3282ea37da7f3ad52559d4b783edd96791fbfcd4530cb33b90424bbb34f72511

Analysis

user interaction
yes
max time kernel
180s
max time network
440s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 21:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ZEROAVG.exe
Size 627.7MB
Sample260708-1vdfjsav9w
SHA256 3282ea37da7f3ad52559d4b783edd96791fbfcd4530cb33b90424bbb34f72511
MD5 5921edb2696d02d2c472545abb0309cc
SHA1 95738ba72778ee77501f0ab9bee3e5821f919147
SHA512 13157bf14b2fbe2962b434c2fe41561a7ab1bbd9469c70cf42119dcc6577921cab56420c7cf78168aef171d35b9a29b9a6768d7b0c193f636640f052f9093273
SSDEEP 12582912:QmmIQlwJq/CrXv0d8zdeChSHrx3TCUGmoAQAJcpZn/TlWk1jhtmG:QoQCJ/rcd8Q5x3TRG1AJcpZ/BD
TLSH
T15469336AE6611EEEC33AC6B71ACA8801AC9B437F5F479F17355874871EC4346B82841F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5948	netsh.exe
2916	netsh.exe

Executes dropped EXE 18 IoCs

pid	Process
5576	BlueStacksInstaller.exe
1996	7zr.exe
3104	HD-ForceGPU.exe
2916	HD-GLCheck.exe
2388	HD-GLCheck.exe
1260	HD-GLCheck.exe
1368	HD-CheckCpu.exe
2816	HD-GLCheck.exe
5756	HD-GLCheck.exe
4240	HD-GLCheck.exe
8	HD-GLCheck.exe
900	7zr.exe
1196	HD-GLCheck.exe
5380	HD-GLCheck.exe
4052	HD-GLCheck.exe
1156	7zr.exe
3048	7zr.exe
2948	HD-ComRegistrar.exe

Loads dropped DLL 40 IoCs

pid	Process
2916	HD-GLCheck.exe
2388	HD-GLCheck.exe
2388	HD-GLCheck.exe
2388	HD-GLCheck.exe
2388	HD-GLCheck.exe
2388	HD-GLCheck.exe
1260	HD-GLCheck.exe
1260	HD-GLCheck.exe
1260	HD-GLCheck.exe
1260	HD-GLCheck.exe
2816	HD-GLCheck.exe
5756	HD-GLCheck.exe
5756	HD-GLCheck.exe
5756	HD-GLCheck.exe
5756	HD-GLCheck.exe
4240	HD-GLCheck.exe
4240	HD-GLCheck.exe
4240	HD-GLCheck.exe
4240	HD-GLCheck.exe
4240	HD-GLCheck.exe
8	HD-GLCheck.exe
8	HD-GLCheck.exe
8	HD-GLCheck.exe
8	HD-GLCheck.exe
8	HD-GLCheck.exe
8	HD-GLCheck.exe
8	HD-GLCheck.exe
1196	HD-GLCheck.exe
1196	HD-GLCheck.exe
1196	HD-GLCheck.exe
1196	HD-GLCheck.exe
5380	HD-GLCheck.exe
5380	HD-GLCheck.exe
5380	HD-GLCheck.exe
5380	HD-GLCheck.exe
4052	HD-GLCheck.exe
2948	HD-ComRegistrar.exe
2948	HD-ComRegistrar.exe
2948	HD-ComRegistrar.exe
2948	HD-ComRegistrar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-ConfigHttpProxy.exe	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\LICENSE.txt	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\System.Windows.Interactivity.dll	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\BstkProxyStub.dll	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-Aapt.exe	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-MultiInstanceManager.exe.config	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-Plus-Service-Native.dll	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-Plus-Service-Native.dll	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-Quit.exe	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-Sensor-Native.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\msvcr100.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\BlueStacks.Core.dll	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\BstkRT.lib	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-SslCertificateTool.exe.config	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\BstkTypeLib.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-ApkHandler.exe	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\WhiteLogo.png	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-Adb.exe	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-ComRegistrar.exe.config	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-Quit.exe.config	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-RunApp.exe	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\BstkSVC.exe	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-MultiInstanceManager.exe.config	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-VmManager.exe.config	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\libssl32.dll	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\64	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\BstkDD2R0.r0	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\BstkREM.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-Adb.exe	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\libGLESv2.dll	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\Microsoft.Practices.ServiceLocation.dll	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-GpsLocator-Native.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-ServiceInstaller.exe	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\WhiteFullScreen.png	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\CursorSecondary.png	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\DiskCompactionTool.exe.config	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-ApkHandler.exe	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-ConfigHttpProxy.exe	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-Sensor-Native.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-ServiceInstaller.exe.config	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\BstkSharedFolders.dll	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-PgaSocketHgcm.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\LICENSE.txt	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\ssleay32.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-QuitMultiInstall.exe.config	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\VMMRC.rc	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\BstkDD2RC.rc	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\BstkSharedFolders.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\BstkSVC.exe	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-VmManager.exe	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\WhiteLogo.png	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-DataManager.exe	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\AdbWinApi.dll	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\BlueStacks.ico	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-Agent.exe	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-RunApp.exe.config	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\ProductLogo.png	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-Gps-Native.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\libEGL_translator.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\BstkDDRC.rc	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\CursorSecondary.png	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-Opengl-Native.dll	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\D3DCompiler_43.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-Audio-Native.dll	7zr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7zr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7zr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD-CheckCpu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7zr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7zr.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\WOW6432Node\CLSID	HD-ComRegistrar.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\CLSID	HD-ComRegistrar.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2948	HD-ComRegistrar.exe
2948	HD-ComRegistrar.exe
2948	HD-ComRegistrar.exe
2948	HD-ComRegistrar.exe
2948	HD-ComRegistrar.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	5576	BlueStacksInstaller.exe
Token: SeRestorePrivilege	1996	7zr.exe
Token: 35	1996	7zr.exe
Token: SeSecurityPrivilege	1996	7zr.exe
Token: SeSecurityPrivilege	1996	7zr.exe
Token: SeRestorePrivilege	900	7zr.exe
Token: 35	900	7zr.exe
Token: SeSecurityPrivilege	900	7zr.exe
Token: SeSecurityPrivilege	900	7zr.exe
Token: SeRestorePrivilege	1156	7zr.exe
Token: 35	1156	7zr.exe
Token: SeSecurityPrivilege	1156	7zr.exe
Token: SeSecurityPrivilege	1156	7zr.exe
Token: SeRestorePrivilege	3048	7zr.exe
Token: 35	3048	7zr.exe
Token: SeSecurityPrivilege	3048	7zr.exe
Token: SeSecurityPrivilege	3048	7zr.exe
Token: SeDebugPrivilege	2948	HD-ComRegistrar.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5584	StartMenuExperienceHost.exe
1260	HD-GLCheck.exe
5756	HD-GLCheck.exe
5380	HD-GLCheck.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 5576	4068	ZEROAVG.exe	90
PID 5576 wrote to memory of 4504	5576	BlueStacksInstaller.exe	92
PID 5576 wrote to memory of 1996	5576	BlueStacksInstaller.exe	94
PID 5576 wrote to memory of 3104	5576	BlueStacksInstaller.exe	96
PID 5576 wrote to memory of 2916	5576	BlueStacksInstaller.exe	98
PID 5576 wrote to memory of 2388	5576	BlueStacksInstaller.exe	100
PID 5576 wrote to memory of 1260	5576	BlueStacksInstaller.exe	102
PID 5576 wrote to memory of 1368	5576	BlueStacksInstaller.exe	106
PID 5576 wrote to memory of 2816	5576	BlueStacksInstaller.exe	108
PID 5576 wrote to memory of 5756	5576	BlueStacksInstaller.exe	110
PID 5576 wrote to memory of 4240	5576	BlueStacksInstaller.exe	112
PID 5576 wrote to memory of 8	5576	BlueStacksInstaller.exe	114
PID 5576 wrote to memory of 900	5576	BlueStacksInstaller.exe	116
PID 5576 wrote to memory of 1196	5576	BlueStacksInstaller.exe	117
PID 5576 wrote to memory of 5380	5576	BlueStacksInstaller.exe	120
PID 5576 wrote to memory of 4052	5576	BlueStacksInstaller.exe	122
PID 5576 wrote to memory of 1156	5576	BlueStacksInstaller.exe	124
PID 5576 wrote to memory of 3048	5576	BlueStacksInstaller.exe	126
PID 5576 wrote to memory of 5948	5576	BlueStacksInstaller.exe	128
PID 5576 wrote to memory of 2916	5576	BlueStacksInstaller.exe	130
PID 5576 wrote to memory of 4408	5576	BlueStacksInstaller.exe	133
PID 5576 wrote to memory of 612	5576	BlueStacksInstaller.exe	135
PID 5576 wrote to memory of 4928	5576	BlueStacksInstaller.exe	137
PID 5576 wrote to memory of 4340	5576	BlueStacksInstaller.exe	139
PID 5576 wrote to memory of 5528	5576	BlueStacksInstaller.exe	141
PID 5576 wrote to memory of 3860	5576	BlueStacksInstaller.exe	143
PID 5576 wrote to memory of 1664	5576	BlueStacksInstaller.exe	145
PID 5576 wrote to memory of 5372	5576	BlueStacksInstaller.exe	147
PID 5576 wrote to memory of 5316	5576	BlueStacksInstaller.exe	149
PID 5576 wrote to memory of 5376	5576	BlueStacksInstaller.exe	151
PID 5576 wrote to memory of 720	5576	BlueStacksInstaller.exe	153
PID 5576 wrote to memory of 3316	5576	BlueStacksInstaller.exe	155
PID 5576 wrote to memory of 2596	5576	BlueStacksInstaller.exe	157
PID 5576 wrote to memory of 1084	5576	BlueStacksInstaller.exe	159
PID 5576 wrote to memory of 3308	5576	BlueStacksInstaller.exe	161
PID 5576 wrote to memory of 4552	5576	BlueStacksInstaller.exe	163
PID 5576 wrote to memory of 4832	5576	BlueStacksInstaller.exe	165
PID 5576 wrote to memory of 3368	5576	BlueStacksInstaller.exe	167
PID 5576 wrote to memory of 1700	5576	BlueStacksInstaller.exe	169
PID 5576 wrote to memory of 2316	5576	BlueStacksInstaller.exe	171
PID 5576 wrote to memory of 4268	5576	BlueStacksInstaller.exe	173
PID 5576 wrote to memory of 2216	5576	BlueStacksInstaller.exe	175
PID 5576 wrote to memory of 4416	5576	BlueStacksInstaller.exe	177
PID 5576 wrote to memory of 5068	5576	BlueStacksInstaller.exe	179
PID 5576 wrote to memory of 200	5576	BlueStacksInstaller.exe	181
PID 5576 wrote to memory of 2728	5576	BlueStacksInstaller.exe	183
PID 5576 wrote to memory of 3884	5576	BlueStacksInstaller.exe	185
PID 5576 wrote to memory of 1156	5576	BlueStacksInstaller.exe	187
PID 5576 wrote to memory of 2720	5576	BlueStacksInstaller.exe	189
PID 5576 wrote to memory of 6052	5576	BlueStacksInstaller.exe	191
PID 5576 wrote to memory of 696	5576	BlueStacksInstaller.exe	193
PID 5576 wrote to memory of 3204	5576	BlueStacksInstaller.exe	195
PID 5576 wrote to memory of 5764	5576	BlueStacksInstaller.exe	197
PID 5576 wrote to memory of 4276	5576	BlueStacksInstaller.exe	199
PID 5576 wrote to memory of 3692	5576	BlueStacksInstaller.exe	201
PID 5576 wrote to memory of 4936	5576	BlueStacksInstaller.exe	203
PID 5576 wrote to memory of 980	5576	BlueStacksInstaller.exe	205
PID 5576 wrote to memory of 4400	5576	BlueStacksInstaller.exe	207
PID 5576 wrote to memory of 3844	5576	BlueStacksInstaller.exe	209
PID 5576 wrote to memory of 6008	5576	BlueStacksInstaller.exe	211
PID 5576 wrote to memory of 3160	5576	BlueStacksInstaller.exe	213
PID 5576 wrote to memory of 4476	5576	BlueStacksInstaller.exe	215
PID 5576 wrote to memory of 5224	5576	BlueStacksInstaller.exe	217
PID 5576 wrote to memory of 4228	5576	BlueStacksInstaller.exe	219

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5584

C:\Users\Admin\AppData\Local\Temp\ZEROAVG.exe
"C:\Users\Admin\AppData\Local\Temp\ZEROAVG.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\BlueStacksInstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\BlueStacksInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5576
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c dir "C:\Users\Admin\AppData\Local\Temp\RarSFX0\" /s
    3⤵
    PID:4504
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\7zr.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\RarSFX0\CommonInstallUtils.zip" -o"C:\Users\Admin\AppData\Local\Temp\RarSFX0\" -aoa
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1996
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-ForceGPU.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-ForceGPU.exe" 1
    3⤵
    - Executes dropped EXE
    PID:3104
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe" 1 1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2916
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe" 1 2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2388
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe" 4 1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1260
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-CheckCpu.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-CheckCpu.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1368
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe" 1 1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2816
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe" 4 1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:5756
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe" 1 2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4240
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe" 4 2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:8
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\7zr.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PF.zip" -o"C:\Program Files\BlueStacks_bgp64" -aoa
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:900
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\\HD-GLCheck.exe" 2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1196
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\\HD-GLCheck.exe" 3
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:5380
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\\HD-GLCheck.exe" 1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4052
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\7zr.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PD.zip" -o"C:\ProgramData\BlueStacks_bgp64" -aoa
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1156
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\7zr.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\RarSFX0\CefData.zip" -o"C:\ProgramData\BlueStacks_bgp64\CefData" -aoa
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3048
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" advfirewall firewall delete rule name="BlueStacks Service"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5948
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" advfirewall firewall add rule name="BlueStacks Service" dir=in action=allow program="C:\Program Files\BlueStacks_bgp64\HD-Player.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2916
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2861/ User=\"Everyone"
    3⤵
    PID:4408
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2862/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:612
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2863/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4928
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2864/ User=\"Everyone"
    3⤵
    PID:4340
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2865/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5528
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2866/ User=\"Everyone"
    3⤵
    PID:3860
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2867/ User=\"Everyone"
    3⤵
    PID:1664
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2868/ User=\"Everyone"
    3⤵
    PID:5372
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2869/ User=\"Everyone"
    3⤵
    PID:5316
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2870/ User=\"Everyone"
    3⤵
    PID:5376
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2871/ User=\"Everyone"
    3⤵
    PID:720
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2872/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3316
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2873/ User=\"Everyone"
    3⤵
    PID:2596
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2874/ User=\"Everyone"
    3⤵
    PID:1084
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2875/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3308
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2876/ User=\"Everyone"
    3⤵
    PID:4552
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2877/ User=\"Everyone"
    3⤵
    PID:4832
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2878/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3368
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2879/ User=\"Everyone"
    3⤵
    PID:1700
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2880/ User=\"Everyone"
    3⤵
    PID:2316
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2881/ User=\"Everyone"
    3⤵
    PID:4268
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2882/ User=\"Everyone"
    3⤵
    PID:2216
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2883/ User=\"Everyone"
    3⤵
    PID:4416
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2884/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5068
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2885/ User=\"Everyone"
    3⤵
    PID:200
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2886/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2728
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2887/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3884
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2888/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1156
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2889/ User=\"Everyone"
    3⤵
    PID:2720
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2890/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:6052
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2891/ User=\"Everyone"
    3⤵
    PID:696
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2892/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3204
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2893/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5764
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2894/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4276
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2895/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3692
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2896/ User=\"Everyone"
    3⤵
    PID:4936
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2897/ User=\"Everyone"
    3⤵
    PID:980
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2898/ User=\"Everyone"
    3⤵
    PID:4400
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2899/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3844
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2900/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:6008
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2901/ User=\"Everyone"
    3⤵
    PID:3160
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2902/ User=\"Everyone"
    3⤵
    PID:4476
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2903/ User=\"Everyone"
    3⤵
    PID:5224
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2904/ User=\"Everyone"
    3⤵
    PID:4228
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2905/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4116
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2906/ User=\"Everyone"
    3⤵
    PID:1512
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2907/ User=\"Everyone"
    3⤵
    PID:4420
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2908/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3908
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2909/ User=\"Everyone"
    3⤵
    PID:3740
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2910/ User=\"Everyone"
    3⤵
    PID:4544
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2911/ User=\"Everyone"
    3⤵
    PID:6068
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2912/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5100
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2913/ User=\"Everyone"
    3⤵
    PID:4572
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2914/ User=\"Everyone"
    3⤵
    PID:4676
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2915/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2956
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2916/ User=\"Everyone"
    3⤵
    PID:5996
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2917/ User=\"Everyone"
    3⤵
    PID:4340
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2918/ User=\"Everyone"
    3⤵
    PID:5948
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2919/ User=\"Everyone"
    3⤵
    PID:4852
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2920/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4636
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2921/ User=\"Everyone"
    3⤵
    PID:1616
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2922/ User=\"Everyone"
    3⤵
    PID:1332
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2923/ User=\"Everyone"
    3⤵
    PID:5864
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2924/ User=\"Everyone"
    3⤵
    PID:1112
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2925/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:6136
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2926/ User=\"Everyone"
    3⤵
    PID:4216
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2927/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1260
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2928/ User=\"Everyone"
    3⤵
    PID:5132
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2929/ User=\"Everyone"
    3⤵
    PID:4656
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2930/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5956
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2931/ User=\"Everyone"
    3⤵
    PID:2012
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2932/ User=\"Everyone"
    3⤵
    PID:5124
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2933/ User=\"Everyone"
    3⤵
    PID:3440
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2934/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4564
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2935/ User=\"Everyone"
    3⤵
    PID:4548
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2936/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1468
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2937/ User=\"Everyone"
    3⤵
    PID:5160
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2938/ User=\"Everyone"
    3⤵
    PID:5756
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2939/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:948
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2940/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2436
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2941/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1776
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2942/ User=\"Everyone"
    3⤵
    PID:2824
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2943/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2516
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2944/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1136
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2945/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5088
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2946/ User=\"Everyone"
    3⤵
    PID:5780
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2947/ User=\"Everyone"
    3⤵
    PID:2120
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2948/ User=\"Everyone"
    3⤵
    PID:5216
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2949/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5824
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2950/ User=\"Everyone"
    3⤵
    PID:3120
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2951/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5372
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2952/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3308
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2953/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5316
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2954/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1552
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2955/ User=\"Everyone"
    3⤵
    PID:5832
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2956/ User=\"Everyone"
    3⤵
    PID:1908
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2957/ User=\"Everyone"
    3⤵
    PID:6120
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2958/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5436
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2959/ User=\"Everyone"
    3⤵
    PID:2388
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2960/ User=\"Everyone"
    3⤵
    PID:2808
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2961/ User=\"Everyone"
    3⤵
    PID:296
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2962/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1820
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2963/ User=\"Everyone"
    3⤵
    PID:4932
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2964/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:6024
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2965/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2040
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2966/ User=\"Everyone"
    3⤵
    PID:3716
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2967/ User=\"Everyone"
    3⤵
    PID:2548
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2968/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4304
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2969/ User=\"Everyone"
    3⤵
    PID:900
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2970/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:6084
- - C:\Program Files\BlueStacks_bgp64\HD-ComRegistrar.exe
    "C:\Program Files\BlueStacks_bgp64\HD-ComRegistrar.exe" -unreg
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2948
- - C:\Program Files\BlueStacks_bgp64\HD-ComRegistrar.exe
    "C:\Program Files\BlueStacks_bgp64\HD-ComRegistrar.exe" -reg
    3⤵
    PID:6048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4532

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:4340

C:\Program Files\BlueStacks_bgp64\HD-Player.exe
"C:\Program Files\BlueStacks_bgp64\HD-Player.exe" Android -h -sysPrep
1⤵
PID:4228
- C:\Program Files\BlueStacks_bgp64\HD-Agent.exe
  "C:\Program Files\BlueStacks_bgp64\HD-Agent.exe"
  2⤵
  PID:5712
- C:\Program Files\BlueStacks_bgp64\HD-LogCollector.exe
  "C:\Program Files\BlueStacks_bgp64\HD-LogCollector.exe" -boot
  2⤵
  PID:5924

C:\Program Files\BlueStacks_bgp64\BstkSVC.exe
"C:\Program Files\BlueStacks_bgp64\BstkSVC.exe" -Embedding
1⤵
PID:2956

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
PID:1916

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:1668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bg.pak.info

Path C:\ProgramData\BlueStacks_bgp64\CefData\locales\bg.pak.info
Size 378KB
SHA256 81aca701fd815152b02b60d814f5df72db4a70f43475b8bc97aa1af5851f4652
MD5 86abbe39a0ffe4e221c459d98a409765
SHA1 7ffa8bea41bb8c7b8f958681ec097556320d5482
SHA512 66b6a6f8e7f7d857a353244d372b684886830e902cf81678dfd2b8977f1007af0596e94d27e27c930309cf12b14cf1f1af0f292e7da305c58a44f9dde0e5aab0
SSDEEP 6144:AD4ozBJxUsTqmShsGXv/ejFlm+LFHkvpMhCb1o6+j5M63:AGVmOsGXv/ejFlvhTMS
TLSH
T12E847EBC693D226BEC280C8DC069AD139AD20D02F57B6DEEF0DD6371DBF1592016C996
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BST.ico

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\BST.ico
Size 56KB
SHA256 20888b643f8772afe892eb0c0763ade55d1fe00ebc77c1c3270e35daabee4674
MD5 0fc853a106d0f03247480f71bbce166b
SHA1 8d2752e13444d7d86fe8cb75b9c2f6e1c7dc66f9
SHA512 c7f21d9159baa9c509139363a59c5e7411cd10eebb4c22356385719172f2f8b799e2e3b96809ab12dc02baf13f766b37f1e185df91ed5d705df848577628a05d
SSDEEP 1536:jqiuc5jsCu9JmBBqXpem+5TxMJzoNvnVJqmsjz9:efc5jtu9JEPm+5Txj9sjz9
TLSH
T16F4301B09893D7624BB0F0E42A677DA27872C761242EB1C06DB7470CD4ACDEDDB67990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bluestacks64logo.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\bluestacks64logo.png
Size 399KB
SHA256 19ad14a63e6cb541fd080f1309ceb001f251b84d04f33a472f9d97d500e324d5
MD5 6a59bc14b08412453977d14e26a5b7e1
SHA1 adbf1af2d83546af91504ab12730fd4915d37613
SHA512 25ea0920172bdb28f19fd606bfd46bfd2f108e97cd856f3465a0c49c447528c03cb9a97e80bc990fa599ca1b59587dd6b4a0f319dcfa3ee579b304313278356c
SSDEEP 12288:fWl2i+4BEpHcgo6PxNj0Epv2AWFtpnm/g9q:fG1MpHl0XFzm/Aq
TLSH
T10C942343A6A5A37691027D7F5B670DD2214231FBAC8FC45D179366AAB363AFC0C30E64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfgmenu.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\cfgmenu.png
Size 403B
SHA256 6b0946def5b70307bbec919ac982c5f6ac96c4ba45862171ded74981d5665f8d
MD5 4fc05d5a67cc909664633bfe5f03d66a
SHA1 bebbec081c9499967d655f2eb3dec1e85c8d6601
SHA512 f5d8923d7be5174d5ec52fc1007966f3a8ca1d52c75b4cb9a9c08f51e11d877d998064fd983df29fbf1e5f102b965cb4a988e260fa2566dc175a2fc30ad87951
TLSH
T1ECE0CAE302B809E5A0F80713EF55E24BBB650CE51122D51F20D7C8ED3701551F6863D9
MD5 SHA1 SHA512 TLSH

Submit Download

checkbox_new_checked_disable.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\checkbox_new_checked_disable.png
Size 1KB
SHA256 10b92a13277279712e374174a2fcf155510ee7eafcaaa030cfc37611668de7c9
MD5 0eb9bbd689bf9e0895d53da6b11a88fd
SHA1 5ec559aaf2dc3264e0c4122f8a9811d2ce0c2b7d
SHA512 8e0f8477249a725e2d07b4f9bdf59793abb2210022a8e5e9bc0e00fcb22de2d521bab2d959e27f676d325409f8cbd1700f705da05436a6b91b8a37bfcb4994e5
TLSH
T1E82116480264883E860E24A9D30918D36CF70A15DA32AD4F80EFF8AEB1D7884688421C
MD5 SHA1 SHA512 TLSH

Submit Download

checkbox_new_hover.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\checkbox_new_hover.png
Size 863B
SHA256 36b54d6ae5b87e55af2ee26bba025d3a5f3133657998d4d78c78d563f62cd54c
MD5 bab6775bbc3d80026b889f24c7e5a3ac
SHA1 cc17c00a113bab998b85a19751fb78e587d766d8
SHA512 6379a66af7a3aff49b44d82fe7c61cd399b6d3cac7b523eeb8af27b96be427231396ff9955cece1daf2953777fcf3b3959e850417e10277f38ca9c7092117498
TLSH
T15E11DA5053743715C8DC9EB39DE323D1281C40844B26104F674A2F256FE63442166B33
MD5 SHA1 SHA512 TLSH

Submit Download

delete.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\delete.png
Size 460B
SHA256 edf7a461e295ff48c33d7ee61204513f67181531b2e01b8e4cbec9c2cd5ec143
MD5 221765f7635dd6bd4ae06796447cb9af
SHA1 a442991ea8942c212d3b4f591baeee555193a76a
SHA512 ff8e5caafb02ccaf716b3ca39d62609ccfe23f867cbfb64a502c7044609d3dc1c5b09e6bdb7fbb74447ebd85991fe459542affa4615d83d36e153c83a1608e28
TLSH
T1F7F023C5B98C399DC3ED07726117DE942C75F3515313600AA44840F8A8EB5880BCD28F
MD5 SHA1 SHA512 TLSH

Submit Download

detail_close_click.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\detail_close_click.png
Size 738B
SHA256 cd56fb7c1bd56c5e87e862c0191b01cd038c8533bbb0e44eea088f6f1c7f8fd0
MD5 08d506e36623df893269d028eda3bbe4
SHA1 d60b4424b235866a3c2f5c43676a7548fc01bb64
SHA512 a515f8cb1a7828db5ac141e5c949b18e0e2303d8e46b0a0edc5d660fbc01bc2182fabe390e2d2c6cc083a27333af08ea6207f60d0e512ef2f46f158defb311ce
TLSH
T1410115D4366C8F4DC7CD6A778D540B10C9B0855AC489A817461508618958664BA5BB96
MD5 SHA1 SHA512 TLSH

Submit Download

download_hover.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\download_hover.png
Size 651B
SHA256 80fc1da07641210737bca101ea944b17dd6fa6e0e8b48371674bad1161ea04db
MD5 f4cce6dea23354fe3afd3072f0375e9b
SHA1 1b422d7f06640a90eef80b96d4f7b15e79b00a9b
SHA512 b1afaba5d3b0a94ce6007b1ffb22cbfb6f788d2512dad6e07b73ab9f7ddbfb7abdaf090b0b1e11ae36a6bac7775cd862d8557006584017ce61d4919a8bf22a18
TLSH
T194F083E17480056E102B04B2029F20C1FA960BE06F23E01462AABD2E3D684CC52DF012
MD5 SHA1 SHA512 TLSH

Submit Download

macro_delete_hover.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\macro_delete_hover.png
Size 543B
SHA256 292bdcaff65cd06c2504df06c5e9f585ab052d0412647a5e60ffd8b46dd6d878
MD5 401aefb644329e4bf96b51d82c298771
SHA1 0caffebd9fe19f280e481d0fb48fceb41e083c32
SHA512 307a5acd3bc9779e4f2508c5ce0726f0885a10ea910f0246c43510a06cc98bb6a32b8b8f9037ffd07913d3f94aff322559852145634afca9127d9cd357078d0c
TLSH
T1FDF0C0C3FF10777FDEA75062556918D8CA33056217214F2D408FA92E5859C4365AA4A0
MD5 SHA1 SHA512 TLSH

Submit Download

play_hover.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\play_hover.png
Size 647B
SHA256 68e5dde8463cad74867fffb9fd10776eebd53ae155edced63dfbb2be8dc6d110
MD5 fd0daa546ef5ab4d185cd3fbbae04d36
SHA1 840555c05f510e3f63cfe2bb5f79944a70941d8a
SHA512 b7d087c54a9fc3f564057a58dfa5ae064f79b162de0deb633099844a122f35a333bac860bb632faefac85851a1f152e02ab0098c0bff6b86613ef9f23b1e52a2
TLSH
T187F062A88FAD7C2FC10FAA37174BC3A11CF1D8A0A4C0112882F30519089FB82648472D
MD5 SHA1 SHA512 TLSH

Submit Download

sidebar_back_click.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\sidebar_back_click.png
Size 554B
SHA256 336325dfbf3f7508f713c4f2411dc191f2a37575b1abf25d8de5699163d77120
MD5 17c7c1b5b876205c62866f5ac44b9024
SHA1 d06fa430ec93e4c8e8452168f0acdc8f06fb57e5
SHA512 8b09984b99b25a6293654d95be75d791073cce613657abb9f747378f8e96fad3604fcddba67f8eb0acedb5baa5127afb595642adb394df724b9ff88bdd9eb9b1
TLSH
T1A4F020C76B4EBEE9DFFE5DFE6D5F7E62082500191092F029864042225772626104523A
MD5 SHA1 SHA512 TLSH

Submit Download

sidebar_volume_hover.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\sidebar_volume_hover.png
Size 1KB
SHA256 ceea342e0ceaf05f11ce22f602a27019818b02a4799e65d102b5c2e55840317e
MD5 6a62e740ce694e59788b8e78bd5b8fcf
SHA1 f12673b4e56031ead1f618f8bd2b2f01d4395768
SHA512 3820ce2d6303dc727ee7f6e0f36eec011676ba80281f61ea12a68e7d8016eff9ff8fe3bf3cd5ca96a3b0627fdeb7f5739b87edb45ba304fff94be55c3409936d
TLSH
T1DB21B8D81757ECC4DDD25C76039B9BA39CADD3612A12E15830E58DA8245C590AF45F13
MD5 SHA1 SHA512 TLSH

Submit Download

sidebar_volume_muted_popup.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\sidebar_volume_muted_popup.png
Size 1KB
SHA256 3a0513f1285dccf50805e78f277d130a6cef376b9b6b92dac53d56d1dd718885
MD5 2d4d5ec22f348ac53cadf6141735fc0f
SHA1 1e31b410733eb39db45e9fd63b33d320256ab66f
SHA512 6d3653c07efed39d84c78d74725f57e0313f3f5e1ff90ed7fe728870ac46ab206cae2ed011e8eb3b3713e7ac38f12bbdfcb4aed338aac4841351d72642828bd3
TLSH
T1A221DAD177A54CACCED636351B9B802A673321694A17134821C64775201BE47E119B23
MD5 SHA1 SHA512 TLSH

Submit Download

stop_icon.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\stop_icon.png
Size 378B
SHA256 b143b98fb6cd9c4bfe80275c2e46b6c940783feb04f1fcaac64f2158e2c8e01e
MD5 867612221a76c4f61d0fe7d1f27a10c6
SHA1 9c9582ba9f41ba4a7edfb79a35eb8bc87123dd93
SHA512 4a2da5f2db865344c6aad2daa263b9615b90ea7100f7f01b0a7843d116e3940d12267a8c4e3cbb33e88f5338867eeb0570e337205e9e93028cbc3cdfb57c00ae
TLSH
T10AE0C0A6A3F1BC24D05A0A3B91A3C6E48CBAC3570025AC1DE9844AAD0D4A6C553B3752
MD5 SHA1 SHA512 TLSH

Submit Download

stop_recording_hover.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\stop_recording_hover.png
Size 362B
SHA256 9b9633447787f1a5aed01c5f3300bf28cc551a13fd4b6c5536be0edcf5b6d8d2
MD5 5241c549c08bfa5b9401eb6a038be983
SHA1 adf17abecef8ffef98fdc6f0b90b67f6f6d0b0ce
SHA512 cae122559e30c243bcdae1265152e038caba12dc8a9ca0e32fc2a74495a93bd2c36f3412411be7466aad6eb325397ea3133d48651d43201359f86dfacbf26af2
TLSH
T12FE0C0D5024CBC5CC9881D3682D7C3A17CB1A2EC4220000582210B249E69141A8D2744
MD5 SHA1 SHA512 TLSH

Submit Download

sync_operation.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\sync_operation.png
Size 1KB
SHA256 ecc13aadc197aefdfe8a250c11501521cc565a176ab123aecdb2278ccbce9b71
MD5 b56161f3e72bf6b8a7d5d6d7c73e47a3
SHA1 872bac8c206f4863e1fe3f26498749a89f241942
SHA512 2fbdbb72e45b796ea60c19d07dea412de09f095da5a9a2e92602cc3f1dd18af3ad70d34deb3c462caa480656d5ce1f517f547fdf303af9703bcc3d274dd56fb0
TLSH
T12E21EADA7963126F08AE071740473B2C5B735F8C49B4303AF55BC10F2543B89211623E
MD5 SHA1 SHA512 TLSH

Submit Download

volume_switch_on_max.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\volume_switch_on_max.png
Size 1KB
SHA256 46bb73578d5dd30e46d99d945c29386bb25a1552f3dd239c0c8eba4fb087ab6c
MD5 f9c983c77409e5c28f5772d5bd6ffb8b
SHA1 f74d057b3530ca8a25a94d27285b63b5821fc97c
SHA512 7bd948a4fb2690747a7f06c415e7f74b8d3f7581f53dc4ccea8e87be7d8b4f9f2fef53dceca3923c91829d7306ec6453ef26a17d89406a22020682446b39a093
TLSH
T1953108D7011479FAF696B08684F6B542B0E5A1D217A30E4992994008284A23BAEE9FA3
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

7zr.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\7zr.exe
Size 722KB
SHA256 ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d
MD5 43141e85e7c36e31b52b22ab94d5e574
SHA1 cfd7079a9b268d84b856dc668edbb9ab9ef35312
SHA512 9119ae7500aa5cccf26a0f18fd8454245347e3c01dabba56a93dbaaab86535e62b1357170758f3b3445b8359e7dd5d37737318a5d8a6047c499d32d5b64126fc
SSDEEP 12288:AwAxBpwU5gU+2/9dB5XlH1YAEa5OLW0TjLWG3rn0Yf5ogmn9X9Rf6TIALr22DIVM:AhY2gUfVH5XlVYzagW4/3rn0Y5zmzRfq
TLSH
T177F48D227BF6C0B7C64211318A1C6BF690F6F3190B3059C367908F6D6B399D5D63AE1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

close_red.png

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Assets\close_red.png
Size 15KB
SHA256 d0b6d143642d356b40c47459a996131a344cade6bb86158f1b74693426b09bfb
MD5 93216b2f9d66d423b3e1311c0573332d
SHA1 5efaebec5f20f91f164f80d1e36f98c9ddaff805
SHA512 922a7292de627c5e637818556d25d9842a88e89f2b198885835925679500dfd44a1e25ce79e521e63c4f84a6b0bd6bf98e46143ad8cee80ecdbaf3d3bc0f3a32
SSDEEP 48:2/6FwMlYk29WJsEvkch6/Clu5tlL88Lem/fLu5A/luaxN+Y97sc52G7Z+EazEyIc:2SFvYkEWmDCccHAxNX7sc5dZabT
TLSH
T1CA625065BDF075A65589F5322CC564055C730B83DAC09C88FACE5C2B6F01BEA9C1F58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_bg.png

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Assets\installer_bg.png
Size 3KB
SHA256 a54a2aa89521690c734ba3d4f462f23a30ae3e4c4565c2b0a2fa2773ee6aa284
MD5 8cfc6f680dadfc9ecf9fbb04492fda1b
SHA1 2ddc23d9bdd86606662a8645b7eee969bd6ed155
SHA512 9597083e15bb3fd693bce39b33dedc8e865b9fd75dd60c32d2ca8660443e5b7bf5efc69b5a745797aec59d2b6bd91c82f2472d0395c9986eba5d9cb4ebc3e6a6
TLSH
T1496187DDB2618240DF5752F504F726DCAA5DC8C402CB1F0A36088F534FC7AB89E516C0
MD5 SHA1 SHA512 TLSH

Submit Download

BlueStacksInstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\BlueStacksInstaller.exe
Size 168KB
SHA256 daea9478f3d0934fcc3108d6fecce82a40a9f2eb6df8f81bc9054975960f1ece
MD5 1292297da4596eef979ba3c77a3d0bcf
SHA1 21f0df5cdd507c9263de3951ded9b01c99642c04
SHA512 be6a0dc9079a64642b0a49319074470b7e98fd91e6193ca0798ef0f98b56a0dd0ebf96de2557d73f459a75c0b0f8d89a4a6a0f50eaa50fd8aa690ea7021c23c6
SSDEEP 3072:Q3Da7OQI4uhBBTQLqk7eVpcrOZVB+IDsktMNNudv94HD:Aa0HAqKQpKHj
TLSH
T191F30A4437F88928F2FF5FBA29B245154B75B587DA71CB1E0AC3049E0A71740DA26BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlueStacksInstaller.exe.config

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\BlueStacksInstaller.exe.config
Size 392B
SHA256 4b7df915d706af6459c38d75b09c5e14f951842ae0678078400f204ad1c7a7c2
MD5 ca0a329097316832e4a6ea5d870c9268
SHA1 4a36b93361d3dc9df9b00313f2c2b394be9e1e72
SHA512 51f9a874e84f130be4fa29fcc4bc934105318234b5dd9ceedaf569e3f0e6b38e29f3bec056044724476ae24295a510b16d8a737b994fd6f1268609defa315271
TLSH
T1CEE0D81559D8FC2B5EB34B13B6228566EBB0E3D651A45C08F4DF69A30A3308A6B97331
MD5 SHA1 SHA512 TLSH

Submit Download

CommonInstallUtils.zip

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\CommonInstallUtils.zip
Size 7.1MB
SHA256 683bad378c1946a0eca9e39150b57fb3f4086fbfc9098a6951f676109e8b8384
MD5 e4da7c1e1843faebd6db452e39ddda78
SHA1 061477c6154bdad2133e60d4829bf078ae01e1fd
SHA512 2179b93306ee8008bbaac7743fda3098fdb0d736cd207f234af61a7f60eeb92f6185d6d51ce106dfd036d6c5fbb9237dc998efcff78618cb569fc152f9846fd9
SSDEEP 196608:8ez7HAe1ROBfgUACTBC5zMoQlSTtiVwcAtcwbbwnBY6P:8ud1App1V15UiFAtcwbbGBYI
TLSH
T1927633569D3B4BDEFA3B93B872A34031F9AB4BAC8B344444645B2B44C433458769EF2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD-CheckCpu.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-CheckCpu.exe
Size 133KB
SHA256 746aef1025c7cdf9eae0d9e55362d0230a8e877f0d6749ae39c53d730287eb36
MD5 fe2bd5b8dacbb0e6509ab71640979a12
SHA1 1ca2c7713c0dc75e0fb071d068e7f898a5c90085
SHA512 0cd4300a71af6489fa85ee4701d583cb73f1ffc41a850b4245b0c73a892000a754548c91e84c2cde01808c1913f4bfa0e7b2263da7af297163d11e7409d2a832
SSDEEP 1536:HZCLaBoTQokfWF9ATfGWOKbunAi7rsMNzONZjLsxt/w54hX1AivIiRdvVWXit:EL3Qokfqof/bu/fbxGlkwWhHvdRdvVgQ
TLSH
T166D38C203581C432E5A32574CAA8DAB6CE79F8700B7468DB3BD8567E1F697D1AB34307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD-Common.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-Common.dll
Size 1.3MB
SHA256 66508bd97f9f0fa3e3a1c17e438a5691b6697dabadf8e6ef7b9c52ffd95d337a
MD5 870a5e8c5f420bd189cee54f781d643d
SHA1 bcb56596888f6b67af70f33314a6935f3ab8a1b5
SHA512 c149c89b531a20d87918fdfc29820ed9b7cc555ae7af4516a2b0dd5dde849e48ac9c11ac39566294ddb7e64c61e4cf291dc76b12e5866baacada2885a1764248
SSDEEP 24576:ydjtqkx/fmBmtDITTucWtWrnngnnnKnanxN:y/GBIDoTucWErnngnnnKnanz
TLSH
T13155170037F95918E27F1B34B8B302B14A76FC52AA72D75D171079AE7C62B409EA17B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD-ForceGPU.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-ForceGPU.exe
Size 152KB
SHA256 1570d708a26ea4d010ab1416d10be1e5d0f90b810eacdd575ab039dafa7541a0
MD5 f07020138ef4e95df341abee6caa7a31
SHA1 b5f68bc03061f38132c185305da67a54ba16727d
SHA512 7cb3f6c8c24e8c485247d36a42fdb13348a822248648cf1e48ffb2d8bc3648a6de2e032ecb9ea6bcfd632e8c5b6f7c29ce96f51f08968d3aec98403a32152b83
SSDEEP 1536:wfaACJ1h+I2FudMHvRWhHn4FnXqDpu3jj/B44S26boc95vHWXi:1QI2FumqH8WkTjxGbt95Pg
TLSH
T19CE36341EBE132DCD8F9D278E6166095ECB13EF4B31766C70224AD118FA6EE0D639721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD-GLCheck.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe
Size 558KB
SHA256 e06542bc804b9af6818b2c5c4069bca8bebf5c60c4a73aa136a4f373c6161015
MD5 371d3180920f91c09ce70360226502e6
SHA1 b3d6baa6f4b69f0b3b178e849213816ab42861d5
SHA512 20de798b1bee2b52300250e66bafc3c5a5721097e83f2b2b59d6fa4468da4395b405cf69435dc2bd37cef9aa43b3145967efd357028d1ffbbd4f54463c75f425
SSDEEP 3072:UJwEbIGMK9i5OFiBStmLxPEn0nKc30f/BnR492ZajH+PeEkgy7Mn5lYKt8ZZaMt3:i2K84xSJ3ELcLeR0sEZZzLIV+biRCF
TLSH
T117C47B9577A817E6D17BC13DCAC74B1AE97278111321A6CF019842BB1F13AE82E7F721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD-Opengl-Native.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-Opengl-Native.dll
Size 3.0MB
SHA256 b2c9f4311001620d0380c82ee0388d1fc3ed1476e1f3096d6ea140a7ebb57d36
MD5 6af4f0b517a13cbd43b093278fdafd68
SHA1 7cb6bca1e60d7272f2dadc6d4751af79d8189325
SHA512 c7cd87a96106343afb6bed30c6ea2bed2dbe6cbf78f866d1a3a677a53e73643bb932c42eafcb87e5cfcd4e202684cdc4924f10201a4e36b7d8cee63248eed42e
SSDEEP 49152:Smq7Thpz6CSgFOiqpFKeUTRkVZYUjIUIiGPKdzd+KtSbZMMGOmeuZ+iCdNHOP0qy:Zq78gFOiqpFKeUTRkVZYUjIUIiGPKdzW
TLSH
T140E57C4A36A89095D177817CC9C7CB8AE6717C094B215BCB1594A3AE1F37FE9087FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i18n.en-US.txt

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Locales\i18n.en-US.txt
Size 160KB
SHA256 583fbe72088647ba9a676ebd1e72f138b3a20f83b9108dbe46f0d9a02148568e
MD5 a06c8b60062eecd6973ed82dd925e49c
SHA1 71a3d5bcfbf04badc5544af54d086a6260c3215f
SHA512 d87a6b8d2c55cef20120628f6bff8a55b08bcbd0854f3bb51c7d69d3776ab21db175ed40296c664a00ae302fd43dcd69d522ba2d01ea9a85b85e7d40200c531e
SSDEEP 3072:GDdbOhZj0bNwXbwx/fNFgO/xuGKQqLkVwKsTs62oINEJUml+V7sxQwuyt93VsdFW:4db0ZAbNwXw7fxdXVzokEWmljEyt93Vn
TLSH
T1D3F3B06292BB368E11C1A417D8847D09789B63BF3B6A6751286CAC3F36F302C933D55D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Newtonsoft.Json.dll
Size 493KB
SHA256 7181f80c0719d1d75417b8360113d4e55ad93cadedd8a83b4c1869057072c5d2
MD5 9af4748049bd7808a7b5ab2e7d4d4e17
SHA1 342c71611e85b1a2468968ccb0ec12d2c7ae04c3
SHA512 96e286bdc77a0ae7015bc33f31f9379e7a06560d98b0064f9eb559a0b13fef7efe3e2f0baed5a968a6fe91bba5bc163bad7c9f5f490fd353596d6ae35e3d9c3e
SSDEEP 12288:EmKLDa2Tqte5+7OWpP8gkRCj7gBEA+PeKjJc:sie0/pP8gUwcBEAMeKdc
TLSH
T17BB4191133FC8F15E5EE2732E0344525AAFAF457A6BAD74E69419ABE2C93B408D00773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oem.cfg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Oem.cfg
Size 1KB
SHA256 6fa780202167b0c078fa6e68b788861c8f9bdf5c0aa063b35b41e2764d45351d
MD5 9fbf7921df333dccefde278b2a3baadd
SHA1 8b956fbd5aff23e30f69aa9ec1b3ec74b82ef52e
SHA512 10ceb436d08bec055e39977ba8500858b6411bedbc35beca0e69aee061d2956e011344b1d60c4e61ef0e96a61fda70f85ba50d9af5be464a72a2ef96bf597200
TLSH
T12111DA2E3BE03576F93BA327E8CD4612AABA186A746338309585844E6CD0F1513C680B
MD5 SHA1 SHA512 TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\d3dcompiler_47.dll
Size 4.0MB
SHA256 6bf1b5cd6cf5316493a2419ea7ecff44de39c71f226cb1b0dbe18e940f3bc988
MD5 898b3b792574a266c0f60a87244deac5
SHA1 af5f4d815d21f2272ce64a7b414086a6e7eb599a
SHA512 e1ae86e56a1e6f7d0b00d33667e01afea6b1a65013f9247a2a48ed118a31ed01ab1c51881c246378bcd58e6584143d7b81806783cef96c6251a23ca4049cecfb
SSDEEP 49152:2BfmqCtLI4erBYysLjG/A8McPyCD6hw16JVTW7B3EgvVlQ3LAYmyNOvGJse+aWyb:WeZevVKACOvWYQd
TLSH
T113167C46B2A440F9C1AB8139CA5B8717EBB07814173497EF12909625EF73FE16E3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\libEGL.dll
Size 402KB
SHA256 78dbd96e1b2b105030fb50457c1d720d1373558428c980960b4e3b88105ed2af
MD5 948eb249b23a9487d15fab236e4a2805
SHA1 ab7db3e961f007b5b242ce01f8183e197c78a571
SHA512 1510001a8c4e3875dff0b16a77028b35d9c3491c7b52046c0094253165266246d7531c538023a99d57999b41f228175423220acaed9fab1c1857b067c1577782
SSDEEP 3072:kBIQbANn+FUWoKdyx+FZ+3xlGy5UrYfInPePjFP5f+HCTzBz4o5m4O4iiibvBBYJ:kuEOKUoF2BLP9ZP6o5crBBQ6xWhQW
TLSH
T155947C56F79005BAD17BE23CC9634B51EAB278591721E78F03B803AA1F133A1993F725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL_translator.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\libEGL_translator.dll
Size 3.0MB
SHA256 adbf8672d18ce63ca728f24f802b4f7e420cb307ad9e8efb54fd7a87a6975df6
MD5 5e717c3e8c4ab79ccf21017cd743d4f3
SHA1 769a3232bfa49927ee8d5e5b7fb26c1c62815869
SHA512 b773e52be4c585bb946d31052fd74266913080625f69f4eb1ac0a8945fa7aeeaefe1b6a3e6f25ac1482151a3c7cf873cbf5cf44bf69778405fe550db72f25d91
SSDEEP 24576:BzhfNKYszRP+ZvhcvKV0bjKDF3BeWJEuzsq38JhoHVLN8hmv1Vw5hDwZ2+d6418:BzBN2zE0OF3kORgoBv1Vw5dwZ2nX
TLSH
T180E56B5B36581199E07BC07DCACB9F4AD6727005072297CF06A443AE2F67FE909BE721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLES_CM_translator.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\libGLES_CM_translator.dll
Size 3.0MB
SHA256 d1f6e10fcdeb281a79afa90832352634c346e322b19253efaae95b526f728e0c
MD5 46ef9bf67aa4cc25d1d9cf50a777c6f8
SHA1 2ee8be9eaed99089a2063067e1f8c75bd5ee9a0f
SHA512 72b5d76bda749ed0441342d73e4478bad486f60cb55db29531d97739c0ebdf9e5c33f3d13c6e79a67b52c292810cee2a1730cbe7270f77349a0808c6a7c6db93
SSDEEP 24576:X9QQtu9rGhdOyGqr1t1P7cmuGy5C9krEQTeUzG3KJaxi8ajc5UA9E/cbFr6NOqRU:X9QkerGiq/fGeUzJc56/GFr6NOqnc
TLSH
T1E9E57C5A36981199E07BD07DCACB8F4AD6727005032297CF05A443AE2F67FE91DBE721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLES_V2_translator.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\libGLES_V2_translator.dll
Size 4.6MB
SHA256 17347ae4ca411848fa95651425665415e366ed4e3f0611268fff14481f85b475
MD5 bf03cc3d46bc705e1d0b592a76011e4d
SHA1 9fb0d38395a1ad4793a9aecc3edcf85f28006593
SHA512 f9f0be2684bb78da14b49de18c224be2e33d8523a06a7753db16d246a2c52b58c8e8ea37632dae7275af503aa151915ef3d4c874f727985c47ddb3720413fa2b
SSDEEP 49152:X3BdXh/fnBXoIVTCXuC5KbS84PkAsDwEMvuYXPBV6:n59C5suzsALr6
TLSH
T1D7265B1B32A8119AD07BD07DCAC79E4AD6B2740603209BCF4594439D2F67FEA1E7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\libGLESv2.dll
Size 4.0MB
SHA256 7fe01a2b5c197c4604f37dcaef9cb5136b3a2e05cdec60ba06e3d664c58bf1c8
MD5 c9c69793844aeb22784321c3458b33dd
SHA1 8d900d6238c61b129db9288a71464c54295bff77
SHA512 35a3cf14c7c4942073b12e903709410fbb12cb65a160dabd1a14e1641b78c3ed144e5b2d159e2f73a9ef6820f16ba476540bc6689d16cd381f4c0b665d2c5e92
SSDEEP 49152:gHJnqf2NnsNicg/09uIciO7IE1YDNZvvxwpsROHkZ+Au3r7PZuU1WeGip0tTlc+s:GbNnsNo/09gYvxwBD3ZF9i/8Duc
TLSH
T1E0165A1B626900F9C1BBD03DC7576A47E7B2740A4370A7DB02A0466A1F63BF16A7F325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libOpenglRender.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\libOpenglRender.dll
Size 2.7MB
SHA256 4f625456e727b71a7dcb58e39365a408a312376d5fc0dd01f3d11c5b17c86bb8
MD5 8623c1b8a7bb5325e16413d25ffee60c
SHA1 9b8956a1ecf1fb243307b2f0be775503e6a7c481
SHA512 7ccaf105870b472dc5e35a4f0a23ffe39514cb0351dc75f88b1155085bbdb90e287cc779205ea8154e9c0bf8a409709808142586c15141b96224d21fc45002fb
SSDEEP 24576:6Q463DZYOWi5M5ILRsRBFGjxEdhi0tmJrD98v82lNBP:v4EYzAM5ILRsRfGSXXY082FP
TLSH
T13CD57C1E36980091E1BB907DCE878A4AE6B17C09472066CF38D4639E1F73FE9197E761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shortcuts.json

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\shortcuts.json
Size 3KB
SHA256 8b0c21074ea772ed1bc0d75d254101b651008eedae88f4dc7c926722e5966857
MD5 dee9409d0e559cdb1c5b97a3b98f526a
SHA1 cc0abe1b145fc444cb11666ced2ad95a76d4e20f
SHA512 d5d2cef69388b4c32865c254de4e14e2d518f02aa9b0b4481532ea098ed12dd7114e82c603a30a79d46846513fe1b02da2a34c49001c9468609860164f93c0c7
TLSH
T11261DF37F6FEA3F6019F12B110F19856CE1FD55A61469EE4F3089F0671C25280E3DA89
MD5 SHA1 SHA512 TLSH

Submit Download

ApproveMount.i64

Path C:\Users\Admin\Desktop\ApproveMount.i64
Size 447KB
SHA256 2ee67dc39a3d050afe7b4106e7058b2bea687a4e168cb1cb63670f4afbcf57e4
MD5 0021a86ed49100aea80533636582b4bb
SHA1 12221ac143f3fce96707e93fb6e15a295f433ad2
SHA512 5c53f0e28a5822294e1f0aa6670d6432e50ddb849901c3c75362e4f08b08048ac582fa3fa43b3cef17c85505654abc821c4657c35e73fd91751ec98f1b98c289
SSDEEP 12288:NkpUPZlbKw4YyqcwS1smNsgPRLCpQhvsIKgYvZvREaq:NkaPZlbSYyqU3PRmpQhvFavZv8
TLSH
T180A42300600817DB3D682942DB68370F3E6A31790DBE6EAFDF66F76FD82129759401E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompleteRequest.tif

Path C:\Users\Admin\Desktop\CompleteRequest.tif
Size 358KB
SHA256 b0710db1e9a1d9938ddd6d17336b038e1a824ab78b22dd2d5abcdbda3d20e053
MD5 b5b56058cf9cff6c54902068a1b55f20
SHA1 65d2cc3ec2ded965668640adf22d2df7726a8735
SHA512 04327d68d7297c037780ddd7393ecc8e4ec65c11889348a77469f52b9718bc13f3bbc5d519ce903a107ac2013cece2c3fd64e5de80f303afd916971dcdc64666
SSDEEP 6144:emchpbr6MUr/sw6vx3MslBway8KyYkAlbn9pQbY4QFV9Cxl9IjHU/L6smct4Pq2Q:emwb4r0waBc94gIH9wHU52yHll
TLSH
T1D374237ADAC4DE3A6627FFAB676C084CEE0118ED5ACD9231F05095301F262B5F7025AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConfirmRemove.hta

Path C:\Users\Admin\Desktop\ConfirmRemove.hta
Size 215KB
SHA256 c5c41699260fbb9b28522e9732a389ff427b9a4bbf658201d0fef3570742a646
MD5 01ed495f0b20bf570881c4a959988a6f
SHA1 51cd5b2c89ae795b5599da5751ad5fb13c34db17
SHA512 19bf11395ee4ed272e778a1f86b97230f70d994b7f3efcacbbbd28f8ae3955e4e1d074fcdf3ff81274ec3ae37b0ac2dc1d36618068754686d276059b5a1e9a6b
SSDEEP 6144:KJa1vV26pNP+9oDA5qABNSI6Vng88fAODvQrClF:KJuvH3+9v5HBNSPg88fAODSClF
TLSH
T1FD2423768035E7539D2FB997CD24538BF41312EA3946FB203AB680F2D615F117661B38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConfirmUnlock.temp

Path C:\Users\Admin\Desktop\ConfirmUnlock.temp
Size 179KB
SHA256 e9b40f69aa893b7e1997232fc5cffbc5c7e2383abc8b17eeae71a44d67ba3f31
MD5 8225ab4902550f2537a373bc7fea9cba
SHA1 852e7957e5755e1c85139755fbfc0ddbc8562ec3
SHA512 93cbd5013c696ccec8eebe76a4f3665b09c906bce734f43ca1758b6308fcd40e9a2fc07a1fee60c5975fe66696d104c1f74bd1539b84ae502e3b94367fdd63c1
SSDEEP 3072:63pRaRqMOOqQwmV5ralviFk3keB9BEvmERT9Y391PS5mn535SDed5zgjvJKKqzIY:63+OOqQwXlviS3ke/BmRRYN1PSs53UDs
TLSH
T1A6042392909CE5414CB106A0C2E0B0D6DEBDFB138775AD5FDFCE522B1D998D36B00A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CopyUninstall.rmi

Path C:\Users\Admin\Desktop\CopyUninstall.rmi
Size 304KB
SHA256 1f1f58a81aa7664971f8a3e6d1ebc34a9756f5c535a0153a5e2a9b6663fbf601
MD5 b427641bf7ff6a3f5fe82fc6256a142c
SHA1 1a0f876f65be47ae146ee5647f5433b71831d285
SHA512 8bcb56d6fe6c514d6289d2276fc2ce8f5ffd6c2703d52698efda3cbc4fdf0222a4930b5b93be39a593e3f3fa1a6fcc968da002c7078ec6b492dc1727eccaba95
SSDEEP 6144:e+RfZuozu9EoSjjH5ORxUnauZT2nfRDOLhWy:e+J0E5/Hg7UnauFhf
TLSH
T15F6423C29492E36DF807C51CE3577A5B315EB6CBBBC19752A4813D2BD9A31C078B39A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DebugClose.mpeg

Path C:\Users\Admin\Desktop\DebugClose.mpeg
Size 430KB
SHA256 322973e963c577d9775d6ea3e26a78c1f848b9bfaa5efd4e5d9eb20ce6588bd4
MD5 e493ed8ebf6e6ba74b5547cb6b4984b7
SHA1 3efd502858e3896b76224ca3803e9692dd6b6307
SHA512 e8e482961d0031428edc56de92ad69717bf26d6debf6fe036714d0256e1710e471ff7ff68018b7eb6657c1453beda42d62ea3fbcd551ecf0667543dd895d6ef8
SSDEEP 12288:9FDAUE7/PBX07b+QQu9baBF6Pue6+nfi5fQ:fAUc/PBcihu5a6Pue68fi5fQ
TLSH
T1AF94233A81DEE574ADD3FA618D186F77F0A4591AEC3A52E43424E4F10EC4D9206E6CF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismountMeasure.wps

Path C:\Users\Admin\Desktop\DismountMeasure.wps
Size 501KB
SHA256 7ceac314d1b198052d7b2c8c10476b1df00240f9e42d75cb773b5a82c0ce0beb
MD5 ac4b31f725c2bc6a0ad31fa90e89cf73
SHA1 634348727c4a5621beeb3002f05634b56c8a2bce
SHA512 6c3ce117bb4744660368d339831ab32b411b78cc0007362b61f676e1014c1e0d5c8f5ec9953585d5f6915fca1787f4aa7ed085be945e60976bbe97cb0b974b85
SSDEEP 12288:6azgV5t45VPliYWZgtWcyw/aJq+8ywtoNrpaMXblnt:6IE6VdYZw/Mq1srpv7
TLSH
T148B4236D3A48F0CC91F79D18951CE5B860A32F7D545031A5A7A7D8FE3D85328B8F98C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnableDeny.txt

Path C:\Users\Admin\Desktop\EnableDeny.txt
Size 412KB
SHA256 64420a5e307a3824c01c3979afc545bc7a874483ac93c9dc9a79497a25b4bf76
MD5 b73b80c6fdf7f6c6ec95d58353cd382c
SHA1 10d98c7975eff11b333f2491a9a978ee2cc2cee8
SHA512 70e7e638db1baee5d95bf582a11fe8119306169879611a1c019026a88467e51beb72a60ec5c4464d3572a3eb9334280f3db723dedfa269511b28787bd2d03203
SSDEEP 6144:OJWTgwUrfYAYP/d7lYV/Ys3Ez1UjY8qdW35eH0rUBvnkTgbsyhD6:OJQVGw7lYV/Ys361U88qz0wBcTuO
TLSH
T16E942219A9BF3F3411A1F94A0F1B74C502A06DFD863D16D2F2894E99048EBF987467F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetRestart.xlt

Path C:\Users\Admin\Desktop\GetRestart.xlt
Size 394KB
SHA256 9113976b40ac37cc2d8d4810d55f6e841aec2badef5607e428bdd7c60b7e207f
MD5 fca93f7fa751b9171f3ca7ea10b3d137
SHA1 362a45d421a5afe7601abbb8afdd87e6e47fc5d5
SHA512 81c9edd104e6abe86fc99a7d33a71486983ac7bec8045ab4aed17f085b4596c3d33baca3f8673d5e2186df10948524e0476db925c2f660a21e5fad53a284772d
SSDEEP 12288:yuU0t8S5iz3Otqzz1u6hK9ZNkWfjuFQ/AIIg:1F5iLOtq9u6o9rjum/tIg
TLSH
T12A84237986CD0E3442728C6FD58730F4B2C1F1FC3AEDD4444B56883B4AAA6DA995398F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitDebug.MTS

Path C:\Users\Admin\Desktop\LimitDebug.MTS
Size 322KB
SHA256 4f1b3c58c8725e96238563cd927b20233ba4e6e45dd910a1b1aaa4ba02eb3b31
MD5 ad5fbe67f3c42b984dfb4994b6d4f51d
SHA1 985b186a2d77bb9fb7bc7b2abc19b8fa25a68ebb
SHA512 c696f369a1df9beeb7ce105bd845570f03d3999bb3585c1d2eabf2f4ba80f3914da57f8a741cf700d338bb0948d2e162dd2b7a52bdd9942af79b29a02d9ee53c
SSDEEP 6144:161d6K1c/V9/SK0Y5sGTmuW+5SFDN2pvYPNuL6QfB3wmhxsZ6DP8:01k2c/V9R0wSx+5Squs3wbo8
TLSH
T14664235A71BFB212B1484E71EE5A1CCA036E4C553198EF4B25D1D05ECBB9DCCA24CBCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestartEnable.aif

Path C:\Users\Admin\Desktop\RestartEnable.aif
Size 340KB
SHA256 85a53c054ec91c61588cc0ae1abcf9e0000d25d95f1fc8e7fbf03f9c6b195749
MD5 da6605d36d5486919dc2393f86039448
SHA1 50b6f99f26f46e50b98a721c224e516fe35d812c
SHA512 45b2345c4f7d2f50dce3c9e75aa26dbe9013f4317d88ce6b3da7ef53fdf9ec6ef0b9bf0a1b40d31c022d5c8ad0844a4fc77073624e4d59895200f372d1b7d62a
SSDEEP 6144:FuFKiFLV6Qomv7UUPEogZFn/ZSHHBTdEtLUsdzLHzoOCN0LTQYls34qMKPS:FhYd1APn/aHBpEtjJ4G8v5lK
TLSH
T1997423F1E11EF0161B0BEBCA9EE8C625E213672B42C65E0295021FC7FE8874665B4FD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevokeCopy.vsw

Path C:\Users\Admin\Desktop\RevokeCopy.vsw
Size 232KB
SHA256 17efc3817702ce49c387b16dfaf62c214ab049f9248105dd9a8e04632eb2ebff
MD5 56f5179683d37891bc365a6b8d75faea
SHA1 290df45baaee8ffad4701c1a0cce5ec3d426a541
SHA512 b7bfe4323f0a5ddfd577b6389843a435dcec268848a0499b7795cb2350aca780df9bfa98d664cd8cb0f95f259fc5f6271c23a792919eaae9c528de9c166736a9
SSDEEP 6144:yXASERuofCAe4EeV3mfck0VKEcQ7A02QBz+fXoSu7SPcRE:GAhXfCyEk3m305r7ARQBhSOJRE
TLSH
T1D23423B0304052D31EEEEB156387E4FEF1ABFB57F68CDAD088F614055155B29462C2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SendRedo.sys

Path C:\Users\Admin\Desktop\SendRedo.sys
Size 250KB
SHA256 bab18d67482b5b288b8f5a2bac7f396733f00788d5269d7180c0600ab91fbc23
MD5 4177f05c24b188abb91883441f3879a4
SHA1 d6c847f066550f124874890b34afc2f624a57953
SHA512 43590e3f6dee23cb266b3a3bcf7e7a14696acd24ae71e151d8ba1e217f066f30ea754f0489647a0998aa9101bf5cf9054e078fdf54b16d0233777068bc3ab59c
SSDEEP 6144:+jE0+otRmXwlUcqiRLjXH5BJBHM049ko2t5w1A:+MoR4wy2LjXJlMV2oSYA
TLSH
T1CE44121E3FD6A044FE70A5AB22DFFAB351659A667D90F55B330C6201CE200BDC5ACB49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShowGrant.wma

Path C:\Users\Admin\Desktop\ShowGrant.wma
Size 483KB
SHA256 2c836201ff1916c2951805b949b50fe80161d492c8bbd86635a6b4e855dbd7aa
MD5 342890128ba89c56e36ae42741b7e1e8
SHA1 d8421c2a5613c7617bf4f29a53a809f7b86b02cf
SHA512 e76b0d77e7b2f365ffc86dea49a27bd39a924ad9739187778a3298e761eb89bf842f8955b9997870fceda1872cfc65d98d4d08412cebe0f1aa39fdb7f105db6f
SSDEEP 12288:aVhfv8HdzsfB8FNl6RpgTlsUkiWOkAnY/G1dEJ:aVhXUgZ8Bhhslv7Ans+e
TLSH
T146B423E2BB661DCEB47D25634DA42A9480049058CC70E81CD6F2BB15FE9CFF0399FA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShowOptimize.html

Path C:\Users\Admin\Desktop\ShowOptimize.html
Size 698KB
SHA256 fbd93c366db099f452c45497e863f97254e242df1f159c771638ad6d86817875
MD5 5b962061931f36640f21f6e3b7bbc03f
SHA1 5294e3a0e2392c829608eaecef7a56672b2850aa
SHA512 1ea6b5fa131886e4736835111e9d36aefbaf5bdff39697fe250dd9773c5591a262a0d5294cad79aeac89180d269f50edcb02abb0d02bc8678954d4adb4fa82de
SSDEEP 12288:lCtpmfN9SuTWCnj0Dus/HwdvYimGwpL9xjfpGbGbjn+N3/qLO/ofpocg:lpGCj01HwNlRixJR3/cv7/4p7g
TLSH
T1E1E423F549406AAC1ACDDD469E334310222952237BEF26D0F799CDCDC7DE188EA338A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SuspendTrace.ps1

Path C:\Users\Admin\Desktop\SuspendTrace.ps1
Size 197KB
SHA256 09166a5fbe10c344b8d35e36c131b8b6cccdef37d1db742664c8e3205928e93c
MD5 aa9bb8d0e62ccb94ebbe51e15a42c142
SHA1 93ec0a45ec21861d0d0415f6a20ae69a14e74caa
SHA512 049a249114512e4a920e36901fc5c775ee17cefb8aa3024d835aa1361ce7db29eb61c0d57d6a9a71ab6aee593a4d8c0bc0f1919d4ba42487cfe72118a6cc53b8
SSDEEP 3072:lY7kWYLWgiz3szPciN8i2ukQxGxqYN23vcE0ScZ0tHJHcc2aNp8BmU0OXMnppfoy:MA03sbcwRkQxGwaOvnHJHcuuW/f+DUB
TLSH
T1F8142376BB72656AAB58139D127D8608592BF60AC81CF87B8E778040372B1D2273D43F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TraceLimit.pub

Path C:\Users\Admin\Desktop\TraceLimit.pub
Size 465KB
SHA256 e61d44cfdcbbcf98992d0f94bb1ea1b704b2d75262ff27897bd39f4902d288a0
MD5 627f40d09d60867255b233e34eb37bcb
SHA1 29b4531715202f6efe3c7c10a70ed39258e11e73
SHA512 e17fb72e91369db5fbd9ba343fbbf8413c91815aecb3868aae0cadec0bb5790ca8887ba934483d3e9b379bf98b670ac78aaa6b3c4bd19beb9e64febf0ef31f36
SSDEEP 12288:LYzX6+uaqHpsYpnUCqqIpXPQu9RTaZqYn:LYz/0+YpnUCvIpfRbTYn
TLSH
T1D1A4232BECEB5682DC96CC98E93CCB88C573ABE7F5095E27753B4674181AC6AC4D1034
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UninstallCompress.xlsx

Path C:\Users\Admin\Desktop\UninstallCompress.xlsx
Size 10KB
SHA256 12b289efd825f5e0653ef929f017a828e3e7ff3c6f5176af6f38746e6c82410b
MD5 82e29742b8454c4b8f9bf6fb9a964d85
SHA1 3b7d02e066aaaadc953e9b726edbfbdee481a16f
SHA512 84c324953d29c841ae46ea4322bafabdcf917c439f1ee1a963305a26c65b1b42046c7efd4453cd4ac055f5f473ee0bd32900a85828f2b18f48ea8c32fffa79d2
SSDEEP 192:wc8mVw+Ib3UGjth5aFUlbVvevUqzQXpS0yVIcGJ46uqaoSr:wc3C39jeUlM9z6pmIcGlaoSr
TLSH
T167227D4AC065A97DC327C87DC04F01E2774C7082A782215E7875EAEF6E821D7169B3AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WriteCopy.tif

Path C:\Users\Admin\Desktop\WriteCopy.tif
Size 286KB
SHA256 04e3041dfc5b8178de42a1c325e1ca9809b12418b3260094fe2fabdb27c7f49f
MD5 9f4015280a83784d734f1b0acd3e70fa
SHA1 5f2d3a158136e488de7427efdcabf35caa537859
SHA512 217e875beb705bac239c9490c33bbaf4f531ff1a94d7f908c98373715f80a7f97e59e5980b21bd61a9ba9de5666b6fd23d7ec315aa56b36b92d2e6917dca6a2a
SSDEEP 6144:flDAiTxpMP5fA0Bori1YilZ/0kkdmznY9q0hmQi1r27Ko+T1M4UKkKVkgwb:RAiTwP54fOB3pzoq5Qi167UTMKrVkgQ
TLSH
T12554230FD69D2A7A8B17C97F38BD886439353C695B0536C70AC9D849589633C6F324E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Acrobat Reader DC.lnk

Path C:\Users\Public\Desktop\Acrobat Reader DC.lnk
Size 2KB
SHA256 2002768be22cd6e0ecd9531f6d4e7e2bf0f3e174796d735a9ed6adb82898b7f0
MD5 b2158fa2b5eb4d517c3db1db2ec8c84c
SHA1 6eeb3fcb38a884f859d728d59b246335ce8b2032
SHA512 c9576c127fc3f4c30e67b07416e31eaa00408382cc2c483a4260837295ff3b81b2ef1ca8ddb5c256d0f14855887b25e960ef26d7903e547fde320d8c11738576
TLSH
T15641CE100EF60717F137DAF79BF11626EF61BD41E6099B1F008882470D61B01A894F2F
MD5 SHA1 SHA512 TLSH

Submit Download

Firefox.lnk

Path C:\Users\Public\Desktop\Firefox.lnk
Size 1KB
SHA256 7ac79a9d796f1c81e71e6582c0f268368ad580b0179e7e944d459274efbadb32
MD5 cb1fe9dc637573eb776452dc70f3fdd5
SHA1 a7491a79f90067e385081bd0811dffea7b3447ad
SHA512 f5d5de97f7cc4c8f0c7475f88f4cb5d791c37b2e682b47cb18f55d8455f02fa4c327f9abf8ca834983c9749c7964fd180b938e0f1b5500a4b5591224ad02a46d
TLSH
T1DD1199010FF20566F0F7D0317A71AB275733FD02A72A132EC28821948F7A2549829F83
MD5 SHA1 SHA512 TLSH

Submit Download

Google Chrome.lnk

Path C:\Users\Public\Desktop\Google Chrome.lnk
Size 2KB
SHA256 9fcfb4308eac64cf510519b3da21c11fdaef912a809677f8099012e055e52e03
MD5 24fb44366d8454443f39c8536850c4b6
SHA1 baf58686c7451f321e6739ae1660f9cefea9b7cb
SHA512 7acfb28e1386dab3e28d6886f0a5b7f8785209db72ff04316a367571580c30fb0a94e8ca2238931411cbd4bfeab28516dadc99057016f572c83483bba2cda2e1
TLSH
T1D54176023BF91719F2E39671BA333B220F7BFC07A614571EA08582480CA595468DCFB7
MD5 SHA1 SHA512 TLSH

Submit Download

VLC media player.lnk

Path C:\Users\Public\Desktop\VLC media player.lnk
Size 923B
SHA256 d9ca9201ec478ee3369d696e3b00620ca9d1df76aedcb1685f121c51c12bc503
MD5 061bd24a3a779cdf29df51508034c215
SHA1 37f61a2c61192d947c4b9f810e39ba38cd6f2883
SHA512 c07d7623d29d0f6e34beec2e2d191ac0d0b6109d60fbeafb6d54f4efcef4863b8b372d0d5a1ad006076b334189373d8137f10a5a0f4298bea59dc43969b7fce7
TLSH
T17911BD022FB2275FF3A390F1AB3193611BB2FC058781631E818501495C38540E91EBDA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2948-1849-0x0000000000AA0000-0x0000000000AAA000-memory.dmp

Download

memory/4228-1863-0x0000000067D80000-0x0000000067E8A000-memory.dmp

Download

memory/4228-1854-0x000000001C110000-0x000000001C15C000-memory.dmp

Download

memory/4228-1853-0x0000000002F30000-0x0000000002F4C000-memory.dmp

Download

memory/4228-1852-0x0000000000CF0000-0x0000000000D3E000-memory.dmp

Download

memory/5576-99-0x00000000210D0000-0x00000000215F8000-memory.dmp

Download

memory/5576-89-0x000000001F6D0000-0x000000001F6D8000-memory.dmp

Download

memory/5576-84-0x000000001BBD0000-0x000000001BD28000-memory.dmp

Download

memory/5576-82-0x0000000000E90000-0x0000000000EC0000-memory.dmp

Download

memory/5576-90-0x000000001F240000-0x000000001F27E000-memory.dmp

Download

memory/5576-91-0x000000001F210000-0x000000001F21E000-memory.dmp

Download

memory/5576-98-0x00000000208D0000-0x0000000020950000-memory.dmp

Download

memory/5576-100-0x000000001F290000-0x000000001F298000-memory.dmp

Download

memory/5576-101-0x000000001F760000-0x000000001F782000-memory.dmp

Download

memory/5712-1855-0x0000000000940000-0x000000000096A000-memory.dmp

Download

memory/5924-1858-0x0000000000B00000-0x0000000000B20000-memory.dmp

Download