID 2740 wrote to memory of 2972	2740	chrome.exe	102
PID 2740 wrote to memory of 2972	2740	chrome.exe	102
PID 2740 wrote to memory of 5216	2740	chrome.exe	103
PID 2740 wrote to memory of 5216	2740	chrome.exe	103
PID 2740 wrote to memory of 4656	2740	chrome.exe	104
PID 2740 wrote to memory of 4656	2740	chrome.exe	104
PID 2740 wrote to memory of 3988	2740	chrome.exe	105
PID 2740 wrote to memory of 3988	2740	chrome.exe	105
PID 2740 wrote to memory of 368	2740	chrome.exe	109
PID 2740 wrote to memory of 368	2740	chrome.exe	109
PID 2740 wrote to memory of 4460	2740	chrome.exe	117
PID 2740 wrote to memory of 4384	2740	chrome.exe	118
PID 2740 wrote to memory of 2256	2740	chrome.exe	119
PID 2740 wrote to memory of 2264	2740	chrome.exe	127
PID 2740 wrote to memory of 2264	2740	chrome.exe	127
PID 2740 wrote to memory of 3360	2740	chrome.exe	128
PID 2740 wrote to memory of 3360	2740	chrome.exe	128
PID 2740 wrote to memory of 5364	2740	chrome.exe	130
PID 3968 wrote to memory of 4724	3968	OpenWith.exe	132
PID 4724 wrote to memory of 3212	4724	AcroRd32.exe	136
PID 3212 wrote to memory of 4984	3212	RdrCEF.exe	137
PID 3212 wrote to memory of 4224	3212	RdrCEF.exe	138
PID 3212 wrote to memory of 4224	3212	RdrCEF.exe	138
PID 3212 wrote to memory of 3480	3212	RdrCEF.exe	140
PID 3212 wrote to memory of 5232	3212	RdrCEF.exe	141
PID 3212 wrote to memory of 4968	3212	RdrCEF.exe	142
PID 2740 wrote to memory of 4640	2740	chrome.exe	143
PID 2740 wrote to memory of 3016	2740	chrome.exe	144
PID 2740 wrote to memory of 3016	2740	chrome.exe	144
PID 2740 wrote to memory of 5564	2740	chrome.exe	145
PID 2740 wrote to memory of 5564	2740	chrome.exe	145
PID 2740 wrote to memory of 1396	2740	chrome.exe	146
PID 2740 wrote to memory of 1396	2740	chrome.exe	146
PID 2740 wrote to memory of 3128	2740	chrome.exe	147
PID 2740 wrote to memory of 3128	2740	chrome.exe	147
PID 2740 wrote to memory of 4548	2740	chrome.exe	148
PID 2740 wrote to memory of 4548	2740	chrome.exe	148
PID 2740 wrote to memory of 3924	2740	chrome.exe	149
PID 2740 wrote to memory of 5620	2740	chrome.exe	150
PID 5620 wrote to memory of 5040	5620	BlueStacksInstaller_5.22.168.1001_native_cc0dce156389fbe2ea581177b1cc27ff_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe	151
PID 5040 wrote to memory of 2376	5040	BlueStacksInstaller.exe	153
PID 5040 wrote to memory of 2240	5040	BlueStacksInstaller.exe	155
PID 5040 wrote to memory of 5424	5040	BlueStacksInstaller.exe	161
PID 2740 wrote to memory of 6000	2740	chrome.exe	163
PID 2740 wrote to memory of 6000	2740	chrome.exe	163

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://deltaaxecutor.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff83e47c728,0x7ff83e47c734,0x7ff83e47c740
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,7947989540815361613,8037916835583361149,262144 --field-trial-handle=1984,i,8847762960881221970,10350104524814856766,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2220,i,10645636946264747051,2996166085304819506,524288 --field-trial-handle=1984,i,8847762960881221970,10350104524814856766,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,9421298827723745985,3049538851591520707,524288 --field-trial-handle=1984,i,8847762960881221970,10350104524814856766,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:1700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,16588739201098180726,3183630129777715504,2097152 --field-trial-handle=1984,i,8847762960881221970,10350104524814856766,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,13121061198140842748,7364395260672727275,2097152 --field-trial-handle=1984,i,8847762960881221970,10350104524814856766,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4300,i,13070438351059246521,3819541311613603662,2097152 --field-trial-handle=1984,i,8847762960881221970,10350104524814856766,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4776,i,17748767343292261744,13110062471823372642,2097152 --field-trial-handle=1984,i,8847762960881221970,10350104524814856766,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4916,i,5626731744280102894,1165908372076772562,2097152 --field-trial-handle=1984,i,8847762960881221970,10350104524814856766,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,7517279142181553316,12860208553879056140,524288 --field-trial-handle=1984,i,8847762960881221970,10350104524814856766,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5816,i,8836342027178295342,9657561160120246115,2097152 --field-trial-handle=1984,i,8847762960881221970,10350104524814856766,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4856,i,4173235445073672891,17398741829156203563,2097152 --field-trial-handle=1984,i,8847762960881221970,10350104524814856766,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4872,i,3443360168315638445,11731764399003781764,2097152 --field-trial-handle=1984,i,8847762960881221970,10350104524814856766,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4964,i,17206095094049928483,3947482168140989305,2097152 --field-trial-handle=1984,i,8847762960881221970,10350104524814856766,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4872,i,18154543475484499326,3463786680204405275,2097152 --field-trial-handle=1984,i,8847762960881221970,10350104524814856766,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6264,i,16642480022823727043,4760973535318086141,2097152 --field-trial-handle=1984,i,8847762960881221970,10350104524814856766,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6136,i,10901104363255215432,9394789323884209781,524288 --field-trial-handle=1984,i,8847762960881221970,10350104524814856766,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6140,i,4432139548245614405,7547095440360963008,524288 --field-trial-handle=1984,i,8847762960881221970,10350104524814856766,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=208 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6228,i,3565934048301882837,10901231963350142247,524288 --field-trial-handle=1984,i,8847762960881221970,10350104524814856766,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4336,i,14231322855870628393,7756708702757960594,2097152 --field-trial-handle=1984,i,8847762960881221970,10350104524814856766,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4384 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4996,i,15466008973212091156,15075419419284906816,2097152 --field-trial-handle=1984,i,8847762960881221970,10350104524814856766,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6564,i,11147052925518179213,5272154946669634509,524288 --field-trial-handle=1984,i,8847762960881221970,10350104524814856766,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:5364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4444,i,17581143101973417271,11591264436257722131,262144 --field-trial-handle=1984,i,8847762960881221970,10350104524814856766,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4952,i,12828917687182665523,11290272177021121077,2097152 --field-trial-handle=1984,i,8847762960881221970,10350104524814856766,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6448,i,8277700508592055894,9493752779005237920,2097152 --field-trial-handle=1984,i,8847762960881221970,10350104524814856766,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=4328,i,15257608444512968035,7311347670013689193,2097152 --field-trial-handle=1984,i,8847762960881221970,10350104524814856766,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5976,i,11995799123100125233,6624181442009212620,2097152 --field-trial-handle=1984,i,8847762960881221970,10350104524814856766,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=1168,i,10715627528705882081,3276955302156181904,2097152 --field-trial-handle=1984,i,8847762960881221970,10350104524814856766,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6764,i,11779480383175003699,3567131619808755831,524288 --field-trial-handle=1984,i,8847762960881221970,10350104524814856766,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  PID:3924
- C:\Users\Admin\Downloads\BlueStacksInstaller_5.22.168.1001_native_cc0dce156389fbe2ea581177b1cc27ff_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe
  "C:\Users\Admin\Downloads\BlueStacksInstaller_5.22.168.1001_native_cc0dce156389fbe2ea581177b1cc27ff_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5620
- - C:\Users\Admin\AppData\Local\Temp\7zS4F59619A\BlueStacksInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS4F59619A\BlueStacksInstaller.exe"
    3⤵
    - Downloads MZ/PE file
    - Checks computer location settings
    - Executes dropped EXE
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\7zS4F59619A\HD-CheckCpu.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS4F59619A\HD-CheckCpu.exe" --cmd checkHypervEnabled
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\7zS4F59619A\HD-CheckCpu.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS4F59619A\HD-CheckCpu.exe" --cmd checkSSE4
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2240
  - - C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.22.168.1001_nxt.exe
      "C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.22.168.1001_nxt.exe" -s
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:5424
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\BlueStacks X\green.vbs"
        5⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:10880
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c green.bat
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10952
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall delete rule name="BlueStacksWeb"
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:11012
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall delete rule name="Cloud Game"
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:11232
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="BlueStacksWeb" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\BlueStacksWeb.exe"
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:6980
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="Cloud Game" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\Cloud Game.exe"
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:6968
  - - C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.22.168.1001_native_cc0dce156389fbe2ea581177b1cc27ff_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe
      "C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.22.168.1001_native_cc0dce156389fbe2ea581177b1cc27ff_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe" -versionMachineID=01203fda-a9cb-456b-bf20-254e89ba1702 -machineID=a6e326fc-0096-4278-bb4c-94e85198f164 -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Pie64 -imageToLaunch=Pie64 -isSSE4Available=1 -appToLaunch=bs5 -bsxVersion=10.42.168.1001 -country=GB -isWalletFeatureEnabled -discordUrl=https://discord.gg/UnXV7taVs4
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:7188
    - - C:\Users\Admin\AppData\Local\Temp\7zS41C3E68B\Bootstrapper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS41C3E68B\Bootstrapper.exe" -versionMachineID=01203fda-a9cb-456b-bf20-254e89ba1702 -machineID=a6e326fc-0096-4278-bb4c-94e85198f164 -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Pie64 -imageToLaunch=Pie64 -isSSE4Available=1 -appToLaunch=bs5 -bsxVersion=10.42.168.1001 -country=GB -isWalletFeatureEnabled -discordUrl=https://discord.gg/UnXV7taVs4
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:7956
      - C:\Users\Admin\AppData\Local\Temp\7zS41C3E68B\BlueStacksInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS41C3E68B\BlueStacksInstaller.exe" -versionMachineID="01203fda-a9cb-456b-bf20-254e89ba1702" -machineID="a6e326fc-0096-4278-bb4c-94e85198f164" -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName="Pie64" -imageToLaunch="Pie64" -appToLaunch="bs5" -bsxVersion="10.42.168.1001" -country="GB" -isWalletFeatureEnabled -discordUrl="https://discord.gg/UnXV7taVs4" -parentpath="C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.22.168.1001_native_cc0dce156389fbe2ea581177b1cc27ff_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe" -md5=cc0dce156389fbe2ea581177b1cc27ff -app64=
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\7zS41C3E68B\7zr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS41C3E68B\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\7zS41C3E68B\CommonInstallUtils.zip" -o"C:\Users\Admin\AppData\Local\Temp\7zS41C3E68B\" -aoa
        7⤵
        Executes dropped EXE
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\7zS41C3E68B\HD-ForceGPU.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS41C3E68B\HD-ForceGPU.exe" 1 "C:\Program Files\BlueStacks_nxt"
        7⤵
        Executes dropped EXE
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\7zS41C3E68B\HD-GLCheck.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS41C3E68B\HD-GLCheck.exe" 1 2
        7⤵
        Executes dropped EXE
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\7zS41C3E68B\HD-GLCheck.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS41C3E68B\HD-GLCheck.exe" 4 2
        7⤵
        Executes dropped EXE
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\7zS41C3E68B\HD-GLCheck.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS41C3E68B\HD-GLCheck.exe" 2 2
        7⤵
        Executes dropped EXE
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\7zS41C3E68B\HD-GLCheck.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS41C3E68B\HD-GLCheck.exe" 1 1
        7⤵
        Executes dropped EXE
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\7zS41C3E68B\HD-GLCheck.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS41C3E68B\HD-GLCheck.exe" 4 1
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\7zS41C3E68B\HD-GLCheck.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS41C3E68B\HD-GLCheck.exe" 2 1
        7⤵
        Executes dropped EXE
        
        PID:8324
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.bluestacks.com/download.html
        7⤵
        
        PID:3360
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://www.bluestacks.com/download.html
        8⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:1840
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ff81bb4c188,0x7ff81bb4c194,0x7ff81bb4c1a0
        9⤵
        
        PID:4864
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1848,i,4954971770029968605,13627817251601480073,262144 --field-trial-handle=1944,i,12016512428809987137,8823102739963660399,262144 --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:2
        9⤵
        
        PID:1656
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,12547707531889033083,12376741373994974161,524288 --field-trial-handle=1944,i,12016512428809987137,8823102739963660399,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:3
        9⤵
        System Time Discovery
        
        PID:3328
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,11730530003568335028,12120366383433269553,524288 --field-trial-handle=1944,i,12016512428809987137,8823102739963660399,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
        9⤵
        
        PID:4988
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,8504064499122726348,7470428646978659795,2097152 --field-trial-handle=1944,i,12016512428809987137,8823102739963660399,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
        9⤵
        
        PID:6284
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,7698234782618734741,13212932019993296393,2097152 --field-trial-handle=1944,i,12016512428809987137,8823102739963660399,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
        9⤵
        
        PID:6296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4584,i,4146063157393247857,1147155526012518128,524288 --field-trial-handle=1984,i,8847762960881221970,10350104524814856766,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4932 /prefetch:8
  2⤵
  PID:6000

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5984

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3232

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\Delta-Executor-2.719.apk"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3212
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2C60FE1AE758535674858E72F4984039 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:4984
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A654E07B6EAD8F35E3D8255C7C2D1BB0 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A654E07B6EAD8F35E3D8255C7C2D1BB0 --renderer-client-id=2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:4224
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9B1FB5FF25C92DB12B5E558D85371152 --mojo-platform-channel-handle=2328 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:3480
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0769278999676B4C2F9FF34BB380A7B5 --mojo-platform-channel-handle=1956 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:5232
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=59BD82FBDC9216EE523F367620D6CE35 --mojo-platform-channel-handle=1872 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:4968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2036

C:\ProgramData\BlueStacksServicesSetup.exe
"C:\ProgramData\BlueStacksServicesSetup.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:7908
- C:\Windows\SysWOW64\cmd.exe
  cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq BlueStacksServices.exe" | find "BlueStacksServices.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:8128
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq BlueStacksServices.exe"
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5720
- - C:\Windows\SysWOW64\find.exe
    find "BlueStacksServices.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2256

C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
"C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --hidden --initialLaunch
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:8372
- C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
  "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=1728,i,2341725542445166386,7251151777299594455,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  PID:8520
- C:\Windows\system32\cscript.exe
  cscript.exe
  2⤵
  PID:8544
- C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
  "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --mojo-platform-channel-handle=1996 --field-trial-handle=1728,i,2341725542445166386,7251151777299594455,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:8636
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKCU\SOFTWARE\BlueStacksServices
  2⤵
  PID:8680
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKCU\SOFTWARE\BlueStacksServices
  2⤵
  PID:8932
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regPutValue.wsf A
  2⤵
  PID:9072
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regPutValue.wsf A
  2⤵
  PID:9152
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
  2⤵
  PID:9256
- C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
  "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --app-user-model-id=com.bluestacks.services --app-path="C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2576 --field-trial-handle=1728,i,2341725542445166386,7251151777299594455,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:9432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
  2⤵
  PID:10352
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:10436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
  2⤵
  PID:10356
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq BlueStacks X.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:10888
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
  2⤵
  PID:10428
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
  2⤵
  PID:10444
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
  2⤵
  PID:10460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
  2⤵
  PID:11236
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:6876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
  2⤵
  PID:6860
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq BlueStacks X.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:2724
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
  2⤵
  PID:7044
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
  2⤵
  PID:6976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
  2⤵
  PID:4544
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:4440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
  2⤵
  PID:4472
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq BlueStacks X.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:2428
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
  2⤵
  PID:7268
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
  2⤵
  PID:7368
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
  2⤵
  PID:7460
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
  2⤵
  PID:7548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
  2⤵
  PID:7664
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:7712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
  2⤵
  PID:7776
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq BlueStacks X.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:7792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
  2⤵
  PID:7844
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:7968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
  2⤵
  PID:8056
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq BlueStacks X.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:8164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
  2⤵
  PID:468
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:8140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
  2⤵
  PID:1868
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq BlueStacks X.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
  2⤵
  PID:4732
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:4076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
  2⤵
  PID:4884
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq BlueStacks X.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:5416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
  2⤵
  PID:2440
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:4628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
  2⤵
  PID:2108
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq BlueStacks X.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:5876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

close_disabled.svg

Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_disabled.svg
Size 569B
SHA256 8ee5aa84139b2ea5549f7272523aeb203d73954c5ccdcf6f7407bf1a3469f13e
MD5 e7fdf6a9c8cae1fc1108dc5a803a1905
SHA1 2853f9ff5e63685ebb1449dcf693176b17e4ab60
SHA512 a6388b24926934e20ccf7fcab41bd219dc6c0053428481d7f466bf89f26bf1a36fdff716a9ddd9ab268df73b04dff1449c6bac1f5c707e31ae2ee71c2087e0d9
TLSH
T190F0593F02AA213FF540C60C5BAAA5D92F9CD4ABB2852008739D2325CF08C93647A299
MD5 SHA1 SHA512 TLSH

Submit Download

close_hover.svg

Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_hover.svg
Size 653B
SHA256 1bca2e912184b8168ee8961de68d1d839f4f9827fde6f48ab100fb61e82eff90
MD5 76166804e6ce35e8a0c92917b8abc071
SHA1 8bd38726a11a9633ac937b9c6f205ce5d36348b0
SHA512 93c4f1af7e9f89091a207ab308e05ddd4c92406c039f7465d3b8aca7e0cc7a6c922a22e1eee2f5c88db5e89016ef69294b2a0905d7d6a90fd32835bc11929005
TLSH
T1C2F07D3772A99EAD94400F0C9B3CEB49D7346327F5FA5040336F64154F824839B356B5
MD5 SHA1 SHA512 TLSH

Submit Download

close_normal.svg

Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_normal.svg
Size 569B
SHA256 92aeae68e9e0973d9e0dc575941f1cb2e24afd0574341a46b870be7384eaa537
MD5 3221ac69d7facd8aa90ffa15aea991b0
SHA1 e0571f30f4708ec78addc726a743679ca0f05e45
SHA512 5e2de0abfe60a4db16ea5e8739260c19962fbfc60869a77bde6ab3547ad8ee3ad88e74e97da31fa23be096afddad018e431d152d6d0fa21a75357a11dacb1328
TLSH
T1B4F0593F02AA213FF540D7085BAAA9D93B9CD56BB2852018739D2325CF08C83647A299
MD5 SHA1 SHA512 TLSH

Submit Download

close_pressed.svg

Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_pressed.svg
Size 653B
SHA256 9585f41eb6202e89f2087266fa31852d7f41ca8cc659b907c96753fe165f937d
MD5 dfddf8d0788988c3e48fcbfb2a76cd20
SHA1 463bb61f0012289e860c32f1885a3a8f57467f2e
SHA512 e708c5114c60f7574589d6a56c9faedda26ee4a40f0eeb25f5e12eadcf790f24fdbf393fa0aa6ad449b5337d625b092d6f8822472fa8a6ce1339aca59c50c3ca
TLSH
T1A3F07D3762699EAD94400F0C9B3CAB49D7746327F5FA5040336F64144F8248397356B5
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f22cbd3a96983ba2db59be0167ba753a7e8d4d00ffae1068fe3756115e219597
MD5 838cb92a8eccde0a7b81cdae7cc741b6
SHA1 7b05789b2037b13c7af90aa49f2ee618561a7680
SHA512 572b969e8a80c0387406a145695b810d5574b6db01c8096baebd7958033c7a122f493034f7a174e362ac4883f8791fe4781e835e4ea1f4b7206f00e9b19fa499
TLSH
T1D3E022EBD862EC2B0CFD1B286455474AEF01136B2B41591B7A3C960C8FF423B458292C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 21KB
SHA256 6463918226136e7b06e27647269e9b28d108fdb9418e40dce43a371db924b4b0
MD5 af72d17220d8441f5836593372376faa
SHA1 3a6dcb10a08718a44b9782cac5786ee549bc254c
SHA512 f91e1c86d0c6b23e7fedc5709dda5dc264fba9588de5cd4f6007044b416dd7a55094c2b4add47d50769597803f4a574389dc39155299b9327b7a118effb4178d
SSDEEP 384:Xb684eHwuKniWkk7PF0d0asgUxNu5asqiWs+bUNbYcg4XW6MBJp3L1xdCr:XO84eHw9nnkk7PF0Cf7ZsqzXbYhg4XW2
TLSH
T1EDA2D0E1097B98140783131FF161BC4A88B2D4C40559B0DE9DB3713782E6AF60F3636E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000033

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000033
Size 927KB
SHA256 1b92384637507dee9fd2a36df3531241351ca90c866f6589961eb320d850b607
MD5 a73f4191fd1413b293476dc193fb0a03
SHA1 b7845b3395f1e38db1e4dccccd89a398bcfe9804
SHA512 b879656880dbab55aeb37040f140d5a08a28922bf76e90ca6ffdbba5ad07e7e5df27828c35d4befa665253516f0dd843b18040d067112aaf74e4d4d0993e698a
SSDEEP 12288:ZivtCXQd0gjKX7zuqGKu/NGzss4FYmB7uzpzc+MMg0HQpNU3bVfmZmBzp2Xnri7+:ZivtCXWeGKu/NGzTukzxNgcVeU4i7+
TLSH
T15B15DF8C21A1C077CA570FF284D5DF671115F9913B23A52EE6912E99BA30E824BFB137
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 480B
SHA256 6af0546d926daa733576ee176632175a6017b90b11c901c3e9e9849d6c343354
MD5 4c1a7ecfc3ae80d226299bb37376d927
SHA1 05bcf45b0e470952db4bb2dff1fb2b8dfb0a3758
SHA512 709b268dad416089fb315acfdcf55d321a2356b757d85b1d99dfe4dd0143de18d05b0c4f145838b3d00fabebd38f0181eb9e32caeccd435aa65e042c0c55c82a
TLSH
T19BF068570ED68105FF831C76DDE10E823A32FB2A40262F9341675281C003AF2A1C6045
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 456B
SHA256 0272426b713364b88abfe901e76b754ccc9ede73fd64a769ba5388eec27835d0
MD5 8e2b998c9142bd08a024bf2f7c5f4be4
SHA1 8b5ecdd99f3e9d04817d92919c73ee0291ee54a1
SHA512 0b6b316cc12e173f5c25c574f5adb2d1151141631c005d32628d692a1a768ab9caae4fc24691568609b41ca027ffedf8b7d9744d082f287dc686c8d303945225
TLSH
T1E9F0D8570ED58615FF8718B4EFE41FC22922F72A40222F9741675585C103AF6A5C2414
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 2be3bfa369a669d0bd7923794e4a51b3780ed4203bf070a4555f7dc04969fbea
MD5 3c04c49e1e232d025727435d9e8d2eaf
SHA1 fa909329f86500abaac170cb4d626e745b7ae4e0
SHA512 3d10d24298518879e75d4ad4c911c3844086826c31caedc9d34fa42595ae502b2a39b0a950cdbd4b1f3eb9797b9d9cb948521c2a187b9d3057d86e0a666d0eb6
TLSH
T1D021764705C68025FF6928309CA409BB2B6EBB651B133A1342C975A45DD7EF37384020
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 06497fcf32a450c034da57d540b3be4cbc1274f4805ff3ee7d38286a1c23fb1b
MD5 59002d1f99fe53f112ca5e724125b10c
SHA1 7f54aebde00206cf474f45a859b70a37886ea071
SHA512 b7300bf6a929888febf6d115abfea28ddcf97d2b882e7a4fb4c84afd57ae2de7fce966026847b4b042a7cfaed95c6b8455d94c458729981c40f8994068ce0b37
SSDEEP 192:D0vJJUJhJ0J/35taaIEgdyf5QPSHXHOIL1in+691hVDDfqRA9PnnPjac65:D0v3whJ0J/35taaIEgdyf5Q6HXHOIL1X
TLSH
T14D129CF7C3E4862DDA2256F0A6142E1B8F3E0974439C3916C4D9AF1F93F19B1E14564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 6f13ac62b2ee3939ae3f9cc606240e88acd6627ea63b16a4532b0b2adbc62255
MD5 f8dc1551b233c1e361c2dfa56dce9064
SHA1 74f4a94e6442590a4e153e72d68e3cd923be9386
SHA512 ec3805e8d6fcb9ae236bbd246a8f9eb720340610bba56f4659ba95c65a7f501c76f8dcc1779be74e752e86c909122fe5f4299c962f564116f7fe1d05060e0c88
SSDEEP 192:D0vJJUJhJ0J/35taaIEgdyfuq6a6QPSp099XHOILsR39PhnPiycn+L5:D0v3whJ0J/35taaIEgdyfuq6pQ6p099C
TLSH
T158029CF783E4862EDA2252F4AA142E1BCF3E0974039C3956C4D9AF1F93F19B1E14564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 19KB
SHA256 e2acdaac343039b8659bd445595fbd53df3df2c83a04c27405b89581deaaa6fa
MD5 91b26b82b552c39025d1bea2bfb83b34
SHA1 7ebf2e1e27b7fd8d1b28c21425266a0a0b30b5f5
SHA512 da931ac91b69b5897af1bad3895cf7bb282201537ac2b17c12209a213a099e4478ec980137facf7c2f54e0104d70d40e5fc62bed018cc8ba8f70b070b75e11d7
SSDEEP 384:Dv3whJ0J/35VDwDEbi8jJDJcAQukqtaaIFiQ6HXHOIL1in+69WVDLqS9vnrr6Lkd:YGVZu2P5GmHIiiC
TLSH
T1E4929BB7C3E8862DC91256F4AB152F2BCF2E0924436C3D16C4D9AF5F93E18B1E24564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 4b079960548ce52f87203a96552a1e496e8e5503b27591955b9791d59068e5b2
MD5 ff5e3d756bf308261e8f01cb600710ec
SHA1 ad7663239389b103941ae00b9da9aad74119aa8f
SHA512 599c4d88f1d5e7327fba88dd6881729d7089d75dab1487a714e9183676f9da5fa5f27111b89c2598c3e43d331abd0ab14150cc1f1eea45560ae591b4332513bf
SSDEEP 192:3RqcBzKqlP8gj/Jv7japQPRpG4F6XwFCI9mHsb+WNuIP0pxlAFqZ2y6e8mXMad9O:3RqmzKq/JawXPIwwxA62QcadLE
TLSH
T13362E66BA8106D7B4CDBD269FA66BB5BD7F5102161D01E84EAFC8B3C05DB6DC2207027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ccb9c0d89b48e759a02b08bab524cf5d7f869f44e8f391f39f4cceb2e7d602c5
MD5 4186bd57834e29ab555323090ff8202e
SHA1 8b52c302ffb035ca95c22e841414c8d20f1e717c
SHA512 69194a64fe235e5346171016909335d638c14400dc2e80e959826abb5c3bc999ea9456dd04bfbe2b024e43c3b59957209b0a4178dc61ada333e39e0ee369a830
SSDEEP 192:KRq7qlP8gK/Jv7japQPRpG4F7RI9mHsb+WNnyEgaxlYl6e8mXMad9VyIsnAUgE:KRq7d/JawXaIweCY1cadLE
TLSH
T1C652F92AA914693B5CDBC229FA66BB5BD7F5103121D01E84EBFC8B3C05DB6DD2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 bd3406cb8fcf27d4103e4651f3ae2fa8920dab506c909be97dbf0482ad820970
MD5 8b1de74bace1c53c59439ce5dc04c18a
SHA1 364ab1d3c2e7e982fb0938af9467c637f89d3e8e
SHA512 6249a5ce906a54db3e6c68302ca4488c1c1b04e94bb803bd70062e1a829d1d9f53cc68d578959c3c29fd2c266783f9e53ceb8d60bf3e99819f5cee9ba1aba1e1
SSDEEP 192:KRqDqlP8gEfv7japAPRp2OcTa9mHsb+WNnyEgait82Z6e8mXMa89VyIsnAUge:KRqDT3aUXDIweG2hca8Le
TLSH
T19342F92AA914693B4CCBC22DFA66BB57D7F5103125D02E84EBFC8A3C01DB6DC2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d8615e1f45c52f91e3f489d58eac762108c146424f294872fda5c63b992992bd
MD5 f7487f732f473870b7dab8e9a57d94d8
SHA1 cc86645d5075aea0aed9bdecfaa98973beebefdc
SHA512 249ccab60a7db2520d3aa1a2592068a8d7e70d186afa0c5f3f4924178fca4360143cde214a9bf854dde118f7efa9fc35477c5f8ca072a77e02f991d8223c21ec
SSDEEP 192:KRqDqlP8gEImv7japAPRp2O7TI9mHsb+WNnyEgakYeU6e8mXMa89VyIsnAUgE:KRqDTxaUXcIwemeica8LE
TLSH
T17952092AA914693B5CCBD229FA66BB57D7F5103125802E84EBFCCB3C01DB6DD2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f887ee980268933e1d445f3cccc1cef9bc1090ba5e2671f3fa4f927baf145b48
MD5 561d66cd06b7f9b30697a2acd09752bc
SHA1 8f014c33081b59c36e87c13cfd8fce86316a9f0f
SHA512 2d62b53c684a8d3a9708976ca5c218c31d96d142500a8996b1e8d52ad8b65bcbafafc69176cadb627a2846bee930f99496109942d94569d78b2dbd9c713ee6ce
SSDEEP 192:KRqDqlP8gKTv7japQPRpG4F7RI9mHsb+WNnyEgaxlYl6e8mXMad9VyIsnAUgE:KRqDdrawXaIweCY1cadLE
TLSH
T16A52F92AA914693B5CDBC229FA66BB5BD7F5103121D01E84EBFC8B3C05DB6DD2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b58b40df439174884d27823a4330d37c181efa2d308c990dc8e11b4774698821
MD5 ca4d34d938433aa4c63cf064160ef16b
SHA1 7af2f6b944732606628d3abf9dfe9dbf06f1ba9c
SHA512 6af5a7bb625392b9fc5de8b70bba5bcc2230b9a858f1946c1191a4a2b1598901d56898113dc10e63519d9861c72d844f98ea09a34ece9b2f727c4ac5b288bb6b
SSDEEP 192:3RqcBz7qlP8gj/Jv7japQPRpG4F6BFCI9mHsb+WNnP0pxlAFqZ2y6e8mXMad9VyN:3Rqmz7q/JawXoIwMxA62QcadLE
TLSH
T1FE62F82BA8106D3B5CDBD269FA66BB5BD7F5102161D01E84EAFC8B3C05DB6DD2207027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 56a1e8c00cba78461b814b7af7b99a3de58a4329a7a44475b23e4150677716ca
MD5 6932e737f9fb5bb798f741f34796b7e1
SHA1 58bd5e6597f4a5801de9e176eca39fb244cddab8
SHA512 6e0d027f757f85c0e73419b5d0cc63c8778e317595fc91efbb163ddebee9c4ad7ab8467ebddc43b66b02293c61347fd81b0b3e241e6794b5bc99b05d775c9885
SSDEEP 384:y4jGR7KxkXqKf/pUZNCgVLH2Hfgslyi7pLuLcifIpXODGJ+ErU3DcHG8akl78fPY:yMGR7KxkXqKf/pUZNCgVLH2Hfgswi7pz
TLSH
T1FC720AA76C4C997B0F94CACCC8177F4FADB5015B65E9886493FB582603D8BCB11091EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 fbf03013cbec752482e5a7b70b08a089ba3c763b10f4af8f9b6916bc55d5878c
MD5 64e429b4848f5abdf575aa04dd4f10e7
SHA1 ee469e801ee90f04a9a1baac0fbbf31eb8452116
SHA512 3f9ff2d550676fc9f1ab35b6105aa2080cfe0becacb3d2821ff27262678721e8c9dc2d0d922a378c3923c59574a4c04ad59c2487bbb50f500566c466c7a3a9ee
TLSH
T1EBB0121080015911C06342B061C3148C3514AF158705270153E4BA76ED272A74014150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586e84.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586e84.TMP
Size 96B
SHA256 a679a97681517081c08905174cb22dd838dcb49be714890eab9e2c80de8e1d09
MD5 bd4dd61fe06ac0f497ce7f0066a7ef76
SHA1 8d9c8bfbae610614bc36508bd79ec0378f965ad0
SHA512 b9b1842027d15b4f3fc37e7bf536cd15d65ff48f1772d35946da4f68151a539500de1f562734ce5e0e8dd2d4d485ea2c9413fd7f73397c83ce885377f2a6a7ab
TLSH
T132B02208C0033232C00203F022C088C838A0EF22C303020283E00A22EC30230A030A30
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 902b1022cfe7a91f311d75aa3a2000ba764bc0c1bc5b15d5bf956e44a390f6c3
MD5 717177f0a46eab4bd89ef5a990ee46ea
SHA1 e3ea3bd65ea45ca3d4a218b8e91a627315217ba0
SHA512 70fe5a9c6b3ebbfe1109b92fc92d900aafcb030fcf41276611813a3331b50bf37d4ea9199108bed40ec1b05ab9ea181851ae153a2a29396cb1d16931a9e545a6
SSDEEP 1536:01CtqcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9e:0z3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T12B9312BA9E1A46E795BE46D1769EB809CE13130D709FA8CC726C539C21D01C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 25d87f4f1f9f16d1638dca38f55de54694701fd0b281efc09228ce25a61188eb
MD5 7767e5df17e3dcd13f664daa0931d69d
SHA1 aea26d9cdfab9b3e69e600d8eec25c56b3c2cc40
SHA512 3fa876a7773d3fb23546c452a7c6de2a7406fa6874d9e8a0c6be2467037b4773978d80ebe5cb82853614ae4513ecc5692f460ac78d472e0003951bafbb5557a4
SSDEEP 1536:0eCyqcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9e:0T3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1799312BA9E1A46E795BE46D1769E7809CE13130D709FA8CC726C539C21D02C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 8aff4b92dcc52c321406823dce98697111a3e05d7a81e1decf83d941d686c42f
MD5 c83dabc0c47314e096aa8694c82104b0
SHA1 0fde5ee96860ae1b19186e241f9eacf62111852e
SHA512 ec3dc83bff0c25e2c0b9a3c0bd25fa60507d99f216caf699e64a501575b0175ba71e20c8e1e716b50f86a67f564abada08d38d066d1fcc2e591c54782069636b
SSDEEP 1536:0eCVJcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9e:0DJ3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T18B9302BA9E2A49E795BE5681729E7809CE13130D719FA8CC715C539C21D42C82B72E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 dd36f9e299ffc7dcf443e393fda66771d4638c61933d162ca1f6d138a1b38d77
MD5 e9c2be6610c70336fd94ae5d14121c5e
SHA1 47a49e0ef6a8fa176607d46d90ea18bc79b367e1
SHA512 41440a766971e1df8b4e646215545987ef1b052bad25533d706dd749b74fc76c4341684e47b354e572893df63ccd7aa162581bbbb5517b6558702f81a4c4bb97
SSDEEP 1536:0eCeJcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9e:0UJ3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1D89302BA9E2A49E795BE5681725E780DCE13130D719FA8CC715C539C21D42C82B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 2dac58c886d73009f8b7c0260f234e89970e78a331d71064e2dae1c006ff585f
MD5 73abe9fea699ad84a40f8937770d15c6
SHA1 da527a7450c51a37b728bc15978546e97e21d3c5
SHA512 0647e2eb4aaad5806a4f5121f5a9038c548b2e52d356517126525c154e71c704623d0a1a51d626ef79b596c077fb48c4b274bc3c11ae566678c434e2c2f204f6
SSDEEP 1536:0eCVJcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9e:0DJ3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1399302BA9E2A4AE795BE5681B25E780DCE13130D719FA8CC715C539C21D42C82B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 bd4d53c354241f92343a5234eb317556228dba82a7e7a96fef09e31e15c2864d
MD5 9bc73db9c1b86168351df942e36f2702
SHA1 c628cae70f00a78adfdd69f5cacb0d45b803ff4f
SHA512 74b5bed2836b0f03f6414e288a58d69eab42787bef90b057452ca6429f500de74500dff1700885a95799dfae1aeec7bf95148308e8cccfa03181eea939dac79b
SSDEEP 1536:0cCAcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9Yj:0c3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1589302BA9E2646EB957E468176AE7808CE13130D709FA9CC315C639C21D42C92B72F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8b1e4ba6890ec60cfe9f6942acc1937ba6fdde042b45c0a2e0b7e13ade701cfd
MD5 642961cbd4f67f82b3038bc1275d24c3
SHA1 f1df4ba11ac13409c392147b2a9da411bc9cd6eb
SHA512 4f7f98f2ebf15c98a7f379a7975f6dff1c7086a1e3cf81d3daec8c9be6212ba05fb4eefc5fa2c0486a277860dc8b2aecdded5e174409117a0736b1cd3b8443d0
TLSH
T1CCD0805C52B3BC75D4C7997045C53B47373ED493659187317C6274B90C534504D961C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d68b8059d1fdfd8541892ccb136bddd7ec7601b55110e2cdd4c0e5ace97d9da8
MD5 531be76c0b4d3ce6131509c7d95980da
SHA1 8d06c8ade4d281ea8e43a1dd0a469db76987e5cf
SHA512 3f61844b74b97a902b9307c088590e72b7ad0e95c0f14948ae3780aa3e04b871d8e5c5cb6ca5f5fdf524ad8258178623c85c528a35deec8559c2d1d114436d1f
TLSH
T125D0C05C12B3BC35D4CB987004C13B03323ED893659187307C2234B80C0304048960C3
MD5 SHA1 SHA512 TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 75KB
SHA256 af6d5ffd5bdb3854485ad2365bbf67a15c66bf0214ef6332af6f0553f6ef2479
MD5 fd0a39a086bd8646f2dbc90787fc4528
SHA1 d23aa3ec6e38230689d71e837b972278dc81004a
SHA512 6f0687c370093da210b9a94130c8c5153be63da7327632090930c5851428775047e71faa12955524e8cf7eca46ef3239bbdc9e4279df7d166f06e0c6a3b0cfe9
SSDEEP 1536:5ZrjuurgFJgazZYM11tlz9p82zFU1JIh9u6gIZ6sM:TrjCZYM1Llhp82S+ciM
TLSH
T17E73028DCB1230C7112E777D0CCBB3B6555EDC89E816B165B6865A6AB363EC483B1C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 d35207333fb0691482b25562ad1d4fab441203ab1862a363d39cf926de44ab4a
MD5 e85bf26e6574fff7ac3a430f10ad0be8
SHA1 1ab08c9d96dbe883feb5e581ae994cb313413555
SHA512 7f7e539cfaebede720e199b87d11bdaaa8d446c475b2ceca31595dc170acfa14ff96634865a0e02d677e97aedb3cb21036291bd8560f7c0ddd9b0c746140b04f
SSDEEP 384:naiFavqMg3sNv8TUNTUlIm29JCmv3vfEPVhn4gsfQuFPdnS4mtmsPHrNlk+5vI+9:RFayv3UwgdcPVx7sfrFPdS4smq7R
TLSH
T1E8C24B75EC98D9ABEDE78FC5E7497A47EEF001A7998C4AD4CAC81D0E008719E130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 12286eef227b2d1239bd980f7e6195148b81082aa26651248b80cbbdba1bfd52
MD5 30400db2e5e09edaa5399f9814f27efe
SHA1 8962ae3fbda96b888aed30755682b47187957647
SHA512 f5765269312e83727d2bd51d4e00b182291c73d0646d0204a255382e16629881412a73c4456d01aad4646569f521ef50737ce9a74c2d432f3a7c75b4c2674d73
SSDEEP 384:nWiFavqMg3sN/8TUNTUlIm29JT/t3vfEPVhn4gsfQuMt5tIydnS4mtmsPHrNlk+v:9Fayv3AwgNmPVx7sfrMcydS4smq7R
TLSH
T136C24B72E898D9ABEDE78FC5E7497A47EEF04593998C4AD4C6C82E0D00DB1DD530B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

exit_close.png

Path C:\Users\Admin\AppData\Local\Temp\7zS41C3E68B\Assets\exit_close.png
Size 670B
SHA256 7aaef329ba9fa052791d1a09f127551289641ea743baba171de55faa30ec1157
MD5 26eb04b9e0105a7b121ea9c6601bbf2a
SHA1 efc08370d90c8173df8d8c4b122d2bb64c07ccd8
SHA512 9df3c723314d11a6b4ce0577eb61488061f2f96a9746a944eb6a4ee8c0c4d29131231a1b20988ef5454b79f9475b43d62c710839ecc0a9c98324f977cab6db68
TLSH
T1150188D435988F4D07CD96678D540F00C8F0461AC4C9DC13461508608658574BA57F96
MD5 SHA1 SHA512 TLSH

Submit Download

minimize_progress.png

Path C:\Users\Admin\AppData\Local\Temp\7zS41C3E68B\Assets\minimize_progress.png
Size 212B
SHA256 2f62d4e8c643051093f907058dddc78cc525147d9c4f4a0d78b4d0e5c90979f6
MD5 1504b80f2a6f2d3fefc305da54a2a6c2
SHA1 432a9d89ebc2f693836d3c2f0743ea5d2077848d
SHA512 675db04baf3199c8d94af30a1f1c252830a56a90f633c3a72aa9841738b04242902a5e7c56dd792626338e8b7eabc1f359514bb3a2e62bc36c16919e196cfd94
TLSH
T115D023D757C544F46915072E4DFF4C13502144235F318518C54B0D7F75217908579FC2
MD5 SHA1 SHA512 TLSH

Submit Download

Bootstrapper.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS41C3E68B\Bootstrapper.exe
Size 153KB
SHA256 0b5398615c74dd2b1d4d07982d6d7e8c29c5c7ad60f00cb5897170470dc3b15e
MD5 91f2724dc4f10129d8414ddf6dcf6157
SHA1 811d89ed8d96be22fc52a42e32be178a387652fb
SHA512 bb2d9521335e092c99c7cec528e9f40caac0bca009480163f506dcccceeec50059c48282181c50ec699ead44573e445db7194c5f07c80bc59bef6279128d14d5
SSDEEP 3072:ie9iuvxmjbpFvB5JBqlMCIVbIoFY7w2FIj:kvB5bqlMCIVbDu7q
TLSH
T190F38D8C20A5C473CA674FF691A5DF031624F9953B13A02DE0967CA5BAB1E851BF703B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

backicon.png

Path C:\Users\Admin\AppData\Local\Temp\7zS4F59619A\Assets\backicon.png
Size 15KB
SHA256 fa64884054171515e97b78aaa1aad1ec5baa9d1daf9c682e0b3fb4a41a9cb1c1
MD5 7ff5dc8270b5fa7ef6c4a1420bd67a7f
SHA1 b224300372feaa97d882ca2552b227c0f2ef4e3e
SHA512 f0d5a842a01b99f189f3d46ab59d2c388a974951b042b25bbce54a15f5a3f386984d19cfca22ba1440eebd79260066a37dfeff6cb0d1332fca136add14488eef
SSDEEP 48:b//6zMh8k29WJsEvda/PSeld0/u1BLW3qLWoxN+Y9rNGZGvsc5uG7yUWT:b/Ss8kEWmkGPMAxNXrNGZGvsc5VyUA
TLSH
T1D36250A4FDF17565D849F6321DC168068C730B83EA809C86BACE8D277F01BE98C4F196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

change_hover.png

Path C:\Users\Admin\AppData\Local\Temp\7zS4F59619A\Assets\change_hover.png
Size 310B
SHA256 8e5847487da148ebb3ea029cc92165afd215cdc08f7122271e13eb37f94e6dc1
MD5 57092634754fc26e5515e3ed5ca7d461
SHA1 3ae4d01db9d6bba535f5292298502193dfc02710
SHA512 553baf9967847292c8e9249dc3b1d55069f51c79f4d1d3832a0036e79691f433a3ce8296a68c774b5797caf7000037637ce61b8365885d2a4eed3ff0730e5e2a
TLSH
T14AE02DC28308903CC3070C22602281E6E63E04D4292238024890C2382E64D0CD4187B1
MD5 SHA1 SHA512 TLSH

Submit Download

close_red.png

Path C:\Users\Admin\AppData\Local\Temp\7zS4F59619A\Assets\close_red.png
Size 15KB
SHA256 d0b6d143642d356b40c47459a996131a344cade6bb86158f1b74693426b09bfb
MD5 93216b2f9d66d423b3e1311c0573332d
SHA1 5efaebec5f20f91f164f80d1e36f98c9ddaff805
SHA512 922a7292de627c5e637818556d25d9842a88e89f2b198885835925679500dfd44a1e25ce79e521e63c4f84a6b0bd6bf98e46143ad8cee80ecdbaf3d3bc0f3a32
SSDEEP 48:2/6FwMlYk29WJsEvkch6/Clu5tlL88Lem/fLu5A/luaxN+Y97sc52G7Z+EazEyIc:2SFvYkEWmDCccHAxNX7sc5dZabT
TLSH
T1CA625065BDF075A65589F5322CC564055C730B83DAC09C88FACE5C2B6F01BEA9C1F58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

custom.png

Path C:\Users\Admin\AppData\Local\Temp\7zS4F59619A\Assets\custom.png
Size 17KB
SHA256 fbece8bb5f4dfa55dcfbf41151b10608af807b9477e99acf0940954a11e68f7b
MD5 03b17f0b1c067826b0fcc6746cced2cb
SHA1 e07e4434e10df4d6c81b55fceb6eca2281362477
SHA512 67c78ec01e20e9c8d9cdbba665bb2fd2bb150356f30b88d3d400bbdb0ae92010f5d7bcb683dcf6f895722a9151d8e669d8bef913eb6e728ba56bb02f264573b2
SSDEEP 96:wkEWMrbxNXW5G53p1pCcXdV8WMIPX7kTCM4:wkEdV8WM4YWM4
TLSH
T168727229FDF2B2EC450A523339C654015D7307C3E681AC85BACE8D162F21BDD8C8F659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

discord_icon.png

Path C:\Users\Admin\AppData\Local\Temp\7zS4F59619A\Assets\discord_icon.png
Size 564B
SHA256 c29b35c6be50f9e34f1120bd346ce01884f0c7ba1121c866d95b24e46e420b0c
MD5 9354bc445e979c2de9b9eedd9b7c8318
SHA1 8dc3e8fdcad0fcdad1fe19b0b94b676e8846affd
SHA512 ad13f6bf46dd8cb48a030e720c1c577a22b0d3dec794ae807aa482474fe6c2bead7fc63dd45983fb3ab82034d74d4f10b6d9967d4ff677d2226c6c18ee03a4d6
TLSH
T118F096F97D43D827F042101E764B64906C35F5782B32BB2E7588800C790F7B8522B6B0
MD5 SHA1 SHA512 TLSH

Submit Download

discord_icon_hover.png

Path C:\Users\Admin\AppData\Local\Temp\7zS4F59619A\Assets\discord_icon_hover.png
Size 512B
SHA256 6b126c8a7015c2274e6a2ac969e0f31ecae421e1652b446b2aafd2b03d0dc3f5
MD5 c11cc6a9edff1694a71584413dd47dfd
SHA1 3b84fbfab8b53db95e8fb1b409193624fc8359dd
SHA512 bdf3ff3a1b8022521cba870334b11bd9c877b84bf134fc4710f0c9e8fe3703a2604915a24ae6738a3099b7e80f0f5a8d9b161c74fc36ee217e05581d88d728ee
TLSH
T17AF0C486D8980C3FCF0F433F8C2C20EA8738400F379252088C28D6E535E9C022768F02
MD5 SHA1 SHA512 TLSH

Submit Download

folder.png

Path C:\Users\Admin\AppData\Local\Temp\7zS4F59619A\Assets\folder.png
Size 298B
SHA256 7ffa875fab1be82e384022a27f3e627ab75131eb168be949cc83c03b6e291bbf
MD5 8fc519ef684dc58830e462581184eb15
SHA1 cba35cdbb9b87c359b287b13c30a4d2984289ed6
SHA512 fb5cd6fde1b04901cc25508e7011250645d74eafd58a415b2702b04860d76266e0d6a8e9686532a946b2e534bce5cddab53f7f030930852dd4a030e1e4e49f8a
TLSH
T17EE07DD5936D2DAE6CAB812D06364647947B55192451000CDD057568212C96BE05B702
MD5 SHA1 SHA512 TLSH

Submit Download

help_icon.png

Path C:\Users\Admin\AppData\Local\Temp\7zS4F59619A\Assets\help_icon.png
Size 1KB
SHA256 97c7450d55ecda9017d0a9eed0049b8176e1828f3525aaf5660985ba214010cc
MD5 3c955d2be56f76de8a53f77e816f3fb8
SHA1 0c242256f7934e2d857f657ddc7f50589cf489f1
SHA512 2b4ce8453960de520bdccb658d72b55be3c3386b1d394f3acf7269405971843083d0e04d3af05758ac4b8d191ea6a61ea5313a07fa849bcdf1f8eb4d5624521c
TLSH
T18711E9C919D95DF055BB43FB00D407175F784E7225ADC34DF296653C981ED21506C78A
MD5 SHA1 SHA512 TLSH

Submit Download

info_icon.png

Path C:\Users\Admin\AppData\Local\Temp\7zS4F59619A\Assets\info_icon.png
Size 929B
SHA256 ee91e51aaa8356318cc75d60476d9422bf84be7d8a25e1b884aa16c3198dc764
MD5 8f73ec5e7100a0ec232e06e5b3786963
SHA1 15c7bb268803932192a064a4eedc9db42bd6c37c
SHA512 c628dede37fec439a849ab6704046210bdabb1bb576a5c5dae9a28b52ad021307347211ba2aecb47ef836f14e914ba18617b21863bce12bc406513f45c9eb66e
TLSH
T14B11C89128DD586A881E02B2951D97021FFEE03F89B4F40A3D83205F2821045B04A94B
MD5 SHA1 SHA512 TLSH

Submit Download

installer_bg.jpg

Path C:\Users\Admin\AppData\Local\Temp\7zS4F59619A\Assets\installer_bg.jpg
Size 78KB
SHA256 4c7471c986e16de0cd451be27d4b3171e595fe2916b4b3bf7ca52df6ec368904
MD5 3478e24ba1dd52c80a0ff0d43828b6b5
SHA1 b5b13bbf3fb645efb81d3562296599e76a2abac0
SHA512 5c8c9cc76d6dbc7ce482d0d1b6c2f3d48a7a510cd9ed01c191328763e1bccb56daeb3d18c33a9b10ac7c9780127007aa13799fa82d838de27fbe0a02ad98119d
SSDEEP 1536:/8jAVIA5IyKedQSsmprMWI/xKdefJeGhuvIDU1pY7EQGZRV3/X35ev:IAVPVsylI/xJfJHovsU1poEBZP/H5ev
TLSH
T15473F1DC3E9FDDD855E1A3964224A3ED3E99B85E258FFD8CB8200506705A4E37DE7012
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_logo.png

Path C:\Users\Admin\AppData\Local\Temp\7zS4F59619A\Assets\installer_logo.png
Size 9KB
SHA256 462b64f2e016d25a2a6a653ba896206129c4ac841d61a6c2fd116009606f7e1c
MD5 f9db10032266ce8276c922b24de2d60f
SHA1 9c7bc3e277a58c4b59e35b9622e2b7f076ebb2fc
SHA512 9e5e1e345815ff9e815f63a892724bccb2b1fe19d5db91750f681899af6ba52aa3fc9214ef6bcc691a1e7ab9a1c16c093c398544e1f57f0ad5dc883776f657b6
SSDEEP 192:fsCXsMtWAC+DwSuWzRNrk2SEDAnQfQhzNoxiw2H6v3LGAEv3BsBW/V:fsCXs1Az4WVNrLnDAnDboG5AkxeuV
TLSH
T1C322CFA1101DF0A3E72A94B1D0D97E6D936F790D3BFB710D86802DEA80930680359FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_minimize.png

Path C:\Users\Admin\AppData\Local\Temp\7zS4F59619A\Assets\installer_minimize.png
Size 113B
SHA256 a064f417e3c2b8f3121a14bbded268b2cdf635706880b7006f931de31476bbc2
MD5 38b539a1e4229738e5c196eedb4eb225
SHA1 f027b08dce77c47aaed75a28a2fce218ff8c936c
SHA512 2ce433689a94fae454ef65e0e9ec33657b89718bbb5a038bf32950f6d68722803922f3a427278bad432395a1716523e589463fcce4279dc2a895fd77434821cc
TLSH
T162B02BC13608FC34C64E0935416290009921001D011024101E0500680C1B19051A4F00
MD5 SHA1 SHA512 TLSH

Submit Download

loader.png

Path C:\Users\Admin\AppData\Local\Temp\7zS4F59619A\Assets\loader.png
Size 279B
SHA256 076263cc65f9824f4f82eb6beaa594d1df90218a2ee21664cf209181557e04b1
MD5 03903fd42ed2ee3cb014f0f3b410bcb4
SHA1 762a95240607fe8a304867a46bc2d677f494f5c2
SHA512 8b0e717268590e5287c07598a06d89220c5e9a33cd1c29c55f8720321f4b3efc869d20c61fcc892e13188d77f0fdc4c73a2ee6dece174bf876fcc3a6c5683857
TLSH
T17FD0EB93F339AC52F8018213C788083CD2FA26852E476E4C022A8CB60280D3E8AE018B
MD5 SHA1 SHA512 TLSH

Submit Download

logo_text.png

Path C:\Users\Admin\AppData\Local\Temp\7zS4F59619A\Assets\logo_text.png
Size 4KB
SHA256 66df86129129d8aa8dd3ba014eb3b3c27a36c22e4782f3dbd6a9a4bc1f4a87bc
MD5 1fbdb2b7efcae8e9f26b6536ab580968
SHA1 126386cb7c0e8a03d99acb19ec2b13a70114a7d5
SHA512 1a0218122948b7d93dd473f21512bd2411f902ff133b15bf80d36ff474cf29d53880ed0ab38ef76d8288784817e6fc49f54d85f106c97f620331e31d03d6fa73
SSDEEP 96:ucBdj0UbKsYpguE2VTlrtyQnN9EHRs8nTOCCC2Jm0ciOqT3YKU6Y4R4MKYb+OI:u2yVQQYQnARxTGJmxiOKYM6WSOI
TLSH
T148A19FC5C2856BF4B85286C79713EC474513D2052200AB171DF47CEF9441A21AF60EFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setpath.png

Path C:\Users\Admin\AppData\Local\Temp\7zS4F59619A\Assets\setpath.png
Size 15KB
SHA256 5bbb2f41f9f3a805986c3c88a639bcc22d90067d4b8de9f1e21e3cf9e5c1766b
MD5 b2e7f40179744c74fded932e829cb12a
SHA1 a0059ab8158a497d2cf583a292b13f87326ec3f0
SHA512 b95b7ebdb4a74639276eaa5c055fd8d9431e2f58a5f7c57303f7cf22e8b599f6f2a7852074cf71b19b49eb31cc9bf2509aedf41d608981d116e49a00030c797c
SSDEEP 96:iS5YkEWmE5+W+BxNXrNGyxGvsc5RxZ8af:iSqk6C+z5mf
TLSH
T10E624E65FDF0B565D989E2322DC928025C730B83D6809D45BACE8CA72F00BE98D5F593
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlueStacksInstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS4F59619A\BlueStacksInstaller.exe
Size 642KB
SHA256 046be8853ea9646a0c9c4309edf850aea355889549ee4c3c0670386881cdf56e
MD5 9e245054ea4af6f84f0c41227ee102bb
SHA1 86f2265ca8ae24e13dfaf1484e65396133028e0f
SHA512 1abf9f6e860cc63f33341399a7ceaba6a638299efdc5c7ce3f7aa88faa7eb58cb454d46242287480169dc60666fc598915c44d0759c8a060d55e2c74900d3a97
SSDEEP 6144:Mq3WNcXmfpCIwkJFgnF8M338MsRO+WQ66ESvy2p3+uwBV7AzS/QAvB5bqlMCQVb8:MDN7fpCIxcuv93+xBV5QAvB5b6MCyl2
TLSH
T182E4294423F4886AF2BF4FBA98F14E174A72FC467A62D31E4141584E2DB1B419EB6733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlueStacksInstaller.exe.config

Path C:\Users\Admin\AppData\Local\Temp\7zS4F59619A\BlueStacksInstaller.exe.config
Size 324B
SHA256 d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb
MD5 1b456d88546e29f4f007cd0bf1025703
SHA1 e5c444fcfe5baf2ef71c1813afc3f2c1100cab86
SHA512 c545e416c841b8786e4589fc9ca2b732b16cdd759813ec03f558332f2436f165ec1ad2fbc65012b5709fa19ff1e8396639c17bfad150cabeb51328a39ea556e6
TLSH
T1C9E0C21941D8FD2B5D734B13A3128852EFB0A2A391A4544CF0EE7F830F3308A6697332
MD5 SHA1 SHA512 TLSH

Submit Download

HD-CheckCpu.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS4F59619A\HD-CheckCpu.exe
Size 200KB
SHA256 2e14887f3432b4a313442247fc669f891dbdad7ef1a2d371466a2afa88074a4c
MD5 81234fd9895897b8d1f5e6772a1b38d0
SHA1 80b2fec4a85ed90c4db2f09b63bd8f37038db0d3
SHA512 4c924d6524dc2c7d834bfc1a0d98b21753a7bf1e94b1c2c6650f755e6f265512d3a963bc7bc745351f79f547add57c37e29ba9270707edbf62b60df3a541bc16
SSDEEP 3072:KjDeWjpu716WoCYv8NBa3eSx8LHGYwj6V4NL1q7HOAg0FujFfnk601hWNxK:opcoCYv8Xa3eSqL8j/3AOpNq
TLSH
T1FA147C10B4C18433D9B715314DF8DAB99A3DB8110B2559EB73D80B7E4F346E3BA31A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JSON.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS4F59619A\JSON.dll
Size 411KB
SHA256 d2c8d26f95f55431e632c8581154db7c19547b656380e051194a9d2583dd2156
MD5 f5fd966e29f5c359f78cb61a571d1be4
SHA1 a55e7ed593b4bc7a77586da0f1223cfd9d51a233
SHA512 d99e6fe250bb106257f86135938635f6e7ad689b2c11a96bb274f4c4c5e9a85cfacba40122dbc953f77b5d33d886c6af30bff821f10945e15b21a24b66f6c8be
SSDEEP 6144:GmyZXnmtWrnngnnnKnanlywwwBwwA5wwwwswww+wwwGwwwbwwwLwwwwwwwwwnwwd:GmIWtWrnngnnnKnanxNYhX
TLSH
T11F947250D8535838CA244778BA7396B02DF9EC718A07E6716B207EE7F13BA20ED75532
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i18n.en-US.txt

Path C:\Users\Admin\AppData\Local\Temp\7zS4F59619A\Locales\i18n.en-US.txt
Size 21KB
SHA256 945cbd36495c301dcf1cad837a4147479077974bce2790a3cb3961c9c71f22e2
MD5 b5d651273bada061fcff78edaf4d32ef
SHA1 9f56763bd4e373b3f186568d323521fdc7271a73
SHA512 1b1778caf39af7531610e91704a86f41065469c21dbe5ba1723923e2cf9944e812c5be497618f36471b4b002f280da3de25fd348039cbf380c81b598f1fddc23
SSDEEP 384:aBvGq6rKPsL/ds89JplYTWfUvcABRGjV+qXOJtUmEIpNnU6+FKvtCFV30Y4TWEaj:aBvGqaKPsL/ds893l+WfacWRGjV+qXOc
TLSH
T145A22B8FD777136CAAD1011A94E93542A517B35B33693A11BCACC03B1B5790E133EADE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThemeFile

Path C:\Users\Admin\AppData\Local\Temp\7zS4F59619A\ThemeFile
Size 80KB
SHA256 de1a2e6b560e036da5ea6b042e29e81a5bfcf67dde89670c332fc5199e811ba6
MD5 c3e6bab4f92ee40b9453821136878993
SHA1 94493a6b3dfb3135e5775b7d3be227659856fbc4
SHA512 a64b6b06b3a0f3591892b60e59699682700f4018b898efe55d6bd5fb417965a55027671c58092d1eb7e21c2dbac42bc68dfb8c70468d98bed45a8cff0e945895
SSDEEP 1536:Vq0UZUzBB6YjhX8knUVXVqlp1D88p/LUP8f/MPFntuevdxG+PchojU1yZwbP8fZS:pUFmL
TLSH
T178832B9DEADD3C39323F52AEB6361453C847301B7912896ABA1F21215FBC89F3417B25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_bg_1.jpg

Path C:\Users\Admin\AppData\Local\Temp\Assets\installer_bg_1.jpg
Size 30KB
SHA256 873030e34515538dac3efb98edec519596439fa05b7aad37f6137ca954ba41a6
MD5 efb63876389c300433587a29ce85f258
SHA1 8eb00659e003a934c8538b6e5a2be65ea097e5c9
SHA512 3c4a935f949e70199333889ba54870930858e54bf2ee0ac2a27f814710264ae30c474c4cd9e59835cc9bdc9da8c7eb25b963f02ee34767b3738f43988084059d
SSDEEP 768:/8PY3wdSnzEdbnEnqTE6PBtA2Gi5DTglr3cBt41FD98/AX16gANg+IL02U:/8zygdbEniHHPZBBtsD98Md+IRU
TLSH
T1D4E2E1A8BB15C36FED990F74DC3783442B2C1D7AC83402F5A265A032EC5626ABC98249
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BgWorker.dll

Path C:\Users\Admin\AppData\Local\Temp\nseCAA5.tmp\BgWorker.dll
Size 12KB
SHA256 a9e4f7ec65670d2ce375ffaf09b6d07f4cd531132ca002452287a4d540154a38
MD5 36c81676ada53ceb99e06693108d8cce
SHA1 d31fa4aebd584238b3edc4768dd5414494610889
SHA512 1300de7b3e1ac9e706e0aad0b70e3e2a21db8c860e05b314a52e63dd66b5dffdf6be1e38ab6ede13bfd3a64631cc909486bf4b1403e7d821e3b566edc514c63c
SSDEEP 192:W9Hsl/fIYiYF8LgaL2AMkKieowU+noPOJB3hy2sE9jBF0NyZKlH6JqEHma:LIYiVLpMNiuPxh8E9VF0NyZ6aJqEHN
TLSH
T1C1425C7709985C16DD1B6D3070C4963AAE36A6865AD082E3322FC1515B84381BBFE3BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nseCAA5.tmp\System.dll
Size 11KB
SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
MD5 959ea64598b9a3e494c00e8fa793be7e
SHA1 40f284a3b92c2f04b1038def79579d4b3d066ee0
SHA512 5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
SSDEEP 192:sRer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4Sy+Xe:s67Xws4FVWig86/5eCBqSy+Xe
TLSH
T1B3322A2657B0D2F2E6A1827408A639336BBA762412B50D1BDFF74481FC15BC67E39327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nseCAA5.tmp\nsDialogs.dll
Size 9KB
SHA256 2bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e
MD5 f7b92b78f1a00a872c8a38f40afa7d65
SHA1 872522498f69ad49270190c74cf3af28862057f2
SHA512 3ad6afa6269b48f238b48cf09eeefdef03b58bab4e25282c8c2887b4509856cf5cbb0223fbb06c822fb745aeea000dd1eee878df46ad0ba7f2ef520a7a607f79
SSDEEP 192:y1zQhZDqlJcKISw99ioU3MSfwLF/+nhHUisdz:ozoZDGKYw9goWyFGBU7z
TLSH
T1DB121B626688D5BBD2D1223636A92701DBF97328F0666C05D7B34E467DA42C67E39302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDui.dll

Path C:\Users\Admin\AppData\Local\Temp\nseCAA5.tmp\nsDui.dll
Size 3.0MB
SHA256 d770758471fc58d94ddd6adc4c8a59f40f7ebd580ea0bb9de4968446fb7f7332
MD5 226688be0e5bc5e7cafc2c7c5c431fac
SHA1 31160a7809a03034a2e0ab296825089665b7fb54
SHA512 c7d295e8b95403501f2869381b35a7ae0d97161a645d874052250ce1caa98268f5936953a23e51e07fea466b0efe11acaee0c12eee1c5345fa30f3900af19d31
SSDEEP 49152:Fg3eJdDJmTRf9c3F3YshhAzxeOI2u2mhdgWuNMrr5vyxLr2h9:FOVcKsh6zgp2mhKWIMHFyZ2
TLSH
T191E57B08A501D036D9A70BF69979AF7B4928F920372650DFB1C06E657A70DD06FB323B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nseCAA5.tmp\nsis7z.dll
Size 434KB
SHA256 a896a9ece055d334d431cd0f856113ab925d9ee86d2dee383c0bfbbef11a5b50
MD5 95f6f6ab9509bc366ab9215defe4251a
SHA1 e3f4a6effd6ca5838cfe91a01967cb72edcc7b0b
SHA512 a853f70d2ea7f384df99be067724bf3ca73c63f3c3573c112f5528fc86a96bd34509d934b038e2a81833f3abb3eedbc5894921291139100e01df6e35696c0ecc
SSDEEP 6144:CUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckldrx:Cn5QEG39fPAkrE4yrBOXDfaNbckXrx
TLSH
T1B2949E22B6D1C435C56E02309918F77925AEB3B1192CDB1B739C5B6F7FB44C1AA28B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Registry.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf9DC.tmp\Registry.dll
Size 24KB
SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
MD5 2b7007ed0262ca02ef69d8990815cbeb
SHA1 2eabe4f755213666dbbbde024a5235ddde02b47f
SHA512 aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca
SSDEEP 384:W2mvyNjH3rPnAZ4wu2QbnC7qB7PnrvScaeYA4CIDEge/QqL2AQ:/75w/OfrzB4CUxuQfA
TLSH
T1FCB26B82B1D1E973D09F0479AB993F15E3EFAD507670EC5300667AC732A0AA2C769713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf9DC.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf9DC.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf9DC.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
TLSH
T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
MD5 SHA1 SHA512 TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf9DC.tmp\nsExec.dll
Size 6KB
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
TLSH
T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf9DC.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\bluestacks-services\DawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\bluestacks-services\DawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\bluestacks-services\DawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\bluestacks-services\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json
Size 1KB
SHA256 65c5d3057c4062df3ddff573cf1147b2b78f8123eaaf8c1fce9bc90b458081c2
MD5 9c8b9ca1b7a3b210e51deef42d2be930
SHA1 6db527591a2df34fd2989a60e6976a70eb8c8054
SHA512 7a8848450f4159c7334f1c7d688f72d469689ac4daa325a490ed57548cfe1aaa1a5ff287cf74c1ddd2ceefd7d0ab605a7d618a41ed715ffffa92fd2ee2e3b94f
TLSH
T1A731E08536DE63EA95008C1F0B5DF5A2898FCCB3797085FCF641BAE716DC05401A2E79
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json
Size 57B
SHA256 8a2b59f1807e188c8c80973de2d5ee7a3ede176724c86e1a4aab5bbc9b119a76
MD5 f67e695a7bf8d310ccbe64ead0a74387
SHA1 63bfe11c9ed9c3f397e45648000f8c9710bab912
SHA512 1897e905ec1740f5487b3bd05783707abd07ede89f291212ad6732e26eb3dc39c082333844a0b3ff286b26643da36ce39c3d1e4525bb4516bed5578d42677869
TLSH
T1C090021547107536C3115941546457610B519406E0AE621446C339F6134B2215AB703C
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json
Size 119B
SHA256 587a550ae10d2eb5589ed938e60828d5848e82d4736b041b6eea942a239bf468
MD5 b18cd925c0b8e7655ddb340d3e978bfd
SHA1 60c5d49c46394cd0a49f57ef6f314c318929a426
SHA512 f9b1e2269ffc88efd281ec3b58fbe8adc0cde7e6555a704dc064b262ab7b440ce9c1258abc846947ac169edcf6687087838b32ae72a8795668a53cbff5569290
TLSH
T14AB0220803202030CA000BB0AC283B008B82800AA0EE22002B833CFAB38B2080AAA03E
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-77430157917ebd76

Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json.tmp-77430157917ebd76
Size 92B
SHA256 003056b9a7421296fb0bdd804d79543a1614009ec065163febaf279602bcbbba
MD5 278a1a79aca495228dff6310d99de962
SHA1 26337d842ae3488babfa8c2fa944899f4f27c943
SHA512 5b0a032cc384321476b8bdeef990323b6f1419503500877518000c861fb2c0c9225aec0491821d6aca4407b09c9c875094f55e8d87fcb8007534a9c5cafaafce
TLSH
T1A3B0120412003031D3110A74A42427505A41444AA09E32146BC33CFA634F2045A7303C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3212-279-0x0000000001430000-0x0000000001436000-memory.dmp

Download

memory/3212-278-0x00000000017E0000-0x000000000189F000-memory.dmp

Download

memory/3232-146-0x0000017A0B790000-0x0000017A0B8A5000-memory.dmp

Download

memory/3480-254-0x0000000001090000-0x0000000001096000-memory.dmp

Download

memory/3480-253-0x0000000001740000-0x00000000017FF000-memory.dmp

Download

memory/3968-239-0x000001AB5A940000-0x000001AB5AA55000-memory.dmp

Download

memory/3968-242-0x000001AB5A940000-0x000001AB5AA55000-memory.dmp

Download

memory/4224-272-0x00000000015D0000-0x000000000168F000-memory.dmp

Download

memory/4224-273-0x0000000001570000-0x0000000001576000-memory.dmp

Download

memory/4724-280-0x0000000000CB0000-0x0000000000D37000-memory.dmp

Download

memory/4968-261-0x0000000001590000-0x000000000164F000-memory.dmp

Download

memory/4968-262-0x0000000000680000-0x0000000000686000-memory.dmp

Download

memory/4984-250-0x0000000001090000-0x0000000001096000-memory.dmp

Download

memory/4984-249-0x0000000001720000-0x00000000017DF000-memory.dmp

Download

memory/5040-624-0x000000001CB00000-0x000000001CB38000-memory.dmp

Download

memory/5040-625-0x000000001B750000-0x000000001B75E000-memory.dmp

Download

memory/5040-605-0x0000000000760000-0x0000000000804000-memory.dmp

Download

memory/5040-660-0x0000000000D90000-0x0000000000D9C000-memory.dmp

Download

memory/5040-661-0x000000001C4B0000-0x000000001C5C5000-memory.dmp

Download

memory/5040-639-0x0000000020430000-0x0000000020438000-memory.dmp

Download

memory/5040-615-0x0000000001190000-0x00000000011F8000-memory.dmp

Download

memory/5040-621-0x000000001CBF0000-0x000000001D118000-memory.dmp

Download

memory/5232-257-0x0000000000540000-0x00000000005FF000-memory.dmp

Download

memory/5232-258-0x0000000000600000-0x0000000000606000-memory.dmp

Download

memory/5424-9334-0x00000000008C0000-0x000000000097F000-memory.dmp

Download

memory/5424-3800-0x00000000008C0000-0x000000000097F000-memory.dmp

Download

memory/5424-8599-0x00000000008C0000-0x000000000097F000-memory.dmp

Download

memory/5424-9339-0x00000000008C0000-0x000000000097F000-memory.dmp

Download

memory/5620-651-0x0000000002010000-0x00000000020CF000-memory.dmp

Download

memory/5620-8801-0x0000000002010000-0x00000000020CF000-memory.dmp

Download

memory/6268-9904-0x00000252F6F20000-0x00000252F7035000-memory.dmp

Download

memory/6792-9927-0x0000020048760000-0x0000020048875000-memory.dmp

Download

memory/6976-10287-0x000001C8A28E0000-0x000001C8A29F5000-memory.dmp

Download

memory/6976-10288-0x000001C8A12B0000-0x000001C8A12BC000-memory.dmp

Download

memory/7044-10286-0x000001D306C70000-0x000001D306C7C000-memory.dmp

Download

memory/7044-10285-0x000001D3082B0000-0x000001D3083C5000-memory.dmp

Download

memory/7188-9953-0x0000000002180000-0x000000000223F000-memory.dmp

Download

memory/7268-10320-0x00000277A8900000-0x00000277A8A15000-memory.dmp

Download

memory/7268-10321-0x00000277A7100000-0x00000277A710C000-memory.dmp

Download

memory/7368-10323-0x000001952C970000-0x000001952C97C000-memory.dmp

Download

memory/7908-9969-0x00000000024F0000-0x00000000024F6000-memory.dmp

Download

memory/7908-9968-0x00000000006F0000-0x00000000007AF000-memory.dmp

Download

memory/7956-9537-0x0000000000070000-0x0000000000098000-memory.dmp

Download

memory/7956-9538-0x000000001AD20000-0x000000001AE0E000-memory.dmp

Download

memory/8060-10309-0x000000001BDE0000-0x000000001BEF5000-memory.dmp

Download

memory/8060-9557-0x0000000000AE0000-0x0000000000B38000-memory.dmp

Download

memory/8060-9579-0x0000000020C20000-0x0000000020CA0000-memory.dmp

Download

memory/8060-9950-0x000000001CFA0000-0x000000001CFA8000-memory.dmp

Download

memory/8060-9951-0x000000001CFE0000-0x000000001D002000-memory.dmp

Download

memory/8060-10308-0x00000000010D0000-0x00000000010DC000-memory.dmp

Download

memory/8220-9939-0x00000234795D0000-0x00000234796E5000-memory.dmp

Download

memory/8324-9949-0x000002761B050000-0x000002761B165000-memory.dmp

Download

memory/8372-10316-0x000001AD0A7A0000-0x000001AD0A8B5000-memory.dmp

Download

memory/8520-10317-0x0000023AEF440000-0x0000023AEF555000-memory.dmp

Download

memory/8680-9971-0x000001DEBBAB0000-0x000001DEBBABC000-memory.dmp

Download

memory/8680-9970-0x000001DEB9C70000-0x000001DEB9D85000-memory.dmp

Download

memory/8932-9973-0x0000020A10080000-0x0000020A1008C000-memory.dmp

Download

memory/8932-9972-0x0000020A0FD50000-0x0000020A0FE65000-memory.dmp

Download

memory/9072-9974-0x00000266ABEF0000-0x00000266AC005000-memory.dmp

Download

memory/9072-9975-0x00000266ADD20000-0x00000266ADD2C000-memory.dmp

Download

memory/9152-9977-0x000001E4ABF40000-0x000001E4ABF4C000-memory.dmp

Download

memory/9152-9976-0x000001E4ADAA0000-0x000001E4ADBB5000-memory.dmp

Download

memory/9256-9982-0x000001A327AF0000-0x000001A327C05000-memory.dmp

Download

memory/9256-9983-0x000001A325F10000-0x000001A325F1C000-memory.dmp

Download

memory/9432-10003-0x00007FF8588E0000-0x00007FF8588E1000-memory.dmp

Download

memory/9432-10002-0x00007FF859D40000-0x00007FF859D41000-memory.dmp

Download

memory/10428-10283-0x0000011611CB0000-0x0000011611DC5000-memory.dmp

Download

memory/10428-10284-0x00000116104A0000-0x00000116104AC000-memory.dmp

Download

memory/10444-10280-0x000001E48DF70000-0x000001E48DF7C000-memory.dmp

Download

memory/10444-10279-0x000001E48F7A0000-0x000001E48F8B5000-memory.dmp

Download

memory/10460-10281-0x000001F2A1AD0000-0x000001F2A1BE5000-memory.dmp

Download

memory/10460-10282-0x000001F2A1750000-0x000001F2A175C000-memory.dmp

Download

memory/10880-9330-0x0000000003890000-0x00000000038B5000-memory.dmp

Download

memory/10880-9332-0x00000000038E0000-0x000000000391D000-memory.dmp

Download

memory/10880-9331-0x00000000038C0000-0x00000000038DC000-memory.dmp

Download

memory/10880-9329-0x0000000002FC0000-0x0000000003047000-memory.dmp

Download