mofksys | 100257cd11d34b6c178f3263322cfe7d248611f05b4fa7746e8dde3e6e8fd645

Analysis

max time kernel
150s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_2d4f8d2e9f92440464b94e627e1e525d_elex_glassworm_stealc_stop_tofsee.exe
Size 1.1MB
Sample260707-e99awaez9l
SHA256 100257cd11d34b6c178f3263322cfe7d248611f05b4fa7746e8dde3e6e8fd645
MD5 2d4f8d2e9f92440464b94e627e1e525d
SHA1 869094c4bb8f890ad47ca1c43a7ff8109655b254
SHA512 c3212a01f8f425508b05021e604c3e286261a54f6ddb16c81df08c86239a8e10202f81a012b0c3536c0137b75f630ea1826e48eb5300c532c36f6590f4f16659
SSDEEP 24576:H5xolYQY67ivtCXWeGKa/NGzTukzxNwW5mF6SUla908YH:CYrtCXWPX/m3gP6HUvYH
TLSH
T175359C5E6550D03BD8530BF294A5EF636125FD613B53A80FA2902E593930E83A7F723B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery mofksys persistence worm

Malware Config

Signatures

Family: Mofksys
Mofksys is a worm written in VisualBasic.
worm mofksys

Detects Mofksys worm 12 IoCs

resource	yara_rule
behavioral2/memory/2324-0-0x0000000000400000-0x0000000000440000-memory.dmp	family_mofksys
behavioral2/files/0x000e00000001c4f9-144.dat	family_mofksys
behavioral2/files/0x000e00000001c54c-158.dat	family_mofksys
behavioral2/files/0x000e00000001c54e-170.dat	family_mofksys
behavioral2/files/0x000e00000001c551-179.dat	family_mofksys
behavioral2/memory/2776-190-0x0000000000400000-0x0000000000440000-memory.dmp	family_mofksys
behavioral2/memory/1188-193-0x0000000000400000-0x0000000000440000-memory.dmp	family_mofksys
behavioral2/memory/2324-195-0x0000000000400000-0x0000000000440000-memory.dmp	family_mofksys
behavioral2/memory/5244-194-0x0000000000400000-0x0000000000440000-memory.dmp	family_mofksys
behavioral2/files/0x000e00000001c556-196.dat	family_mofksys
behavioral2/memory/2912-241-0x0000000000400000-0x0000000000440000-memory.dmp	family_mofksys
behavioral2/memory/748-242-0x0000000000400000-0x0000000000440000-memory.dmp	family_mofksys

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 9 IoCs

pid	Process
5684	2026-07-06_2d4f8d2e9f92440464b94e627e1e525d_elex_glassworm_stealc_stop_tofsee.exe
5244	icsys.icn.exe
3048	BlueStacksInstaller.exe
2912	explorer.exe
1188	spoolsv.exe
748	svchost.exe
2776	spoolsv.exe
5064	HD-CheckCpu.exe
2084	HD-CheckCpu.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_2d4f8d2e9f92440464b94e627e1e525d_elex_glassworm_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_2d4f8d2e9f92440464b94e627e1e525d_elex_glassworm_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD-CheckCpu.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5244	icsys.icn.exe
5244	icsys.icn.exe
3048	BlueStacksInstaller.exe
2912	explorer.exe
2912	explorer.exe
2912	explorer.exe
2912	explorer.exe
2912	explorer.exe
2912	explorer.exe
2912	explorer.exe
2912	explorer.exe
748	svchost.exe
748	svchost.exe
748	svchost.exe
748	svchost.exe
2912	explorer.exe
2912	explorer.exe
748	svchost.exe
748	svchost.exe
2912	explorer.exe
2912	explorer.exe
748	svchost.exe
748	svchost.exe
2912	explorer.exe
2912	explorer.exe
3048	BlueStacksInstaller.exe
3048	BlueStacksInstaller.exe
3048	BlueStacksInstaller.exe
3048	BlueStacksInstaller.exe
3048	BlueStacksInstaller.exe
748	svchost.exe
748	svchost.exe
2912	explorer.exe
2912	explorer.exe
2912	explorer.exe
2912	explorer.exe
748	svchost.exe
748	svchost.exe
748	svchost.exe
748	svchost.exe
2912	explorer.exe
2912	explorer.exe
748	svchost.exe
748	svchost.exe
2912	explorer.exe
2912	explorer.exe
2912	explorer.exe
748	svchost.exe
748	svchost.exe
2912	explorer.exe
748	svchost.exe
2912	explorer.exe
748	svchost.exe
2912	explorer.exe
2912	explorer.exe
748	svchost.exe
2912	explorer.exe
748	svchost.exe
2912	explorer.exe
2912	explorer.exe
748	svchost.exe
748	svchost.exe
2912	explorer.exe
2912	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2912	explorer.exe
748	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3048	BlueStacksInstaller.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
2324	2026-07-06_2d4f8d2e9f92440464b94e627e1e525d_elex_glassworm_stealc_stop_tofsee.exe
2324	2026-07-06_2d4f8d2e9f92440464b94e627e1e525d_elex_glassworm_stealc_stop_tofsee.exe
5244	icsys.icn.exe
5244	icsys.icn.exe
2912	explorer.exe
2912	explorer.exe
1188	spoolsv.exe
1188	spoolsv.exe
748	svchost.exe
748	svchost.exe
2776	spoolsv.exe
2776	spoolsv.exe
2912	explorer.exe
2912	explorer.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 5684	2324	2026-07-06_2d4f8d2e9f92440464b94e627e1e525d_elex_glassworm_stealc_stop_tofsee.exe	87
PID 2324 wrote to memory of 5244	2324	2026-07-06_2d4f8d2e9f92440464b94e627e1e525d_elex_glassworm_stealc_stop_tofsee.exe	88
PID 5684 wrote to memory of 3048	5684	2026-07-06_2d4f8d2e9f92440464b94e627e1e525d_elex_glassworm_stealc_stop_tofsee.exe	89
PID 5244 wrote to memory of 2912	5244	icsys.icn.exe	90
PID 2912 wrote to memory of 1188	2912	explorer.exe	91
PID 1188 wrote to memory of 748	1188	spoolsv.exe	92
PID 748 wrote to memory of 2776	748	svchost.exe	93
PID 748 wrote to memory of 3040	748	svchost.exe	94
PID 3048 wrote to memory of 5064	3048	BlueStacksInstaller.exe	96
PID 3048 wrote to memory of 2084	3048	BlueStacksInstaller.exe	100
PID 748 wrote to memory of 5704	748	svchost.exe	102
PID 748 wrote to memory of 5760	748	svchost.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-07-06_2d4f8d2e9f92440464b94e627e1e525d_elex_glassworm_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_2d4f8d2e9f92440464b94e627e1e525d_elex_glassworm_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324
- \??\c:\users\admin\appdata\local\temp\2026-07-06_2d4f8d2e9f92440464b94e627e1e525d_elex_glassworm_stealc_stop_tofsee.exe
  c:\users\admin\appdata\local\temp\2026-07-06_2d4f8d2e9f92440464b94e627e1e525d_elex_glassworm_stealc_stop_tofsee.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5684
- - C:\Users\Admin\AppData\Local\Temp\7zS436B7D88\BlueStacksInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS436B7D88\BlueStacksInstaller.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Users\Admin\AppData\Local\Temp\7zS436B7D88\HD-CheckCpu.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS436B7D88\HD-CheckCpu.exe" --cmd checkHypervEnabled
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\7zS436B7D88\HD-CheckCpu.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS436B7D88\HD-CheckCpu.exe" --cmd checkSSE4
      4⤵
      Executes dropped EXE
      PID:2084
- C:\Users\Admin\AppData\Local\icsys.icn.exe
  C:\Users\Admin\AppData\Local\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5244
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of hidden/system files in Explorer
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - \??\c:\windows\system\spoolsv.exe
      c:\windows\system\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1188
    - - \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        5⤵
        Modifies WinLogon for persistence
        Modifies visibility of hidden/system files in Explorer
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:748
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2776
      - C:\Windows\SysWOW64\at.exe
        
        at 05:41 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3040
      - C:\Windows\SysWOW64\at.exe
        
        at 05:42 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5704
      - C:\Windows\SysWOW64\at.exe
        
        at 05:43 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-07-06_2d4f8d2e9f92440464b94e627e1e525d_elex_glassworm_stealc_stop_tofsee.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-06_2d4f8d2e9f92440464b94e627e1e525d_elex_glassworm_stealc_stop_tofsee.exe
Size 927KB
SHA256 a52babce6f6eabf4f968a7adaa0796ccbe076dcf20645575eafb0265f7f3ca19
MD5 cff6ac15ac5c59a9b9352698d0a7754c
SHA1 5d8375b45f87c71a06a8ae67e0ab269712d8fcb9
SHA512 4327929320e71c06ed88f1df2204e51ad47785a3db5615a6aa87494b0d13672df80a00dacb541897df2745e29248a249e873a43bb469dc78ec44f3b6982648a2
SSDEEP 24576:SivtCXWeGKa/NGzTukzxNwW5mF6SUla908Y9:XtCXWPX/m3gP6HUvY9
TLSH
T19415DF5D20A1C077C9130FF285E4DF236115F9913B23A52EE6912EA97A70E924BFB173
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

backicon.png

Path C:\Users\Admin\AppData\Local\Temp\7zS436B7D88\Assets\backicon.png
Size 15KB
SHA256 fa64884054171515e97b78aaa1aad1ec5baa9d1daf9c682e0b3fb4a41a9cb1c1
MD5 7ff5dc8270b5fa7ef6c4a1420bd67a7f
SHA1 b224300372feaa97d882ca2552b227c0f2ef4e3e
SHA512 f0d5a842a01b99f189f3d46ab59d2c388a974951b042b25bbce54a15f5a3f386984d19cfca22ba1440eebd79260066a37dfeff6cb0d1332fca136add14488eef
SSDEEP 48:b//6zMh8k29WJsEvda/PSeld0/u1BLW3qLWoxN+Y9rNGZGvsc5uG7yUWT:b/Ss8kEWmkGPMAxNXrNGZGvsc5VyUA
TLSH
T1D36250A4FDF17565D849F6321DC168068C730B83EA809C86BACE8D277F01BE98C4F196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

change_hover.png

Path C:\Users\Admin\AppData\Local\Temp\7zS436B7D88\Assets\change_hover.png
Size 310B
SHA256 8e5847487da148ebb3ea029cc92165afd215cdc08f7122271e13eb37f94e6dc1
MD5 57092634754fc26e5515e3ed5ca7d461
SHA1 3ae4d01db9d6bba535f5292298502193dfc02710
SHA512 553baf9967847292c8e9249dc3b1d55069f51c79f4d1d3832a0036e79691f433a3ce8296a68c774b5797caf7000037637ce61b8365885d2a4eed3ff0730e5e2a
TLSH
T14AE02DC28308903CC3070C22602281E6E63E04D4292238024890C2382E64D0CD4187B1
MD5 SHA1 SHA512 TLSH

Submit Download

close_red.png

Path C:\Users\Admin\AppData\Local\Temp\7zS436B7D88\Assets\close_red.png
Size 15KB
SHA256 d0b6d143642d356b40c47459a996131a344cade6bb86158f1b74693426b09bfb
MD5 93216b2f9d66d423b3e1311c0573332d
SHA1 5efaebec5f20f91f164f80d1e36f98c9ddaff805
SHA512 922a7292de627c5e637818556d25d9842a88e89f2b198885835925679500dfd44a1e25ce79e521e63c4f84a6b0bd6bf98e46143ad8cee80ecdbaf3d3bc0f3a32
SSDEEP 48:2/6FwMlYk29WJsEvkch6/Clu5tlL88Lem/fLu5A/luaxN+Y97sc52G7Z+EazEyIc:2SFvYkEWmDCccHAxNX7sc5dZabT
TLSH
T1CA625065BDF075A65589F5322CC564055C730B83DAC09C88FACE5C2B6F01BEA9C1F58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

custom.png

Path C:\Users\Admin\AppData\Local\Temp\7zS436B7D88\Assets\custom.png
Size 17KB
SHA256 fbece8bb5f4dfa55dcfbf41151b10608af807b9477e99acf0940954a11e68f7b
MD5 03b17f0b1c067826b0fcc6746cced2cb
SHA1 e07e4434e10df4d6c81b55fceb6eca2281362477
SHA512 67c78ec01e20e9c8d9cdbba665bb2fd2bb150356f30b88d3d400bbdb0ae92010f5d7bcb683dcf6f895722a9151d8e669d8bef913eb6e728ba56bb02f264573b2
SSDEEP 96:wkEWMrbxNXW5G53p1pCcXdV8WMIPX7kTCM4:wkEdV8WM4YWM4
TLSH
T168727229FDF2B2EC450A523339C654015D7307C3E681AC85BACE8D162F21BDD8C8F659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

discord_icon.png

Path C:\Users\Admin\AppData\Local\Temp\7zS436B7D88\Assets\discord_icon.png
Size 564B
SHA256 c29b35c6be50f9e34f1120bd346ce01884f0c7ba1121c866d95b24e46e420b0c
MD5 9354bc445e979c2de9b9eedd9b7c8318
SHA1 8dc3e8fdcad0fcdad1fe19b0b94b676e8846affd
SHA512 ad13f6bf46dd8cb48a030e720c1c577a22b0d3dec794ae807aa482474fe6c2bead7fc63dd45983fb3ab82034d74d4f10b6d9967d4ff677d2226c6c18ee03a4d6
TLSH
T118F096F97D43D827F042101E764B64906C35F5782B32BB2E7588800C790F7B8522B6B0
MD5 SHA1 SHA512 TLSH

Submit Download

folder.png

Path C:\Users\Admin\AppData\Local\Temp\7zS436B7D88\Assets\folder.png
Size 298B
SHA256 7ffa875fab1be82e384022a27f3e627ab75131eb168be949cc83c03b6e291bbf
MD5 8fc519ef684dc58830e462581184eb15
SHA1 cba35cdbb9b87c359b287b13c30a4d2984289ed6
SHA512 fb5cd6fde1b04901cc25508e7011250645d74eafd58a415b2702b04860d76266e0d6a8e9686532a946b2e534bce5cddab53f7f030930852dd4a030e1e4e49f8a
TLSH
T17EE07DD5936D2DAE6CAB812D06364647947B55192451000CDD057568212C96BE05B702
MD5 SHA1 SHA512 TLSH

Submit Download

help_icon.png

Path C:\Users\Admin\AppData\Local\Temp\7zS436B7D88\Assets\help_icon.png
Size 1KB
SHA256 97c7450d55ecda9017d0a9eed0049b8176e1828f3525aaf5660985ba214010cc
MD5 3c955d2be56f76de8a53f77e816f3fb8
SHA1 0c242256f7934e2d857f657ddc7f50589cf489f1
SHA512 2b4ce8453960de520bdccb658d72b55be3c3386b1d394f3acf7269405971843083d0e04d3af05758ac4b8d191ea6a61ea5313a07fa849bcdf1f8eb4d5624521c
TLSH
T18711E9C919D95DF055BB43FB00D407175F784E7225ADC34DF296653C981ED21506C78A
MD5 SHA1 SHA512 TLSH

Submit Download

info_icon.png

Path C:\Users\Admin\AppData\Local\Temp\7zS436B7D88\Assets\info_icon.png
Size 929B
SHA256 ee91e51aaa8356318cc75d60476d9422bf84be7d8a25e1b884aa16c3198dc764
MD5 8f73ec5e7100a0ec232e06e5b3786963
SHA1 15c7bb268803932192a064a4eedc9db42bd6c37c
SHA512 c628dede37fec439a849ab6704046210bdabb1bb576a5c5dae9a28b52ad021307347211ba2aecb47ef836f14e914ba18617b21863bce12bc406513f45c9eb66e
TLSH
T14B11C89128DD586A881E02B2951D97021FFEE03F89B4F40A3D83205F2821045B04A94B
MD5 SHA1 SHA512 TLSH

Submit Download

installer_bg.jpg

Path C:\Users\Admin\AppData\Local\Temp\7zS436B7D88\Assets\installer_bg.jpg
Size 78KB
SHA256 4c7471c986e16de0cd451be27d4b3171e595fe2916b4b3bf7ca52df6ec368904
MD5 3478e24ba1dd52c80a0ff0d43828b6b5
SHA1 b5b13bbf3fb645efb81d3562296599e76a2abac0
SHA512 5c8c9cc76d6dbc7ce482d0d1b6c2f3d48a7a510cd9ed01c191328763e1bccb56daeb3d18c33a9b10ac7c9780127007aa13799fa82d838de27fbe0a02ad98119d
SSDEEP 1536:/8jAVIA5IyKedQSsmprMWI/xKdefJeGhuvIDU1pY7EQGZRV3/X35ev:IAVPVsylI/xJfJHovsU1poEBZP/H5ev
TLSH
T15473F1DC3E9FDDD855E1A3964224A3ED3E99B85E258FFD8CB8200506705A4E37DE7012
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_logo.png

Path C:\Users\Admin\AppData\Local\Temp\7zS436B7D88\Assets\installer_logo.png
Size 9KB
SHA256 462b64f2e016d25a2a6a653ba896206129c4ac841d61a6c2fd116009606f7e1c
MD5 f9db10032266ce8276c922b24de2d60f
SHA1 9c7bc3e277a58c4b59e35b9622e2b7f076ebb2fc
SHA512 9e5e1e345815ff9e815f63a892724bccb2b1fe19d5db91750f681899af6ba52aa3fc9214ef6bcc691a1e7ab9a1c16c093c398544e1f57f0ad5dc883776f657b6
SSDEEP 192:fsCXsMtWAC+DwSuWzRNrk2SEDAnQfQhzNoxiw2H6v3LGAEv3BsBW/V:fsCXs1Az4WVNrLnDAnDboG5AkxeuV
TLSH
T1C322CFA1101DF0A3E72A94B1D0D97E6D936F790D3BFB710D86802DEA80930680359FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_minimize.png

Path C:\Users\Admin\AppData\Local\Temp\7zS436B7D88\Assets\installer_minimize.png
Size 113B
SHA256 a064f417e3c2b8f3121a14bbded268b2cdf635706880b7006f931de31476bbc2
MD5 38b539a1e4229738e5c196eedb4eb225
SHA1 f027b08dce77c47aaed75a28a2fce218ff8c936c
SHA512 2ce433689a94fae454ef65e0e9ec33657b89718bbb5a038bf32950f6d68722803922f3a427278bad432395a1716523e589463fcce4279dc2a895fd77434821cc
TLSH
T162B02BC13608FC34C64E0935416290009921001D011024101E0500680C1B19051A4F00
MD5 SHA1 SHA512 TLSH

Submit Download

loader.png

Path C:\Users\Admin\AppData\Local\Temp\7zS436B7D88\Assets\loader.png
Size 279B
SHA256 076263cc65f9824f4f82eb6beaa594d1df90218a2ee21664cf209181557e04b1
MD5 03903fd42ed2ee3cb014f0f3b410bcb4
SHA1 762a95240607fe8a304867a46bc2d677f494f5c2
SHA512 8b0e717268590e5287c07598a06d89220c5e9a33cd1c29c55f8720321f4b3efc869d20c61fcc892e13188d77f0fdc4c73a2ee6dece174bf876fcc3a6c5683857
TLSH
T17FD0EB93F339AC52F8018213C788083CD2FA26852E476E4C022A8CB60280D3E8AE018B
MD5 SHA1 SHA512 TLSH

Submit Download

logo_text.png

Path C:\Users\Admin\AppData\Local\Temp\7zS436B7D88\Assets\logo_text.png
Size 4KB
SHA256 66df86129129d8aa8dd3ba014eb3b3c27a36c22e4782f3dbd6a9a4bc1f4a87bc
MD5 1fbdb2b7efcae8e9f26b6536ab580968
SHA1 126386cb7c0e8a03d99acb19ec2b13a70114a7d5
SHA512 1a0218122948b7d93dd473f21512bd2411f902ff133b15bf80d36ff474cf29d53880ed0ab38ef76d8288784817e6fc49f54d85f106c97f620331e31d03d6fa73
SSDEEP 96:ucBdj0UbKsYpguE2VTlrtyQnN9EHRs8nTOCCC2Jm0ciOqT3YKU6Y4R4MKYb+OI:u2yVQQYQnARxTGJmxiOKYM6WSOI
TLSH
T148A19FC5C2856BF4B85286C79713EC474513D2052200AB171DF47CEF9441A21AF60EFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setpath.png

Path C:\Users\Admin\AppData\Local\Temp\7zS436B7D88\Assets\setpath.png
Size 15KB
SHA256 5bbb2f41f9f3a805986c3c88a639bcc22d90067d4b8de9f1e21e3cf9e5c1766b
MD5 b2e7f40179744c74fded932e829cb12a
SHA1 a0059ab8158a497d2cf583a292b13f87326ec3f0
SHA512 b95b7ebdb4a74639276eaa5c055fd8d9431e2f58a5f7c57303f7cf22e8b599f6f2a7852074cf71b19b49eb31cc9bf2509aedf41d608981d116e49a00030c797c
SSDEEP 96:iS5YkEWmE5+W+BxNXrNGyxGvsc5RxZ8af:iSqk6C+z5mf
TLSH
T10E624E65FDF0B565D989E2322DC928025C730B83D6809D45BACE8CA72F00BE98D5F593
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlueStacksInstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS436B7D88\BlueStacksInstaller.exe
Size 642KB
SHA256 f09e1926eaef0a41d66cd1e4695880224c65ff7688b11709fef4fe06c0f575e3
MD5 58539f76587fc02b72198765191f7d1b
SHA1 b762b487904a79f7331dfa5e59b9df05a1f863fa
SHA512 1ff23145d7915de731aaf038a36fe9853dd80971e29e3c8aa2f1959c5ea340542d30320d0a5a2aaae6d3b239c599b24f1d894f80740ff7b888cf6b8d6716264f
SSDEEP 6144:Jq3WNcXmfpCIwkJFgnF8M338MsRO+WQ66E1vy2p3+uwB8Y2zS/4MvB5bqlMCQVbd:JDN7fpCIxcuc93+xB8i4MvB5b6MCySM
TLSH
T1A1E4294423F4886AF2BF4FBA98F14E174A72FC467A62D71E4141584E2DB1B019EB6733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlueStacksInstaller.exe.config

Path C:\Users\Admin\AppData\Local\Temp\7zS436B7D88\BlueStacksInstaller.exe.config
Size 324B
SHA256 d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb
MD5 1b456d88546e29f4f007cd0bf1025703
SHA1 e5c444fcfe5baf2ef71c1813afc3f2c1100cab86
SHA512 c545e416c841b8786e4589fc9ca2b732b16cdd759813ec03f558332f2436f165ec1ad2fbc65012b5709fa19ff1e8396639c17bfad150cabeb51328a39ea556e6
TLSH
T1C9E0C21941D8FD2B5D734B13A3128852EFB0A2A391A4544CF0EE7F830F3308A6697332
MD5 SHA1 SHA512 TLSH

Submit Download

HD-CheckCpu.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS436B7D88\HD-CheckCpu.exe
Size 200KB
SHA256 2e14887f3432b4a313442247fc669f891dbdad7ef1a2d371466a2afa88074a4c
MD5 81234fd9895897b8d1f5e6772a1b38d0
SHA1 80b2fec4a85ed90c4db2f09b63bd8f37038db0d3
SHA512 4c924d6524dc2c7d834bfc1a0d98b21753a7bf1e94b1c2c6650f755e6f265512d3a963bc7bc745351f79f547add57c37e29ba9270707edbf62b60df3a541bc16
SSDEEP 3072:KjDeWjpu716WoCYv8NBa3eSx8LHGYwj6V4NL1q7HOAg0FujFfnk601hWNxK:opcoCYv8Xa3eSqL8j/3AOpNq
TLSH
T1FA147C10B4C18433D9B715314DF8DAB99A3DB8110B2559EB73D80B7E4F346E3BA31A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JSON.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS436B7D88\JSON.dll
Size 411KB
SHA256 d2c8d26f95f55431e632c8581154db7c19547b656380e051194a9d2583dd2156
MD5 f5fd966e29f5c359f78cb61a571d1be4
SHA1 a55e7ed593b4bc7a77586da0f1223cfd9d51a233
SHA512 d99e6fe250bb106257f86135938635f6e7ad689b2c11a96bb274f4c4c5e9a85cfacba40122dbc953f77b5d33d886c6af30bff821f10945e15b21a24b66f6c8be
SSDEEP 6144:GmyZXnmtWrnngnnnKnanlywwwBwwA5wwwwswww+wwwGwwwbwwwLwwwwwwwwwnwwd:GmIWtWrnngnnnKnanxNYhX
TLSH
T11F947250D8535838CA244778BA7396B02DF9EC718A07E6716B207EE7F13BA20ED75532
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i18n.en-US.txt

Path C:\Users\Admin\AppData\Local\Temp\7zS436B7D88\Locales\i18n.en-US.txt
Size 21KB
SHA256 945cbd36495c301dcf1cad837a4147479077974bce2790a3cb3961c9c71f22e2
MD5 b5d651273bada061fcff78edaf4d32ef
SHA1 9f56763bd4e373b3f186568d323521fdc7271a73
SHA512 1b1778caf39af7531610e91704a86f41065469c21dbe5ba1723923e2cf9944e812c5be497618f36471b4b002f280da3de25fd348039cbf380c81b598f1fddc23
SSDEEP 384:aBvGq6rKPsL/ds89JplYTWfUvcABRGjV+qXOJtUmEIpNnU6+FKvtCFV30Y4TWEaj:aBvGqaKPsL/ds893l+WfacWRGjV+qXOc
TLSH
T145A22B8FD777136CAAD1011A94E93542A517B35B33693A11BCACC03B1B5790E133EADE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThemeFile

Path C:\Users\Admin\AppData\Local\Temp\7zS436B7D88\ThemeFile
Size 80KB
SHA256 de1a2e6b560e036da5ea6b042e29e81a5bfcf67dde89670c332fc5199e811ba6
MD5 c3e6bab4f92ee40b9453821136878993
SHA1 94493a6b3dfb3135e5775b7d3be227659856fbc4
SHA512 a64b6b06b3a0f3591892b60e59699682700f4018b898efe55d6bd5fb417965a55027671c58092d1eb7e21c2dbac42bc68dfb8c70468d98bed45a8cff0e945895
SSDEEP 1536:Vq0UZUzBB6YjhX8knUVXVqlp1D88p/LUP8f/MPFntuevdxG+PchojU1yZwbP8fZS:pUFmL
TLSH
T178832B9DEADD3C39323F52AEB6361453C847301B7912896ABA1F21215FBC89F3417B25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_bg_1.jpg

Path C:\Users\Admin\AppData\Local\Temp\Assets\installer_bg_1.jpg
Size 30KB
SHA256 873030e34515538dac3efb98edec519596439fa05b7aad37f6137ca954ba41a6
MD5 efb63876389c300433587a29ce85f258
SHA1 8eb00659e003a934c8538b6e5a2be65ea097e5c9
SHA512 3c4a935f949e70199333889ba54870930858e54bf2ee0ac2a27f814710264ae30c474c4cd9e59835cc9bdc9da8c7eb25b963f02ee34767b3738f43988084059d
SSDEEP 768:/8PY3wdSnzEdbnEnqTE6PBtA2Gi5DTglr3cBt41FD98/AX16gANg+IL02U:/8zygdbEniHHPZBBtsD98Md+IRU
TLSH
T1D4E2E1A8BB15C36FED990F74DC3783442B2C1D7AC83402F5A265A032EC5626ABC98249
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Users\Admin\AppData\Local\icsys.icn.exe
Size 206KB
SHA256 5ddd291b7e02dd402f6080be14a52a40e784ebb33c0f3a923821bfcc1ec273d1
MD5 f1fb7905ccba21abae74d270cff444ec
SHA1 694f23bda74235966eb25a2372ea89567bf2f6ad
SHA512 a42e48a6d39e4e2c433a595e5955ebcf6683396c1573cd9328b61543e32f1c25ac8939f0e8abad61218247ab25c6bc287f641475e2fb236aa45a91e48cf13604
SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unD:5vEN2U+T6i5LirrllHy4HUcMQY68
TLSH
T12B24EA7BFA00602EE8A785F16436A266B5362D361FD29C0B67D0AF4A2471653F1F431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 207KB
SHA256 e62c14b8c64e7d2865ab392de1428f2d15cf7e16db448dc356e59d58274b3471
MD5 4b32347fe9c7a03a57b87f54fa790da2
SHA1 d6d41e7186077d0375b3b15a1354ac7bb39e2135
SHA512 79521267933fe53f2472e8374be928d041b4467071698669c445415ddc305c499b31b9aae6ec8db682bf7dd2a297bc8eaf90660f97adaddac3cc0d8d6fe54f9a
SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un9:5vEN2U+T6i5LirrllHy4HUcMQY6Q
TLSH
T1DB24F82BBA56712EE4A7CAF0286561AAF6216E360BC09C0F63D16F453471603F5F631F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 206KB
SHA256 a47b6fb10ef8c2ecfbbe4f7fad992fbfd76e50f4e10a2b8c0cc5bc73b5f23723
MD5 021c5f80a9a668ad04e4149c56e0d05f
SHA1 d433aa4e6a33bc56e6efe554ed256a92a04c9ec1
SHA512 e198e5e5814e970b16f3f4e6125f77e6cc4bd37363bdfccb893e46835a8463fa4a2e9a54b0de35b63a5df9b520985854e7fd1030d953acdb2dbf1a74a8d517c6
SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unY:5vEN2U+T6i5LirrllHy4HUcMQY6t
TLSH
T1AD24081BEA04701FD46BD6F04826AAA6B6267D321F919C0F23D1AF993871503F5B631F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 207KB
SHA256 251e7a028e35303f59f453c5aee5e6e0b8f95605913d773fcbb9d87b6f59ed05
MD5 ec8f2d647fa6169de146dc0bdf0763b9
SHA1 325e87abe150026c1588d002ff6fa6bdd02d5cc9
SHA512 5fbbbf4dce13741902d5534f4346ebc1aeeb9225586a837da1774dc196a80c69594fe197294b6e73fff7d86fe0e0a1caaf1a47789ed1348f135549ff012f0ab5
SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6uny:5vEN2U+T6i5LirrllHy4HUcMQY6t
TLSH
T13724E76BAA00A03ED85385F059A665A6BA322D311FD19C4F23E19F8534B1B53F1F532F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 206KB
SHA256 2d82da65616a6b00f3b1eb445611dcc8585c6b32c74371e4a923c94a04dfa450
MD5 23bb27d11885d8688a3fff6333c2f4df
SHA1 fcd1db1801e2ccba417bf43fcf8821367748b82a
SHA512 4a4829d89e8b091279df0f5477dd8a3f3100afbca9c2ffaadae6380dc7007c4cbfd4be1b5ace10528f7db7aa3f426993981dad87b100a2b5d2da0ff539756742
SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unY:5vEN2U+T6i5LirrllHy4HUcMQY6l
TLSH
T11324F727EA40702ED493C6F12816B5AABA362E350BD0AC4F27D1AF863475513B5F931F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/748-242-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1188-193-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2324-0-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2324-195-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2776-190-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2912-241-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3048-181-0x000000001B320000-0x000000001B388000-memory.dmp

Download

memory/3048-156-0x0000000000640000-0x00000000006E4000-memory.dmp

Download

memory/3048-220-0x0000000020C30000-0x0000000020C38000-memory.dmp

Download

memory/3048-206-0x0000000020770000-0x000000002077E000-memory.dmp

Download

memory/3048-205-0x00000000207B0000-0x00000000207EE000-memory.dmp

Download

memory/3048-201-0x000000001D210000-0x000000001D738000-memory.dmp

Download

memory/5244-194-0x0000000000400000-0x0000000000440000-memory.dmp

Download