6f7b996c4be267f29731f18b7cce9c63f65e689b84405413d07bcfd9428eefa1

Analysis

user interaction
yes
max time kernel
91s
max time network
171s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 00:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zeusupdate (1).exe
Size 828.6MB
Sample261102-ashpdags6n
SHA256 6f7b996c4be267f29731f18b7cce9c63f65e689b84405413d07bcfd9428eefa1
MD5 7c20056d6e0a060ca31ba64e81786bee
SHA1 a736f4e32026823c2adf2b1b4754fcd36c40b63f
SHA512 aeac5c0fbb827f97edf2ec6cc97f37543f4fb9584730ace160472636458499c7058c3a9c09a6b8bbc0dd059d6b90385405be84ed1f5df06651671ae47f5c52ac
SSDEEP 12582912:4qG2J1U79RFFngWtrxx6+5mm+i664JY5L3b2bWMpol7c5PMaPourCO/VG70Y1aZP:4qU79RFdg+xMT6422bWMpi7+oY/+j12v
TLSH
T175993358C3B976FBC72F867685782C58D4F0D467FB22CC9F954813ED079A3C1A92A806
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1936	netsh.exe
4140	netsh.exe

Executes dropped EXE 19 IoCs

pid	Process
5776	BlueStacksInstaller.exe
1284	7zr.exe
5508	HD-ForceGPU.exe
5692	HD-GLCheck.exe
5320	HD-GLCheck.exe
1376	HD-GLCheck.exe
700	HD-CheckCpu.exe
2272	HD-GLCheck.exe
3004	HD-GLCheck.exe
892	HD-GLCheck.exe
2992	HD-GLCheck.exe
4704	HD-GLCheck.exe
2616	7zr.exe
2108	HD-GLCheck.exe
8	HD-GLCheck.exe
3880	7zr.exe
5044	7zr.exe
564	BstkDrv_bgp64.sys
2040	HD-ComRegistrar.exe

Loads dropped DLL 41 IoCs

pid	Process
5776	BlueStacksInstaller.exe
5692	HD-GLCheck.exe
5320	HD-GLCheck.exe
5320	HD-GLCheck.exe
5320	HD-GLCheck.exe
5320	HD-GLCheck.exe
5320	HD-GLCheck.exe
1376	HD-GLCheck.exe
1376	HD-GLCheck.exe
1376	HD-GLCheck.exe
1376	HD-GLCheck.exe
2272	HD-GLCheck.exe
3004	HD-GLCheck.exe
3004	HD-GLCheck.exe
3004	HD-GLCheck.exe
3004	HD-GLCheck.exe
892	HD-GLCheck.exe
892	HD-GLCheck.exe
892	HD-GLCheck.exe
892	HD-GLCheck.exe
892	HD-GLCheck.exe
2992	HD-GLCheck.exe
2992	HD-GLCheck.exe
2992	HD-GLCheck.exe
2992	HD-GLCheck.exe
2992	HD-GLCheck.exe
2992	HD-GLCheck.exe
2992	HD-GLCheck.exe
4704	HD-GLCheck.exe
4704	HD-GLCheck.exe
4704	HD-GLCheck.exe
4704	HD-GLCheck.exe
2108	HD-GLCheck.exe
2108	HD-GLCheck.exe
2108	HD-GLCheck.exe
2108	HD-GLCheck.exe
8	HD-GLCheck.exe
2040	HD-ComRegistrar.exe
2040	HD-ComRegistrar.exe
2040	HD-ComRegistrar.exe
2040	HD-ComRegistrar.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\ProgramData\BlueStacks_bgp64\Client\Assets\desktop.ini	7zr.exe
File opened for modification	C:\ProgramData\BlueStacks_bgp64\Client\Assets\desktop.ini	7zr.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	BlueStacksInstaller.exe
File opened (read-only)	\??\D:	BlueStacksInstaller.exe
File opened (read-only)	\??\M:	BlueStacksInstaller.exe
File opened (read-only)	\??\P:	BlueStacksInstaller.exe
File opened (read-only)	\??\S:	BlueStacksInstaller.exe
File opened (read-only)	\??\X:	BlueStacksInstaller.exe
File opened (read-only)	\??\Y:	BlueStacksInstaller.exe
File opened (read-only)	\??\I:	BlueStacksInstaller.exe
File opened (read-only)	\??\J:	BlueStacksInstaller.exe
File opened (read-only)	\??\K:	BlueStacksInstaller.exe
File opened (read-only)	\??\N:	BlueStacksInstaller.exe
File opened (read-only)	\??\T:	BlueStacksInstaller.exe
File opened (read-only)	\??\V:	BlueStacksInstaller.exe
File opened (read-only)	\??\H:	BlueStacksInstaller.exe
File opened (read-only)	\??\L:	BlueStacksInstaller.exe
File opened (read-only)	\??\O:	BlueStacksInstaller.exe
File opened (read-only)	\??\Q:	BlueStacksInstaller.exe
File opened (read-only)	\??\R:	BlueStacksInstaller.exe
File opened (read-only)	\??\Z:	BlueStacksInstaller.exe
File opened (read-only)	\??\B:	BlueStacksInstaller.exe
File opened (read-only)	\??\G:	BlueStacksInstaller.exe
File opened (read-only)	\??\U:	BlueStacksInstaller.exe
File opened (read-only)	\??\W:	BlueStacksInstaller.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\BlueStacks_bgp64\HD-Frontend-Native.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-GuestCommandRunner.exe	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-GuestCommandRunner.exe.config	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-PgaSocketHgcm.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\msvcp100.dll	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\BlueStacks.ico	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\BstkDrv_bgp64.sys	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\D3DCompiler_43.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\64	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\BstkVMMR0_bgp64.r0	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\Newtonsoft.Json.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\BstkDD.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\BstkREM.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-ConfigHttpProxy.exe	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-ForceGPU.exe	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-ServiceInstaller.exe.config	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-SslCertificateTool.exe	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\BstkDrv_bgp64.sys	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\libssl32.dll	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\LICENSE.txt	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\ssleay32.dll	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-Camera-Native.dll	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-LogCollector.exe	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\BlueStacksUninstaller.exe	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\ProductLogo.ico	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\BstkVMMgr.exe	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\SlimDX.dll	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\CursorSecondary.png	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-ComRegistrar.exe.config	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-GuestCommandRunner.exe.config	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\libEGL_translator.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\loadingCircles.gif	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-Opengl-Native.dll	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-ApkHandler.exe	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-ApkHandler.exe.config	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-DataManager.exe	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-Adb.exe	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\XButton.png	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\BstkRT.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\BstkSharedFolders.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-GLCheck.exe	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-QuitMultiInstall.exe	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-VmManager.exe	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\Microsoft.Practices.ServiceLocation.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\BstkDDU.dll	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\CursorPrimary.png	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-QuitMultiInstall.exe.config	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\ProductLogo.ico	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\BstkDD2.dll	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-GLCheck.exe	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-Player.exe.config	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-Quit.exe	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\ssleay32.dll	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\7zr.exe	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-Imap-Native.dll	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\BstkRT.lib	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-MultiInstanceManager.exe.config	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-Sensor-Native.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\WhiteLogo.png	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\HD-Frontend-Native.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\BstkVMMR0_bgp64.r0	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\HD-VmManager.exe.config	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_bgp64\libGLES_CM_translator.dll	7zr.exe
File created	C:\Program Files\BlueStacks_bgp64\7zr.exe	7zr.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	BlueStacksInstaller.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5908	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BlueStacksInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BlueStacksInstaller.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7zr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7zr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD-CheckCpu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7zr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7zr.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\CLSID	HD-ComRegistrar.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5776	BlueStacksInstaller.exe
2040	HD-ComRegistrar.exe
2040	HD-ComRegistrar.exe
2040	HD-ComRegistrar.exe
2040	HD-ComRegistrar.exe
2040	HD-ComRegistrar.exe
2040	HD-ComRegistrar.exe
2040	HD-ComRegistrar.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5776	BlueStacksInstaller.exe
Token: SeShutdownPrivilege	5776	BlueStacksInstaller.exe
Token: SeCreatePagefilePrivilege	5776	BlueStacksInstaller.exe
Token: SeRestorePrivilege	1284	7zr.exe
Token: 35	1284	7zr.exe
Token: SeSecurityPrivilege	1284	7zr.exe
Token: SeSecurityPrivilege	1284	7zr.exe
Token: SeRestorePrivilege	2616	7zr.exe
Token: 35	2616	7zr.exe
Token: SeSecurityPrivilege	2616	7zr.exe
Token: SeSecurityPrivilege	2616	7zr.exe
Token: SeRestorePrivilege	3880	7zr.exe
Token: 35	3880	7zr.exe
Token: SeSecurityPrivilege	3880	7zr.exe
Token: SeSecurityPrivilege	3880	7zr.exe
Token: SeRestorePrivilege	5044	7zr.exe
Token: 35	5044	7zr.exe
Token: SeSecurityPrivilege	5044	7zr.exe
Token: SeSecurityPrivilege	5044	7zr.exe
Token: SeDebugPrivilege	2040	HD-ComRegistrar.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1376	HD-GLCheck.exe
3004	HD-GLCheck.exe
2108	HD-GLCheck.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 5776	4996	zeusupdate (1).exe	89
PID 5776 wrote to memory of 5908	5776	BlueStacksInstaller.exe	90
PID 5776 wrote to memory of 1284	5776	BlueStacksInstaller.exe	93
PID 5776 wrote to memory of 5508	5776	BlueStacksInstaller.exe	95
PID 5776 wrote to memory of 5692	5776	BlueStacksInstaller.exe	97
PID 5776 wrote to memory of 5320	5776	BlueStacksInstaller.exe	99
PID 5776 wrote to memory of 1376	5776	BlueStacksInstaller.exe	101
PID 5776 wrote to memory of 700	5776	BlueStacksInstaller.exe	104
PID 5776 wrote to memory of 2272	5776	BlueStacksInstaller.exe	106
PID 5776 wrote to memory of 3004	5776	BlueStacksInstaller.exe	108
PID 5776 wrote to memory of 892	5776	BlueStacksInstaller.exe	110
PID 5776 wrote to memory of 2992	5776	BlueStacksInstaller.exe	112
PID 5776 wrote to memory of 4704	5776	BlueStacksInstaller.exe	114
PID 5776 wrote to memory of 2616	5776	BlueStacksInstaller.exe	115
PID 5776 wrote to memory of 2108	5776	BlueStacksInstaller.exe	119
PID 5776 wrote to memory of 8	5776	BlueStacksInstaller.exe	121
PID 5776 wrote to memory of 3880	5776	BlueStacksInstaller.exe	123
PID 5776 wrote to memory of 5044	5776	BlueStacksInstaller.exe	125
PID 5776 wrote to memory of 1936	5776	BlueStacksInstaller.exe	127
PID 5776 wrote to memory of 4140	5776	BlueStacksInstaller.exe	129
PID 5776 wrote to memory of 5268	5776	BlueStacksInstaller.exe	131
PID 5776 wrote to memory of 4992	5776	BlueStacksInstaller.exe	133
PID 5776 wrote to memory of 2932	5776	BlueStacksInstaller.exe	135
PID 5776 wrote to memory of 5072	5776	BlueStacksInstaller.exe	139
PID 5776 wrote to memory of 2344	5776	BlueStacksInstaller.exe	141
PID 5776 wrote to memory of 1596	5776	BlueStacksInstaller.exe	143
PID 5776 wrote to memory of 3868	5776	BlueStacksInstaller.exe	145
PID 5776 wrote to memory of 2660	5776	BlueStacksInstaller.exe	147
PID 5776 wrote to memory of 792	5776	BlueStacksInstaller.exe	149
PID 5776 wrote to memory of 2648	5776	BlueStacksInstaller.exe	151
PID 5776 wrote to memory of 1544	5776	BlueStacksInstaller.exe	153
PID 5776 wrote to memory of 1792	5776	BlueStacksInstaller.exe	155
PID 5776 wrote to memory of 1400	5776	BlueStacksInstaller.exe	157
PID 5776 wrote to memory of 4292	5776	BlueStacksInstaller.exe	159
PID 5776 wrote to memory of 5600	5776	BlueStacksInstaller.exe	161
PID 5776 wrote to memory of 2692	5776	BlueStacksInstaller.exe	163
PID 5776 wrote to memory of 2844	5776	BlueStacksInstaller.exe	165
PID 5776 wrote to memory of 3852	5776	BlueStacksInstaller.exe	167
PID 5776 wrote to memory of 5752	5776	BlueStacksInstaller.exe	169
PID 5776 wrote to memory of 4776	5776	BlueStacksInstaller.exe	171
PID 5776 wrote to memory of 4688	5776	BlueStacksInstaller.exe	174
PID 5776 wrote to memory of 4464	5776	BlueStacksInstaller.exe	176
PID 5776 wrote to memory of 2268	5776	BlueStacksInstaller.exe	178
PID 5776 wrote to memory of 5508	5776	BlueStacksInstaller.exe	180
PID 5776 wrote to memory of 700	5776	BlueStacksInstaller.exe	182
PID 5776 wrote to memory of 1688	5776	BlueStacksInstaller.exe	184
PID 5776 wrote to memory of 768	5776	BlueStacksInstaller.exe	186
PID 5776 wrote to memory of 4584	5776	BlueStacksInstaller.exe	188
PID 5776 wrote to memory of 5232	5776	BlueStacksInstaller.exe	190
PID 5776 wrote to memory of 3744	5776	BlueStacksInstaller.exe	192
PID 5776 wrote to memory of 3824	5776	BlueStacksInstaller.exe	194
PID 5776 wrote to memory of 4424	5776	BlueStacksInstaller.exe	196
PID 5776 wrote to memory of 1520	5776	BlueStacksInstaller.exe	198
PID 5776 wrote to memory of 4960	5776	BlueStacksInstaller.exe	200
PID 5776 wrote to memory of 1840	5776	BlueStacksInstaller.exe	202
PID 5776 wrote to memory of 4756	5776	BlueStacksInstaller.exe	204
PID 5776 wrote to memory of 1296	5776	BlueStacksInstaller.exe	206
PID 5776 wrote to memory of 1268	5776	BlueStacksInstaller.exe	208
PID 5776 wrote to memory of 2376	5776	BlueStacksInstaller.exe	286
PID 5776 wrote to memory of 4324	5776	BlueStacksInstaller.exe	212
PID 5776 wrote to memory of 2816	5776	BlueStacksInstaller.exe	214
PID 5776 wrote to memory of 4744	5776	BlueStacksInstaller.exe	216
PID 5776 wrote to memory of 2064	5776	BlueStacksInstaller.exe	219
PID 5776 wrote to memory of 3456	5776	BlueStacksInstaller.exe	221

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	BlueStacksInstaller.exe

C:\Users\Admin\AppData\Local\Temp\zeusupdate (1).exe
"C:\Users\Admin\AppData\Local\Temp\zeusupdate (1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Users\Admin\AppData\Local\Temp\BlueStacksInstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\BlueStacksInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Direct Volume Access: Opens a physical disk for reading
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5776
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c dir "C:\Users\Admin\AppData\Local\Temp\" /s
    3⤵
    - Executes a command shell one-liner
    PID:5908
- - C:\Users\Admin\AppData\Local\Temp\7zr.exe
    "C:\Users\Admin\AppData\Local\Temp\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\CommonInstallUtils.zip" -o"C:\Users\Admin\AppData\Local\Temp\" -aoa
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1284
- - C:\Users\Admin\AppData\Local\Temp\HD-ForceGPU.exe
    "C:\Users\Admin\AppData\Local\Temp\HD-ForceGPU.exe" 1
    3⤵
    - Executes dropped EXE
    PID:5508
- - C:\Users\Admin\AppData\Local\Temp\HD-GLCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\HD-GLCheck.exe" 1 1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5692
- - C:\Users\Admin\AppData\Local\Temp\HD-GLCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\HD-GLCheck.exe" 1 2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5320
- - C:\Users\Admin\AppData\Local\Temp\HD-GLCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\HD-GLCheck.exe" 4 1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1376
- - C:\Users\Admin\AppData\Local\Temp\HD-CheckCpu.exe
    "C:\Users\Admin\AppData\Local\Temp\HD-CheckCpu.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:700
- - C:\Users\Admin\AppData\Local\Temp\HD-GLCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\HD-GLCheck.exe" 1 1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2272
- - C:\Users\Admin\AppData\Local\Temp\HD-GLCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\HD-GLCheck.exe" 4 1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:3004
- - C:\Users\Admin\AppData\Local\Temp\HD-GLCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\HD-GLCheck.exe" 1 2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:892
- - C:\Users\Admin\AppData\Local\Temp\HD-GLCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\HD-GLCheck.exe" 4 2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2992
- - C:\Users\Admin\AppData\Local\Temp\HD-GLCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\\HD-GLCheck.exe" 2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4704
- - C:\Users\Admin\AppData\Local\Temp\7zr.exe
    "C:\Users\Admin\AppData\Local\Temp\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\PF.zip" -o"C:\Program Files\BlueStacks_bgp64" -aoa
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2616
- - C:\Users\Admin\AppData\Local\Temp\HD-GLCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\\HD-GLCheck.exe" 3
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2108
- - C:\Users\Admin\AppData\Local\Temp\HD-GLCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\\HD-GLCheck.exe" 1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:8
- - C:\Users\Admin\AppData\Local\Temp\7zr.exe
    "C:\Users\Admin\AppData\Local\Temp\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\PD.zip" -o"C:\ProgramData\BlueStacks_bgp64" -aoa
    3⤵
    - Executes dropped EXE
    - Drops desktop.ini file(s)
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3880
- - C:\Users\Admin\AppData\Local\Temp\7zr.exe
    "C:\Users\Admin\AppData\Local\Temp\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\CefData.zip" -o"C:\ProgramData\BlueStacks_bgp64\CefData" -aoa
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5044
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" advfirewall firewall delete rule name="BlueStacks Service"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1936
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" advfirewall firewall add rule name="BlueStacks Service" dir=in action=allow program="C:\Program Files\BlueStacks_bgp64\HD-Player.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:4140
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2861/ User=\"Everyone"
    3⤵
    PID:5268
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2862/ User=\"Everyone"
    3⤵
    PID:4992
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2863/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2932
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2864/ User=\"Everyone"
    3⤵
    PID:5072
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2865/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2344
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2866/ User=\"Everyone"
    3⤵
    PID:1596
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2867/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3868
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2868/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2660
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2869/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:792
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2870/ User=\"Everyone"
    3⤵
    PID:2648
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2871/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1544
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2872/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1792
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2873/ User=\"Everyone"
    3⤵
    PID:1400
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2874/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4292
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2875/ User=\"Everyone"
    3⤵
    PID:5600
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2876/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2692
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2877/ User=\"Everyone"
    3⤵
    PID:2844
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2878/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3852
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2879/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5752
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2880/ User=\"Everyone"
    3⤵
    PID:4776
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2881/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4688
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2882/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4464
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2883/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2268
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2884/ User=\"Everyone"
    3⤵
    PID:5508
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2885/ User=\"Everyone"
    3⤵
    PID:700
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2886/ User=\"Everyone"
    3⤵
    PID:1688
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2887/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:768
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2888/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4584
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2889/ User=\"Everyone"
    3⤵
    PID:5232
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2890/ User=\"Everyone"
    3⤵
    PID:3744
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2891/ User=\"Everyone"
    3⤵
    PID:3824
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2892/ User=\"Everyone"
    3⤵
    PID:4424
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2893/ User=\"Everyone"
    3⤵
    PID:1520
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2894/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4960
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2895/ User=\"Everyone"
    3⤵
    PID:1840
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2896/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4756
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2897/ User=\"Everyone"
    3⤵
    PID:1296
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2898/ User=\"Everyone"
    3⤵
    PID:1268
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2899/ User=\"Everyone"
    3⤵
    PID:2376
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2900/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4324
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2901/ User=\"Everyone"
    3⤵
    PID:2816
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2902/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4744
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2903/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2064
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2904/ User=\"Everyone"
    3⤵
    PID:3456
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2905/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2488
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2906/ User=\"Everyone"
    3⤵
    PID:5272
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2907/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4600
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2908/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:824
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2909/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2108
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2910/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5472
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2911/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2280
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2912/ User=\"Everyone"
    3⤵
    PID:2408
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2913/ User=\"Everyone"
    3⤵
    PID:1084
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2914/ User=\"Everyone"
    3⤵
    PID:5248
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2915/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1604
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2916/ User=\"Everyone"
    3⤵
    PID:2792
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2917/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4740
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2918/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5932
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2919/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2364
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2920/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1556
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2921/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2096
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2922/ User=\"Everyone"
    3⤵
    PID:5060
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2923/ User=\"Everyone"
    3⤵
    PID:1928
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2924/ User=\"Everyone"
    3⤵
    PID:6000
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2925/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4072
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2926/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3432
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2927/ User=\"Everyone"
    3⤵
    PID:2024
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2928/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4552
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2929/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3968
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2930/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1072
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2931/ User=\"Everyone"
    3⤵
    PID:4264
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2932/ User=\"Everyone"
    3⤵
    PID:3696
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2933/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2484
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2934/ User=\"Everyone"
    3⤵
    PID:4856
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2935/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:8
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2936/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4600
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2376
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2937/ User=\"Everyone"
    3⤵
    PID:2648
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2938/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5268
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2939/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2288
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2940/ User=\"Everyone"
    3⤵
    PID:4576
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2941/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:564
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2942/ User=\"Everyone"
    3⤵
    PID:4652
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2943/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3436
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2944/ User=\"Everyone"
    3⤵
    PID:4168
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2945/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1592
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2946/ User=\"Everyone"
    3⤵
    PID:3140
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2947/ User=\"Everyone"
    3⤵
    PID:1680
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2948/ User=\"Everyone"
    3⤵
    PID:4780
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2949/ User=\"Everyone"
    3⤵
    PID:1396
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2950/ User=\"Everyone"
    3⤵
    PID:4548
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2951/ User=\"Everyone"
    3⤵
    PID:2316
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2952/ User=\"Everyone"
    3⤵
    PID:3540
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2953/ User=\"Everyone"
    3⤵
    PID:3768
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2954/ User=\"Everyone"
    3⤵
    PID:3428
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2955/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1372
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2956/ User=\"Everyone"
    3⤵
    PID:6040
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2957/ User=\"Everyone"
    3⤵
    PID:5124
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2958/ User=\"Everyone"
    3⤵
    PID:256
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2959/ User=\"Everyone"
    3⤵
    PID:2752
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2960/ User=\"Everyone"
    3⤵
    PID:1164
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2961/ User=\"Everyone"
    3⤵
    PID:3880
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2962/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4776
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:824
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2963/ User=\"Everyone"
    3⤵
    PID:5232
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2964/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4960
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2965/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4148
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2966/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2860
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2967/ User=\"Everyone"
    3⤵
    PID:4916
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2968/ User=\"Everyone"
    3⤵
    PID:5648
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2969/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1320
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" http add urlacl url=http://*:2970/ User=\"Everyone"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1536
- - C:\Program Files\BlueStacks_bgp64\HD-ComRegistrar.exe
    "C:\Program Files\BlueStacks_bgp64\HD-ComRegistrar.exe" -unreg
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2040
- - C:\Program Files\BlueStacks_bgp64\HD-ComRegistrar.exe
    "C:\Program Files\BlueStacks_bgp64\HD-ComRegistrar.exe" -reg
    3⤵
    PID:4764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3328

C:\Program Files\BlueStacks_bgp64\BstkDrv_bgp64.sys
"C:\Program Files\BlueStacks_bgp64\BstkDrv_bgp64.sys"
1⤵
- Executes dropped EXE
PID:564

C:\Program Files\BlueStacks_bgp64\HD-Player.exe
"C:\Program Files\BlueStacks_bgp64\HD-Player.exe" Android -h -sysPrep
1⤵
PID:1804
- C:\Program Files\BlueStacks_bgp64\HD-Agent.exe
  "C:\Program Files\BlueStacks_bgp64\HD-Agent.exe"
  2⤵
  PID:3124

C:\Program Files\BlueStacks_bgp64\BstkSVC.exe
"C:\Program Files\BlueStacks_bgp64\BstkSVC.exe" -Embedding
1⤵
PID:5320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HD-XapkHandler.exe.config

Path C:\Program Files\BlueStacks_bgp64\HD-XapkHandler.exe.config
Size 386B
SHA256 9fa3f6f8c42357837ee22760aca3aa6517d940ac7bbc691a9a948b857a879d2e
MD5 9c571f9979a9a9e71ce232735df29330
SHA1 78783cbd6897fd0ca040f3d5760f99b55f9e0fbe
SHA512 cce861a13ca7efd40ae82b167ed05a63a511b93b7de997ea3fd0e4d9dbe7e0a6722f9ef5a69754301eb125ddefc7f15fceb07fe2c7c2d01941d219903889a2ce
TLSH
T1DCE0D81515D8FD2B5E734B23B2228866EFB0E3D650A45808F4DF79A30A2308A67A7331
MD5 SHA1 SHA512 TLSH

Submit Download

ar.pak.info

Path C:\ProgramData\BlueStacks_bgp64\CefData\locales\ar.pak.info
Size 378KB
SHA256 81aca701fd815152b02b60d814f5df72db4a70f43475b8bc97aa1af5851f4652
MD5 86abbe39a0ffe4e221c459d98a409765
SHA1 7ffa8bea41bb8c7b8f958681ec097556320d5482
SHA512 66b6a6f8e7f7d857a353244d372b684886830e902cf81678dfd2b8977f1007af0596e94d27e27c930309cf12b14cf1f1af0f292e7da305c58a44f9dde0e5aab0
SSDEEP 6144:AD4ozBJxUsTqmShsGXv/ejFlm+LFHkvpMhCb1o6+j5M63:AGVmOsGXv/ejFlvhTMS
TLSH
T12E847EBC693D226BEC280C8DC069AD139AD20D02F57B6DEEF0DD6371DBF1592016C996
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MIMClose_click.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\MIMClose_click.png
Size 991B
SHA256 9ca58c290cdc9e49357d2815be9838ebf8d77dece5cf4a239dda906591318029
MD5 547cb19b693d00ff65198e1d858113f1
SHA1 6633766acd7ef4a23019b26b9c0ff36ab12fed30
SHA512 f45aef3389fe099d2fdac096b90d951a4583d664071e41c91b668a6b180ac9c3f95b27efad87b806371226b91014f6e2d132f7bbdecace460413d0bc15fe9bd4
TLSH
T17311C88F572D2982CC242FBDE7FE9C02B9BB5A19800BDF8658840DB18FDC9D58136207
MD5 SHA1 SHA512 TLSH

Submit Download

MultiInstanceManagerLogo.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\MultiInstanceManagerLogo.png
Size 200KB
SHA256 7da73b722b462f3e0e0f3fdadfc5d0a2f8ac116eaa27fe1064d1e1d338266f4f
MD5 bb2947178c7efd29202f7b4646796011
SHA1 98b56a00a9ef4ee4d6dfc14d4270c50212330c2a
SHA512 a548579b33c073a2696dd39c3dacd304f5f18bc6bd73004a9cbbc66a4161e789d32af251afeaa606ff2c2c8952d566bd755557e472bf79e220b742142df75823
SSDEEP 3072:VzVpi7oNAZJyN0tHuZb5uIFpPijspIf/DNHHO3FzasZ:Vni76AZxtHyuWpYspK/JnO3Fzv
TLSH
T1D214D0449F5A2CC9CD98897295986F7273EB05A501605B8B8BB0B070AFDB5CFFAC34C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bgpcheckbox_hover.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\bgpcheckbox_hover.png
Size 1KB
SHA256 82b73ed961813a4c9c63f56f69963c86f22d3a5d32c50e82625f4613fc5b821a
MD5 840868d78ad49c74f08bd96761642f6e
SHA1 d68f443945c66aa8250b6bb369e697212790a3ea
SHA512 e18a4d67ed2c9a024c06697cb5bfd3382383d1a5211389bd00024098b032ad8913bcce541bb235338d0acef751da0c4eb7f104779868c188125afbab5558635a
TLSH
T13111B5EC6DD911A71B9A2D37B90B9521E48B59FC1B1130586237C81332805E2128A9C1
MD5 SHA1 SHA512 TLSH

Submit Download

checked_gray_hover.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\checked_gray_hover.png
Size 912B
SHA256 6785fb1541154c4a318e42ceaf14a23de67127e669e1b70f65a4f79f0fe066a8
MD5 c60f5c2fe886517e38d5dd7a00a0f411
SHA1 753ee26518a3fed017571b3e51f3c5638afb6a5e
SHA512 34435ca7ae08f85b016cde6bf66b6a95cc6085b6a945684d98a20496016ea862c2d082bcf66d711d66b7df142af28420b873f069ede264c4ad9954ac1074130f
TLSH
T19711B7CD1695EDBF611A059131BF0B4CF0660FEAD8A64D01022675311B91D8754C83A0
MD5 SHA1 SHA512 TLSH

Submit Download

closePopup.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\closePopup.png
Size 25KB
SHA256 45b1f75bdc4fa2b6bd0972229bfbd2fa97c67eaaa1d054250168241d6aa58cfb
MD5 adce7b9de954b094e271abfbc1e10f3f
SHA1 d3011e3e65b14e90aedd77062d5d4ea802b42830
SHA512 42d20107725c827e60f5b24a4f1fbd87fc89b9c664271b1fa0fb43416d45a970ca7e2640b92316f9bd182bab02dd6bc515d4be48ba5f8a3f4c03f5160d91600a
SSDEEP 768:WQ6eXeGrKJUrDkIl6N5zbKrxiBm2mA+ZLW5/HP/Y:yeXeGSUrIg6N5z2482mlZyR/Y
TLSH
T152C2E191EF8E9028FF36B13B1B6B3703112330C2A261560776E713642619C76B1AB46E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

close_button_click.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\close_button_click.png
Size 141KB
SHA256 73c4279bc4566615b815cdff6eadecedd23ccfa6043c475f345cf6d3cf789a9a
MD5 9d19962e0fcf9e01697dcbc7d37bacb6
SHA1 309e5b07351246a75344042c4a6115353787141b
SHA512 2d863f423055d127372d0be30ecdd3727c8930b665cead4b0f98ab43854bfaab1f9dae8bf5fc6a2dce861cf01a527665c7a9dab299da20aeed891832ff33c74b
SSDEEP 3072:MCK2QKK5/MJDti9VfSOYMa+4qUnw/vPixfnAsUZDwxcQGu/:U21W/ztSOS+4rnw/v8fAsADt90
TLSH
T104E312172F5650952EE3C69FE1BC7DDBD63356432323B1D034B0F4792684DE6A8A2227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

close_cc_hover.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\close_cc_hover.png
Size 72KB
SHA256 92b90c47d5b1d349dd46e29090ee96b73908c783a2762560974fead1afdd107c
MD5 05cc95992dfa741833b6d1ddb7c96548
SHA1 16429cf98c055b0f8e5486d3efcec708ef78dfcf
SHA512 5967369c819a0be54735d6b9de43a8888782b7b61b6af9ee6fa3676d9ea93d51013ea7bcb624931a0c85c807d70e6bd423bb288e82856ccd43d2744c5fe668e7
SSDEEP 1536:8H83jfRYSQIQIbGn2f3MHse1W97yldfnnS9wWiswTr/+yZo:8czdP982Le2YFnnOwWYTBZo
TLSH
T10473015C178582F35F4692E53FB4C4894960E9EE3836C68AA7F7B39F8402D69D4B100F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dantg.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\dantg.png
Size 25KB
SHA256 481c27346e823d4521ff1720f2f82771d990cb221fa35cd4746cb317ef8b8151
MD5 dc08a0bdb35733cb1a5c023040016100
SHA1 4d06e8280ebb3196a348e2e774a60de91e030148
SHA512 73ae95c2dbfbbc7dcacacf3ff5363d6c5ad5505ff77e8e8d01b50cabfbf5abfcb56eba0ee137d14c4d55fac8a1da85f5d6fab6e57b3607f62a40eab5a88f4188
SSDEEP 384:y+WQO06pp/kYl1QLOsTWaoAGIKMWTeZNw1mPnDonb7hb6ngezyrxZ5FqP:ylx3T/e5oliq1mPDa7hmtGVFqP
TLSH
T120C2E06263A0D71EE1303D7CDCE2532377E174696837B88A552E2CFE576C127169CA0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

detail_close.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\detail_close.png
Size 3KB
SHA256 1e74452a8f11b390899ece536ef103b7b22d36516513d8c863a8f055c494a1dc
MD5 a0002dcb97375892ad6190a9342edc04
SHA1 4a9b3e26758bcf93fd712a43c0edb67f05c704ac
SHA512 c2efa8245dc0599f0c2ddc6eccf7eec6f613e6b109cd61cdd13ee4c0e857d6f28ef64ba4c26366f7e2b57c2e8e5ecf1e2395ef245f240f200d7deb5ceb9be8d9
TLSH
T193717D88DC588855390B0BAF3577ED859B27DE50D2A55E08F9ADD20F4610A022C66B5F
MD5 SHA1 SHA512 TLSH

Submit Download

detail_close_click.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\detail_close_click.png
Size 3KB
SHA256 13c319a89fde263fd732e9f83ecb2217e32cf519f3eac68dc84ad1bba645d930
MD5 774118c3b7f6be4cbad3ab315d8b634f
SHA1 af2e06c07c73ead842fd4de59b8ff1f25f8d01c1
SHA512 0141d39d1c9ebcadb482447b49f40835d04c4002e70154f37399756b2cf5b4272dfbfcd9f737a656084ac278942429b840cd227523d672c77d935697bf87b041
TLSH
T1AA713BA2A8E4BFA0B50F517A6071CCC75F7A6D70C0D4D88CFD5769475C045411CAAF5B
MD5 SHA1 SHA512 TLSH

Submit Download

detail_close_hover.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\detail_close_hover.png
Size 1KB
SHA256 fe843a44d8e233c092baf30028a776222823fc56b43306838c269a89d674a434
MD5 cee2c197590ecbbb44c7a5b751a5e4c8
SHA1 5b4baf88699444191c9a543b7929f2cec5b13824
SHA512 de9e0d6de428606a07855a93a3a76acabcd4e3c340e32f94567cb3a72c0eb72c4f7be4e6466dac02adca08cd5dec6413335ebf61f17b5cb0e54952a4c13451ab
TLSH
T1B931B6C056018B4C34D2E51AEAE848D7FCA7C1EF297E0F2F10B5E4D15002E594A724B1
MD5 SHA1 SHA512 TLSH

Submit Download

duplicate_click.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\duplicate_click.png
Size 222B
SHA256 06725850cfbeff625e6c2c13554a2f5109be20790f06e688619ce6a24e609114
MD5 13a01eb488543f720b7a4d420226574b
SHA1 57609b4434414c981210614a7f38dce929e229e6
SHA512 81469e4a6056d5602fe77575bac3c0760750a9e1a0bae9d61768b3b7040aa1be24fd92490c0705f4783ede0b4a49f24e22c2eab91c03a9aff278acebf59dad61
TLSH
T12ED097D1092528AC920A02FE520250E7EA6974050031C82EEE008468EC3CC4554CB602
MD5 SHA1 SHA512 TLSH

Submit Download

edit_icon_click.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\edit_icon_click.png
Size 449B
SHA256 1fa3dd395e094974484915d7c25e7f5ae8610dc4348cd16cc2cab128d38035cf
MD5 92f45e5aa3d4abe16b2be528c69cd8ad
SHA1 8896d093be9e92d03bdeebf7fb54466404e0a812
SHA512 fed789a84a79dbdc4c7f7df35e6aa3a9d88f4ff56b9fb87387744c474a15d23cf347ee08ab8c3528b7004b7ae63922278c6609beccc8552699051f315ad8f065
TLSH
T1BEF023C045A54CA0ED2C4217E0CBC354F4DB6997ECA50F7D6E80A09E84D8C716ECFA57
MD5 SHA1 SHA512 TLSH

Submit Download

edit_keys.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\edit_keys.png
Size 768B
SHA256 9cdb0131fb4d057e95726fcc9ba617e5535d7c70a47efc7f9f48a2a468ab51c6
MD5 0c0961ca11d8aa80de48937fd318d516
SHA1 e23d513acc6613ae0bf3bbc38f2a4d8e1de5650f
SHA512 1c7e979e6eb83b35e03b1d8fb1f058e042cfa611bbd2064dfc95cf74b64076e71d2d9fa8d025ae6d38e9decb2a79e547f4ee80be01b83832806d509ceec83c57
TLSH
T1850165B39FD7C7EFE8C89A0DB70655B1D369148C044A8358AE2421169A2DFF7F281143
MD5 SHA1 SHA512 TLSH

Submit Download

import.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\import.png
Size 425B
SHA256 4cef2ef83fef14f935cdb957fbec6db58ab4a1cd31680376ffa59820b725edda
MD5 09aedb66e4473dea2b1d47fc274473b2
SHA1 33131ec9391928e8fe29205776b48841a5eddf2e
SHA512 9b5dc8a6b99da5e83365a55a9d707ada834f6005170a717341b1d7760a5cc28c71a97d32578b90a9367723c184dc8c3f59a5a766b8bb18363709d8bd3367b85f
TLSH
T12AE0A3C3BD85DDB8A15D0717D1A54310FEA9246C6E58F10CA2BD14F42010CD14D13662
MD5 SHA1 SHA512 TLSH

Submit Download

maximize_disabled.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\maximize_disabled.png
Size 3KB
SHA256 2ff5b019275680aee8bbddf21b6871b1c735883eda75052448642cd92bfc7eef
MD5 8e49192d6326f678094e08b2de391c71
SHA1 bfffd96604a9ab42ecdca1898740a0bb98768674
SHA512 7787b1ffdc92eaa1b629f6e3c8407fc162db1c818fc76ec45d95c5984a13cc2ff7afefacb92acc06cff41dc5b7fe2338d40291a1f705f7d146fe98ddc05330a5
TLSH
T1EE5128DBAA18C77150CE0EBD213FEAA4593661D861052EACAED9A28BD000B156B30F53
MD5 SHA1 SHA512 TLSH

Submit Download

minimize_disabled.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\minimize_disabled.png
Size 2KB
SHA256 6e12c2ec7f51746be118d405d799041aa22a8755354f84647bfedb6e23ab7527
MD5 9ac44b19a899ad7d3c897ca604e4099b
SHA1 006eeab9d40319b1f28ae11c0acdaa211e5f1dc5
SHA512 986c26c392f6668988232c7816a76d25377fabf6b318d41e9c0558e184b23af3028b62fdc3aef32b6226d2e5fb4d95d6541f0b8f55de30e8bd114f635996ad21
TLSH
T15C51298DE6864629890D8B7C31D7BE01C636B684C38C1E0CAF5A925FD220F443C21BA6
MD5 SHA1 SHA512 TLSH

Submit Download

radio_selected_click.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\radio_selected_click.png
Size 1KB
SHA256 e40c1d50afa908bdbf713040c86b928f07a920b0a4cb28995784da2aecf1309e
MD5 7caee1f0f42cfe04a89f69e8e936e241
SHA1 bf64431415a8dadb99b540cc47c9907d72e55b39
SHA512 eb2d7c89bdb88405e4024c1ddb8759f8e77c51b9fbffba45f0584b691224b6ac08d503edc30146824e710e7bd0deb3fbbc117580496742b1820583b4661f5766
TLSH
T17B41FAA1A2704BADE118710B480E7959F8E5049A49EEDF2C07ECF8673B4A11B224A592
MD5 SHA1 SHA512 TLSH

Submit Download

radio_unselected.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\radio_unselected.png
Size 1KB
SHA256 9167ef6b73f306cc0ded5ab89c9cd920a795ac9ab615e2c97e2322eccb29669a
MD5 aba2ee4c702e083931f1589eb9077a9e
SHA1 8f1519eba25f2d01f8115b8b950a8bd9bcce97ac
SHA512 fc143b9c0fc89bdd5b002a8f8913fd0234e14ecb237c40a500f4142662147eea00198219575f6b8049abfe7391940fbbc505450136628410a589376fce00531d
TLSH
T16B210B9483D9F67FE21269E6293B0070184CCF8F9FF0F50434A881992C12B417E4160F
MD5 SHA1 SHA512 TLSH

Submit Download

shortcut_click.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\shortcut_click.png
Size 684B
SHA256 f0c524fe1db3932a92d7efbd85bc0bc150a29bf191c437b7e8139fd12cf246a5
MD5 ebb41463f094bc8348bdea245d2e385d
SHA1 eeaeb4a64c3ce8543be10ee3b4cc123220288e70
SHA512 af1c92ca5aa2f705080fcfe9153e7bb177580cfc35b180dcfb6a433b4cfab04f493f16d2a227b2273761ca8b863661a6a347d1828d8939eb07fb285f2e96f963
TLSH
T1C4012340533C7E17F5EAB13942535340AC67D9E08627702766F5D64A0CDB94583EC3A2
MD5 SHA1 SHA512 TLSH

Submit Download

sidebar_controls_hover.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\sidebar_controls_hover.png
Size 346KB
SHA256 59bbe1c35255c901383bf2d275c9bbe9300def0ab2c77c515a9ecb7dafa6c0b8
MD5 508692b914d403a18742ce9ee49fcf93
SHA1 2d41fd3bdf7486c56dcd1af5af057592a558ca74
SHA512 2edd673d74fa195c59ded166e05d21e28f4589be8b34cab6740d7596d3d34902612d30682e06f5bffefeeddaa24f05dc527284b4c47e07cd5ac1b3fc998ff56b
SSDEEP 6144:HjM7WvDoW+3KAbOhgf/FHOnkb95QyxHjsMDYLLS4rGSnwHWG64o:DMXWCqif9uu/xDdsHSgGSwHa4o
TLSH
T18274E011DB37D5A4CF1F49BA28B64EB715614530C0A02EFA97BAE92CC5C690AFA335C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sidebar_overlay_click.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\sidebar_overlay_click.png
Size 507KB
SHA256 a7daed0fef35f239ab89066aa1663a39ab642723afb8f26e17067cdcc586bce4
MD5 4e59a57f2ab5a4a06c223afd3637d933
SHA1 79fe244991199cee645d2f2901b88f9aeac387f6
SHA512 0f4215b3d4e1c071f2a3048cad52a9dad61a01cfcc66a7add04152b3c05d26e59abf1d7be4a74fee19e2793c49c00ee879fa7d2548d767064e790c722fb42e68
SSDEEP 12288:SV9PxG0WRaRiJC0Yma9K2don78N0U+jyEqCpqUvUCwOne:A9pG0njSa9K209jyCjUCwX
TLSH
T159B402D96E33C8ECFE0B843772390EF385A57464006D4FF567A59C8DB812F9AA923494
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sidebar_volume_click.png

Path C:\ProgramData\BlueStacks_bgp64\Client\Assets\sidebar_volume_click.png
Size 278KB
SHA256 b7eb3964ba342891f0c8f450a47e0540148d35899e4a5f36820d29f9472e5eb6
MD5 7277d3367522ab9bc68ab6888f689c59
SHA1 bd494c7f9819b0eb4ff50870325101c4fd393a92
SHA512 010b0c5cdc76b13d020323e8dafa07e037df85db4bc81a1235572a7c016b0e2ca55a8a9fe21af158079d5e09e2123c4704e7c19f2292e47bc9f34f6b93a44aa3
SSDEEP 6144:ITHdW2E5ZHETbAwDiiXnHnAuqy04b58ENIqFw4F:QOUbAwDCuD0SOVqNF
TLSH
T10A54CE50BB71C872CD9504BE80FE7EEB01FA9274C0602EDF95E5A9741683D86F6AB4D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Android.bstk-prev

Path C:\ProgramData\BlueStacks_bgp64\Engine\Android\Android.bstk-prev
Size 5KB
SHA256 38ac61f1c911e5bdb1fad8dd6eb00e6e2893f406ff6047a738416210d03b123c
MD5 9a3985a40a855fc79a1fc806cfbadb6e
SHA1 c97b2223935d189ec7af5025fa27111f94a62550
SHA512 96af29973148ab0e80adf68e31eb67cf2d08e0d34a622037c151d7e47d7074d1960d2137588e5fe1c051e041f7d6bb450c11bc41101d91f81a0e2ef56af8b933
SSDEEP 96:e2LNNzrBCGzCcECgCsEC3ECfCBECGEC7kCmEC2ECUC2ECyEC9CyECpECBECyCDEZ:e2BNMzGt2Za3MFsc5cIYIP33lpWQB6h1
TLSH
T1E6C15111B2F0EF2D425380241FDD60552E214CD75346A489BA8D2A84EF9EE8C39B7FF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SidebarConfig_Android_1.json

Path C:\ProgramData\BlueStacks_bgp64\Engine\UserData\Gadget\SidebarConfig_Android_1.json
Size 108B
SHA256 c9c29ffa5a73fc77d7a0dbf2b3b961d1d8e41d381a21a62238c9db9a945e8deb
MD5 aac14b0a80086020332a7e335483908c
SHA1 c672e4f918744c030fc93ddf3a67ec6dd0758703
SHA512 44c3b131117c5e4f8cb4dc50458c1977a05f1e82351008844b0a605bf6fa4ac0e3e37ecdef3607b2571edf12f4f7be04b295788ebcd131a6e28741c7e8fcf4d6
TLSH
T146B012173083F30F0204C80993B1F0BE089CC909C0302D0EBC0C053740003008D471F0
MD5 SHA1 SHA512 TLSH

Submit Download

apps_Android.json

Path C:\ProgramData\BlueStacks_bgp64\Engine\UserData\Gadget\apps_Android.json
Size 343B
SHA256 1b2a3cdb187c0b9ba0225559ab5bb771396187d19bd29d618e5bd9a7f24a6113
MD5 6201cdd893aba55f75bd421b912dc469
SHA1 b6a7e49681f3363d42b0b00ff1e3b782f24ff83b
SHA512 a76f7266820928d3390f665a47525714922b4139780082db7b2a8e1c9a1d16c59ed379950602a7bbf4f62830185b27fecd52dc1ccd99f26cda5182963534c669
TLSH
T10BE0C076010A5C27B20A42D25DC0E68232FC28E022CC64C0FA4F0E693CCE6C92202626
MD5 SHA1 SHA512 TLSH

Submit Download

apps_Android_1.json.bak

Path C:\ProgramData\BlueStacks_bgp64\Engine\UserData\Gadget\apps_Android_1.json.bak
Size 343B
SHA256 d352d15769551408be7d768160d93efc1f38efd821c6fcbc5acb6e187cb37379
MD5 b1cd06d1743db20c66350bd1750830e4
SHA1 bd5c57d9806f228823610b0eb2906f0f1e155cae
SHA512 76a5e1fbbdcd7599a83121f19c83e86fd1b9860dcec0730f6ba0f8fd40f01e7731d338ab7990fa4c41d3658f0909572019b35bee6cc6a004380f2586dcf308c4
TLSH
T1E9E0207502095D27B61A46D25DC0E68532FC29E0528C64D0FA4F4E653DDEB891212666
MD5 SHA1 SHA512 TLSH

Submit Download

com.android.chrome.png

Path C:\ProgramData\BlueStacks_bgp64\Engine\UserData\Gadget\com.android.chrome.png
Size 10KB
SHA256 7e168034614840c105b44633d42b6a16235f21ce79537db130404e11c2c74c3d
MD5 1a438fe6262e9384cf4076ef0997345a
SHA1 1412afca214dd5ed59ebe75759b23e7aac13437a
SHA512 3496f2e20d3a372f049cc4201f3dc4bdd43bc89726dd60447f1d2e8cd1959224dbb7e2ae16d1569171f4ae1e84a34b4284d14c382b428b88dbfce0a27c45dbf3
SSDEEP 192:3pCppNhHvUoKpIlrdBL5OuggkHWZGKYRCnv2IfralIWsXrGTXfFlMiQGRkxSWezl:ZkpNJvvKpSbQck2ZGKYmDWorkXNiCgQ
TLSH
T1F422B0C3B7F00914E8C91B65CEFF996B67A329C33E94C3B4715AD06ED80168754479C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.axlebolt.standoff2.png

Path C:\ProgramData\BlueStacks_bgp64\Engine\UserData\Gadget\com.axlebolt.standoff2.png
Size 557KB
SHA256 dff07a11d89915a4ae1006286e3dbe20d543daecfdb8102e7c46c2ac2ceb7479
MD5 c09c6cbdcc7c148d419ee8d8fb0ccf4e
SHA1 629ccc0d6b694d27124e99870714024a9770dd2e
SHA512 2d95555589bd1f01347ae9326e51ba5a87b7f6aa9bc38d16deed6b72d345195a85482928783b7462ad05003b5498beec478564214d517352b38f3746b05ca1ee
SSDEEP 12288:wQW3QNgitWa/CKeCyozfB5WHKYhLBhf1L1iRe+k2V3:w1312BplB5W95meRW
TLSH
T1DDC412061B33E23DCE0FC27396155FA306F75A0514E093BAD3B9183EBE87D4AA76A445
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

req_trans.json.bak

Path C:\ProgramData\BlueStacks_bgp64\Engine\UserData\Gadget\req_trans.json.bak
Size 802KB
SHA256 b2b703ef85d9b330bdb1522be9bbcc8aa887451ec273bc9c579472a1c58d906b
MD5 dd5b5640dd1641dc14cf140e5193b322
SHA1 0af7f6abf04deb388da0a12a34951dd04d745a7c
SHA512 50477eb9cf41a10fdd350487d05c65936b356525a01405701306c1ea7a43dccbfb5d2fddd651debc0e0da56a75ae93ca3ccefe144ebda264117ebb6377ac6440
SSDEEP 12288:W5FbTbVYA6AT3gAApfZfygjWPwyffYHn3whcH/c29LfVyrR1XbbJe:+PbVYmbbJe
TLSH
T15705F82A06D76C3C87641746F5AA7437A29C15AA27A3FDE2947C00EF11D0386C39BE7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

requirements.json.bak

Path C:\ProgramData\BlueStacks_bgp64\Engine\UserData\Gadget\requirements.json.bak
Size 4.5MB
SHA256 f1712e8794dc7841cb2af4bc763c422ce8ae1c027e64b877b8fd47d24a675210
MD5 2ea221c6a2c1dbe435d0fee888fcd219
SHA1 ddbf3cd1a3b63275f4f4434ede9dfe3ef673e75f
SHA512 23fbd4d208e5ed5902c602afc7029408ce5249dcefa564e4c6de1597e10c621b9d268ae8a218147923b87aa61fde982f8bae19299f0554c53ebe9adce4ed39c3
SSDEEP 3072:Iga45cewpG2geCPTonBcpsCRXvMmRQtE7HZ:FToCNRQtE7HZ
TLSH
T1DA26F05210A23D7E93D6E7E6E4E36C0C42A82B03C680ED79556B90DE9BD7F54C12B39C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i18n.en-US.txt

Path C:\ProgramData\BlueStacks_bgp64\Locales\i18n.en-US.txt
Size 158KB
SHA256 0b47c70876a056ebf19c65bbcd0d8c92f6117735e9919d4c103ae35081223841
MD5 16a27eb8acc15236ed0439d835a48702
SHA1 618c83a7e31a5a183dd375af0710ffa7e7ad33f0
SHA512 49dc507e3c20e21af1d932034eb59ce1fba5934888c1ba99927bfcab4b82072cc2d9c0ace53ba851b14dd86d1e48ef7cc42da5a50fcebb4b366ff64808db1131
SSDEEP 3072:4oCf0j0bNwXxwAffNFgO/xuGKQqLkV9KsTs6/INzZJUtV7FNcdSyt3grFduzkfHK:lCf0AbNwXv7fxdXVdk1Wrpyt3grFdKkS
TLSH
T101F3AE6292BB368E11C1A407D8447D09789B63BF3B6A6751286CAD3F36F302C933D55D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zr.exe

Path C:\Users\Admin\AppData\Local\Temp\7zr.exe
Size 722KB
SHA256 ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d
MD5 43141e85e7c36e31b52b22ab94d5e574
SHA1 cfd7079a9b268d84b856dc668edbb9ab9ef35312
SHA512 9119ae7500aa5cccf26a0f18fd8454245347e3c01dabba56a93dbaaab86535e62b1357170758f3b3445b8359e7dd5d37737318a5d8a6047c499d32d5b64126fc
SSDEEP 12288:AwAxBpwU5gU+2/9dB5XlH1YAEa5OLW0TjLWG3rn0Yf5ogmn9X9Rf6TIALr22DIVM:AhY2gUfVH5XlVYzagW4/3rn0Y5zmzRfq
TLSH
T177F48D227BF6C0B7C64211318A1C6BF690F6F3190B3059C367908F6D6B399D5D63AE1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

backicon.png

Path C:\Users\Admin\AppData\Local\Temp\Assets\backicon.png
Size 15KB
SHA256 fa64884054171515e97b78aaa1aad1ec5baa9d1daf9c682e0b3fb4a41a9cb1c1
MD5 7ff5dc8270b5fa7ef6c4a1420bd67a7f
SHA1 b224300372feaa97d882ca2552b227c0f2ef4e3e
SHA512 f0d5a842a01b99f189f3d46ab59d2c388a974951b042b25bbce54a15f5a3f386984d19cfca22ba1440eebd79260066a37dfeff6cb0d1332fca136add14488eef
SSDEEP 48:b//6zMh8k29WJsEvda/PSeld0/u1BLW3qLWoxN+Y9rNGZGvsc5uG7yUWT:b/Ss8kEWmkGPMAxNXrNGZGvsc5VyUA
TLSH
T1D36250A4FDF17565D849F6321DC168068C730B83EA809C86BACE8D277F01BE98C4F196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

checked_gray.png

Path C:\Users\Admin\AppData\Local\Temp\Assets\checked_gray.png
Size 538B
SHA256 d8e502fab00b0c6f06ba6abede6922ab3b423fe6f2d2f56941dabc887b229ad3
MD5 ce144d2aab3bf213af693d4e18f87a59
SHA1 df59dc3dbba88bdc5ffc25f2e5e7b73ac3de5afa
SHA512 0f930edd485a0d49ef157f6cc8856609c087c91b77845adeb5cc8c8a80ebc7ec5416df351ffa1af780caad884dbb49dcc778b0b30de6fb7c85ffef22d7220ebe
TLSH
T1ADF020933A94808CE3CEF532B6CA805BE8FE9315948B568AC890D03FEC81D5C0994F88
MD5 SHA1 SHA512 TLSH

Submit Download

close_red.png

Path C:\Users\Admin\AppData\Local\Temp\Assets\close_red.png
Size 15KB
SHA256 d0b6d143642d356b40c47459a996131a344cade6bb86158f1b74693426b09bfb
MD5 93216b2f9d66d423b3e1311c0573332d
SHA1 5efaebec5f20f91f164f80d1e36f98c9ddaff805
SHA512 922a7292de627c5e637818556d25d9842a88e89f2b198885835925679500dfd44a1e25ce79e521e63c4f84a6b0bd6bf98e46143ad8cee80ecdbaf3d3bc0f3a32
SSDEEP 48:2/6FwMlYk29WJsEvkch6/Clu5tlL88Lem/fLu5A/luaxN+Y97sc52G7Z+EazEyIc:2SFvYkEWmDCccHAxNX7sc5dZabT
TLSH
T1CA625065BDF075A65589F5322CC564055C730B83DAC09C88FACE5C2B6F01BEA9C1F58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

custom.png

Path C:\Users\Admin\AppData\Local\Temp\Assets\custom.png
Size 17KB
SHA256 fbece8bb5f4dfa55dcfbf41151b10608af807b9477e99acf0940954a11e68f7b
MD5 03b17f0b1c067826b0fcc6746cced2cb
SHA1 e07e4434e10df4d6c81b55fceb6eca2281362477
SHA512 67c78ec01e20e9c8d9cdbba665bb2fd2bb150356f30b88d3d400bbdb0ae92010f5d7bcb683dcf6f895722a9151d8e669d8bef913eb6e728ba56bb02f264573b2
SSDEEP 96:wkEWMrbxNXW5G53p1pCcXdV8WMIPX7kTCM4:wkEdV8WM4YWM4
TLSH
T168727229FDF2B2EC450A523339C654015D7307C3E681AC85BACE8D162F21BDD8C8F659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

error_icon.png

Path C:\Users\Admin\AppData\Local\Temp\Assets\error_icon.png
Size 1KB
SHA256 666ad4fe456216ddc06618967846ed31f81d8db5be97da6531842c0667352b89
MD5 dab2c4538a83422b5deae0e0de9b7a30
SHA1 78c2ab2271aa4020df1e0289bc3c1ba9a43fd424
SHA512 24cb30a68ce117ba16edd1e94c7d066343eb265c874cd55467db2f913c01b9d776b2ad846e3414cd820c0ba10d93f132aea27739d16165b6e9dd5fbc8890bfdc
TLSH
T18B412ED999C54CDCAEC5780AB5D7DC51981274A6106AF1C02142DE68E491B2DD41DF43
MD5 SHA1 SHA512 TLSH

Submit Download

exit_close_click.png

Path C:\Users\Admin\AppData\Local\Temp\Assets\exit_close_click.png
Size 670B
SHA256 7aaef329ba9fa052791d1a09f127551289641ea743baba171de55faa30ec1157
MD5 26eb04b9e0105a7b121ea9c6601bbf2a
SHA1 efc08370d90c8173df8d8c4b122d2bb64c07ccd8
SHA512 9df3c723314d11a6b4ce0577eb61488061f2f96a9746a944eb6a4ee8c0c4d29131231a1b20988ef5454b79f9475b43d62c710839ecc0a9c98324f977cab6db68
TLSH
T1150188D435988F4D07CD96678D540F00C8F0461AC4C9DC13461508608658574BA57F96
MD5 SHA1 SHA512 TLSH

Submit Download

installer_logo.png

Path C:\Users\Admin\AppData\Local\Temp\Assets\installer_logo.png
Size 6KB
SHA256 06f6630b150cca4ab3a00b663bfb6b0fe0c53309d434036c5ef16b3fe01304ed
MD5 4cc6586c249ae201501c07fe5354b23b
SHA1 8fda8ef400f0bc25fd19cf4aa13469141befa3d8
SHA512 65ce7392ad4519ca51edafb5e25d60f0b0d2d37f7f8afe0394aa0594e63c38d331cd3c63aea149419dedabdc836f10cb1e9cc468c2d40afbb9e94a344a20fa83
SSDEEP 96:6LB+NXPkBgoVkTC+sTf/k31LgObdEKF+MrwwwAlLCXSisPj+DC0VDep6/jk+A8RO:pBP6gj3sTXIX5EJDlJW+D//QD8REO6
TLSH
T1E9E18FBD50655C900309C1D2D970440CADEF63E1EA19B24E0B8AD47FF2741EE5EB1F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_minimize.png

Path C:\Users\Admin\AppData\Local\Temp\Assets\installer_minimize.png
Size 113B
SHA256 a064f417e3c2b8f3121a14bbded268b2cdf635706880b7006f931de31476bbc2
MD5 38b539a1e4229738e5c196eedb4eb225
SHA1 f027b08dce77c47aaed75a28a2fce218ff8c936c
SHA512 2ce433689a94fae454ef65e0e9ec33657b89718bbb5a038bf32950f6d68722803922f3a427278bad432395a1716523e589463fcce4279dc2a895fd77434821cc
TLSH
T162B02BC13608FC34C64E0935416290009921001D011024101E0500680C1B19051A4F00
MD5 SHA1 SHA512 TLSH

Submit Download

minimize_progress_click.png

Path C:\Users\Admin\AppData\Local\Temp\Assets\minimize_progress_click.png
Size 212B
SHA256 2f62d4e8c643051093f907058dddc78cc525147d9c4f4a0d78b4d0e5c90979f6
MD5 1504b80f2a6f2d3fefc305da54a2a6c2
SHA1 432a9d89ebc2f693836d3c2f0743ea5d2077848d
SHA512 675db04baf3199c8d94af30a1f1c252830a56a90f633c3a72aa9841738b04242902a5e7c56dd792626338e8b7eabc1f359514bb3a2e62bc36c16919e196cfd94
TLSH
T115D023D757C544F46915072E4DFF4C13502144235F318518C54B0D7F75217908579FC2
MD5 SHA1 SHA512 TLSH

Submit Download

setpath.png

Path C:\Users\Admin\AppData\Local\Temp\Assets\setpath.png
Size 15KB
SHA256 5bbb2f41f9f3a805986c3c88a639bcc22d90067d4b8de9f1e21e3cf9e5c1766b
MD5 b2e7f40179744c74fded932e829cb12a
SHA1 a0059ab8158a497d2cf583a292b13f87326ec3f0
SHA512 b95b7ebdb4a74639276eaa5c055fd8d9431e2f58a5f7c57303f7cf22e8b599f6f2a7852074cf71b19b49eb31cc9bf2509aedf41d608981d116e49a00030c797c
SSDEEP 96:iS5YkEWmE5+W+BxNXrNGyxGvsc5RxZ8af:iSqk6C+z5mf
TLSH
T10E624E65FDF0B565D989E2322DC928025C730B83D6809D45BACE8CA72F00BE98D5F593
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unchecked_gray.png

Path C:\Users\Admin\AppData\Local\Temp\Assets\unchecked_gray.png
Size 192B
SHA256 671f26795b12008fbea1943143f660095f3dca5d925f67d765e2352fd7ee2396
MD5 e50df2a0768f7fc4c3fe8d784564fea3
SHA1 d1fc4db50fe8e534019eb7ce70a61fd4c954621a
SHA512 c87a8308a73b17cbdd179737631fb1ba7fdaeb65e82263f6617727519b70a81266bb695867b9e599c1306ee2cf0de525452f77ce367ca89bf870ea3ae7189998
TLSH
T1BBC02292B92C9C6E868A003BF0311A40A03B037201808A199211E020D6967328B832B2
MD5 SHA1 SHA512 TLSH

Submit Download

BlueStacksInstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\BlueStacksInstaller.exe
Size 185KB
SHA256 0ba4648e994852eb60429236dae2f74fc0e9600645208cb08f2268cc6f108aa8
MD5 c524d765b9fc9e9be120d2e1a555734f
SHA1 8b316df946ffab7e0f9754ae9500d9e4e42ecaf5
SHA512 2f0d38867710da445e04842d69d09b834dcf02eace1093fd06b8132e047ee6682b7ef8fd3548c06007d94acc6c107519f6f765fc1ad431db115c8dcd116002ab
SSDEEP 3072:tZsY0RCj6XaKTnGStckPUYFzeXOcfgZVB+IYsktWNdudAKZaow29J1:LTMzdtckhpmOv2wK9P
TLSH
T1B9042B443BFC8918F1FF1F7A29B245104B36B9878A35DB2E069250CE0E71745DA66BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bootstrapper.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe.config
Size 392B
SHA256 4b7df915d706af6459c38d75b09c5e14f951842ae0678078400f204ad1c7a7c2
MD5 ca0a329097316832e4a6ea5d870c9268
SHA1 4a36b93361d3dc9df9b00313f2c2b394be9e1e72
SHA512 51f9a874e84f130be4fa29fcc4bc934105318234b5dd9ceedaf569e3f0e6b38e29f3bec056044724476ae24295a510b16d8a737b994fd6f1268609defa315271
TLSH
T1CEE0D81559D8FC2B5EB34B13B6228566EBB0E3D651A45C08F4DF69A30A3308A6B97331
MD5 SHA1 SHA512 TLSH

Submit Download

CommonInstallUtils.zip

Path C:\Users\Admin\AppData\Local\Temp\CommonInstallUtils.zip
Size 6.9MB
SHA256 0ffff7ea5f8076bac60eed43b2cd5da45b2dbfd7231db9018eeec6c76ff60b43
MD5 f09a12bf745e3b661186b59df36f9fb6
SHA1 a648ca550ec915883bdca7c06b9a518758e44873
SHA512 f8f1e55c3242bbc4f7029bbc7acd03a5be8d00d3be680b1b939c8a9b5d3a09f3790ad7cf68f049464c54b41bcae2f078563e5e3145b23bc03c0177a6e6f576da
SSDEEP 196608:8ez7HAe1ROBfWMh55zMoQlSTtiVwcAtcwbbwnBY68:8ud1ApWMG5UiFAtcwbbGBYz
TLSH
T1EC7633A7DC268BDFBE3BA3A822A18035F8EF5E7C8B304544565B17448032558B59DF2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCOMPILER_47.dll

Path C:\Users\Admin\AppData\Local\Temp\D3DCOMPILER_47.dll
Size 4.0MB
SHA256 6bf1b5cd6cf5316493a2419ea7ecff44de39c71f226cb1b0dbe18e940f3bc988
MD5 898b3b792574a266c0f60a87244deac5
SHA1 af5f4d815d21f2272ce64a7b414086a6e7eb599a
SHA512 e1ae86e56a1e6f7d0b00d33667e01afea6b1a65013f9247a2a48ed118a31ed01ab1c51881c246378bcd58e6584143d7b81806783cef96c6251a23ca4049cecfb
SSDEEP 49152:2BfmqCtLI4erBYysLjG/A8McPyCD6hw16JVTW7B3EgvVlQ3LAYmyNOvGJse+aWyb:WeZevVKACOvWYQd
TLSH
T113167C46B2A440F9C1AB8139CA5B8717EBB07814173497EF12909625EF73FE16E3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD-CheckCpu.exe

Path C:\Users\Admin\AppData\Local\Temp\HD-CheckCpu.exe
Size 133KB
SHA256 746aef1025c7cdf9eae0d9e55362d0230a8e877f0d6749ae39c53d730287eb36
MD5 fe2bd5b8dacbb0e6509ab71640979a12
SHA1 1ca2c7713c0dc75e0fb071d068e7f898a5c90085
SHA512 0cd4300a71af6489fa85ee4701d583cb73f1ffc41a850b4245b0c73a892000a754548c91e84c2cde01808c1913f4bfa0e7b2263da7af297163d11e7409d2a832
SSDEEP 1536:HZCLaBoTQokfWF9ATfGWOKbunAi7rsMNzONZjLsxt/w54hX1AivIiRdvVWXit:EL3Qokfqof/bu/fbxGlkwWhHvdRdvVgQ
TLSH
T166D38C203581C432E5A32574CAA8DAB6CE79F8700B7468DB3BD8567E1F697D1AB34307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD-Common.dll

Path C:\Users\Admin\AppData\Local\Temp\HD-Common.dll
Size 1.3MB
SHA256 c5726b4eb1d06ef31f316b84d3d1feb6b1a6cba5d15360273b2315afcfb1c2f6
MD5 ad4946d13bc7e78c99110067e6b1cf30
SHA1 ca2dc3e902f46d027fd3c03d0265893d691b91e4
SHA512 1eba47aa17683a5af7244658a8a475cd29ed5e6decc8f06625f9b4b0fe81cbcdc3b2dfa02deac324b8f4765429257731acb1fe8600640e5e3bdd5c28a0bc7954
SSDEEP 24576:upIYjXzR2FfyT+oQ1kx/WWtWrnngnnnKnanx/:MRYqTZ5+WErnngnnnKnanF
TLSH
T1A8554A00B7F54918E67F1B34B4B215304A75FC91AAA6E35E0610BEAE7D727009DA0BF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD-ForceGPU.exe

Path C:\Users\Admin\AppData\Local\Temp\HD-ForceGPU.exe
Size 152KB
SHA256 1570d708a26ea4d010ab1416d10be1e5d0f90b810eacdd575ab039dafa7541a0
MD5 f07020138ef4e95df341abee6caa7a31
SHA1 b5f68bc03061f38132c185305da67a54ba16727d
SHA512 7cb3f6c8c24e8c485247d36a42fdb13348a822248648cf1e48ffb2d8bc3648a6de2e032ecb9ea6bcfd632e8c5b6f7c29ce96f51f08968d3aec98403a32152b83
SSDEEP 1536:wfaACJ1h+I2FudMHvRWhHn4FnXqDpu3jj/B44S26boc95vHWXi:1QI2FumqH8WkTjxGbt95Pg
TLSH
T19CE36341EBE132DCD8F9D278E6166095ECB13EF4B31766C70224AD118FA6EE0D639721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD-GLCheck.exe

Path C:\Users\Admin\AppData\Local\Temp\HD-GLCheck.exe
Size 558KB
SHA256 e06542bc804b9af6818b2c5c4069bca8bebf5c60c4a73aa136a4f373c6161015
MD5 371d3180920f91c09ce70360226502e6
SHA1 b3d6baa6f4b69f0b3b178e849213816ab42861d5
SHA512 20de798b1bee2b52300250e66bafc3c5a5721097e83f2b2b59d6fa4468da4395b405cf69435dc2bd37cef9aa43b3145967efd357028d1ffbbd4f54463c75f425
SSDEEP 3072:UJwEbIGMK9i5OFiBStmLxPEn0nKc30f/BnR492ZajH+PeEkgy7Mn5lYKt8ZZaMt3:i2K84xSJ3ELcLeR0sEZZzLIV+biRCF
TLSH
T117C47B9577A817E6D17BC13DCAC74B1AE97278111321A6CF019842BB1F13AE82E7F721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD-Handle.exe

Path C:\Users\Admin\AppData\Local\Temp\HD-Handle.exe
Size 407KB
SHA256 5d9c352b0544df6502da7d24d704765e63251adc9c19c0d293edd4450d5f6204
MD5 b2347b57ae73d52ee509d2037bf10f83
SHA1 7d3d45d2995e1520d7c93ebf5aef7c799e2800ca
SHA512 adda7b69ba17bf85f06fb1cc665f2bb4aea0b6144875a505f07304d99f8cfd88549c152b60d8f81cf5e418651f1e8fb28af5638a4316da110fc6c6037d5cf53e
SSDEEP 6144:EzAYWot1WkE3fDIERf0tgjtAVN6/SnLahE8YjHNWVY91NTNM:I+ozY3JfT2CbD0NM
TLSH
T141948D16B3D080F2D4578175C952C7B2EE3778251725A6CF6BD486B91F233E1AA3A30E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD-Opengl-Native.dll

Path C:\Users\Admin\AppData\Local\Temp\HD-Opengl-Native.dll
Size 3.0MB
SHA256 f3858993196244a24f55845aec1e4677f7488a41d68f3780725bc9c48d12ec97
MD5 7d32025467a5eef90e9bb4ee36fdb802
SHA1 d1387abc34aa76c14793976e165e407d0e8d2038
SHA512 7d43fb8741351c8f83b22f3e2bfb64fc41bcc16aae4de6dbfb63763da123b925d4d5aca21621ea1f3d4da0a52ae195f10ef2c5956b76afe5cdbff9b313485cfe
SSDEEP 49152:Smq7Thpz6CSgFOiqpFKeUTRkVZYUjIUIiGPKdzd+KtSbZMMGOmeuZ+iCdNHOP0qh:Zq78gFOiqpFKeUTRkVZYUjIUIiGPKdzt
TLSH
T199E57C4A36A89095D177817CC9C7CB8AE6717C094B215BCB1594A3AE1F37FE9087FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i18n.en-US.txt

Path C:\Users\Admin\AppData\Local\Temp\Locales\i18n.en-US.txt
Size 109KB
SHA256 4558128fd5acd625d6f8fd8d7958af7e37c83cfc68055471af6c9f226e07028c
MD5 19bbe3ec3a7d096f4752dd3eab359678
SHA1 91070307671259aa253c07614f85dd995f40adea
SHA512 61adad3b30d536f6e549edb9d77d2eec0269cd8608e5b46a64e7063032f5332f28543801d7be7f8a10c6978f65c7ba1071ca5f896a3d5df24c3f13528c139e2b
SSDEEP 1536:H938XkHN8fQlU98vHZQMPd2xDGTqg2WXrXlLBzKv8VYBvF10o1TLb62wfuZdUANM:H98QrCwKDXLsV09aDRmyMX/jb3OB
TLSH
T170B394AFE33B535A96D2051A90C83042A507B36B33687A017CACC43B576B56D437EEDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\Newtonsoft.Json.dll
Size 493KB
SHA256 7181f80c0719d1d75417b8360113d4e55ad93cadedd8a83b4c1869057072c5d2
MD5 9af4748049bd7808a7b5ab2e7d4d4e17
SHA1 342c71611e85b1a2468968ccb0ec12d2c7ae04c3
SHA512 96e286bdc77a0ae7015bc33f31f9379e7a06560d98b0064f9eb559a0b13fef7efe3e2f0baed5a968a6fe91bba5bc163bad7c9f5f490fd353596d6ae35e3d9c3e
SSDEEP 12288:EmKLDa2Tqte5+7OWpP8gkRCj7gBEA+PeKjJc:sie0/pP8gUwcBEAMeKdc
TLSH
T17BB4191133FC8F15E5EE2732E0344525AAFAF457A6BAD74E69419ABE2C93B408D00773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oem.cfg

Path C:\Users\Admin\AppData\Local\Temp\Oem.cfg
Size 1KB
SHA256 621422f0b7d21ef6c1b55fbc4a5db671d052060563bdd2e94da73b84e8d606a9
MD5 c67b040f7136bf6ab258d8bf1803fd5d
SHA1 7befdedd864aa6680bac2db9c1683678588db20e
SHA512 a8dbb4cf6ce2260bcb879f5c413ce3194fd09257ed26c194b848de7af301e0cc02ef5c7dc783484fce8f6660dee14b792c801ac20c9ce84e19a3ecd7efee1607
TLSH
T126116A2E37E03576F93B9327E8C95512AA7A1C5970637830D645444E68C0F1953D688B
MD5 SHA1 SHA512 TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\libEGL.dll
Size 402KB
SHA256 78dbd96e1b2b105030fb50457c1d720d1373558428c980960b4e3b88105ed2af
MD5 948eb249b23a9487d15fab236e4a2805
SHA1 ab7db3e961f007b5b242ce01f8183e197c78a571
SHA512 1510001a8c4e3875dff0b16a77028b35d9c3491c7b52046c0094253165266246d7531c538023a99d57999b41f228175423220acaed9fab1c1857b067c1577782
SSDEEP 3072:kBIQbANn+FUWoKdyx+FZ+3xlGy5UrYfInPePjFP5f+HCTzBz4o5m4O4iiibvBBYJ:kuEOKUoF2BLP9ZP6o5crBBQ6xWhQW
TLSH
T155947C56F79005BAD17BE23CC9634B51EAB278591721E78F03B803AA1F133A1993F725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL_translator.dll

Path C:\Users\Admin\AppData\Local\Temp\libEGL_translator.dll
Size 3.0MB
SHA256 adbf8672d18ce63ca728f24f802b4f7e420cb307ad9e8efb54fd7a87a6975df6
MD5 5e717c3e8c4ab79ccf21017cd743d4f3
SHA1 769a3232bfa49927ee8d5e5b7fb26c1c62815869
SHA512 b773e52be4c585bb946d31052fd74266913080625f69f4eb1ac0a8945fa7aeeaefe1b6a3e6f25ac1482151a3c7cf873cbf5cf44bf69778405fe550db72f25d91
SSDEEP 24576:BzhfNKYszRP+ZvhcvKV0bjKDF3BeWJEuzsq38JhoHVLN8hmv1Vw5hDwZ2+d6418:BzBN2zE0OF3kORgoBv1Vw5dwZ2nX
TLSH
T180E56B5B36581199E07BC07DCACB9F4AD6727005072297CF06A443AE2F67FE909BE721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLES_CM_translator.dll

Path C:\Users\Admin\AppData\Local\Temp\libGLES_CM_translator.dll
Size 3.0MB
SHA256 d1f6e10fcdeb281a79afa90832352634c346e322b19253efaae95b526f728e0c
MD5 46ef9bf67aa4cc25d1d9cf50a777c6f8
SHA1 2ee8be9eaed99089a2063067e1f8c75bd5ee9a0f
SHA512 72b5d76bda749ed0441342d73e4478bad486f60cb55db29531d97739c0ebdf9e5c33f3d13c6e79a67b52c292810cee2a1730cbe7270f77349a0808c6a7c6db93
SSDEEP 24576:X9QQtu9rGhdOyGqr1t1P7cmuGy5C9krEQTeUzG3KJaxi8ajc5UA9E/cbFr6NOqRU:X9QkerGiq/fGeUzJc56/GFr6NOqnc
TLSH
T1E9E57C5A36981199E07BD07DCACB8F4AD6727005032297CF05A443AE2F67FE91DBE721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLES_V2_translator.dll

Path C:\Users\Admin\AppData\Local\Temp\libGLES_V2_translator.dll
Size 4.6MB
SHA256 17347ae4ca411848fa95651425665415e366ed4e3f0611268fff14481f85b475
MD5 bf03cc3d46bc705e1d0b592a76011e4d
SHA1 9fb0d38395a1ad4793a9aecc3edcf85f28006593
SHA512 f9f0be2684bb78da14b49de18c224be2e33d8523a06a7753db16d246a2c52b58c8e8ea37632dae7275af503aa151915ef3d4c874f727985c47ddb3720413fa2b
SSDEEP 49152:X3BdXh/fnBXoIVTCXuC5KbS84PkAsDwEMvuYXPBV6:n59C5suzsALr6
TLSH
T1D7265B1B32A8119AD07BD07DCAC79E4AD6B2740603209BCF4594439D2F67FEA1E7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll
Size 4.0MB
SHA256 7fe01a2b5c197c4604f37dcaef9cb5136b3a2e05cdec60ba06e3d664c58bf1c8
MD5 c9c69793844aeb22784321c3458b33dd
SHA1 8d900d6238c61b129db9288a71464c54295bff77
SHA512 35a3cf14c7c4942073b12e903709410fbb12cb65a160dabd1a14e1641b78c3ed144e5b2d159e2f73a9ef6820f16ba476540bc6689d16cd381f4c0b665d2c5e92
SSDEEP 49152:gHJnqf2NnsNicg/09uIciO7IE1YDNZvvxwpsROHkZ+Au3r7PZuU1WeGip0tTlc+s:GbNnsNo/09gYvxwBD3ZF9i/8Duc
TLSH
T1E0165A1B626900F9C1BBD03DC7576A47E7B2740A4370A7DB02A0466A1F63BF16A7F325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libOpenglRender.dll

Path C:\Users\Admin\AppData\Local\Temp\libOpenglRender.dll
Size 2.7MB
SHA256 4f625456e727b71a7dcb58e39365a408a312376d5fc0dd01f3d11c5b17c86bb8
MD5 8623c1b8a7bb5325e16413d25ffee60c
SHA1 9b8956a1ecf1fb243307b2f0be775503e6a7c481
SHA512 7ccaf105870b472dc5e35a4f0a23ffe39514cb0351dc75f88b1155085bbdb90e287cc779205ea8154e9c0bf8a409709808142586c15141b96224d21fc45002fb
SSDEEP 24576:6Q463DZYOWi5M5ILRsRBFGjxEdhi0tmJrD98v82lNBP:v4EYzAM5ILRsRfGSXXY082FP
TLSH
T13CD57C1E36980091E1BB907DCE878A4AE6B17C09472066CF38D4639E1F73FE9197E761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shortcuts.json

Path C:\Users\Admin\AppData\Local\Temp\shortcuts.json
Size 192B
SHA256 45493da13cf4ec83391228fe63509460fcdc39028a2ff2b119a86db4e6adfbee
MD5 4f19ed49197e417edb9d77b93ffc1d66
SHA1 3c300e9543c1139d0c5cc1bb29c2870e25cccfbf
SHA512 a8e06a32e101aa6ba064cffba01c7b893f56f099cb25cb18acda65fd97c6130c56fdcd0e6881071b69d8bddfb6a0a486ea043e8d29cedd58d74486544acf80d3
TLSH
T155C01216D935D653027F676096811804EC07159714568D4AF62D5C083F601090669D40
MD5 SHA1 SHA512 TLSH

Submit Download

memory/564-1265-0x0000000140000000-0x000000014005A000-memory.dmp

Download

memory/1804-1279-0x000000001B630000-0x000000001B67C000-memory.dmp

Download

memory/1804-1276-0x00000000000F0000-0x000000000013E000-memory.dmp

Download

memory/1804-1277-0x0000000002290000-0x00000000022AC000-memory.dmp

Download

memory/2040-1268-0x0000000000980000-0x000000000098A000-memory.dmp

Download

memory/3124-1278-0x0000000000450000-0x0000000000480000-memory.dmp

Download

memory/5776-270-0x00007FFED0F30000-0x00007FFED18D4000-memory.dmp

Download

memory/5776-167-0x00007FFED0F30000-0x00007FFED18D4000-memory.dmp

Download

memory/5776-161-0x00007FFED0F30000-0x00007FFED18D4000-memory.dmp

Download

memory/5776-160-0x000000001B200000-0x000000001B35C000-memory.dmp

Download

memory/5776-164-0x000000001BC90000-0x000000001C1B8000-memory.dmp

Download

memory/5776-158-0x00007FFED0F30000-0x00007FFED18D4000-memory.dmp

Download

memory/5776-157-0x00007FFED0F30000-0x00007FFED18D4000-memory.dmp

Download

memory/5776-156-0x00007FFED0F30000-0x00007FFED18D4000-memory.dmp

Download

memory/5776-155-0x00000000003A0000-0x00000000003D4000-memory.dmp

Download

memory/5776-154-0x00007FFED10BF000-0x00007FFED10C0000-memory.dmp

Download

memory/5776-166-0x00007FFED0F30000-0x00007FFED18D4000-memory.dmp

Download

memory/5776-162-0x00007FFED0F30000-0x00007FFED18D4000-memory.dmp

Download

memory/5776-258-0x00007FFED0F30000-0x00007FFED18D4000-memory.dmp

Download

memory/5776-1266-0x0000000021DD0000-0x0000000021DD8000-memory.dmp

Download

memory/5776-1267-0x0000000021E10000-0x0000000021E32000-memory.dmp

Download

memory/5776-259-0x00007FFED0F30000-0x00007FFED18D4000-memory.dmp

Download

memory/5776-180-0x00000000211D0000-0x00000000211D8000-memory.dmp

Download

memory/5776-186-0x000000001EE10000-0x000000001EE1E000-memory.dmp

Download

memory/5776-185-0x000000001EE40000-0x000000001EE7E000-memory.dmp

Download

memory/5776-274-0x00007FFED0F30000-0x00007FFED18D4000-memory.dmp

Download

memory/5776-195-0x0000000022A50000-0x0000000022AD0000-memory.dmp

Download