021bcdc70e00c08b16cd2863e5dea59e7603eff2037fb673bff49648270147e9

Analysis

user interaction
yes
max time kernel
411s
max time network
426s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/08/2026, 07:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
minimal (2).exe
Size 623.4MB
Sample260810-jg629stepd
SHA256 021bcdc70e00c08b16cd2863e5dea59e7603eff2037fb673bff49648270147e9
MD5 1b37e8f4729ea7da302e221214e9cfde
SHA1 69e20549fc4ff07324dd422e571abf94aa24eb51
SHA512 9a5eafe3ef503058d98d945cb8c264f0adfe2c385b80352b5410e04852500e3ef850ead21423a581d389e15b8927c22d13712c3a75c283b5e3cbdd6ca25507e5
SSDEEP 12582912:SIQlwJq/CrXv0d8zdeChSHrx3TCUGmoAQAJcpZn/TlWvU/1B8m8:BQCJ/rcd8Q5x3TRG1AJcpZ/7ex
TLSH
T1116933A6E5110ADEC376C7FB0A85D521AC5B0B7F9F079B13E09468877EC8617B82C05B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4380	netsh.exe
4296	netsh.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 25 IoCs

pid	Process
244	BlueStacksInstaller.exe
2264	7zr.exe
1412	HD-ForceGPU.exe
2148	HD-GLCheck.exe
5456	HD-GLCheck.exe
4620	HD-GLCheck.exe
4532	HD-CheckCpu.exe
5664	HD-GLCheck.exe
3948	HD-GLCheck.exe
3312	HD-GLCheck.exe
2436	HD-GLCheck.exe
4720	7zr.exe
5660	HD-GLCheck.exe
2984	HD-GLCheck.exe
5912	HD-GLCheck.exe
4396	7zr.exe
4480	7zr.exe
5884	BstkDrv_bgp64.sys
3024	HD-ComRegistrar.exe
4308	HD-ComRegistrar.exe
4344	HD-Player.exe
3160	BstkSVC.exe
2748	HD-Agent.exe
3276	HD-MultiInstanceManager.exe
4936	Bluestacks.exe

Loads dropped DLL 64 IoCs

pid	Process
2148	HD-GLCheck.exe
5456	HD-GLCheck.exe
5456	HD-GLCheck.exe
5456	HD-GLCheck.exe
5456	HD-GLCheck.exe
5456	HD-GLCheck.exe
4620	HD-GLCheck.exe
4620	HD-GLCheck.exe
4620	HD-GLCheck.exe
4620	HD-GLCheck.exe
5664	HD-GLCheck.exe
3948	HD-GLCheck.exe
3948	HD-GLCheck.exe
3948	HD-GLCheck.exe
3948	HD-GLCheck.exe
3312	HD-GLCheck.exe
3312	HD-GLCheck.exe
3312	HD-GLCheck.exe
3312	HD-GLCheck.exe
3312	HD-GLCheck.exe
2436	HD-GLCheck.exe
2436	HD-GLCheck.exe
2436	HD-GLCheck.exe
2436	HD-GLCheck.exe
2436	HD-GLCheck.exe
2436	HD-GLCheck.exe
2436	HD-GLCheck.exe
5660	HD-GLCheck.exe
5660	HD-GLCheck.exe
5660	HD-GLCheck.exe
5660	HD-GLCheck.exe
2984	HD-GLCheck.exe
2984	HD-GLCheck.exe
2984	HD-GLCheck.exe
2984	HD-GLCheck.exe
5912	HD-GLCheck.exe
3024	HD-ComRegistrar.exe
3024	HD-ComRegistrar.exe
3024	HD-ComRegistrar.exe
3024	HD-ComRegistrar.exe
4308	HD-ComRegistrar.exe
4308	HD-ComRegistrar.exe
4308	HD-ComRegistrar.exe
4308	HD-ComRegistrar.exe
4344	HD-Player.exe
4344	HD-Player.exe
4344	HD-Player.exe
4344	HD-Player.exe
4344	HD-Player.exe
4344	HD-Player.exe
4344	HD-Player.exe
4344	HD-Player.exe
3160	BstkSVC.exe
3160	BstkSVC.exe
3160	BstkSVC.exe
3160	BstkSVC.exe
4344	HD-Player.exe
4344	HD-Player.exe
4344	HD-Player.exe
4344	HD-Player.exe
3160	BstkSVC.exe
4344	HD-Player.exe
4344	HD-Player.exe
4344	HD-Player.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\BlueStacks_bgp64\Assets\close_red_hover.png	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-ApkHandler.exe.config	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-Plus-Service-Native.dll	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\BstkVMMR0_bgp64.r0	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\DiskCompactionTool.exe	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-SslCertificateTool.exe	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\libssl32.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\msvcp100.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-Camera-Native.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\System.Windows.Interactivity.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\Assets\exit_close_click.png	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\BstkDD.dll	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\CursorPrimary.png	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-ConfigHttpProxy.exe.config	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\Assets\instancemanagerlogo.ico	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\BstkRT.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-Adb.exe	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\Assets\close_red_hover.png	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\bluestackslogo.png	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-QuitMultiInstall.exe.config	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-Quit.exe.config	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-VMCommand.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\BstkDrv_bgp64.sys	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-CheckCpu.exe	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-ForceGPU.exe	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\WhiteFullScreen.png	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-RunApp.exe	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-MultiInstanceManager.exe.config	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-XapkHandler.exe	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-png2ico.exe	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\libOpenglRender.dll	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-Aapt.exe	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\MultiInstanceManagerLogo.png	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\Assets	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-ComRegistrar.exe	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\7zr.exe	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\BstkC.dll	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\BstkREM.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\BstkSharedFolders.dll	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\BstkVMMgr.exe	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\d3dcompiler_47.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\GalaSoft.MvvmLight.dll	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-ApkHandler.exe	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-SslCertificateTool.exe.config	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\Assets\close_red.png	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\GalaSoft.MvvmLight.Extras.dll	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-Common.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-ConfigHttpProxy.exe	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\MultiInstanceManagerLogo.ico	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\XButton.png	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\BlueStacks.ico	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-PgaSocketHgcm.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\MultiInstanceManagerLogo.ico	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\CursorSecondary.png	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\DiskCompactionTool.exe.config	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-Frontend-Native.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-LogCollector.exe.config	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\libGLESv2.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\WhiteLogo.png	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\BstkDD2RC.rc	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-ComRegistrar.exe.config	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-Quit.exe.config	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\BstkDDR0.r0	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\BstkVMM.lib	7zr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5640	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7zr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD-CheckCpu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7zr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7zr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7zr.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6935012D-374D-408E-A03E-536C0C57952C}\ProxyStubClsid32	HD-ComRegistrar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD5CFB2E-2B14-4089-A653-1303FF59BED3}	HD-ComRegistrar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5DFD4132-72BE-4DB4-8BDB-0D2D59B2708A}\ProxyStubClsid32\ = "{BD20420B-DF5F-403C-A737-5DD16559D60A}"	HD-ComRegistrar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8F5ABD39-6E88-49A1-ACE3-039727A70D69}\ProxyStubClsid32\ = "{BD20420B-DF5F-403C-A737-5DD16559D60A}"	HD-ComRegistrar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CA34CC4E-6FB2-4A2D-A487-2300CA4027C8}\ProxyStubClsid32\ = "{BD20420B-DF5F-403C-A737-5DD16559D60A}"	HD-ComRegistrar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E5BEE89-8F81-46C1-B764-B65945934BFA}\ProxyStubClsid32\ = "{BD20420B-DF5F-403C-A737-5DD16559D60A}"	HD-ComRegistrar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E91C7BE-DE42-451D-A5C8-A29E84223354}\ = "IGuestSession"	HD-ComRegistrar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A1D21164-4CE1-42AE-B449-1B23BB8CA94D}	HD-ComRegistrar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B925EC2-A8B1-486D-9608-0B92EB2B4415}\ProxyStubClsid32\ = "{BD20420B-DF5F-403C-A737-5DD16559D60A}"	HD-ComRegistrar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A672EFCF-1858-4A73-BFD6-4B4323C356A3}\NumMethods	HD-ComRegistrar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7BCE0D6-B67B-4731-A4E1-9211359CBF54}\NumMethods	HD-ComRegistrar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0224EE9-D93A-467F-AF9C-14A73241F125}\NumMethods	HD-ComRegistrar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4534FAF8-CB48-415C-9E1A-5D8B03B34D96}\ProxyStubClsid32	HD-ComRegistrar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3F41678D-2113-4B35-B10E-6E12E3412C20}\ = "IParallelPort"	HD-ComRegistrar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F97A7CAC-9E9D-4945-8A40-4D7953EAED20}\ = "ICPUExecutionCapChangedEvent"	HD-ComRegistrar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A672EFCF-1858-4A73-BFD6-4B4323C356A3}\ = "ISnapshotTakenEvent"	HD-ComRegistrar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4AB93E4E-E38C-4729-91D8-CA38896659B6}	HD-ComRegistrar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5DE3904D-9C3D-4095-BCD7-BE6FEA0B6EEA}\ProxyStubClsid32	HD-ComRegistrar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4903776-6141-448E-956B-56E2181DABC9}\ProxyStubClsid32	HD-ComRegistrar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks.Apk\ = "BlueStacks Android Package File"	BlueStacksInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{76EE8BCE-A821-427C-910E-6CEC54B5C746}\ = "IToken"	HD-ComRegistrar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177B5AD1-D3EA-4DDD-A5BF-DFE3E6A4A2E0}	HD-ComRegistrar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{87123A37-2B36-43A5-B5E6-0EFE26CDF985}\ProxyStubClsid32\ = "{BD20420B-DF5F-403C-A737-5DD16559D60A}"	HD-ComRegistrar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0224EE9-D93A-467F-AF9C-14A73241F125}\ProxyStubClsid32\ = "{BD20420B-DF5F-403C-A737-5DD16559D60A}"	HD-ComRegistrar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks.Xapk\ = "BlueStacks Android Package File"	BlueStacksInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{605A33BE-20D1-465E-82CF-BAF89580DC6F}\ = "IPCIDeviceAttachment"	HD-ComRegistrar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B7A1BBAF-507B-40CB-A689-82C28DA411AF}\ = "IDisplay"	HD-ComRegistrar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7E4BFB3-118F-486C-9DB4-BA8D677B17C2}	HD-ComRegistrar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D3CE85F4-1AE8-406B-8C0A-E8843664A36B}\ = "IGuestFileWriteEvent"	HD-ComRegistrar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{810BF3A5-8281-4B5D-9206-5BC2B710ED39}	HD-ComRegistrar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41C84E02-B336-4B4F-ABA2-8A3FA46584B9}\NumMethods	HD-ComRegistrar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{610EE12C-EF34-4714-965E-F268F992EBE5}\NumMethods\ = "24"	HD-ComRegistrar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C10D8433-6362-46BC-9851-6B414D1A684C}\ProxyStubClsid32\ = "{BD20420B-DF5F-403C-A737-5DD16559D60A}"	HD-ComRegistrar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A7F72EBA-9A87-4281-A581-DE7EA48715B6}\ = "IEvent"	HD-ComRegistrar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F282A828-AB65-4D5D-B3C5-DC2CF60591C8}\ = "IDisplaySourceBitmap"	HD-ComRegistrar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53F0F924-FCAA-42DC-8F07-D4B4A8734BC7}\NumMethods\ = "17"	HD-ComRegistrar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{25EE18A1-600E-42E2-8DC9-FC6381203335}\NumMethods	HD-ComRegistrar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{38C631E4-21E5-4224-BEC2-ED46509F5B78}\NumMethods	HD-ComRegistrar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3BDF47FF-FF1C-4AA8-951F-A725AAB46A37}\NumMethods	HD-ComRegistrar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5A56ED7D-3381-47E3-93C5-B8E05324B270}	HD-ComRegistrar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{106D9ABB-4041-41A4-9BEF-881BE740BE7C}	HD-ComRegistrar.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\WOW6432Node\CLSID	HD-ComRegistrar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{36570EDE-1895-4FD3-BF1A-159554BFFFFC}	HD-ComRegistrar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6935012D-374D-408E-A03E-536C0C57952C}	HD-ComRegistrar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5DE3904D-9C3D-4095-BCD7-BE6FEA0B6EEA}	HD-ComRegistrar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2724C818-5351-4951-95E0-0C4FAFC7136B}	HD-ComRegistrar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DB3D998A-B872-4299-923E-CDB10E05A933}\ProxyStubClsid32	HD-ComRegistrar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CD6463E4-36A7-44EA-9F3E-25EE1EDE5170}\ProxyStubClsid32	HD-ComRegistrar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EBCB4312-BD9B-4116-AFEE-451AD824A023}	HD-ComRegistrar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{24A982BE-062B-4E4D-8486-7C1B1F46C57E}\ = "IPCIAddress"	HD-ComRegistrar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3BDF47FF-FF1C-4AA8-951F-A725AAB46A37}	HD-ComRegistrar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D4A9A21-6BFB-42DE-A91C-E260F2A0EE13}\ = "IGuestFile"	HD-ComRegistrar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{28C1DAEB-FCEF-4842-A609-E162834ADC7D}	HD-ComRegistrar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C8A8CE3-E39F-464B-AB2C-653575ACCEA8}\ = "IBandwidthControl"	HD-ComRegistrar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1D31C944-6817-437B-96BC-AA20EA6EBFDC}	HD-ComRegistrar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EB5850D0-0084-4CA4-8983-1696F231E228}\ = "IGuestProcessOutputEvent"	HD-ComRegistrar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CA34CC4E-6FB2-4A2D-A487-2300CA4027C8}\ = "ISnapshot"	HD-ComRegistrar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DFBC4993-C6DF-45D9-B3D8-741761A837CB}\ = "IStorageControllerChangedEvent"	HD-ComRegistrar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E1270201-ABA4-4997-A497-C9B0FC076E45}\NumMethods\ = "16"	HD-ComRegistrar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9D935332-D386-438D-911B-5B0C38B30DD1}\NumMethods\ = "15"	HD-ComRegistrar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8581FE3B-3C09-4A78-81C7-43CB86FE1DD7}\ProxyStubClsid32	HD-ComRegistrar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{23016F65-88CB-43E4-9418-4C2AD6A48BC0}\ProxyStubClsid32	HD-ComRegistrar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CC440391-28D1-405C-AC32-8753C13B44B4}\ProxyStubClsid32\ = "{BD20420B-DF5F-403C-A737-5DD16559D60A}"	HD-ComRegistrar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualBox.VirtualBoxClient.1\CLSID	HD-ComRegistrar.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2748	HD-Agent.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
244	BlueStacksInstaller.exe
3024	HD-ComRegistrar.exe
3024	HD-ComRegistrar.exe
3024	HD-ComRegistrar.exe
3024	HD-ComRegistrar.exe
3024	HD-ComRegistrar.exe
3024	HD-ComRegistrar.exe
4308	HD-ComRegistrar.exe
4308	HD-ComRegistrar.exe
4308	HD-ComRegistrar.exe
4308	HD-ComRegistrar.exe
4308	HD-ComRegistrar.exe
4308	HD-ComRegistrar.exe
4344	HD-Player.exe
4344	HD-Player.exe
4344	HD-Player.exe
4344	HD-Player.exe
4344	HD-Player.exe
4344	HD-Player.exe
2748	HD-Agent.exe
2748	HD-Agent.exe
2748	HD-Agent.exe
2748	HD-Agent.exe
2748	HD-Agent.exe
2748	HD-Agent.exe
2748	HD-Agent.exe
3276	HD-MultiInstanceManager.exe
4936	Bluestacks.exe
4936	Bluestacks.exe
4936	Bluestacks.exe
4936	Bluestacks.exe
4936	Bluestacks.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	244	BlueStacksInstaller.exe
Token: SeRestorePrivilege	2264	7zr.exe
Token: 35	2264	7zr.exe
Token: SeSecurityPrivilege	2264	7zr.exe
Token: SeSecurityPrivilege	2264	7zr.exe
Token: SeRestorePrivilege	4720	7zr.exe
Token: 35	4720	7zr.exe
Token: SeSecurityPrivilege	4720	7zr.exe
Token: SeSecurityPrivilege	4720	7zr.exe
Token: SeRestorePrivilege	4396	7zr.exe
Token: 35	4396	7zr.exe
Token: SeSecurityPrivilege	4396	7zr.exe
Token: SeSecurityPrivilege	4396	7zr.exe
Token: SeRestorePrivilege	4480	7zr.exe
Token: 35	4480	7zr.exe
Token: SeSecurityPrivilege	4480	7zr.exe
Token: SeSecurityPrivilege	4480	7zr.exe
Token: SeDebugPrivilege	3024	HD-ComRegistrar.exe
Token: SeDebugPrivilege	4308	HD-ComRegistrar.exe
Token: SeTakeOwnershipPrivilege	4308	HD-ComRegistrar.exe
Token: SeRestorePrivilege	4308	HD-ComRegistrar.exe
Token: SeSecurityPrivilege	4308	HD-ComRegistrar.exe
Token: SeTakeOwnershipPrivilege	4308	HD-ComRegistrar.exe
Token: SeRestorePrivilege	4308	HD-ComRegistrar.exe
Token: SeSecurityPrivilege	4308	HD-ComRegistrar.exe
Token: SeTakeOwnershipPrivilege	4308	HD-ComRegistrar.exe
Token: SeRestorePrivilege	4308	HD-ComRegistrar.exe
Token: SeSecurityPrivilege	4308	HD-ComRegistrar.exe
Token: SeTakeOwnershipPrivilege	4308	HD-ComRegistrar.exe
Token: SeRestorePrivilege	4308	HD-ComRegistrar.exe
Token: SeSecurityPrivilege	4308	HD-ComRegistrar.exe
Token: SeTakeOwnershipPrivilege	4308	HD-ComRegistrar.exe
Token: SeRestorePrivilege	4308	HD-ComRegistrar.exe
Token: SeSecurityPrivilege	4308	HD-ComRegistrar.exe
Token: SeTakeOwnershipPrivilege	4308	HD-ComRegistrar.exe
Token: SeRestorePrivilege	4308	HD-ComRegistrar.exe
Token: SeSecurityPrivilege	4308	HD-ComRegistrar.exe
Token: SeDebugPrivilege	4344	HD-Player.exe
Token: SeDebugPrivilege	2748	HD-Agent.exe
Token: SeBackupPrivilege	2748	HD-Agent.exe
Token: SeSecurityPrivilege	2748	HD-Agent.exe
Token: SeSecurityPrivilege	2748	HD-Agent.exe
Token: SeBackupPrivilege	2748	HD-Agent.exe
Token: SeSecurityPrivilege	2748	HD-Agent.exe
Token: SeBackupPrivilege	2748	HD-Agent.exe
Token: SeSecurityPrivilege	2748	HD-Agent.exe
Token: SeSecurityPrivilege	2748	HD-Agent.exe
Token: SeBackupPrivilege	2748	HD-Agent.exe
Token: SeSecurityPrivilege	2748	HD-Agent.exe
Token: 33	2748	HD-Agent.exe
Token: SeIncBasePriorityPrivilege	2748	HD-Agent.exe
Token: SeDebugPrivilege	3276	HD-MultiInstanceManager.exe
Token: 33	2748	HD-Agent.exe
Token: SeIncBasePriorityPrivilege	2748	HD-Agent.exe
Token: 33	2748	HD-Agent.exe
Token: SeIncBasePriorityPrivilege	2748	HD-Agent.exe
Token: 33	2748	HD-Agent.exe
Token: SeIncBasePriorityPrivilege	2748	HD-Agent.exe
Token: SeDebugPrivilege	4936	Bluestacks.exe
Token: 33	2748	HD-Agent.exe
Token: SeIncBasePriorityPrivilege	2748	HD-Agent.exe
Token: 33	2748	HD-Agent.exe
Token: SeIncBasePriorityPrivilege	2748	HD-Agent.exe
Token: 33	2748	HD-Agent.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2748	HD-Agent.exe
2748	HD-Agent.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2748	HD-Agent.exe
2748	HD-Agent.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4620	HD-GLCheck.exe
3948	HD-GLCheck.exe
2984	HD-GLCheck.exe
4344	HD-Player.exe
4344	HD-Player.exe
4344	HD-Player.exe
6132	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6128 wrote to memory of 244	6128	minimal (2).exe	79
PID 244 wrote to memory of 5640	244	BlueStacksInstaller.exe	81
PID 244 wrote to memory of 2264	244	BlueStacksInstaller.exe	83
PID 244 wrote to memory of 1412	244	BlueStacksInstaller.exe	85
PID 244 wrote to memory of 2148	244	BlueStacksInstaller.exe	87
PID 244 wrote to memory of 5456	244	BlueStacksInstaller.exe	89
PID 244 wrote to memory of 4620	244	BlueStacksInstaller.exe	91
PID 244 wrote to memory of 4532	244	BlueStacksInstaller.exe	93
PID 244 wrote to memory of 5664	244	BlueStacksInstaller.exe	95
PID 244 wrote to memory of 3948	244	BlueStacksInstaller.exe	97
PID 244 wrote to memory of 3312	244	BlueStacksInstaller.exe	99
PID 244 wrote to memory of 2436	244	BlueStacksInstaller.exe	101
PID 244 wrote to memory of 4720	244	BlueStacksInstaller.exe	103
PID 244 wrote to memory of 5660	244	BlueStacksInstaller.exe	104
PID 244 wrote to memory of 2984	244	BlueStacksInstaller.exe	107
PID 244 wrote to memory of 5912	244	BlueStacksInstaller.exe	109
PID 244 wrote to memory of 4396	244	BlueStacksInstaller.exe	111
PID 244 wrote to memory of 4480	244	BlueStacksInstaller.exe	113
PID 244 wrote to memory of 4380	244	BlueStacksInstaller.exe	115
PID 244 wrote to memory of 4296	244	BlueStacksInstaller.exe	117
PID 244 wrote to memory of 4560	244	BlueStacksInstaller.exe	119
PID 244 wrote to memory of 4580	244	BlueStacksInstaller.exe	123
PID 244 wrote to memory of 3476	244	BlueStacksInstaller.exe	125
PID 244 wrote to memory of 3452	244	BlueStacksInstaller.exe	127
PID 244 wrote to memory of 5176	244	BlueStacksInstaller.exe	129
PID 244 wrote to memory of 408	244	BlueStacksInstaller.exe	131
PID 244 wrote to memory of 2808	244	BlueStacksInstaller.exe	133
PID 244 wrote to memory of 4056	244	BlueStacksInstaller.exe	135
PID 244 wrote to memory of 4820	244	BlueStacksInstaller.exe	137
PID 244 wrote to memory of 2792	244	BlueStacksInstaller.exe	139
PID 244 wrote to memory of 2956	244	BlueStacksInstaller.exe	141
PID 244 wrote to memory of 4952	244	BlueStacksInstaller.exe	143
PID 244 wrote to memory of 4936	244	BlueStacksInstaller.exe	145
PID 244 wrote to memory of 964	244	BlueStacksInstaller.exe	147
PID 244 wrote to memory of 2100	244	BlueStacksInstaller.exe	149
PID 244 wrote to memory of 3212	244	BlueStacksInstaller.exe	151
PID 244 wrote to memory of 4520	244	BlueStacksInstaller.exe	153
PID 244 wrote to memory of 5336	244	BlueStacksInstaller.exe	155
PID 244 wrote to memory of 4188	244	BlueStacksInstaller.exe	157
PID 244 wrote to memory of 2540	244	BlueStacksInstaller.exe	159
PID 244 wrote to memory of 2636	244	BlueStacksInstaller.exe	161
PID 244 wrote to memory of 2180	244	BlueStacksInstaller.exe	163
PID 244 wrote to memory of 5660	244	BlueStacksInstaller.exe	165
PID 244 wrote to memory of 4052	244	BlueStacksInstaller.exe	167
PID 244 wrote to memory of 5212	244	BlueStacksInstaller.exe	169
PID 244 wrote to memory of 2368	244	BlueStacksInstaller.exe	171
PID 244 wrote to memory of 3360	244	BlueStacksInstaller.exe	173
PID 244 wrote to memory of 5856	244	BlueStacksInstaller.exe	175
PID 244 wrote to memory of 2008	244	BlueStacksInstaller.exe	177
PID 244 wrote to memory of 4080	244	BlueStacksInstaller.exe	179
PID 244 wrote to memory of 3540	244	BlueStacksInstaller.exe	181
PID 244 wrote to memory of 3064	244	BlueStacksInstaller.exe	183
PID 244 wrote to memory of 2376	244	BlueStacksInstaller.exe	185
PID 244 wrote to memory of 4272	244	BlueStacksInstaller.exe	187
PID 244 wrote to memory of 4076	244	BlueStacksInstaller.exe	189
PID 244 wrote to memory of 5820	244	BlueStacksInstaller.exe	191
PID 244 wrote to memory of 1184	244	BlueStacksInstaller.exe	193
PID 244 wrote to memory of 5860	244	BlueStacksInstaller.exe	195
PID 244 wrote to memory of 5188	244	BlueStacksInstaller.exe	197
PID 244 wrote to memory of 3260	244	BlueStacksInstaller.exe	199
PID 244 wrote to memory of 768	244	BlueStacksInstaller.exe	201
PID 244 wrote to memory of 3732	244	BlueStacksInstaller.exe	203
PID 244 wrote to memory of 5916	244	BlueStacksInstaller.exe	205
PID 244 wrote to memory of 760	244	BlueStacksInstaller.exe	207

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\minimal (2).exe
"C:\Users\Admin\AppData\Local\Temp\minimal (2).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6128
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\BlueStacksInstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\BlueStacksInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:244
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c dir "C:\Users\Admin\AppData\Local\Temp\RarSFX0\" /s
    3⤵
    - Executes a command shell one-liner
    PID:5640
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\7zr.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\RarSFX0\CommonInstallUtils.zip" -o"C:\Users\Admin\AppData\Local\Temp\RarSFX0\" -aoa
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2264
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-ForceGPU.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-ForceGPU.exe" 1
    3⤵
    - Executes dropped EXE
    PID:1412
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe" 1 1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2148
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe" 1 2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5456
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe" 4 1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:4620
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-CheckCpu.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-CheckCpu.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4532
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe" 1 1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5664
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe" 4 1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:3948
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe" 1 2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3312
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe" 4 2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2436
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\7zr.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PF.zip" -o"C:\Program Files\BlueStacks_bgp64" -aoa
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4720
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\\HD-GLCheck.exe" 2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5660
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\\HD-GLCheck.exe" 3
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2984
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\\HD-GLCheck.exe" 1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5912
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\7zr.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PD.zip" -o"C:\ProgramData\BlueStacks_bgp64" -aoa
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4396
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\7zr.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\RarSFX0\CefData.zip" -o"C:\ProgramData\BlueStacks_bgp64\CefData" -aoa
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4480
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" advfirewall firewall delete rule name="BlueStacks Service"
    3⤵
    - Modifies Windows Firewall
    PID:4380
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" advfirewall firewall add rule name="BlueStacks Service" dir=in action=allow program="C:\Program Files\BlueStacks_bgp64\HD-Player.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:4296
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2861/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4560
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2862/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4580
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2863/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3476
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2864/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3452
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2865/ User=\"Everyone"
    3⤵
    PID:5176
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2866/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:408
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2867/ User=\"Everyone"
    3⤵
    PID:2808
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2868/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4056
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2869/ User=\"Everyone"
    3⤵
    PID:4820
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2870/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2792
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2871/ User=\"Everyone"
    3⤵
    PID:2956
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2872/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4952
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2873/ User=\"Everyone"
    3⤵
    PID:4936
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2874/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:964
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2875/ User=\"Everyone"
    3⤵
    PID:2100
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2876/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3212
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2877/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4520
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2878/ User=\"Everyone"
    3⤵
    PID:5336
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2879/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4188
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2880/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2540
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2881/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2636
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2882/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2180
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2883/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5660
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2884/ User=\"Everyone"
    3⤵
    PID:4052
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2885/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5212
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2886/ User=\"Everyone"
    3⤵
    PID:2368
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2887/ User=\"Everyone"
    3⤵
    PID:3360
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2888/ User=\"Everyone"
    3⤵
    PID:5856
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2889/ User=\"Everyone"
    3⤵
    PID:2008
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2890/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4080
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2891/ User=\"Everyone"
    3⤵
    PID:3540
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2892/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3064
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2893/ User=\"Everyone"
    3⤵
    PID:2376
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2894/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4272
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2895/ User=\"Everyone"
    3⤵
    PID:4076
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2896/ User=\"Everyone"
    3⤵
    PID:5820
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2897/ User=\"Everyone"
    3⤵
    PID:1184
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2898/ User=\"Everyone"
    3⤵
    PID:5860
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2899/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5188
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2900/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3260
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2901/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:768
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2902/ User=\"Everyone"
    3⤵
    PID:3732
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2903/ User=\"Everyone"
    3⤵
    PID:5916
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2904/ User=\"Everyone"
    3⤵
    PID:760
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2905/ User=\"Everyone"
    3⤵
    PID:4948
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2906/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1944
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2907/ User=\"Everyone"
    3⤵
    PID:1492
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2908/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2584
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2909/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2964
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2910/ User=\"Everyone"
    3⤵
    PID:3304
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2911/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3692
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2912/ User=\"Everyone"
    3⤵
    PID:4372
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2913/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3468
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2914/ User=\"Everyone"
    3⤵
    PID:460
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2915/ User=\"Everyone"
    3⤵
    PID:6124
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2916/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5200
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2917/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3532
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2918/ User=\"Everyone"
    3⤵
    PID:2944
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2919/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5124
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2920/ User=\"Everyone"
    3⤵
    PID:1000
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2921/ User=\"Everyone"
    3⤵
    PID:1676
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2922/ User=\"Everyone"
    3⤵
    PID:5732
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2923/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5508
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2924/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:6056
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2925/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5448
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2926/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:6132
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2927/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1408
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2928/ User=\"Everyone"
    3⤵
    PID:4880
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2929/ User=\"Everyone"
    3⤵
    PID:712
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2930/ User=\"Everyone"
    3⤵
    PID:4812
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2931/ User=\"Everyone"
    3⤵
    PID:4868
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2932/ User=\"Everyone"
    3⤵
    PID:4772
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2933/ User=\"Everyone"
    3⤵
    PID:5652
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2934/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3256
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2935/ User=\"Everyone"
    3⤵
    PID:3584
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2936/ User=\"Everyone"
    3⤵
    PID:4536
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2937/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4260
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2938/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1184
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2939/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1944
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2940/ User=\"Everyone"
    3⤵
    PID:2656
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2941/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1536
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2942/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3716
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2943/ User=\"Everyone"
    3⤵
    PID:4476
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2944/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5816
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2945/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5668
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2946/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1528
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2947/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1308
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2948/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4092
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2949/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5260
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2950/ User=\"Everyone"
    3⤵
    PID:376
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2951/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2796
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2952/ User=\"Everyone"
    3⤵
    PID:5208
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2953/ User=\"Everyone"
    3⤵
    PID:2424
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2954/ User=\"Everyone"
    3⤵
    PID:4008
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2955/ User=\"Everyone"
    3⤵
    PID:5408
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2956/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5848
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2957/ User=\"Everyone"
    3⤵
    PID:3572
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2958/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2768
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2959/ User=\"Everyone"
    3⤵
    PID:916
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2960/ User=\"Everyone"
    3⤵
    PID:1004
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2961/ User=\"Everyone"
    3⤵
    PID:2852
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2962/ User=\"Everyone"
    3⤵
    PID:4516
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2963/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4328
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2964/ User=\"Everyone"
    3⤵
    PID:4056
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2965/ User=\"Everyone"
    3⤵
    PID:2368
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2966/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4748
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2967/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4600
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2968/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3312
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2969/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4412
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2970/ User=\"Everyone"
    3⤵
    PID:4720
- - C:\Program Files\BlueStacks_bgp64\HD-ComRegistrar.exe
    "C:\Program Files\BlueStacks_bgp64\HD-ComRegistrar.exe" -unreg
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3024
- - C:\Program Files\BlueStacks_bgp64\HD-ComRegistrar.exe
    "C:\Program Files\BlueStacks_bgp64\HD-ComRegistrar.exe" -reg
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4308

C:\Program Files\BlueStacks_bgp64\BstkDrv_bgp64.sys
"C:\Program Files\BlueStacks_bgp64\BstkDrv_bgp64.sys"
1⤵
- Executes dropped EXE
PID:5884

C:\Program Files\BlueStacks_bgp64\HD-Player.exe
"C:\Program Files\BlueStacks_bgp64\HD-Player.exe" Android -h -sysPrep
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4344
- C:\Program Files\BlueStacks_bgp64\HD-Agent.exe
  "C:\Program Files\BlueStacks_bgp64\HD-Agent.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2748

C:\Program Files\BlueStacks_bgp64\BstkSVC.exe
"C:\Program Files\BlueStacks_bgp64\BstkSVC.exe" -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3160

C:\Program Files\BlueStacks_bgp64\HD-MultiInstanceManager.exe
"C:\Program Files\BlueStacks_bgp64\HD-MultiInstanceManager.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3276

C:\ProgramData\BlueStacks_bgp64\Client\Bluestacks.exe
"C:\ProgramData\BlueStacks_bgp64\Client\Bluestacks.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4936

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:6132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

exit_close.png

Path C:\Program Files\BlueStacks_bgp64\Assets\exit_close.png
Size 670B
SHA256 7aaef329ba9fa052791d1a09f127551289641ea743baba171de55faa30ec1157
MD5 26eb04b9e0105a7b121ea9c6601bbf2a
SHA1 efc08370d90c8173df8d8c4b122d2bb64c07ccd8
SHA512 9df3c723314d11a6b4ce0577eb61488061f2f96a9746a944eb6a4ee8c0c4d29131231a1b20988ef5454b79f9475b43d62c710839ecc0a9c98324f977cab6db68
TLSH
T1150188D435988F4D07CD96678D540F00C8F0461AC4C9DC13461508608658574BA57F96
MD5 SHA1 SHA512 TLSH

Submit Download

instancemanagerlogo.ico

Path C:\Program Files\BlueStacks_bgp64\instancemanagerlogo.ico
Size 4KB
SHA256 6baa49439989809e889298e56d855732e4c1a7c3dda46c20d5d6c87a1728ab12
MD5 99e0df90da69d4a094e772caa8792bc2
SHA1 7c9352ba2e140e223fafbe9776b63320a35d3d05
SHA512 d870378342487c9084bd9471a3c9dcdbecf17fabe1da5bd7797c6522f38727728d4d11160eb8ebe92daa930bc3beef0276fec320995a0d0790a5986c44d15412
SSDEEP 48:+FnzNDyjIg25Ce0WH84GxrnFuroLqExDYCDuEAmUZhwg5P2zgIaPxETnhqOPARI4:GlxgQr0ulGvWoLrXqxZP2zomTh8/F
TLSH
T1F4912C8ED1806A5DEC85977810C32A16EE1A10396DBB5AA06DBDD01A8F1C32559337B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak.info

Path C:\ProgramData\BlueStacks_bgp64\CefData\locales\bg.pak.info
Size 378KB
SHA256 81aca701fd815152b02b60d814f5df72db4a70f43475b8bc97aa1af5851f4652
MD5 86abbe39a0ffe4e221c459d98a409765
SHA1 7ffa8bea41bb8c7b8f958681ec097556320d5482
SHA512 66b6a6f8e7f7d857a353244d372b684886830e902cf81678dfd2b8977f1007af0596e94d27e27c930309cf12b14cf1f1af0f292e7da305c58a44f9dde0e5aab0
SSDEEP 6144:AD4ozBJxUsTqmShsGXv/ejFlm+LFHkvpMhCb1o6+j5M63:AGVmOsGXv/ejFlvhTMS
TLSH
T12E847EBC693D226BEC280C8DC069AD139AD20D02F57B6DEEF0DD6371DBF1592016C996
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BST.ico

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\BST.ico
Size 2KB
SHA256 9bde7fa55923f4a18ea6d3628564fef99850851142ef5aa3790214b652fae350
MD5 0323e5728df7d8d67dec97ed956b014b
SHA1 5eceffe508bfef08f0c5f7f822d12a649b47c7c0
SHA512 43af0d61f7fdf17bf30853e76c1db52788eea94015c2a13a0b80c5664b8532692edef6a3f0499caba5a61c01cd3d42031ddbe55a7602a961a67efc4104184e31
TLSH
T1A7512A02823C597AD5A32B3222DD1F4B9B7EA4A1B6456FC31EB543530F2132BF58B611
MD5 SHA1 SHA512 TLSH

Submit Download

bgpcheckbox.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\bgpcheckbox.png
Size 176B
SHA256 c0f7f6b9b95a5463258916afd1337e2ca49a8c69a20e843c629db8065a00e68b
MD5 86852b8d52fcab9b23e5ecd2345cb28b
SHA1 902805a9080bf9a2dff8ea69d228ca8216853407
SHA512 476a90a0714701702ccc59ac0b1555d7a75f7665e6067422fcf389195f625ca5b308627059c0dbb786565a773ce643737923456b176a5e77f210173248d19585
TLSH
T180C0C0C3D9B81DB88C05C63B30770450F823DC0333B0A14C4711DC080925D453972380
MD5 SHA1 SHA512 TLSH

Submit Download

bluestackslogo.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\bluestackslogo.png
Size 2KB
SHA256 9e3cfe0f514d6e0089841753c88f516c0208e405d15991e84648318e3490d2dc
MD5 d04b86d187495224d78c452b2bc3ddb0
SHA1 6a48c282ae5907884fd81cc2200c14a445c0261b
SHA512 ba4c0b284eccd6f9024d3576fb0fec33716f3d3301e53bdeb04073112e6d8a04da07e6c7df958b6574e7f90268de18365671cf59c014dcd9773a057cb3314004
TLSH
T116411B48F5444C500999FEA49B0C60C2B922AA5761A1B1069D03F7900EF69643BECF3E
MD5 SHA1 SHA512 TLSH

Submit Download

checkbox_new_checked_click.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\checkbox_new_checked_click.png
Size 1KB
SHA256 038a502ab656e8b4eef82ca45cd06339030fba7edeb483b070ed627ebdf84e2a
MD5 a5ccd2f0c623da5db76cf55892d5775f
SHA1 6231e2a14d98acfc84bdff53ba0aa55a6417aef1
SHA512 3d10943b583cf33f7fe46b1becb5e75e1ab43311bd4076d44c677cb69fbd65d51d23fb11e6ee1c236f5ac8ff90f264485900aed1544dd749955698d4d041e603
TLSH
T185415408F9A0BC506248AE856DFA51976A7B43D096C0E49BBCE9C9034D721FD8A5E1C7
MD5 SHA1 SHA512 TLSH

Submit Download

close_themedisabled.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\close_themedisabled.png
Size 447B
SHA256 caa2a8fe9b282939a21b86f8f61fb0c9452222cc3409f06cbb0dcc45613aca8e
MD5 b09525b48c0023f893d6b64d06add4b1
SHA1 10ecd439ea04e02eefe17f6c110d0c0a78a1db21
SHA512 c6f5a7014c24133eb576708ca17d15becf2b45ec278b3f94e5275e47c78cf0f2eb8bb1a17d277d1a665039f38f2e25faf830e275f426b0a94c6a3da096b6204f
TLSH
T123F0DC8BF9CC787E648C9A9EB0A69B50A23ED2017686503DF05087DD4173C4CC2067C0
MD5 SHA1 SHA512 TLSH

Submit Download

collapse_hover.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\collapse_hover.png
Size 362B
SHA256 b03e51a5c7efd136df2abb5d3951cbd6b23d94fffc49c6b874d26d92b33bda3f
MD5 68c072e8aabe82847a71e16e67f385c7
SHA1 807cbda180a12fe8bca35121f0de5caa0f3478c5
SHA512 c28b324636524b2759b60224cd47f8048cc0d34b5b0419154e13c328121209d2ff249b2f5f9a5c3a8259a90f814758a2e6923ad3a5382af91b2c993b2f46e71d
TLSH
T1BBE0C0C9521A3E22C6AA367B2E5B821596789186D303A005E802C77A6B476409AB1B21
MD5 SHA1 SHA512 TLSH

Submit Download

delete_icon.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\delete_icon.png
Size 327B
SHA256 428007be308e2ede2e18d5533fd1e7dcef22956972c5a6a2061a816c3a9f24ea
MD5 401e09c16308cec53665b47cfec88d04
SHA1 9f74de57ba786221cbcd9219199c769754103ff2
SHA512 51a81aeb8f2a906ccb8a15cc6341d790d2dacf08ce078f14de2c30e931c1463a6b05bfe0fb86e1401188923f15c64cc5cac9b4c43b5fe382ef4f625ab5bec9f4
TLSH
T140E07DC09FB7C5BCF81B00627163E4D36876053B7133F00B54A759101008D718641F82
MD5 SHA1 SHA512 TLSH

Submit Download

exit_close_hover.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\exit_close_hover.png
Size 447B
SHA256 5674b440c16fd138d6a5b9bee0adf1399bdea98e15c3fec32cb90b6be3487748
MD5 811b8372e36c83b5afa8881cfefe1693
SHA1 dd30b446490a9db7e9089816ba92560c4a76b12f
SHA512 f7d5cc6b97ddd98035ee023a2736b45e3de5e77f42f97132f9d4585d03203338c2f625f6016294a747ba3f98e6e2c2b79711b9b2c8851be0bb7db8479e6734a5
TLSH
T132F0DC8EF9CC743DA89C5A9EB0A65B50A23E92007A87907DF05287AC01A3C4CC106BC0
MD5 SHA1 SHA512 TLSH

Submit Download

guidance_gamepad_click.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\guidance_gamepad_click.png
Size 398B
SHA256 88ba83c43fddb2f84e01e11f3f19853630215941de294fcad5b41a3b6e6620c4
MD5 a46048d038a86b71aacb9a008e333fb4
SHA1 27bd92c6c60aaf9a62dbc50053c192341d4ce53c
SHA512 210cc790dec9e4cab733c32fdefcdee3484a447616218dc444fb6b22e99991bb3d916be34c75bc333a1809a26a0d70ffc23740e5f45a52b6fca01b920c734870
TLSH
T162E068DB5A75D9983D98718620F3004AA0F766340FEA640DE72F0E23A4B39619DB81C1
MD5 SHA1 SHA512 TLSH

Submit Download

instancemanagerlogo.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\instancemanagerlogo.png
Size 7KB
SHA256 3a11c739b3f9612ab0ee1ae357f70965c5c2648b525185678838e2412e63ac7a
MD5 afa47c9badfddd5694d6a68609d57c71
SHA1 08193f7f50be85e71930a14a5808a67ded4036f3
SHA512 b11e6cf08c57c29cd531577a894e1039cc842e8332473e0607f935d5f36401f6c019c461a004f9970ef4a02843d0bacf8931fcc4342a0db3754551becdc3c872
SSDEEP 192:1SvQYLWUN8D9Fpr6hsPLXZ5/91RsYx3RBRuiQlYOKIQlg5:UlhN8xF9JzXZvD18cnlg5
TLSH
T1F1F1AFE182C39D8071A91F05F3316A8B43671C3253A42561359EA543AB1336A5769BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

macro_delete_hover.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\macro_delete_hover.png
Size 332B
SHA256 f1e184b859ed98e24bc88afc22dd34056f227b5e4bb89d020243f4d0b89c0f1c
MD5 c6baed75b85d538498c0c5b6a8b6ccb3
SHA1 a8bda4785bd9bfe0f19fe3123af93b0ebebbfe97
SHA512 7cc2685903e1366201771c46a0459a4f041be6a986928f7147ec351541d53d4881da2ebc81459095f9412e2ce7abbd2c39259d7894c448396ad6d86fab735593
TLSH
T10BE07D45CFFBCAACBA9B2A2532A7D40755BB082D2233E0379964642955184C6C143AC2
MD5 SHA1 SHA512 TLSH

Submit Download

maximize_hover.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\maximize_hover.png
Size 1KB
SHA256 0345461b0f45b9465ebb7ce2376cb1d3e7848631c403501a79ed1e145a175d0d
MD5 5bc00b085ba9c5cac4fc3f0167d931b1
SHA1 c2f384ff3e7cc385ab0264ed0fb5424c9001b3cc
SHA512 edd68f0f8d745e082234a275669efd2a7c2be23320f71c225f98e58edbf5216355a8eba65675dd951c27402efb67c3d30cdded9c9d8dd0abdee23ecfb58b7527
TLSH
T1FE31FF04A9D2ACC2A2CFED5128FCA09315ABC58076D3D596FCC9C84614700B9EA1D1CE
MD5 SHA1 SHA512 TLSH

Submit Download

minimize_hover.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\minimize_hover.png
Size 1KB
SHA256 3452b52767ef56912e8a5b822e74a7bf8e30ed766ac632905523acd9990ce536
MD5 8f5a518bbc64b3db95f2fc3cee3a0ac3
SHA1 db71c9f2a8ae6b5dfd5201b30058475417bc94ec
SHA512 59230f5933fb94d5d9bd3b0dd637fd85da377aaedfcad48751ed4c7e2a9fcb6cc0042b2f2f88da77b47747e5d8268441adfdc412e0a9451a77bc8b89b079b121
TLSH
T11C31D019A891A94093499A123CED0C975A23A5F09AB3B495BCC9DE53F8220F58D192C7
MD5 SHA1 SHA512 TLSH

Submit Download

new_hover.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\new_hover.png
Size 231B
SHA256 9810a9b84034e55ce699fd199bbd5ac7577f6f00c6d31e75587827f6d4ef1f3a
MD5 b6a41a0a4749aa39a636799b4ef6fd80
SHA1 5a12435c76d064dabed61c8e637f794f1ff7e3e9
SHA512 d7679841679488c4e9fbd2bf19f5b221eed876f8af3dda5b4dec2cd380a6fc06f9b4327287dde536002d1cf0e8edfff1137c382b6dd0ea1f75989bd0b3902a72
TLSH
T1CBD0A7A25646647C6C1DB822799B48C0E8E6DB563338D90EEC224424703C90D0F327C2
MD5 SHA1 SHA512 TLSH

Submit Download

radio_selected_disable.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\radio_selected_disable.png
Size 2KB
SHA256 0aab9eb413a3fb6a74fac37742f50612de7975c26bd0ee6f58ea6fb75741c79f
MD5 a649d17aad8e233247dd5a04b383d35e
SHA1 3d65b4045586558df234bdb61ee70168b7a24f9a
SHA512 e987eb36cdcae4328dc2aed34c47d1de8e5b6a18bdd9006ddfba5ba3b92d7fc0a2b75e242d367811ef192b882c2d6483a1735ac5128349f7479eb1724fc5cdb5
TLSH
T1BD410A53EE10FAD05A1DEE1129E9A1C33933C5C0D681F4AAADC9981378B05F6462C0D7
MD5 SHA1 SHA512 TLSH

Submit Download

radio_unselected_hover.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\radio_unselected_hover.png
Size 480B
SHA256 0ec39ed4bf89a341f1b5aea56d0e99ff5c923b9c3a6a81adeb9ff21764136f92
MD5 22efccf38e15df945962ac85ac3aa3b7
SHA1 b94a8615dc92982e1637680446896080f97c2564
SHA512 41a4dbb57abed1a16aa84c72c202da461ca45cbaf68f69a10cb3e5529e8dff659e89f7f4459d1e2e8f3549c6fd51f23fc8422f86667577ebed5ab5df149c79ee
TLSH
T18EF00EA6E37F81A04209092A303B0664A2FAA9575160B9261A72662C4A79A9E81D2A34
MD5 SHA1 SHA512 TLSH

Submit Download

sidebar_hide_disabled.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\sidebar_hide_disabled.png
Size 2KB
SHA256 b9b7d07ba6dc1d26ba014a9c9eef0a4bca4f83b555284769b435c1d6948bb2f5
MD5 3cdf2b1d191e96d194929480b0144f33
SHA1 980fe04dbc604c247355bef9e842a7429fa7eabd
SHA512 f820527275ece47b69e72509d0c753c60100daf53464671a97c5ce69b5e0d3d16e271c0968d9dc7934b81c57d3dcc62586ffcb20bd724b2941dae7c8df3aafd1
TLSH
T1D8418449EE12B9E09505D806FAFD78A7D62355818AA0F1A2EDDD8817E8710FA680C1C7
MD5 SHA1 SHA512 TLSH

Submit Download

sidebar_overlay_hover.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\sidebar_overlay_hover.png
Size 812B
SHA256 fe602cdd154a282938f68fe9c66c29b9e506f20f277d4ed8b5ef08e274fcec41
MD5 a55cc76776e5d1a5e0feec486108c53c
SHA1 71d8d2ec2bdbedb6637d6ecb54d45e6e86a9a588
SHA512 d9d2b03ac3b07c052256060e7e6942885399c9d67d97719e2fefa62b874baef8ba69ad7f88c086a7cd872cca81a63c2277f07485ae94a4d1e51f68c678d9f7f6
TLSH
T1D201CAF3C520D4F4A03CE535FA311625A867CD0C06C7F889D55650AC16005DABC6E7D3
MD5 SHA1 SHA512 TLSH

Submit Download

sidebar_overlay_inactive_hover.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\sidebar_overlay_inactive_hover.png
Size 1KB
SHA256 f59d3ee314c0efe9bf15aeb0785cf3ca2df06f125928adb92383056e96adc6c9
MD5 fd9e2bfb4ce4c10b544474233a3f9386
SHA1 8cb2cee9b365a72d429c36fa895ffd637a7692ea
SHA512 8e705c34dc979fd00fdb3e8ab1c227b2c2c2369051ce528f63997199db43be7c71c5a1bff18527d175add114b1835c45f136f9a0baa0feb30d58398a458c9ec9
TLSH
T19311A8E0DB46F4E8B1C274617AC30F2EA7704E5D109B1532ED385356C68DD7461D2F80
MD5 SHA1 SHA512 TLSH

Submit Download

sidebar_settings_hover.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\sidebar_settings_hover.png
Size 1KB
SHA256 f1271d728335e384586181127cb119630b8a09e8922f7e4908dbe18bd0bdbef6
MD5 f4a88c79b3c4c9243a5a0de07eb4df37
SHA1 b5c3a4f0d9846ecd855c8c42f25a8ad0c292fe08
SHA512 6fd796749a167d5b65c82a843742baae428b78f529895d9aaa47568b16d7c53321e319b64c923c36cc02fede2c704813b05d3089c586f20f56cfd52b196c6e17
TLSH
T10611E5F1698EB174F47CA83B3857152951383CE21881A30FFC9011F29EBB656ECC4283
MD5 SHA1 SHA512 TLSH

Submit Download

sidebar_show_click.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\sidebar_show_click.png
Size 2KB
SHA256 3fccef228bc829e30f111eb029834c26f5492e161139b2c0adfdd58904e8ce61
MD5 3c119419f8e848995829355d4d99b68d
SHA1 f4c9ff66bff126d9da53219506a86b0481769404
SHA512 cfc27b9737998a63ac3e78a38c91fb31ae892126171b5c806b53c0c1f3212c8ca1f7180c405e6b37abbf7f956fd17c79eb1ec9eccea5b3eef1c2293719695370
TLSH
T13741EB0CAF40F5403436E8066AEC05D75A3F8781EB95E9D9FCE498131C201F99D0E0DB
MD5 SHA1 SHA512 TLSH

Submit Download

tabclose.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\tabclose.png
Size 1KB
SHA256 59088667ec302534d41a207a3844ca154cdbce39a24db5a5c87a18bc4ff43400
MD5 aabddac09daf8cd7712ed560c973d268
SHA1 b40dd1035acb0e1b1395bc0c85a65c72ccb30737
SHA512 5293bf9e6a8ea3f5c028c684c0afc48ad7369a8015412e53f07232ba1c3e895d2be91b4be07faf4484a93876c0e0cbee5df6e306553196742849d265302b46a7
TLSH
T19C319508FDA1BC61431CDA652EED52172A334A90F3E4F486BCD68E9328704B48D4D9C7
MD5 SHA1 SHA512 TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 22KB
SHA256 ba2836707cdb57ea2aa4c0777014346125a22f0948b36d0e889c6159c9fa7d49
MD5 488a65820fe8e7ab039769f8aaa4ffb3
SHA1 7142bba3612cd996b684f0ac537387708e26981f
SHA512 6627d42f39875d5d61f24ae45147f09ca585d7f5dc2f2fb88fd7b358c88f2aca41167b722546b460e494888dccf33621ac8790cefd62c64467ff0d8043256da0
SSDEEP 384:MtPMJWJjVMczkkrtJvOm+SbfQOVjeQ8RJo3hghFUjUXPW35PIm59+GDa50HIsYAq:R+jVMGrVl8RJYhgTUjUXP6t9+GDa50Ho
TLSH
T1BBA24C743AF51319F3B29F759AF1A95A643AB866AC00DB4D0162038D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zr.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\7zr.exe
Size 722KB
SHA256 ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d
MD5 43141e85e7c36e31b52b22ab94d5e574
SHA1 cfd7079a9b268d84b856dc668edbb9ab9ef35312
SHA512 9119ae7500aa5cccf26a0f18fd8454245347e3c01dabba56a93dbaaab86535e62b1357170758f3b3445b8359e7dd5d37737318a5d8a6047c499d32d5b64126fc
SSDEEP 12288:AwAxBpwU5gU+2/9dB5XlH1YAEa5OLW0TjLWG3rn0Yf5ogmn9X9Rf6TIALr22DIVM:AhY2gUfVH5XlVYzagW4/3rn0Y5zmzRfq
TLSH
T177F48D227BF6C0B7C64211318A1C6BF690F6F3190B3059C367908F6D6B399D5D63AE1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

close_red.png

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Assets\close_red.png
Size 15KB
SHA256 d0b6d143642d356b40c47459a996131a344cade6bb86158f1b74693426b09bfb
MD5 93216b2f9d66d423b3e1311c0573332d
SHA1 5efaebec5f20f91f164f80d1e36f98c9ddaff805
SHA512 922a7292de627c5e637818556d25d9842a88e89f2b198885835925679500dfd44a1e25ce79e521e63c4f84a6b0bd6bf98e46143ad8cee80ecdbaf3d3bc0f3a32
SSDEEP 48:2/6FwMlYk29WJsEvkch6/Clu5tlL88Lem/fLu5A/luaxN+Y97sc52G7Z+EazEyIc:2SFvYkEWmDCccHAxNX7sc5dZabT
TLSH
T1CA625065BDF075A65589F5322CC564055C730B83DAC09C88FACE5C2B6F01BEA9C1F58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_flash_background.png

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Assets\installer_flash_background.png
Size 603KB
SHA256 cd43a91306d0af372587267f1d92a5ccbbdec0c19d4cc04fcd4df51beb81e1f1
MD5 8d29e022d2eb11eff728b7e00073a9ad
SHA1 dcb9498095cddbf32b5cfe534e0036fe1842fcae
SHA512 faf7b34fe7a99ea6b6f99a0d316a6811a512976705425b18e6cd0e47c9ba1490d12576dc1d9a0bd0aae4358a93a9a4ec7049ece956f5c31a58dcea8afa844a06
SSDEEP 12288:nIS7y+ogB3eqhrZTbnOPdbkbizYn0b34x5QvfcYWyfqrrj5:ndV3TfXncwbi60bIvQvfcJySp
TLSH
T197D43349F29990B40C48BD678E7B68C76E3CCE08A940D36893DC4A9BF47665CFC657C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlueStacksInstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\BlueStacksInstaller.exe
Size 184KB
SHA256 d6f9cac969c0b8e8a8a96e95bcf6d0f33eff75b5e1314a181ae5b64fdc791f65
MD5 f1d9e9218e332c4c37103530d3efd49c
SHA1 bd8ca89364c9ddbd8f6bb2626a9dedcc192a458f
SHA512 d42fb7fa6ddae413e491fade7a34db342c3d488271b7426bf2b930a43a38a491727e923d9f42ea152125d98d54d2f273e4febf0df59f24f9dd307a0d3d0cf1af
SSDEEP 3072:R5Gdyrf15qKoOFP7eVAcr6ZVB+nGskeMN1udwWzaow29J1:bGS5hBQAUIK9P
TLSH
T1C304194437FC4918F2FF5BBA2DB245114B35B98B8932DB1E0AD214DE0A71744DA62BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlueStacksInstaller.exe.config

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\BlueStacksInstaller.exe.config
Size 392B
SHA256 4b7df915d706af6459c38d75b09c5e14f951842ae0678078400f204ad1c7a7c2
MD5 ca0a329097316832e4a6ea5d870c9268
SHA1 4a36b93361d3dc9df9b00313f2c2b394be9e1e72
SHA512 51f9a874e84f130be4fa29fcc4bc934105318234b5dd9ceedaf569e3f0e6b38e29f3bec056044724476ae24295a510b16d8a737b994fd6f1268609defa315271
TLSH
T1CEE0D81559D8FC2B5EB34B13B6228566EBB0E3D651A45C08F4DF69A30A3308A6B97331
MD5 SHA1 SHA512 TLSH

Submit Download

CommonInstallUtils.zip

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\CommonInstallUtils.zip
Size 6.9MB
SHA256 0ffff7ea5f8076bac60eed43b2cd5da45b2dbfd7231db9018eeec6c76ff60b43
MD5 f09a12bf745e3b661186b59df36f9fb6
SHA1 a648ca550ec915883bdca7c06b9a518758e44873
SHA512 f8f1e55c3242bbc4f7029bbc7acd03a5be8d00d3be680b1b939c8a9b5d3a09f3790ad7cf68f049464c54b41bcae2f078563e5e3145b23bc03c0177a6e6f576da
SSDEEP 196608:8ez7HAe1ROBfWMh55zMoQlSTtiVwcAtcwbbwnBY68:8ud1ApWMG5UiFAtcwbbGBYz
TLSH
T1EC7633A7DC268BDFBE3BA3A822A18035F8EF5E7C8B304544565B17448032558B59DF2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD-CheckCpu.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-CheckCpu.exe
Size 133KB
SHA256 746aef1025c7cdf9eae0d9e55362d0230a8e877f0d6749ae39c53d730287eb36
MD5 fe2bd5b8dacbb0e6509ab71640979a12
SHA1 1ca2c7713c0dc75e0fb071d068e7f898a5c90085
SHA512 0cd4300a71af6489fa85ee4701d583cb73f1ffc41a850b4245b0c73a892000a754548c91e84c2cde01808c1913f4bfa0e7b2263da7af297163d11e7409d2a832
SSDEEP 1536:HZCLaBoTQokfWF9ATfGWOKbunAi7rsMNzONZjLsxt/w54hX1AivIiRdvVWXit:EL3Qokfqof/bu/fbxGlkwWhHvdRdvVgQ
TLSH
T166D38C203581C432E5A32574CAA8DAB6CE79F8700B7468DB3BD8567E1F697D1AB34307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD-Common.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-Common.dll
Size 1.3MB
SHA256 c5726b4eb1d06ef31f316b84d3d1feb6b1a6cba5d15360273b2315afcfb1c2f6
MD5 ad4946d13bc7e78c99110067e6b1cf30
SHA1 ca2dc3e902f46d027fd3c03d0265893d691b91e4
SHA512 1eba47aa17683a5af7244658a8a475cd29ed5e6decc8f06625f9b4b0fe81cbcdc3b2dfa02deac324b8f4765429257731acb1fe8600640e5e3bdd5c28a0bc7954
SSDEEP 24576:upIYjXzR2FfyT+oQ1kx/WWtWrnngnnnKnanx/:MRYqTZ5+WErnngnnnKnanF
TLSH
T1A8554A00B7F54918E67F1B34B4B215304A75FC91AAA6E35E0610BEAE7D727009DA0BF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD-ForceGPU.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-ForceGPU.exe
Size 152KB
SHA256 1570d708a26ea4d010ab1416d10be1e5d0f90b810eacdd575ab039dafa7541a0
MD5 f07020138ef4e95df341abee6caa7a31
SHA1 b5f68bc03061f38132c185305da67a54ba16727d
SHA512 7cb3f6c8c24e8c485247d36a42fdb13348a822248648cf1e48ffb2d8bc3648a6de2e032ecb9ea6bcfd632e8c5b6f7c29ce96f51f08968d3aec98403a32152b83
SSDEEP 1536:wfaACJ1h+I2FudMHvRWhHn4FnXqDpu3jj/B44S26boc95vHWXi:1QI2FumqH8WkTjxGbt95Pg
TLSH
T19CE36341EBE132DCD8F9D278E6166095ECB13EF4B31766C70224AD118FA6EE0D639721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD-GLCheck.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-GLCheck.exe
Size 558KB
SHA256 e06542bc804b9af6818b2c5c4069bca8bebf5c60c4a73aa136a4f373c6161015
MD5 371d3180920f91c09ce70360226502e6
SHA1 b3d6baa6f4b69f0b3b178e849213816ab42861d5
SHA512 20de798b1bee2b52300250e66bafc3c5a5721097e83f2b2b59d6fa4468da4395b405cf69435dc2bd37cef9aa43b3145967efd357028d1ffbbd4f54463c75f425
SSDEEP 3072:UJwEbIGMK9i5OFiBStmLxPEn0nKc30f/BnR492ZajH+PeEkgy7Mn5lYKt8ZZaMt3:i2K84xSJ3ELcLeR0sEZZzLIV+biRCF
TLSH
T117C47B9577A817E6D17BC13DCAC74B1AE97278111321A6CF019842BB1F13AE82E7F721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD-Opengl-Native.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\HD-Opengl-Native.dll
Size 3.0MB
SHA256 f3858993196244a24f55845aec1e4677f7488a41d68f3780725bc9c48d12ec97
MD5 7d32025467a5eef90e9bb4ee36fdb802
SHA1 d1387abc34aa76c14793976e165e407d0e8d2038
SHA512 7d43fb8741351c8f83b22f3e2bfb64fc41bcc16aae4de6dbfb63763da123b925d4d5aca21621ea1f3d4da0a52ae195f10ef2c5956b76afe5cdbff9b313485cfe
SSDEEP 49152:Smq7Thpz6CSgFOiqpFKeUTRkVZYUjIUIiGPKdzd+KtSbZMMGOmeuZ+iCdNHOP0qh:Zq78gFOiqpFKeUTRkVZYUjIUIiGPKdzt
TLSH
T199E57C4A36A89095D177817CC9C7CB8AE6717C094B215BCB1594A3AE1F37FE9087FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Newtonsoft.Json.dll
Size 493KB
SHA256 7181f80c0719d1d75417b8360113d4e55ad93cadedd8a83b4c1869057072c5d2
MD5 9af4748049bd7808a7b5ab2e7d4d4e17
SHA1 342c71611e85b1a2468968ccb0ec12d2c7ae04c3
SHA512 96e286bdc77a0ae7015bc33f31f9379e7a06560d98b0064f9eb559a0b13fef7efe3e2f0baed5a968a6fe91bba5bc163bad7c9f5f490fd353596d6ae35e3d9c3e
SSDEEP 12288:EmKLDa2Tqte5+7OWpP8gkRCj7gBEA+PeKjJc:sie0/pP8gUwcBEAMeKdc
TLSH
T17BB4191133FC8F15E5EE2732E0344525AAFAF457A6BAD74E69419ABE2C93B408D00773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oem.cfg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Oem.cfg
Size 1KB
SHA256 2b0341056709bf30b5690a2e805246bae891f818d1e62ee1fb520ba0849961a7
MD5 1b72d69aab8a22fae80380adee2d69b7
SHA1 e5da38fbecdf6e4fd29ca21be477ba04d35181ee
SHA512 273037217a26c4c81e356786fb00d615c08ea2e659b0dbc25a148fa0ebec8dbbd6d25b57b201c312cad3d73c8559121cc5f99a2e8f62bddf288611cb93557017
TLSH
T1A011EF7E37D13276FA3FE327E4CD5603AE761869306339309944444E68C0F1553D681B
MD5 SHA1 SHA512 TLSH

Submit Download

PF.zip

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\PF.zip
Size 37.5MB
SHA256 df36ef3098b55d635e0e98acbb7fb892f25d208ed4b417ca98626036d35ae085
MD5 dc192b73d12e0c7d2a397f50a4255d93
SHA1 9e0f3eca196af69fe1747bc21257575ab8bab3b2
SHA512 d7946851661b62adf3af15d36cfbd83549a7ad0e18aeee979a4cc1353022480a7539bdb1103434322e998b0597f7050cd88e1b622a62e39bf847f4d1e51ccba9
SSDEEP 786432:sF5GHwEfLtwzPSF8d2+VLVOb+1pKbpHAHjCId1yFWnuWLk5LAxKSB31eaEqacJQK:sF5hEzgSG0+3OC1ECDCIGAn45LAISB31
TLSH
T1F987330423363ABED8BF5BB25974BF99F9AD8E94359B5E58771280031C42CC3CB62C65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThemeFile

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\ThemeFile
Size 82KB
SHA256 e68f0ddfcf71a71d8ff6d9f1a2b0451a08fc29e6356473815155e196da434d56
MD5 a5436746518402cbbc67edd3a7626b6d
SHA1 fdd056e61e8cdab8ff72ff54f3d47fcf2d78b4a7
SHA512 458f7b22bbacc8478607bdeef083259fd5028db19f6f826ff4b69d54be44127cd37bcaced8bf033e742e0ccc28ecfa6da0ed39e373a802d808532f832dc941b9
SSDEEP 1536:pWLcMdesVPl0GVT7jTSW5uxkh2RwjaHoboDzwb2TYT2dw9aboD57cy6lYFiKbQFz:ycO6J
TLSH
T1218348695DC92D3D233B539FB9B32057C84B300B788B49E6BA6F1112EFB859E1427634
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\d3dcompiler_47.dll
Size 4.0MB
SHA256 6bf1b5cd6cf5316493a2419ea7ecff44de39c71f226cb1b0dbe18e940f3bc988
MD5 898b3b792574a266c0f60a87244deac5
SHA1 af5f4d815d21f2272ce64a7b414086a6e7eb599a
SHA512 e1ae86e56a1e6f7d0b00d33667e01afea6b1a65013f9247a2a48ed118a31ed01ab1c51881c246378bcd58e6584143d7b81806783cef96c6251a23ca4049cecfb
SSDEEP 49152:2BfmqCtLI4erBYysLjG/A8McPyCD6hw16JVTW7B3EgvVlQ3LAYmyNOvGJse+aWyb:WeZevVKACOvWYQd
TLSH
T113167C46B2A440F9C1AB8139CA5B8717EBB07814173497EF12909625EF73FE16E3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\libEGL.dll
Size 402KB
SHA256 78dbd96e1b2b105030fb50457c1d720d1373558428c980960b4e3b88105ed2af
MD5 948eb249b23a9487d15fab236e4a2805
SHA1 ab7db3e961f007b5b242ce01f8183e197c78a571
SHA512 1510001a8c4e3875dff0b16a77028b35d9c3491c7b52046c0094253165266246d7531c538023a99d57999b41f228175423220acaed9fab1c1857b067c1577782
SSDEEP 3072:kBIQbANn+FUWoKdyx+FZ+3xlGy5UrYfInPePjFP5f+HCTzBz4o5m4O4iiibvBBYJ:kuEOKUoF2BLP9ZP6o5crBBQ6xWhQW
TLSH
T155947C56F79005BAD17BE23CC9634B51EAB278591721E78F03B803AA1F133A1993F725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL_translator.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\libEGL_translator.dll
Size 3.0MB
SHA256 adbf8672d18ce63ca728f24f802b4f7e420cb307ad9e8efb54fd7a87a6975df6
MD5 5e717c3e8c4ab79ccf21017cd743d4f3
SHA1 769a3232bfa49927ee8d5e5b7fb26c1c62815869
SHA512 b773e52be4c585bb946d31052fd74266913080625f69f4eb1ac0a8945fa7aeeaefe1b6a3e6f25ac1482151a3c7cf873cbf5cf44bf69778405fe550db72f25d91
SSDEEP 24576:BzhfNKYszRP+ZvhcvKV0bjKDF3BeWJEuzsq38JhoHVLN8hmv1Vw5hDwZ2+d6418:BzBN2zE0OF3kORgoBv1Vw5dwZ2nX
TLSH
T180E56B5B36581199E07BC07DCACB9F4AD6727005072297CF06A443AE2F67FE909BE721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLES_CM_translator.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\libGLES_CM_translator.dll
Size 3.0MB
SHA256 d1f6e10fcdeb281a79afa90832352634c346e322b19253efaae95b526f728e0c
MD5 46ef9bf67aa4cc25d1d9cf50a777c6f8
SHA1 2ee8be9eaed99089a2063067e1f8c75bd5ee9a0f
SHA512 72b5d76bda749ed0441342d73e4478bad486f60cb55db29531d97739c0ebdf9e5c33f3d13c6e79a67b52c292810cee2a1730cbe7270f77349a0808c6a7c6db93
SSDEEP 24576:X9QQtu9rGhdOyGqr1t1P7cmuGy5C9krEQTeUzG3KJaxi8ajc5UA9E/cbFr6NOqRU:X9QkerGiq/fGeUzJc56/GFr6NOqnc
TLSH
T1E9E57C5A36981199E07BD07DCACB8F4AD6727005032297CF05A443AE2F67FE91DBE721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLES_V2_translator.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\libGLES_V2_translator.dll
Size 4.6MB
SHA256 17347ae4ca411848fa95651425665415e366ed4e3f0611268fff14481f85b475
MD5 bf03cc3d46bc705e1d0b592a76011e4d
SHA1 9fb0d38395a1ad4793a9aecc3edcf85f28006593
SHA512 f9f0be2684bb78da14b49de18c224be2e33d8523a06a7753db16d246a2c52b58c8e8ea37632dae7275af503aa151915ef3d4c874f727985c47ddb3720413fa2b
SSDEEP 49152:X3BdXh/fnBXoIVTCXuC5KbS84PkAsDwEMvuYXPBV6:n59C5suzsALr6
TLSH
T1D7265B1B32A8119AD07BD07DCAC79E4AD6B2740603209BCF4594439D2F67FEA1E7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\libGLESv2.dll
Size 4.0MB
SHA256 7fe01a2b5c197c4604f37dcaef9cb5136b3a2e05cdec60ba06e3d664c58bf1c8
MD5 c9c69793844aeb22784321c3458b33dd
SHA1 8d900d6238c61b129db9288a71464c54295bff77
SHA512 35a3cf14c7c4942073b12e903709410fbb12cb65a160dabd1a14e1641b78c3ed144e5b2d159e2f73a9ef6820f16ba476540bc6689d16cd381f4c0b665d2c5e92
SSDEEP 49152:gHJnqf2NnsNicg/09uIciO7IE1YDNZvvxwpsROHkZ+Au3r7PZuU1WeGip0tTlc+s:GbNnsNo/09gYvxwBD3ZF9i/8Duc
TLSH
T1E0165A1B626900F9C1BBD03DC7576A47E7B2740A4370A7DB02A0466A1F63BF16A7F325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libOpenglRender.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\libOpenglRender.dll
Size 2.7MB
SHA256 4f625456e727b71a7dcb58e39365a408a312376d5fc0dd01f3d11c5b17c86bb8
MD5 8623c1b8a7bb5325e16413d25ffee60c
SHA1 9b8956a1ecf1fb243307b2f0be775503e6a7c481
SHA512 7ccaf105870b472dc5e35a4f0a23ffe39514cb0351dc75f88b1155085bbdb90e287cc779205ea8154e9c0bf8a409709808142586c15141b96224d21fc45002fb
SSDEEP 24576:6Q463DZYOWi5M5ILRsRBFGjxEdhi0tmJrD98v82lNBP:v4EYzAM5ILRsRfGSXXY082FP
TLSH
T13CD57C1E36980091E1BB907DCE878A4AE6B17C09472066CF38D4639E1F73FE9197E761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shortcuts.json

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\shortcuts.json
Size 223B
SHA256 d375d88b4e7b44edda3fd1335dd082a6302a7cb500a644a18d13e961d9d00672
MD5 8dea686976f6a00480ae8952d93b75c5
SHA1 b67f1c20f3353fa6124b6ae48ede29076d4a28de
SHA512 addf22fc71c2efd9be3af030372a13907ac22b729d02a922d967f7c24fc0153e78313eaa2ada5725b7cb36120d6406d1ab58ca41756fc527e44ce8365e7a3f26
TLSH
T1A3D0A73FEB7882E3034B67A046745800ED0F5885148698EDF2045D047641114067AA44
MD5 SHA1 SHA512 TLSH

Submit Download

memory/244-68-0x0000000003220000-0x0000000003230000-memory.dmp

Download

memory/244-67-0x000000001D4B0000-0x000000001D60C000-memory.dmp

Download

memory/244-78-0x0000000021F50000-0x0000000021FD0000-memory.dmp

Download

memory/244-65-0x0000000000FA0000-0x0000000000FD4000-memory.dmp

Download

memory/244-69-0x000000001DE40000-0x000000001E368000-memory.dmp

Download

memory/244-85-0x0000000003220000-0x0000000003230000-memory.dmp

Download

memory/244-84-0x0000000003220000-0x0000000003230000-memory.dmp

Download

memory/244-74-0x000000001DDD0000-0x000000001DDD8000-memory.dmp

Download

memory/244-75-0x0000000020F30000-0x0000000020F68000-memory.dmp

Download

memory/244-76-0x0000000020EF0000-0x0000000020EFE000-memory.dmp

Download

memory/2748-1273-0x0000000000510000-0x0000000000540000-memory.dmp

Download

memory/3024-1261-0x0000000000C80000-0x0000000000C8A000-memory.dmp

Download

memory/3276-1281-0x0000000000FB0000-0x0000000001026000-memory.dmp

Download

memory/4344-1270-0x0000000000CB0000-0x0000000000CFA000-memory.dmp

Download

memory/4344-1271-0x000000001D7B0000-0x000000001D7CC000-memory.dmp

Download

memory/4344-1272-0x000000001DBC0000-0x000000001DC0C000-memory.dmp

Download

memory/4936-1285-0x0000000000B80000-0x0000000000D80000-memory.dmp

Download

memory/4936-1287-0x000000001D600000-0x000000001D6C0000-memory.dmp

Download

memory/4936-1286-0x000000001D1A0000-0x000000001D2F8000-memory.dmp

Download

memory/4936-1289-0x00000000016E0000-0x00000000016FA000-memory.dmp

Download

memory/4936-1290-0x000000001D0C0000-0x000000001D152000-memory.dmp

Download

memory/4936-1288-0x00000000016C0000-0x00000000016DA000-memory.dmp

Download

memory/5884-1259-0x0000000140000000-0x000000014005A000-memory.dmp

Download

memory/5884-1258-0x0000000140000000-0x000000014005A000-memory.dmp

Download