267737b6425f3a473e11b6051f2a95ddab5f8f6d2e6aebd2ff9033fd31d5c145

Analysis

user interaction
yes
max time kernel
56s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 23:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BlueStacks10Installer_10.42.265.1001_native_36e511ad5a5a4eec0ee44b33ae5b5078_MzsxNSwwOzUsNTsxNQ==_U2lsdmVyIFBhbGFjZQ==.exe
Size 931KB
Sample260922-31ab7avanb
SHA256 267737b6425f3a473e11b6051f2a95ddab5f8f6d2e6aebd2ff9033fd31d5c145
MD5 d0df19ad5d5cc93d5397f13dea2ea5fc
SHA1 eee25a5f0545fbb708ccbca093ee00e408523660
SHA512 876cead729d17785e96147aa1797400da3e9bbf596f3753e29f2c5f3c9bca5584d69961567e1bcfe72b535b9ac2e9724c379c87a186d02f60ac48784684a1abb
SSDEEP 24576:QivtCXWeGKW/NGzTukzl7AMkE9A4YMpOaCrR8:VtCXWPf/m3mMkEC/MpOaCl8
TLSH
T17615CE9C21A1C077CA530FF284E5DF671554FA913B23A52EE2952E997A30E824BF7133
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
89	discord.com
62	discord.com
63	discord.com
65	discord.com
69	discord.com
87	discord.com

Downloads MZ/PE file 1 IoCs

flow	pid	Process
33	452	BlueStacksInstaller.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	BlueStacksInstaller.exe

Modifies Windows Firewall 2 TTPs 4 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5544	netsh.exe
2552	netsh.exe
5152	netsh.exe
6824	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	BlueStacks10Installer_10.42.265.1001_native_36e511ad5a5a4eec0ee44b33ae5b5078_MzsxNSwwOzUsNTsxNQ==_U2lsdmVyIFBhbGFjZQ==.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	BSX-Setup-5.22.265.1012_nxt.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5648	WScript.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\video_chroma\libyuy2_i422_plugin.dll	BSX-Setup-5.22.265.1012_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\image\TypeIndicator\PremiumGame_hover.svg	BSX-Setup-5.22.265.1012_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\translations\qtwebengine_locales\da.pak	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\Offers\Up.svg	BSX-Setup-5.22.265.1012_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\translations\qtwebengine_locales\fil.pak	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\api-ms-win-core-synch-l1-2-0.dll	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\api-ms-win-crt-runtime-l1-1-0.dll	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\services_discovery\libmediadirs_plugin.dll	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\video_filter\libmotionblur_plugin.dll	BSX-Setup-5.22.265.1012_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_disabled.svg	BSX-Setup-5.22.265.1012_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\translations\qtwebengine_locales\zh-CN.pak	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\www\js\utils.js	BSX-Setup-5.22.265.1012_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\api-ms-win-crt-private-l1-1-0.dll	BSX-Setup-5.22.265.1012_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\access\libtcp_plugin.dll	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\maximize_normal.svg	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\MyGames\Card_Detail_page.svg	BSX-Setup-5.22.265.1012_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\image\NowBuxUser\Account.svg	BSX-Setup-5.22.265.1012_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\translations\qtwebengine_locales\el.pak	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\www\images\noNetwork.svg	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\api-ms-win-core-timezone-l1-1-0.dll	BSX-Setup-5.22.265.1012_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\api-ms-win-core-xstate-l2-1-0.dll	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\imageformats\qtiff.dll	BSX-Setup-5.22.265.1012_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\image\checkBox\checked_pressed.svg	BSX-Setup-5.22.265.1012_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\www\js\localize.js	BSX-Setup-5.22.265.1012_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\audio_filter\libkaraoke_plugin.dll	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\audio_filter\libmono_plugin.dll	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\video_chroma\libi422_i420_plugin.dll	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\video_filter\libposterize_plugin.dll	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\Search\SearchIndicator.svg	BSX-Setup-5.22.265.1012_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\xplugins\BrowserWeb3Plugin.dll	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\xplugins\MyGamePlugin.dll	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\MyGames\NavigatorForward_Holding.svg	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\NowBuxUser\right-chevron.svg	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\TypeIndicator\PremiumGame.svg	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\www\offline_cef.html	BSX-Setup-5.22.265.1012_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\codec\liba52_plugin.dll	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\Search	BSX-Setup-5.22.265.1012_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\video_chroma\libi422_yuy2_mmx_plugin.dll	BSX-Setup-5.22.265.1012_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\video_filter\libblend_plugin.dll	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\video_filter\librotate_plugin.dll	BSX-Setup-5.22.265.1012_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\video_splitter\libpanoramix_plugin.dll	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\mux	BSX-Setup-5.22.265.1012_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\image\Gallery\close_normal.svg	BSX-Setup-5.22.265.1012_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\image\MyGames\NavigatorForward_Click.svg	BSX-Setup-5.22.265.1012_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\translations\qtwebengine_locales\sk.pak	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\iconengines\qsvgicon.dll	BSX-Setup-5.22.265.1012_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\access\libhttp_plugin.dll	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\codec\libaraw_plugin.dll	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\misc\libgnutls_plugin.dll	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\Tutorial\PremiumGames	BSX-Setup-5.22.265.1012_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\image\Guide\GoldCoins_Right.gif	BSX-Setup-5.22.265.1012_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\image\TypeIndicator\web3.svg	BSX-Setup-5.22.265.1012_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\translations\qt_cs.qm	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\video_chroma\libgrey_yuv_plugin.dll	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\video_chroma\libyuvp_plugin.dll	BSX-Setup-5.22.265.1012_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\video_output\libdirectdraw_plugin.dll	BSX-Setup-5.22.265.1012_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\image\default_app.svg	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\wallet\logo.svg	BSX-Setup-5.22.265.1012_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\language\vi.qm	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\translations\qtwebengine_locales\fi.pak	BSX-Setup-5.22.265.1012_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\api-ms-win-core-synch-l1-2-0.dll	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\codec\libspudec_plugin.dll	BSX-Setup-5.22.265.1012_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\xplugins\BuriedpointPlugin.dll	BSX-Setup-5.22.265.1012_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\www\images	BSX-Setup-5.22.265.1012_nxt.exe

Executes dropped EXE 4 IoCs

pid	Process
452	BlueStacksInstaller.exe
4120	HD-CheckCpu.exe
2628	HD-CheckCpu.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe

Loads dropped DLL 64 IoCs

pid	Process
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6068	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BlueStacks10Installer_10.42.265.1001_native_36e511ad5a5a4eec0ee44b33ae5b5078_MzsxNSwwOzUsNTsxNQ==_U2lsdmVyIFBhbGFjZQ==.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD-CheckCpu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD-CheckCpu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BSX-Setup-5.22.265.1012_nxt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1404	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345951425984485"	msedge.exe

Modifies registry class 17 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\shell\open\	BSX-Setup-5.22.265.1012_nxt.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	BSX-Setup-5.22.265.1012_nxt.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{B1AC1640-7DC6-449B-BA41-1637D1994B6A}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX	BSX-Setup-5.22.265.1012_nxt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\shell\open\command	BSX-Setup-5.22.265.1012_nxt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\DefaultIcon	BSX-Setup-5.22.265.1012_nxt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\shell	BSX-Setup-5.22.265.1012_nxt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\shell\open	BSX-Setup-5.22.265.1012_nxt.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\URL Protocol	BSX-Setup-5.22.265.1012_nxt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\DefaultIcon\ = "C:\\Program Files (x86)\\BlueStacks X\\BlueStacks X.exe,0"	BSX-Setup-5.22.265.1012_nxt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\shell\	BSX-Setup-5.22.265.1012_nxt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\shell\open\command\ = "\"C:\\Program Files (x86)\\BlueStacks X\\BlueStacks X.exe\" -open \"%1\""	BSX-Setup-5.22.265.1012_nxt.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{A28F599B-1B53-42E3-97CC-6D97DCF04309}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	BSX-Setup-5.22.265.1012_nxt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\ = "URL:BlueStacksX Protocol Handler"	BSX-Setup-5.22.265.1012_nxt.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
452	BlueStacksInstaller.exe
452	BlueStacksInstaller.exe
452	BlueStacksInstaller.exe
452	BlueStacksInstaller.exe
452	BlueStacksInstaller.exe
452	BlueStacksInstaller.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe
6012	BSX-Setup-5.22.265.1012_nxt.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	452	BlueStacksInstaller.exe
Token: SeSecurityPrivilege	6012	BSX-Setup-5.22.265.1012_nxt.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 452	636	BlueStacks10Installer_10.42.265.1001_native_36e511ad5a5a4eec0ee44b33ae5b5078_MzsxNSwwOzUsNTsxNQ==_U2lsdmVyIFBhbGFjZQ==.exe	86
PID 452 wrote to memory of 4120	452	BlueStacksInstaller.exe	92
PID 452 wrote to memory of 2628	452	BlueStacksInstaller.exe	98
PID 452 wrote to memory of 2896	452	BlueStacksInstaller.exe	104
PID 2896 wrote to memory of 1312	2896	msedge.exe	105
PID 1312 wrote to memory of 4460	1312	msedge.exe	106
PID 1312 wrote to memory of 1404	1312	msedge.exe	108
PID 1312 wrote to memory of 1848	1312	msedge.exe	109
PID 1312 wrote to memory of 508	1312	msedge.exe	110
PID 1312 wrote to memory of 1848	1312	msedge.exe	109
PID 1312 wrote to memory of 1848	1312	msedge.exe	109
PID 1312 wrote to memory of 508	1312	msedge.exe	110
PID 1312 wrote to memory of 3180	1312	msedge.exe	111
PID 1312 wrote to memory of 3180	1312	msedge.exe	111
PID 1312 wrote to memory of 3180	1312	msedge.exe	111
PID 1312 wrote to memory of 4976	1312	msedge.exe	112
PID 1312 wrote to memory of 4976	1312	msedge.exe	112
PID 1312 wrote to memory of 4976	1312	msedge.exe	112
PID 1312 wrote to memory of 3768	1312	msedge.exe	113
PID 1312 wrote to memory of 3768	1312	msedge.exe	113
PID 1312 wrote to memory of 3768	1312	msedge.exe	113
PID 1312 wrote to memory of 3688	1312	msedge.exe	114
PID 1312 wrote to memory of 3688	1312	msedge.exe	114
PID 1312 wrote to memory of 3688	1312	msedge.exe	114
PID 1312 wrote to memory of 1640	1312	msedge.exe	116
PID 1312 wrote to memory of 1640	1312	msedge.exe	116
PID 1312 wrote to memory of 2092	1312	msedge.exe	117
PID 1312 wrote to memory of 2092	1312	msedge.exe	117
PID 1312 wrote to memory of 2192	1312	msedge.exe	119
PID 1312 wrote to memory of 2192	1312	msedge.exe	119
PID 1312 wrote to memory of 2192	1312	msedge.exe	119
PID 1312 wrote to memory of 412	1312	msedge.exe	120
PID 1312 wrote to memory of 3824	1312	msedge.exe	121
PID 1312 wrote to memory of 412	1312	msedge.exe	120
PID 1312 wrote to memory of 3824	1312	msedge.exe	121
PID 1312 wrote to memory of 5620	1312	msedge.exe	122
PID 1312 wrote to memory of 5620	1312	msedge.exe	122
PID 1312 wrote to memory of 5688	1312	msedge.exe	124
PID 1312 wrote to memory of 6104	1312	msedge.exe	127
PID 1312 wrote to memory of 6108	1312	msedge.exe	126
PID 1312 wrote to memory of 6104	1312	msedge.exe	127
PID 1312 wrote to memory of 5316	1312	msedge.exe	128
PID 1312 wrote to memory of 5316	1312	msedge.exe	128
PID 1312 wrote to memory of 5672	1312	msedge.exe	129
PID 1312 wrote to memory of 5624	1312	msedge.exe	130
PID 1312 wrote to memory of 5672	1312	msedge.exe	129
PID 1312 wrote to memory of 5624	1312	msedge.exe	130
PID 452 wrote to memory of 6012	452	BlueStacksInstaller.exe	131
PID 1312 wrote to memory of 4992	1312	msedge.exe	133
PID 1312 wrote to memory of 4992	1312	msedge.exe	133
PID 6012 wrote to memory of 5648	6012	BSX-Setup-5.22.265.1012_nxt.exe	136

C:\Users\Admin\AppData\Local\Temp\BlueStacks10Installer_10.42.265.1001_native_36e511ad5a5a4eec0ee44b33ae5b5078_MzsxNSwwOzUsNTsxNQ==_U2lsdmVyIFBhbGFjZQ==.exe
"C:\Users\Admin\AppData\Local\Temp\BlueStacks10Installer_10.42.265.1001_native_36e511ad5a5a4eec0ee44b33ae5b5078_MzsxNSwwOzUsNTsxNQ==_U2lsdmVyIFBhbGFjZQ==.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:636
- C:\Users\Admin\AppData\Local\Temp\7zSC729DDB8\BlueStacksInstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\7zSC729DDB8\BlueStacksInstaller.exe"
  2⤵
  - Downloads MZ/PE file
  - Enumerates connected drives
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:452
- - C:\Users\Admin\AppData\Local\Temp\7zSC729DDB8\HD-CheckCpu.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSC729DDB8\HD-CheckCpu.exe" --cmd checkHypervEnabled
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4120
- - C:\Users\Admin\AppData\Local\Temp\7zSC729DDB8\HD-CheckCpu.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSC729DDB8\HD-CheckCpu.exe" --cmd checkSSE4
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/UnXV7taVs4
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://discord.gg/UnXV7taVs4
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffab77dc188,0x7ffab77dc194,0x7ffab77dc1a0
        5⤵
        
        PID:4460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1748,i,9110054463561378584,959419526999103650,524288 --field-trial-handle=2644,i,3876622038412821612,3752463056121482626,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:1404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,9506903684908404904,13909605247675342793,262144 --field-trial-handle=2644,i,3876622038412821612,3752463056121482626,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:2
        5⤵
        
        PID:1848
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2188,i,10615630230097038665,8667458458103712412,524288 --field-trial-handle=2644,i,3876622038412821612,3752463056121482626,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:8
        5⤵
        
        PID:508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,3555535656305799273,16074721914828629463,2097152 --field-trial-handle=2644,i,3876622038412821612,3752463056121482626,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
        5⤵
        
        PID:3180
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,9359006485213248899,17068343532351811145,2097152 --field-trial-handle=2644,i,3876622038412821612,3752463056121482626,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
        5⤵
        
        PID:4976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4112,i,7570353013189401060,6781082188455086457,2097152 --field-trial-handle=2644,i,3876622038412821612,3752463056121482626,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
        5⤵
        
        PID:3768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,18260029253773174559,11158225836269424889,2097152 --field-trial-handle=2644,i,3876622038412821612,3752463056121482626,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
        5⤵
        
        PID:3688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3648,i,15640591542818247846,2639014325013649952,524288 --field-trial-handle=2644,i,3876622038412821612,3752463056121482626,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:8
        5⤵
        
        PID:1640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5292,i,16451997560224606481,2484039621468039459,524288 --field-trial-handle=2644,i,3876622038412821612,3752463056121482626,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
        5⤵
        
        PID:2092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5452,i,12113484921778401922,10314088644511160942,2097152 --field-trial-handle=2644,i,3876622038412821612,3752463056121482626,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
        5⤵
        
        PID:2192
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4528,i,342552841937041914,18362812070839142128,524288 --field-trial-handle=2644,i,3876622038412821612,3752463056121482626,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
        5⤵
        
        PID:412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5004,i,3807991511942170255,6184791830991803244,524288 --field-trial-handle=2644,i,3876622038412821612,3752463056121482626,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
        5⤵
        
        PID:3824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6216,i,1073643213734502238,13882714407921354331,524288 --field-trial-handle=2644,i,3876622038412821612,3752463056121482626,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
        5⤵
        
        PID:5620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6196,i,3388875616771057006,69805775940190635,524288 --field-trial-handle=2644,i,3876622038412821612,3752463056121482626,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
        5⤵
        
        PID:5628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6196,i,3388875616771057006,69805775940190635,524288 --field-trial-handle=2644,i,3876622038412821612,3752463056121482626,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
        5⤵
        
        PID:5688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6796,i,10631286766118337892,12548354800597693364,524288 --field-trial-handle=2644,i,3876622038412821612,3752463056121482626,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:8
        5⤵
        Modifies registry class
        
        PID:6108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6792,i,10832550688058456319,14398778079760509768,524288 --field-trial-handle=2644,i,3876622038412821612,3752463056121482626,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:8
        5⤵
        
        PID:6104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5112,i,11586801303317910596,12527407143991553358,524288 --field-trial-handle=2644,i,3876622038412821612,3752463056121482626,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:8
        5⤵
        
        PID:5316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5292,i,11889749594296326292,7189645395909270078,524288 --field-trial-handle=2644,i,3876622038412821612,3752463056121482626,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
        5⤵
        
        PID:5672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5316,i,14543591473607523718,12910102045636824523,524288 --field-trial-handle=2644,i,3876622038412821612,3752463056121482626,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
        5⤵
        
        PID:5624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5080,i,10257704550191839233,12024624867126665987,524288 --field-trial-handle=2644,i,3876622038412821612,3752463056121482626,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
        5⤵
        
        PID:4992
- - C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.22.265.1012_nxt.exe
    "C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.22.265.1012_nxt.exe" -s
    3⤵
    - Checks computer location settings
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:6012
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\BlueStacks X\green.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      System Location Discovery: System Language Discovery
      PID:5648
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c green.bat
        5⤵
        Executes a command shell one-liner
        
        PID:6068
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall delete rule name="BlueStacksWeb"
        6⤵
        Modifies Windows Firewall
        
        PID:5544
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall delete rule name="Cloud Game"
        6⤵
        Modifies Windows Firewall
        
        PID:2552
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="BlueStacksWeb" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\BlueStacksWeb.exe"
        6⤵
        Modifies Windows Firewall
        
        PID:5152
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="Cloud Game" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\Cloud Game.exe"
        6⤵
        Modifies Windows Firewall
        
        PID:6824

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2092

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:6948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

close_disabled.svg

Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_disabled.svg
Size 569B
SHA256 8ee5aa84139b2ea5549f7272523aeb203d73954c5ccdcf6f7407bf1a3469f13e
MD5 e7fdf6a9c8cae1fc1108dc5a803a1905
SHA1 2853f9ff5e63685ebb1449dcf693176b17e4ab60
SHA512 a6388b24926934e20ccf7fcab41bd219dc6c0053428481d7f466bf89f26bf1a36fdff716a9ddd9ab268df73b04dff1449c6bac1f5c707e31ae2ee71c2087e0d9
TLSH
T190F0593F02AA213FF540C60C5BAAA5D92F9CD4ABB2852008739D2325CF08C93647A299
MD5 SHA1 SHA512 TLSH

Submit Download

close_hover.svg

Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_hover.svg
Size 653B
SHA256 1bca2e912184b8168ee8961de68d1d839f4f9827fde6f48ab100fb61e82eff90
MD5 76166804e6ce35e8a0c92917b8abc071
SHA1 8bd38726a11a9633ac937b9c6f205ce5d36348b0
SHA512 93c4f1af7e9f89091a207ab308e05ddd4c92406c039f7465d3b8aca7e0cc7a6c922a22e1eee2f5c88db5e89016ef69294b2a0905d7d6a90fd32835bc11929005
TLSH
T1C2F07D3772A99EAD94400F0C9B3CEB49D7346327F5FA5040336F64154F824839B356B5
MD5 SHA1 SHA512 TLSH

Submit Download

close_normal.svg

Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_normal.svg
Size 569B
SHA256 92aeae68e9e0973d9e0dc575941f1cb2e24afd0574341a46b870be7384eaa537
MD5 3221ac69d7facd8aa90ffa15aea991b0
SHA1 e0571f30f4708ec78addc726a743679ca0f05e45
SHA512 5e2de0abfe60a4db16ea5e8739260c19962fbfc60869a77bde6ab3547ad8ee3ad88e74e97da31fa23be096afddad018e431d152d6d0fa21a75357a11dacb1328
TLSH
T1B4F0593F02AA213FF540D7085BAAA9D93B9CD56BB2852018739D2325CF08C83647A299
MD5 SHA1 SHA512 TLSH

Submit Download

close_pressed.svg

Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_pressed.svg
Size 653B
SHA256 9585f41eb6202e89f2087266fa31852d7f41ca8cc659b907c96753fe165f937d
MD5 dfddf8d0788988c3e48fcbfb2a76cd20
SHA1 463bb61f0012289e860c32f1885a3a8f57467f2e
SHA512 e708c5114c60f7574589d6a56c9faedda26ee4a40f0eeb25f5e12eadcf790f24fdbf393fa0aa6ad449b5337d625b092d6f8822472fa8a6ce1339aca59c50c3ca
TLSH
T1A3F07D3762699EAD94400F0C9B3CAB49D7746327F5FA5040336F64144F8248397356B5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 24c133ed61416156a3d0b4fa00bfca479eb7ecb5184955e998fbedcca605f8b1
MD5 b90ecf74a561822627982f1b8d4c4873
SHA1 3340a2b49ee7948da3345fd34ecb2ab68420b586
SHA512 eb4373bf9ed3d7960d90950f6ae991a5e15a049a12d096bc176bd999a7c117e37d44210634cdfb6f388be8a9ac75d4920be8d0f0c23e0873f2a14b925d350604
TLSH
T1BBD08025C9F46FD5E037103D012241447ECC95665B023116E169156E19955D71E61891
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
MD5 3bc9cc32c2de3150dc7916bb61984962
SHA1 d75ba9bc7ad74cb95dcb4ec6de6e6b18f5813a04
SHA512 fd090e624e91a98337689ed57390fc5813fab21acd3af426c9de6566ea4d92a7875c4f92a1b64d547eaf9ce40cad3d8a85472a30cf521aea6198cf74b69805ac
TLSH
T12ED02232ABF00E82C80B0032082082880F08C03C0800B323A23C20AE2A82CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 83e8dd5307ae7771b3de1a15350f10f4f9856d15287ed3b5d40e5b2cdf94c46f
MD5 4eb2ca40072faa9c8668003e90981d15
SHA1 c883410a5145a7fa06fd0c58c67452d5ef09564a
SHA512 12c1ee6bc0d1ad989342160bd280c47a09a91731ae934cc476e325c5c5b107572a3496e5864f6ea77e9216d213c75ca7cd05fb78894b32bc518462ed7ac72f5e
SSDEEP 192:1OH6R8VJgra+jZMma5cdsnP0sM5X/POtf:1OH6R2gTo5WsnP0scXXyf
TLSH
T11F22A5637DEEE0E0FBA573F194C91FA730B2A15CDEC70EA52487F8B66046B6154A0B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe593b4a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593b4a.TMP
Size 3KB
SHA256 deef2094e4aeb9cdddfc36199eb88bbab63fbba070aee8eecb5fa7730dd57add
MD5 182c5e56805180e28bf86be0b15d4ead
SHA1 6bb8bfd8090071ae3e00cfa9b685452e7a3cd347
SHA512 21206ca335b193dc41ded69912d7698758868802d9ebbb01e98755967042a35878a215d9c37301b3dcf3d34050253a32c345231250623d7452127991d6e6148f
TLSH
T18461B5C01EBAF5A8FBF84374C5DA136738F498B8358B1F52105BC1B9A40B72559C032B
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1a21ea22583fffa183afee243e9a91f8ffcd768ed4d3a2c2f730d196caa6fb80
MD5 5f229be5f97468611cbb1dd383216572
SHA1 69c61a9a33c702427105ab68c47c07508ab3053c
SHA512 2e0a7f76e2ba79e29de6a1280d7e6ec64e955cc68d0810c2a20a4e7a7b9cea7d2355e6ee5c24109fed536a08a574ed79a59f996a7923b53029ce9841104644ac
TLSH
T130518DF3C7E8862DCA0156F4AA146E2BCE2D0954431C3C2AC5D49E1FA7E25B1F14159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 fd7a33b39d7da61c322061ec6821c876842f0abe1d383c002c14a1669c52ad01
MD5 1822e43fa5ce1d0ad7eab43abf317949
SHA1 2c59282d74b9b10b3362e7245c1cec2559ccd863
SHA512 4bd63d6b4a099378655634af98a56789729a5ee3a6fe63882e27275e4fa290c3f25879103b0ccc4292acc025649474705b24011370b6119ff17dd60b4cf5264c
SSDEEP 192:sxZiRCZq/f/scWpVDj5A6IdpEKHW6+WN3iX8/eBNY1cqIgboJ:sxZiAq/f/scWvDNATTHb9/ekg
TLSH
T12632C816AD28697B8CC6D61DBA25BF13D6F9503295D10E48AAFC8A1C04EB7DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 598f86341a237538d5167915c7c9801a8f783f253f1867183a5a73f2b2c6880f
MD5 ab629eb5987d5f7912f5be80d647f06d
SHA1 9b3a491f3d70b5091daca3fe5f2ece482098ebe9
SHA512 f3af93ece6986d43d3f4e8b8f956bb1f16c93032c33eb791475dba49d332319c46833682b0766f05ded40299a4d13508a4921e8703a21a6d94067b786f01fe0a
SSDEEP 192:sxZiRqsq/f/sxrEdpEKHW6+WNzX8/YgtmIIg4J:sxZilq/f/sxoTHbg/Rc
TLSH
T18B12A956AE28A97B8CC7D61DBB25BF53D1F9503295D11E48A6FC861C04E67CD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 fc8e3d9cd3b54c6928c8678060d4387dd65903f717ad7b333b414024a1e17c12
MD5 a7e8bc0894efb492a930599f93d3ab90
SHA1 7d7266d740e770e3d31225aa4010f2e8303ed903
SHA512 6ccfe5ea0c126c07a159dcd45721a4460f8c50c18a1d2fb3416b08267a333f10a68d2887acb7e46897a2a2f1fe4123542ee4f8ef612c8b35d45d7e6763821018
SSDEEP 192:sxZiRqZq/f/sRj5A6IdpEKHW6+WNzX8/eBNgtmIIg5oJ:sxZisq/f/sRNATTHbg/eCi
TLSH
T1EE32C956AE28A97B4CC7D61DBA25BF53D6F9503295D00E48AAFC861C04EB7DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c980b250be1000a7e3cda7bd20699f06609959f6f38f05e46666063eac4590e5
MD5 6e98fbdb68cb0224194dca6195e012f9
SHA1 f16ff587c51edc705d4b072f7f3942f3403f9edc
SHA512 57782c85231d4600ea28153905f2c7aef1c929214fe951e5667f9bc4f348458d32f50eef49f38eeb4f169c41fbdeb761da29a6946daf6a1afbbc99f5491503e8
SSDEEP 768:vsichkPWvPZhl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVv+LlEKXzsrooXLq:vsichkPWvPZhlu1jao+LKgz36q
TLSH
T10FC2F97B640CCA7E4FC00E9DDD1A6F9A6EA802C7A6548D4047FE984C02C77EE61264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 a7e25546ea19cbb651c94df6dd98cda62c92f611c52370eb857d20ec4880e06f
MD5 710ce1ad59393bdc219713fb35aef252
SHA1 0e3c07373422e80537c79ffd3e6b617ada748faf
SHA512 20027b2317ee3461e228f3a2d4ebb34fca529fe6148be1f84de9f0a8d5936294963a2074c98c5411caa20ecd94e1ad1f45726e30176138bbeb43d62d50e85026
TLSH
T113D0979BD8E11E80CEAA0A41762210A747A12CC8198880ACE402343D08B0A03D226EAA
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 6b4a2f0433325968fead540ce0c2c510dff3a51a82d4f6045a5e97165922b9b1
MD5 fbe6008ab0dcbe965e81b8f3c46ebd7f
SHA1 4945f283e62c10a58ed15ef1bfc120a48dbcef77
SHA512 f233703c18353f5a14f7e08ce71a6c70cee8d13f51177b20ee67f12efb4f2372b39d9dfe340e7aa218859930882dae628070dd696d816a58b9f47276642cf611
TLSH
T10DD097ABE0945E80CEAE0B503622106B47512CC8294880ACF40208394CA1A03D102EAA
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58febe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe58febe.TMP
Size 138B
SHA256 3b6ba4b9ea4a9a7effcc0402a6f3e2ffb3c24ef23ff308ec3be3987cb2c9695b
MD5 1c0a6574409b3ae6e0f8bc2e4cbc0127
SHA1 53d15b64159388f0e6d0fbdd04b92393c60b4043
SHA512 2ebb37cb0788c15cc8cadaae0cd484f93b43e4456056b7b1488639ceb91c9b8f41c9f70e0234901c9cc5520be857e1ed19b80ac3bc847348444b0c49e39b1ef5
TLSH
T1B2C02BEBE4840901C72C07508333014D8B452CDC0C89888C7413303C1870F136103FF6
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 54df37ed08387b559d6baef03e533d8e1471f5e7c59ceda799a2074a4e74ac7a
MD5 d91eaa560a160ee62bc36ed78eca4294
SHA1 ad49e6e057e7984b772c41852b359d3a590dc0e8
SHA512 dc122daea12d0840e9bfeb2d83a67a40980ed786e4e2b235decc7072f30395416de07d80b55af5443f2dadc2b0fc74a0a6c2508f13df068ca3c6974801e4f240
SSDEEP 48:K0wfWaAqefbWt2ISyfK9O1UfxoPYVGu0yLVUplXD34brOrIS94K9d1P4x9oYePPV:K4HmKg4Gyq8K7qodeKGYiGXaKo8d
TLSH
T106B1780631BB121138BE294C91A1962F524632723168F93F7FBE11E64E6AF181DFF5C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9c37f13edaa16915dcf7d5326e6d478794feee71f6206460934f47c0ac055b1c
MD5 363a77bcfc3d46a5caff03b6601cfde1
SHA1 790ef1d475f8414c25cc60cea12cc217799c4f6a
SHA512 4fa3f39688c1021e9b8f5ec33f2a596bab569e1e746eadf39a3ca3f4e12483fd96bafef2b652baf62fa6eb484ee379a145e4efdf161259f19172c19c71dbfa66
SSDEEP 384:nhZcIhsNFxBxDAAC5MIFBGYX5EOFNMSy0/upa7dLKkVl0o5:ph+bC5XGYuOFuB0Sa7dLKkX0u
TLSH
T1F1827D76DCB49C771CFBA655F44A39034EF880279AC9AF8495FD6B1D00EB598130B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 014d220b8f56392cbf8ab6600cf18500dfe6671df464cf95f55b688ec69cec7c
MD5 198b1906b6e02282fb98cb9c7959665d
SHA1 31722500bb1a6747147c33cb6ca9a977ef71d90f
SHA512 9bf999ae60cf78817a5014e8a847fdd1d593382d028edce4ffb4d89a78c66effc76652cfeff269ebbf4759531e09fb6d306067f2469926f92b2b09d98426ca3b
SSDEEP 192:LJONs6DphmqQmiUyNdq8wGYX59ezvCnyRykk7XYU6:lONs619MRwGYX5EOHoU6
TLSH
T1A102E935E8B87C7B8DE36E45B5872A135FD8212BAA956F44D6E81E1C00D768C1307937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d07db1a0cab14b2d519fb70b1c1ec1e67ed4ff16e51274555666d7e67c09c8dd
MD5 a00df376043626d346981c575842dacc
SHA1 859be9f4bebeb40f828b1c192fbb63a43e06e613
SHA512 78b9bb9f2417f0f13a6bc75f8a0e5249a10ad52a0654f800fc043295a7040fdebcd1810e771a24b4926ba4dd46d8bf65d4e36629d6dd81c858181f2618fb3954
SSDEEP 192:LJONw6DphYqQmiUyOd3wGYX59ezvCnyRWNde+kIISCr/5bU6:lONw61j13wGYX5EOFNMSyU6
TLSH
T1A512E836E8B8BC7B5DD39991B48735035EA8512BEB896F5096EC2E1C00DF69C130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 ef4d9e18e440bbc4bb781e10fc1e1625d1a5cd2c80de077297841a8f686f1a4d
MD5 7f6b9df87e9b516450f8e45939cd297d
SHA1 574f8b3acaf61ef9d7f41a2c87e8d651c0b5a4bf
SHA512 a5ef4361154fb3aa3bbd50cb7b3970282d5f60a820a116dec0a15fa5ea97916660ae2d96ba64c8aeebaad648919beddccca7eb312fefa989b1cae0b6781fb08e
SSDEEP 384:ntZcI6sNFxBxDAAC5vMFBGYX5EOFNMOrAStS8ZOlA9vG0/upa7dLKkVl0o5:16+bCKXGYuOFuTSYlA9vG0Sa7dLKkX0u
TLSH
T1ADA24AB5C8B46CF748F6E9C5A446F5036EA8413B85986A4CD6FD7B3D309F9F80312826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ce8197a5cbf498558eea4d21c2ff86bfa4ac468244fc41256f786cc890e47064
MD5 7ef660ea4edb8f3f82536383b26eb723
SHA1 45d18f88911011970fed93751c883b73647cea54
SHA512 8055a18fff68e4b7c51af2ac6c814f90d14eb8f214f2e691ea72bcb82fc68441c37e811c4989a0e5e38a710dc3edfec5090fccf5b104a2194ead4c8e3d90f492
SSDEEP 384:nhZcI6sNFxBxDAAC5e6FBGYX5EOFNMSy0/upa7dLKkVl0o5:p6+bCLXGYuOFuB0Sa7dLKkX0u
TLSH
T12E827C769CB49C771CFBA655F44639034EB8C0279AC9AF8495FD5B0D00EB698130B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0cb5b637-6c64-4a45-96fe-0322bfcac4ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0cb5b637-6c64-4a45-96fe-0322bfcac4ac.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

726e3531-c968-44ee-9615-5d4e4a8c6ac3.tmp

Path C:\Users\Admin\AppData\Local\Temp\726e3531-c968-44ee-9615-5d4e4a8c6ac3.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

backicon.png

Path C:\Users\Admin\AppData\Local\Temp\7zSC729DDB8\Assets\backicon.png
Size 15KB
SHA256 fa64884054171515e97b78aaa1aad1ec5baa9d1daf9c682e0b3fb4a41a9cb1c1
MD5 7ff5dc8270b5fa7ef6c4a1420bd67a7f
SHA1 b224300372feaa97d882ca2552b227c0f2ef4e3e
SHA512 f0d5a842a01b99f189f3d46ab59d2c388a974951b042b25bbce54a15f5a3f386984d19cfca22ba1440eebd79260066a37dfeff6cb0d1332fca136add14488eef
SSDEEP 48:b//6zMh8k29WJsEvda/PSeld0/u1BLW3qLWoxN+Y9rNGZGvsc5uG7yUWT:b/Ss8kEWmkGPMAxNXrNGZGvsc5VyUA
TLSH
T1D36250A4FDF17565D849F6321DC168068C730B83EA809C86BACE8D277F01BE98C4F196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

change_hover.png

Path C:\Users\Admin\AppData\Local\Temp\7zSC729DDB8\Assets\change_hover.png
Size 310B
SHA256 8e5847487da148ebb3ea029cc92165afd215cdc08f7122271e13eb37f94e6dc1
MD5 57092634754fc26e5515e3ed5ca7d461
SHA1 3ae4d01db9d6bba535f5292298502193dfc02710
SHA512 553baf9967847292c8e9249dc3b1d55069f51c79f4d1d3832a0036e79691f433a3ce8296a68c774b5797caf7000037637ce61b8365885d2a4eed3ff0730e5e2a
TLSH
T14AE02DC28308903CC3070C22602281E6E63E04D4292238024890C2382E64D0CD4187B1
MD5 SHA1 SHA512 TLSH

Submit Download

close_red.png

Path C:\Users\Admin\AppData\Local\Temp\7zSC729DDB8\Assets\close_red.png
Size 15KB
SHA256 d0b6d143642d356b40c47459a996131a344cade6bb86158f1b74693426b09bfb
MD5 93216b2f9d66d423b3e1311c0573332d
SHA1 5efaebec5f20f91f164f80d1e36f98c9ddaff805
SHA512 922a7292de627c5e637818556d25d9842a88e89f2b198885835925679500dfd44a1e25ce79e521e63c4f84a6b0bd6bf98e46143ad8cee80ecdbaf3d3bc0f3a32
SSDEEP 48:2/6FwMlYk29WJsEvkch6/Clu5tlL88Lem/fLu5A/luaxN+Y97sc52G7Z+EazEyIc:2SFvYkEWmDCccHAxNX7sc5dZabT
TLSH
T1CA625065BDF075A65589F5322CC564055C730B83DAC09C88FACE5C2B6F01BEA9C1F58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

custom.png

Path C:\Users\Admin\AppData\Local\Temp\7zSC729DDB8\Assets\custom.png
Size 17KB
SHA256 fbece8bb5f4dfa55dcfbf41151b10608af807b9477e99acf0940954a11e68f7b
MD5 03b17f0b1c067826b0fcc6746cced2cb
SHA1 e07e4434e10df4d6c81b55fceb6eca2281362477
SHA512 67c78ec01e20e9c8d9cdbba665bb2fd2bb150356f30b88d3d400bbdb0ae92010f5d7bcb683dcf6f895722a9151d8e669d8bef913eb6e728ba56bb02f264573b2
SSDEEP 96:wkEWMrbxNXW5G53p1pCcXdV8WMIPX7kTCM4:wkEdV8WM4YWM4
TLSH
T168727229FDF2B2EC450A523339C654015D7307C3E681AC85BACE8D162F21BDD8C8F659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

discord_icon.png

Path C:\Users\Admin\AppData\Local\Temp\7zSC729DDB8\Assets\discord_icon.png
Size 564B
SHA256 c29b35c6be50f9e34f1120bd346ce01884f0c7ba1121c866d95b24e46e420b0c
MD5 9354bc445e979c2de9b9eedd9b7c8318
SHA1 8dc3e8fdcad0fcdad1fe19b0b94b676e8846affd
SHA512 ad13f6bf46dd8cb48a030e720c1c577a22b0d3dec794ae807aa482474fe6c2bead7fc63dd45983fb3ab82034d74d4f10b6d9967d4ff677d2226c6c18ee03a4d6
TLSH
T118F096F97D43D827F042101E764B64906C35F5782B32BB2E7588800C790F7B8522B6B0
MD5 SHA1 SHA512 TLSH

Submit Download

discord_icon_hover.png

Path C:\Users\Admin\AppData\Local\Temp\7zSC729DDB8\Assets\discord_icon_hover.png
Size 512B
SHA256 6b126c8a7015c2274e6a2ac969e0f31ecae421e1652b446b2aafd2b03d0dc3f5
MD5 c11cc6a9edff1694a71584413dd47dfd
SHA1 3b84fbfab8b53db95e8fb1b409193624fc8359dd
SHA512 bdf3ff3a1b8022521cba870334b11bd9c877b84bf134fc4710f0c9e8fe3703a2604915a24ae6738a3099b7e80f0f5a8d9b161c74fc36ee217e05581d88d728ee
TLSH
T17AF0C486D8980C3FCF0F433F8C2C20EA8738400F379252088C28D6E535E9C022768F02
MD5 SHA1 SHA512 TLSH

Submit Download

folder.png

Path C:\Users\Admin\AppData\Local\Temp\7zSC729DDB8\Assets\folder.png
Size 298B
SHA256 7ffa875fab1be82e384022a27f3e627ab75131eb168be949cc83c03b6e291bbf
MD5 8fc519ef684dc58830e462581184eb15
SHA1 cba35cdbb9b87c359b287b13c30a4d2984289ed6
SHA512 fb5cd6fde1b04901cc25508e7011250645d74eafd58a415b2702b04860d76266e0d6a8e9686532a946b2e534bce5cddab53f7f030930852dd4a030e1e4e49f8a
TLSH
T17EE07DD5936D2DAE6CAB812D06364647947B55192451000CDD057568212C96BE05B702
MD5 SHA1 SHA512 TLSH

Submit Download

help_icon.png

Path C:\Users\Admin\AppData\Local\Temp\7zSC729DDB8\Assets\help_icon.png
Size 1KB
SHA256 97c7450d55ecda9017d0a9eed0049b8176e1828f3525aaf5660985ba214010cc
MD5 3c955d2be56f76de8a53f77e816f3fb8
SHA1 0c242256f7934e2d857f657ddc7f50589cf489f1
SHA512 2b4ce8453960de520bdccb658d72b55be3c3386b1d394f3acf7269405971843083d0e04d3af05758ac4b8d191ea6a61ea5313a07fa849bcdf1f8eb4d5624521c
TLSH
T18711E9C919D95DF055BB43FB00D407175F784E7225ADC34DF296653C981ED21506C78A
MD5 SHA1 SHA512 TLSH

Submit Download

info_icon.png

Path C:\Users\Admin\AppData\Local\Temp\7zSC729DDB8\Assets\info_icon.png
Size 929B
SHA256 ee91e51aaa8356318cc75d60476d9422bf84be7d8a25e1b884aa16c3198dc764
MD5 8f73ec5e7100a0ec232e06e5b3786963
SHA1 15c7bb268803932192a064a4eedc9db42bd6c37c
SHA512 c628dede37fec439a849ab6704046210bdabb1bb576a5c5dae9a28b52ad021307347211ba2aecb47ef836f14e914ba18617b21863bce12bc406513f45c9eb66e
TLSH
T14B11C89128DD586A881E02B2951D97021FFEE03F89B4F40A3D83205F2821045B04A94B
MD5 SHA1 SHA512 TLSH

Submit Download

installer_bg.jpg

Path C:\Users\Admin\AppData\Local\Temp\7zSC729DDB8\Assets\installer_bg.jpg
Size 78KB
SHA256 4c7471c986e16de0cd451be27d4b3171e595fe2916b4b3bf7ca52df6ec368904
MD5 3478e24ba1dd52c80a0ff0d43828b6b5
SHA1 b5b13bbf3fb645efb81d3562296599e76a2abac0
SHA512 5c8c9cc76d6dbc7ce482d0d1b6c2f3d48a7a510cd9ed01c191328763e1bccb56daeb3d18c33a9b10ac7c9780127007aa13799fa82d838de27fbe0a02ad98119d
SSDEEP 1536:/8jAVIA5IyKedQSsmprMWI/xKdefJeGhuvIDU1pY7EQGZRV3/X35ev:IAVPVsylI/xJfJHovsU1poEBZP/H5ev
TLSH
T15473F1DC3E9FDDD855E1A3964224A3ED3E99B85E258FFD8CB8200506705A4E37DE7012
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_logo.png

Path C:\Users\Admin\AppData\Local\Temp\7zSC729DDB8\Assets\installer_logo.png
Size 9KB
SHA256 462b64f2e016d25a2a6a653ba896206129c4ac841d61a6c2fd116009606f7e1c
MD5 f9db10032266ce8276c922b24de2d60f
SHA1 9c7bc3e277a58c4b59e35b9622e2b7f076ebb2fc
SHA512 9e5e1e345815ff9e815f63a892724bccb2b1fe19d5db91750f681899af6ba52aa3fc9214ef6bcc691a1e7ab9a1c16c093c398544e1f57f0ad5dc883776f657b6
SSDEEP 192:fsCXsMtWAC+DwSuWzRNrk2SEDAnQfQhzNoxiw2H6v3LGAEv3BsBW/V:fsCXs1Az4WVNrLnDAnDboG5AkxeuV
TLSH
T1C322CFA1101DF0A3E72A94B1D0D97E6D936F790D3BFB710D86802DEA80930680359FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_minimize.png

Path C:\Users\Admin\AppData\Local\Temp\7zSC729DDB8\Assets\installer_minimize.png
Size 113B
SHA256 a064f417e3c2b8f3121a14bbded268b2cdf635706880b7006f931de31476bbc2
MD5 38b539a1e4229738e5c196eedb4eb225
SHA1 f027b08dce77c47aaed75a28a2fce218ff8c936c
SHA512 2ce433689a94fae454ef65e0e9ec33657b89718bbb5a038bf32950f6d68722803922f3a427278bad432395a1716523e589463fcce4279dc2a895fd77434821cc
TLSH
T162B02BC13608FC34C64E0935416290009921001D011024101E0500680C1B19051A4F00
MD5 SHA1 SHA512 TLSH

Submit Download

loader.png

Path C:\Users\Admin\AppData\Local\Temp\7zSC729DDB8\Assets\loader.png
Size 279B
SHA256 076263cc65f9824f4f82eb6beaa594d1df90218a2ee21664cf209181557e04b1
MD5 03903fd42ed2ee3cb014f0f3b410bcb4
SHA1 762a95240607fe8a304867a46bc2d677f494f5c2
SHA512 8b0e717268590e5287c07598a06d89220c5e9a33cd1c29c55f8720321f4b3efc869d20c61fcc892e13188d77f0fdc4c73a2ee6dece174bf876fcc3a6c5683857
TLSH
T17FD0EB93F339AC52F8018213C788083CD2FA26852E476E4C022A8CB60280D3E8AE018B
MD5 SHA1 SHA512 TLSH

Submit Download

logo_text.png

Path C:\Users\Admin\AppData\Local\Temp\7zSC729DDB8\Assets\logo_text.png
Size 4KB
SHA256 66df86129129d8aa8dd3ba014eb3b3c27a36c22e4782f3dbd6a9a4bc1f4a87bc
MD5 1fbdb2b7efcae8e9f26b6536ab580968
SHA1 126386cb7c0e8a03d99acb19ec2b13a70114a7d5
SHA512 1a0218122948b7d93dd473f21512bd2411f902ff133b15bf80d36ff474cf29d53880ed0ab38ef76d8288784817e6fc49f54d85f106c97f620331e31d03d6fa73
SSDEEP 96:ucBdj0UbKsYpguE2VTlrtyQnN9EHRs8nTOCCC2Jm0ciOqT3YKU6Y4R4MKYb+OI:u2yVQQYQnARxTGJmxiOKYM6WSOI
TLSH
T148A19FC5C2856BF4B85286C79713EC474513D2052200AB171DF47CEF9441A21AF60EFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setpath.png

Path C:\Users\Admin\AppData\Local\Temp\7zSC729DDB8\Assets\setpath.png
Size 15KB
SHA256 5bbb2f41f9f3a805986c3c88a639bcc22d90067d4b8de9f1e21e3cf9e5c1766b
MD5 b2e7f40179744c74fded932e829cb12a
SHA1 a0059ab8158a497d2cf583a292b13f87326ec3f0
SHA512 b95b7ebdb4a74639276eaa5c055fd8d9431e2f58a5f7c57303f7cf22e8b599f6f2a7852074cf71b19b49eb31cc9bf2509aedf41d608981d116e49a00030c797c
SSDEEP 96:iS5YkEWmE5+W+BxNXrNGyxGvsc5RxZ8af:iSqk6C+z5mf
TLSH
T10E624E65FDF0B565D989E2322DC928025C730B83D6809D45BACE8CA72F00BE98D5F593
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlueStacksInstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC729DDB8\BlueStacksInstaller.exe
Size 648KB
SHA256 15de7af7ecd98f14b1b247d028c31e5d36a86840c3159fb8b65354e953e45c1f
MD5 902d41015471f7df917b423269f49328
SHA1 a30d362fcb37cd94e0ce90877392ad0f10663998
SHA512 9832c55ed9a8a013145fe1a53418f5b079d41e172352851de8d6ef824be925a7abf65a0cf12c1ea8b4124bc62900ce964641111ec007a650236a53c2fead520e
SSDEEP 6144:oOiCs6qp+yhejcfJwGBvBcIfOS3Yy2L4YPSBBcp+zSs88vB5bqlMCQVbDNYb:o3pPufIWW64YqBue88vB5b6MCyNYb
TLSH
T125E4198423F48826F2BF4FB9D9F25F174A31F8467AA2D65E4141184E2DB1F019EA2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlueStacksInstaller.exe.config

Path C:\Users\Admin\AppData\Local\Temp\7zSC729DDB8\BlueStacksInstaller.exe.config
Size 324B
SHA256 d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb
MD5 1b456d88546e29f4f007cd0bf1025703
SHA1 e5c444fcfe5baf2ef71c1813afc3f2c1100cab86
SHA512 c545e416c841b8786e4589fc9ca2b732b16cdd759813ec03f558332f2436f165ec1ad2fbc65012b5709fa19ff1e8396639c17bfad150cabeb51328a39ea556e6
TLSH
T1C9E0C21941D8FD2B5D734B13A3128852EFB0A2A391A4544CF0EE7F830F3308A6697332
MD5 SHA1 SHA512 TLSH

Submit Download

HD-CheckCpu.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC729DDB8\HD-CheckCpu.exe
Size 200KB
SHA256 2e14887f3432b4a313442247fc669f891dbdad7ef1a2d371466a2afa88074a4c
MD5 81234fd9895897b8d1f5e6772a1b38d0
SHA1 80b2fec4a85ed90c4db2f09b63bd8f37038db0d3
SHA512 4c924d6524dc2c7d834bfc1a0d98b21753a7bf1e94b1c2c6650f755e6f265512d3a963bc7bc745351f79f547add57c37e29ba9270707edbf62b60df3a541bc16
SSDEEP 3072:KjDeWjpu716WoCYv8NBa3eSx8LHGYwj6V4NL1q7HOAg0FujFfnk601hWNxK:opcoCYv8Xa3eSqL8j/3AOpNq
TLSH
T1FA147C10B4C18433D9B715314DF8DAB99A3DB8110B2559EB73D80B7E4F346E3BA31A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JSON.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC729DDB8\JSON.dll
Size 411KB
SHA256 d2c8d26f95f55431e632c8581154db7c19547b656380e051194a9d2583dd2156
MD5 f5fd966e29f5c359f78cb61a571d1be4
SHA1 a55e7ed593b4bc7a77586da0f1223cfd9d51a233
SHA512 d99e6fe250bb106257f86135938635f6e7ad689b2c11a96bb274f4c4c5e9a85cfacba40122dbc953f77b5d33d886c6af30bff821f10945e15b21a24b66f6c8be
SSDEEP 6144:GmyZXnmtWrnngnnnKnanlywwwBwwA5wwwwswww+wwwGwwwbwwwLwwwwwwwwwnwwd:GmIWtWrnngnnnKnanxNYhX
TLSH
T11F947250D8535838CA244778BA7396B02DF9EC718A07E6716B207EE7F13BA20ED75532
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i18n.en-US.txt

Path C:\Users\Admin\AppData\Local\Temp\7zSC729DDB8\Locales\i18n.en-US.txt
Size 22KB
SHA256 8936455d79f33eb298869f1654286db493fb5b11b580ef7e8d859ce63541ba91
MD5 9cceee1d4dbebd6e2ae5fb017f48d443
SHA1 fa3eb52b2f1dc3a627be05c33d1db434fef252c9
SHA512 81459ff26bb670c4b1e071dba1f0a1e52d6e2cd0ca4f39845e4b274b49e47e3f792717824b375a23f868d71b0156ab268719425bc0405432c60d3078cbb7aef8
SSDEEP 384:aBvGq6rKPsL/ds89JplYTWfUvcABRGjV+qXOJtUmEIpNGU6+FKvtCFV30Y4TWEa5:aBvGqaKPsL/ds893l+WfacWRGjV+qXOB
TLSH
T110A21A8BD777136CAAD1011A94E93542B517B36B33683A11BCACC07B1B5790E133EADE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThemeFile

Path C:\Users\Admin\AppData\Local\Temp\7zSC729DDB8\ThemeFile
Size 80KB
SHA256 de1a2e6b560e036da5ea6b042e29e81a5bfcf67dde89670c332fc5199e811ba6
MD5 c3e6bab4f92ee40b9453821136878993
SHA1 94493a6b3dfb3135e5775b7d3be227659856fbc4
SHA512 a64b6b06b3a0f3591892b60e59699682700f4018b898efe55d6bd5fb417965a55027671c58092d1eb7e21c2dbac42bc68dfb8c70468d98bed45a8cff0e945895
SSDEEP 1536:Vq0UZUzBB6YjhX8knUVXVqlp1D88p/LUP8f/MPFntuevdxG+PchojU1yZwbP8fZS:pUFmL
TLSH
T178832B9DEADD3C39323F52AEB6361453C847301B7912896ABA1F21215FBC89F3417B25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6632570-f445-4ce1-919e-55cf069ad004.tmp

Path C:\Users\Admin\AppData\Local\Temp\f6632570-f445-4ce1-919e-55cf069ad004.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BgWorker.dll

Path C:\Users\Admin\AppData\Local\Temp\nseE9D.tmp\BgWorker.dll
Size 12KB
SHA256 a9e4f7ec65670d2ce375ffaf09b6d07f4cd531132ca002452287a4d540154a38
MD5 36c81676ada53ceb99e06693108d8cce
SHA1 d31fa4aebd584238b3edc4768dd5414494610889
SHA512 1300de7b3e1ac9e706e0aad0b70e3e2a21db8c860e05b314a52e63dd66b5dffdf6be1e38ab6ede13bfd3a64631cc909486bf4b1403e7d821e3b566edc514c63c
SSDEEP 192:W9Hsl/fIYiYF8LgaL2AMkKieowU+noPOJB3hy2sE9jBF0NyZKlH6JqEHma:LIYiVLpMNiuPxh8E9VF0NyZ6aJqEHN
TLSH
T1C1425C7709985C16DD1B6D3070C4963AAE36A6865AD082E3322FC1515B84381BBFE3BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nseE9D.tmp\System.dll
Size 11KB
SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
MD5 959ea64598b9a3e494c00e8fa793be7e
SHA1 40f284a3b92c2f04b1038def79579d4b3d066ee0
SHA512 5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
SSDEEP 192:sRer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4Sy+Xe:s67Xws4FVWig86/5eCBqSy+Xe
TLSH
T1B3322A2657B0D2F2E6A1827408A639336BBA762412B50D1BDFF74481FC15BC67E39327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nseE9D.tmp\nsDialogs.dll
Size 9KB
SHA256 2bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e
MD5 f7b92b78f1a00a872c8a38f40afa7d65
SHA1 872522498f69ad49270190c74cf3af28862057f2
SHA512 3ad6afa6269b48f238b48cf09eeefdef03b58bab4e25282c8c2887b4509856cf5cbb0223fbb06c822fb745aeea000dd1eee878df46ad0ba7f2ef520a7a607f79
SSDEEP 192:y1zQhZDqlJcKISw99ioU3MSfwLF/+nhHUisdz:ozoZDGKYw9goWyFGBU7z
TLSH
T1DB121B626688D5BBD2D1223636A92701DBF97328F0666C05D7B34E467DA42C67E39302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDui.dll

Path C:\Users\Admin\AppData\Local\Temp\nseE9D.tmp\nsDui.dll
Size 3.0MB
SHA256 4a7eafae1daeb3a5fe2bb618a2ad14b88e8be2a24f7bb63372b3a4455b319941
MD5 5e1acf5870c98de8481ee674ffa354cb
SHA1 81cb2d2628ad13881851f4c95261a711379cf051
SHA512 106c2c131fa207eb90ff32062684fe6354b1933c4d0190bbd6632f5d1f25c773ffbc4e21c3e18cc0ff4f603128de07e088befe3dd5cc4810049bb05a0ff35ef4
SSDEEP 49152:cg3eJdDJmTRf9c3F3YshhAzxeOIqu2mhdgWuNMrr5vyxLr2h9:cOVcKsh6zgR2mhKWIMHFyZ2
TLSH
T187E57B08A501D036D9A70BF69979AF7B4928F920372650DFB1C06E657A70DD06FB323B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nseE9D.tmp\nsis7z.dll
Size 434KB
SHA256 a896a9ece055d334d431cd0f856113ab925d9ee86d2dee383c0bfbbef11a5b50
MD5 95f6f6ab9509bc366ab9215defe4251a
SHA1 e3f4a6effd6ca5838cfe91a01967cb72edcc7b0b
SHA512 a853f70d2ea7f384df99be067724bf3ca73c63f3c3573c112f5528fc86a96bd34509d934b038e2a81833f3abb3eedbc5894921291139100e01df6e35696c0ecc
SSDEEP 6144:CUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckldrx:Cn5QEG39fPAkrE4yrBOXDfaNbckXrx
TLSH
T1B2949E22B6D1C435C56E02309918F77925AEB3B1192CDB1B739C5B6F7FB44C1AA28B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbc56683-7ee1-4098-aac3-745e90b098c0.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1312_1583401924\cbc56683-7ee1-4098-aac3-745e90b098c0.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1312_226682660\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/452-174-0x000000001C590000-0x000000001C5A0000-memory.dmp

Download

memory/452-151-0x000000001DBD0000-0x000000001E0F8000-memory.dmp

Download

memory/452-155-0x000000001DB20000-0x000000001DB58000-memory.dmp

Download

memory/452-148-0x000000001C590000-0x000000001C5A0000-memory.dmp

Download

memory/452-144-0x000000001C7A0000-0x000000001C808000-memory.dmp

Download

memory/452-156-0x000000001D140000-0x000000001D14E000-memory.dmp

Download

memory/452-170-0x0000000022270000-0x0000000022278000-memory.dmp

Download

memory/452-142-0x000000001C590000-0x000000001C5A0000-memory.dmp

Download

memory/452-141-0x00000000008E0000-0x0000000000984000-memory.dmp

Download

memory/452-149-0x000000001C590000-0x000000001C5A0000-memory.dmp

Download

memory/452-175-0x000000001C590000-0x000000001C5A0000-memory.dmp

Download

memory/6948-9914-0x0000016BAB850000-0x0000016BAB851000-memory.dmp

Download

memory/6948-9913-0x0000016BAB850000-0x0000016BAB851000-memory.dmp

Download

memory/6948-9912-0x0000016BAB850000-0x0000016BAB851000-memory.dmp

Download

memory/6948-9924-0x0000016BAB850000-0x0000016BAB851000-memory.dmp

Download

memory/6948-9923-0x0000016BAB850000-0x0000016BAB851000-memory.dmp

Download

memory/6948-9922-0x0000016BAB850000-0x0000016BAB851000-memory.dmp

Download

memory/6948-9921-0x0000016BAB850000-0x0000016BAB851000-memory.dmp

Download

memory/6948-9920-0x0000016BAB850000-0x0000016BAB851000-memory.dmp

Download

memory/6948-9919-0x0000016BAB850000-0x0000016BAB851000-memory.dmp

Download

memory/6948-9918-0x0000016BAB850000-0x0000016BAB851000-memory.dmp

Download