hxxps://down[.]aweray[.]com/awesun/windows/Aweray_Remote_2[.]0[.]0[.]45399_x64[.]exe

Analysis

max time kernel
1502s
max time network
1502s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01/04/2023, 10:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://down.aweray.com/awesun/windows/Aweray_Remote_2.0.0.45399_x64.exe

Score

8^/10

discovery evasion persistence upx

Malware Config

Signatures

Downloads MZ/PE file

Modifies Windows Firewall 1 TTPs 8 IoCs

evasion

Modify Existing Service

T1031

pid	Process
5628	netsh.exe
4048	netsh.exe
6128	netsh.exe
4240	netsh.exe
3020	netsh.exe
1908	netsh.exe
5680	netsh.exe
6040	netsh.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	Bootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	BlueStacksInstaller_5.11.41.1005_native_96b729ce04fedd1fd61feffb1077ea5c_MzsxNSwwOzUsMTsxNSw0OzE1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	BSX-Setup-5.11.41.1005.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	BlueStacksInstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	BlueStacksInstaller_5.11.41.1005_native_96b729ce04fedd1fd61feffb1077ea5c_MzsxNSwwOzUsMTsxNSw0OzE1.exe

Executes dropped EXE 44 IoCs

pid	Process
3500	Aweray_Remote_2.0.0.45399_x64.exe
1608	Aweray_Remote_2.0.0.45399_x64.exe
4152	Aweray_Remote_2.0.0.45399_x64.exe
3156	Aweray_Remote_2.0.0.45399_x64.exe
3240	Aweray_Remote_2.0.0.45399_x64.exe
3552	Aweray_Remote_2.0.0.45399_x64.exe
4520	Aweray_Remote_2.0.0.45399_x64.exe
2364	Aweray_Remote_2.0.0.45399_x64.exe
4084	Aweray_Remote_2.0.0.45399_x64.exe
4924	Aweray_Remote_2.0.0.45399_x64.exe
4332	AweSun.exe
5056	AweSun.exe
4804	BlueStacksInstaller_5.11.41.1005_native_96b729ce04fedd1fd61feffb1077ea5c_MzsxNSwwOzUsMTsxNSw0OzE1.exe
4492	BlueStacksInstaller.exe
3696	HD-CheckCpu.exe
4180	HD-CheckCpu.exe
4388	BSX-Setup-5.11.41.1005.exe
5400	BlueStacksInstaller_5.11.41.1005_native_96b729ce04fedd1fd61feffb1077ea5c_MzsxNSwwOzUsMTsxNSw0OzE1.exe
5972	Bootstrapper.exe
5820	BlueStacksInstaller.exe
1060	7zr.exe
6064	7zr.exe
864	HD-ForceGPU.exe
2388	HD-GLCheck.exe
1236	HD-GLCheck.exe
3348	HD-CheckCpu.exe
2448	HD-GLCheck.exe
3320	7zr.exe
1340	HD-GLCheck.exe
3900	HD-GLCheck.exe
2748	HD-GLCheck.exe
640	HD-GLCheck.exe
5204	HD-GLCheck.exe
5576	HD-GLCheck.exe
2624	7zr.exe
5588	BlueStacksServices.exe
6044	7zr.exe
5136	7zr.exe
1076	BlueStacksServices.exe
4444	BlueStacksServices.exe
5776	BlueStacksServices.exe
4260	HD-CheckCpu.exe
5784	7zr.exe
5476	BlueStacksServices.exe

Loads dropped DLL 64 IoCs

pid	Process
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe
4388	BSX-Setup-5.11.41.1005.exe

UPX packed file 45 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0003000000000733-158.dat	upx
behavioral1/files/0x0003000000000733-222.dat	upx
behavioral1/files/0x0003000000000733-223.dat	upx
behavioral1/files/0x0003000000000733-242.dat	upx
behavioral1/files/0x0003000000000733-244.dat	upx
behavioral1/memory/3500-243-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/files/0x0003000000000733-251.dat	upx
behavioral1/memory/4152-252-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/memory/1608-262-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/memory/3156-276-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/memory/1608-277-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/memory/3156-278-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/memory/3156-285-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/memory/3156-287-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/memory/3156-289-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/memory/3156-291-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/files/0x0003000000000733-294.dat	upx
behavioral1/memory/3156-295-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/files/0x0003000000000733-299.dat	upx
behavioral1/memory/1608-300-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/files/0x0003000000000733-304.dat	upx
behavioral1/memory/3240-301-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/files/0x0003000000000733-305.dat	upx
behavioral1/memory/3240-309-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/files/0x0003000000000733-345.dat	upx
behavioral1/memory/3552-307-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/files/0x0003000000000733-373.dat	upx
behavioral1/memory/4924-433-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/memory/1608-451-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/memory/4520-470-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/memory/2364-478-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/memory/4084-479-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/memory/4520-490-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/memory/2364-491-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/memory/4520-494-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/memory/4520-498-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/memory/4520-502-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/memory/4520-508-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/memory/4520-512-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/memory/4520-516-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/memory/4520-520-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/memory/4520-524-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/memory/2364-525-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/memory/4520-528-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx
behavioral1/memory/2364-529-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Windows\CurrentVersion\Run	BlueStacksServices.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\electron.app.BlueStacks Services = "C:\\Users\\Admin\\AppData\\Local\\Programs\\bluestacks-services\\BlueStacksServices.exe --hidden"	BlueStacksServices.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\BlueStacks X\translations\qtwebengine_locales\he.pak	BSX-Setup-5.11.41.1005.exe
File created	C:\Program Files\BlueStacks_nxt\libcrypto-1_1-x64.dll	7zr.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\position	BSX-Setup-5.11.41.1005.exe
File created	C:\Program Files (x86)\BlueStacks X\image\MyGames\tip_ico.svg	BSX-Setup-5.11.41.1005.exe
File created	C:\Program Files (x86)\BlueStacks X\translations\qtwebengine_locales\nb.pak	BSX-Setup-5.11.41.1005.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\aws\aws-c-io.dll	BSX-Setup-5.11.41.1005.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\aws\aws-checksums.dll	BSX-Setup-5.11.41.1005.exe
File created	C:\Program Files\BlueStacks_nxt\msvcp100.dll	7zr.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\iconengines	BSX-Setup-5.11.41.1005.exe
File created	C:\Program Files (x86)\BlueStacks X\image\Logo_Nowgg.svg	BSX-Setup-5.11.41.1005.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\video_filter\libantiflicker_plugin.dll	BSX-Setup-5.11.41.1005.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\CloudMode	BSX-Setup-5.11.41.1005.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_normal.svg	BSX-Setup-5.11.41.1005.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\api-ms-win-crt-runtime-l1-1-0.dll	BSX-Setup-5.11.41.1005.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\MIM Logo.svg	BSX-Setup-5.11.41.1005.exe
File created	C:\Program Files (x86)\BlueStacks X\image\MyGames\NavigatorForward_Click.svg	BSX-Setup-5.11.41.1005.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\video_output\libwinhibit_plugin.dll	BSX-Setup-5.11.41.1005.exe
File created	C:\Program Files (x86)\BlueStacks X\image\TypeIndicator\web3.svg	BSX-Setup-5.11.41.1005.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\aws\aws-cpp-sdk-s3.dll	BSX-Setup-5.11.41.1005.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\Qt5Multimedia.dll	BSX-Setup-5.11.41.1005.exe
File opened for modification	C:\Program Files\BlueStacks_nxt\QtGraphicalEffects\private\FastGlow.qml	7zr.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\MyGames\NavigatorForward_Disable.svg	BSX-Setup-5.11.41.1005.exe
File created	C:\Program Files (x86)\BlueStacks X\image\Search\mini_and.svg	BSX-Setup-5.11.41.1005.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\codec\libspeex_plugin.dll	BSX-Setup-5.11.41.1005.exe
File created	C:\Program Files\BlueStacks_nxt\BstkVMM.dll	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_nxt\imageformats	7zr.exe
File created	C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\et.pak	7zr.exe
File created	C:\Program Files (x86)\BlueStacks X\cef\locales\te.pak	BSX-Setup-5.11.41.1005.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\TypeIndicator\web3.svg	BSX-Setup-5.11.41.1005.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\msvcp140.dll	BSX-Setup-5.11.41.1005.exe
File opened for modification	C:\Program Files\BlueStacks_nxt\QtQuick\Controls\Styles\Desktop	7zr.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\video_chroma\libi420_nv12_plugin.dll	BSX-Setup-5.11.41.1005.exe
File opened for modification	C:\Program Files\BlueStacks_nxt\AdbWinApi.dll	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\te.pak	7zr.exe
File created	C:\Program Files (x86)\BlueStacks X\www\js\utils.js	BSX-Setup-5.11.41.1005.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\mediaservice\wmfengine.dll	BSX-Setup-5.11.41.1005.exe
File created	C:\Program Files\BlueStacks_nxt\QtQuick\Controls\TabView.qml	7zr.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\audio_filter\libaudiobargraph_a_plugin.dll	BSX-Setup-5.11.41.1005.exe
File opened for modification	C:\Program Files\BlueStacks_nxt\BstkSharedFolders.dll	7zr.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\resources\qtwebengine_resources_200p.pak	BSX-Setup-5.11.41.1005.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\radioButton\unselected_normal.svg	BSX-Setup-5.11.41.1005.exe
File created	C:\Program Files (x86)\BlueStacks X\translations\qtwebengine_locales\hr.pak	BSX-Setup-5.11.41.1005.exe
File created	C:\Program Files\BlueStacks_nxt\QtGraphicalEffects\private\GaussianInnerShadow.qml	7zr.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\cef\locales\ms.pak	BSX-Setup-5.11.41.1005.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\cef\locales\ro.pak	BSX-Setup-5.11.41.1005.exe
File created	C:\Program Files (x86)\BlueStacks X\image\MyGames\mygames_cloud_on.svg	BSX-Setup-5.11.41.1005.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\video_chroma\libyuy2_i420_plugin.dll	BSX-Setup-5.11.41.1005.exe
File created	C:\Program Files\BlueStacks_nxt\Assets\installer_logo.png	7zr.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\cef\locales\lv.pak	BSX-Setup-5.11.41.1005.exe
File created	C:\Program Files (x86)\BlueStacks X\image\help.svg	BSX-Setup-5.11.41.1005.exe
File created	C:\Program Files\BlueStacks_nxt\ssleay32.dll	7zr.exe
File created	C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\zh-TW.pak	7zr.exe
File created	C:\Program Files (x86)\BlueStacks X\translations\qtwebengine_locales\ta.pak	BSX-Setup-5.11.41.1005.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\codec\libtheora_plugin.dll	BSX-Setup-5.11.41.1005.exe
File created	C:\Program Files\BlueStacks_nxt\QtGraphicalEffects\Colorize.qml	7zr.exe
File opened for modification	C:\Program Files\BlueStacks_nxt\QtQuick\Controls\Private\SystemPaletteSingleton.qml	7zr.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\codec\liblibass_plugin.dll	BSX-Setup-5.11.41.1005.exe
File opened for modification	C:\Program Files\BlueStacks_nxt\QtQuick\Controls\Private\CalendarHeaderModel.qml	7zr.exe
File created	C:\Program Files (x86)\BlueStacks X\image\Promote\CasualL.png	BSX-Setup-5.11.41.1005.exe
File created	C:\Program Files (x86)\BlueStacks X\opengl32sw.dll	BSX-Setup-5.11.41.1005.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\platforms\qwindows.dll	BSX-Setup-5.11.41.1005.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\video_chroma\libi422_yuy2_mmx_plugin.dll	BSX-Setup-5.11.41.1005.exe
File opened for modification	C:\Program Files\BlueStacks_nxt\QtWebChannel	7zr.exe
File created	C:\Program Files (x86)\BlueStacks X\image\account\discord.svg	BSX-Setup-5.11.41.1005.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3360	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Aweray_Remote_2.0.0.45399_x64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	BlueStacksInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	BlueStacksInstaller.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Aweray_Remote_2.0.0.45399_x64.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133248273601144273"	chrome.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X\shell	BSX-Setup-5.11.41.1005.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X\shell\	BSX-Setup-5.11.41.1005.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X\shell\open\	BSX-Setup-5.11.41.1005.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	BSX-Setup-5.11.41.1005.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1529757233-3489015626-3409890339-1000\{F0EAC3AF-ABBD-4920-A2AA-C9B1336C75E9}	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X\ = "URL:BlueStacks X Protocol Handler"	BSX-Setup-5.11.41.1005.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X\DefaultIcon	BSX-Setup-5.11.41.1005.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X\shell\open	BSX-Setup-5.11.41.1005.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X\shell\open\command	BSX-Setup-5.11.41.1005.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X\shell\open\command\ = "\"C:\\Program Files (x86)\\BlueStacks X\\BlueStacks X.exe\" -open \"%1\""	BSX-Setup-5.11.41.1005.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X	BSX-Setup-5.11.41.1005.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X\URL Protocol	BSX-Setup-5.11.41.1005.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X\DefaultIcon\ = "C:\\Program Files (x86)\\BlueStacks X\\BlueStacks X.exe,0"	BSX-Setup-5.11.41.1005.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4120	chrome.exe
4120	chrome.exe
3372	chrome.exe
3372	chrome.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2040	taskmgr.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe
Token: SeShutdownPrivilege	4120	chrome.exe
Token: SeCreatePagefilePrivilege	4120	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
2364	Aweray_Remote_2.0.0.45399_x64.exe
2364	Aweray_Remote_2.0.0.45399_x64.exe
2364	Aweray_Remote_2.0.0.45399_x64.exe
2364	Aweray_Remote_2.0.0.45399_x64.exe
2364	Aweray_Remote_2.0.0.45399_x64.exe
2364	Aweray_Remote_2.0.0.45399_x64.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
4120	chrome.exe
2364	Aweray_Remote_2.0.0.45399_x64.exe
2364	Aweray_Remote_2.0.0.45399_x64.exe
2364	Aweray_Remote_2.0.0.45399_x64.exe
2364	Aweray_Remote_2.0.0.45399_x64.exe
2364	Aweray_Remote_2.0.0.45399_x64.exe
2364	Aweray_Remote_2.0.0.45399_x64.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe
2040	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1340	HD-GLCheck.exe
5204	HD-GLCheck.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 3788	4120	chrome.exe	84
PID 4120 wrote to memory of 3788	4120	chrome.exe	84
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 5040	4120	chrome.exe	85
PID 4120 wrote to memory of 220	4120	chrome.exe	86
PID 4120 wrote to memory of 220	4120	chrome.exe	86
PID 4120 wrote to memory of 832	4120	chrome.exe	87
PID 4120 wrote to memory of 832	4120	chrome.exe	87
PID 4120 wrote to memory of 832	4120	chrome.exe	87
PID 4120 wrote to memory of 832	4120	chrome.exe	87
PID 4120 wrote to memory of 832	4120	chrome.exe	87
PID 4120 wrote to memory of 832	4120	chrome.exe	87
PID 4120 wrote to memory of 832	4120	chrome.exe	87
PID 4120 wrote to memory of 832	4120	chrome.exe	87
PID 4120 wrote to memory of 832	4120	chrome.exe	87
PID 4120 wrote to memory of 832	4120	chrome.exe	87
PID 4120 wrote to memory of 832	4120	chrome.exe	87
PID 4120 wrote to memory of 832	4120	chrome.exe	87
PID 4120 wrote to memory of 832	4120	chrome.exe	87
PID 4120 wrote to memory of 832	4120	chrome.exe	87
PID 4120 wrote to memory of 832	4120	chrome.exe	87
PID 4120 wrote to memory of 832	4120	chrome.exe	87
PID 4120 wrote to memory of 832	4120	chrome.exe	87
PID 4120 wrote to memory of 832	4120	chrome.exe	87
PID 4120 wrote to memory of 832	4120	chrome.exe	87
PID 4120 wrote to memory of 832	4120	chrome.exe	87
PID 4120 wrote to memory of 832	4120	chrome.exe	87
PID 4120 wrote to memory of 832	4120	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://down.aweray.com/awesun/windows/Aweray_Remote_2.0.0.45399_x64.exe
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa756d9758,0x7ffa756d9768,0x7ffa756d9778
  2⤵
  PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1736,i,7210817146659585660,17253016943966503818,131072 /prefetch:2
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1736,i,7210817146659585660,17253016943966503818,131072 /prefetch:8
  2⤵
  PID:220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1736,i,7210817146659585660,17253016943966503818,131072 /prefetch:8
  2⤵
  PID:832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3100 --field-trial-handle=1736,i,7210817146659585660,17253016943966503818,131072 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3112 --field-trial-handle=1736,i,7210817146659585660,17253016943966503818,131072 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4772 --field-trial-handle=1736,i,7210817146659585660,17253016943966503818,131072 /prefetch:8
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5140 --field-trial-handle=1736,i,7210817146659585660,17253016943966503818,131072 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5096 --field-trial-handle=1736,i,7210817146659585660,17253016943966503818,131072 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 --field-trial-handle=1736,i,7210817146659585660,17253016943966503818,131072 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 --field-trial-handle=1736,i,7210817146659585660,17253016943966503818,131072 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1016 --field-trial-handle=1736,i,7210817146659585660,17253016943966503818,131072 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5136 --field-trial-handle=1736,i,7210817146659585660,17253016943966503818,131072 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2472 --field-trial-handle=1736,i,7210817146659585660,17253016943966503818,131072 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=832 --field-trial-handle=1736,i,7210817146659585660,17253016943966503818,131072 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4240 --field-trial-handle=1736,i,7210817146659585660,17253016943966503818,131072 /prefetch:8
  2⤵
  PID:2964
- C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe
  "C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe"
  2⤵
  - Executes dropped EXE
  PID:3500
- - C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe
    "C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe" --mod=install --admin=1
    3⤵
    - Executes dropped EXE
    PID:1608
- C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe
  "C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe"
  2⤵
  - Executes dropped EXE
  PID:4152
- - C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe
    "C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe" --mod=install --admin=1
    3⤵
    - Executes dropped EXE
    PID:3156
  - - C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe
      "C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe" --mod=green
      4⤵
      Executes dropped EXE
      PID:3240
    - - C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe
        
        "C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe" --mod=green --admin=1
        5⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2364
    - - C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe
        
        "C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe" --mod=service
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:4520
      - C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe
        
        C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe --mod=watch --pid=4520
        6⤵
        Executes dropped EXE
        
        PID:4084
      - C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe
        
        "C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe" --mod=update --cmd=check
        6⤵
        Executes dropped EXE
        
        PID:4924
      - C:\ProgramData\AweSun\agent\AweSun.exe
        
        "C:/ProgramData/AweSun\agent\AweSun.exe" --mod=desktopagent --port=50005 --agentid=1
        6⤵
        Executes dropped EXE
        
        PID:4332
        
        C:\ProgramData\AweSun\agent\AweSun.exe
        
        "C:\ProgramData\AweSun\agent\AweSun.exe" --mod=dragserver --port=50255
        7⤵
        Executes dropped EXE
        
        PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3732 --field-trial-handle=1736,i,7210817146659585660,17253016943966503818,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=212 --field-trial-handle=1736,i,7210817146659585660,17253016943966503818,131072 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4364 --field-trial-handle=1736,i,7210817146659585660,17253016943966503818,131072 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 --field-trial-handle=1736,i,7210817146659585660,17253016943966503818,131072 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5796 --field-trial-handle=1736,i,7210817146659585660,17253016943966503818,131072 /prefetch:1
  2⤵
  PID:732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=6008 --field-trial-handle=1736,i,7210817146659585660,17253016943966503818,131072 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6368 --field-trial-handle=1736,i,7210817146659585660,17253016943966503818,131072 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6348 --field-trial-handle=1736,i,7210817146659585660,17253016943966503818,131072 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5772 --field-trial-handle=1736,i,7210817146659585660,17253016943966503818,131072 /prefetch:8
  2⤵
  PID:3884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5296 --field-trial-handle=1736,i,7210817146659585660,17253016943966503818,131072 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=6992 --field-trial-handle=1736,i,7210817146659585660,17253016943966503818,131072 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5976 --field-trial-handle=1736,i,7210817146659585660,17253016943966503818,131072 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6936 --field-trial-handle=1736,i,7210817146659585660,17253016943966503818,131072 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6016 --field-trial-handle=1736,i,7210817146659585660,17253016943966503818,131072 /prefetch:8
  2⤵
  PID:2336
- C:\Users\Admin\Downloads\BlueStacksInstaller_5.11.41.1005_native_96b729ce04fedd1fd61feffb1077ea5c_MzsxNSwwOzUsMTsxNSw0OzE1.exe
  "C:\Users\Admin\Downloads\BlueStacksInstaller_5.11.41.1005_native_96b729ce04fedd1fd61feffb1077ea5c_MzsxNSwwOzUsMTsxNSw0OzE1.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4804
- - C:\Users\Admin\AppData\Local\Temp\7zS4C2A397F\BlueStacksInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS4C2A397F\BlueStacksInstaller.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\7zS4C2A397F\HD-CheckCpu.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS4C2A397F\HD-CheckCpu.exe" --cmd checkHypervEnabled
      4⤵
      Executes dropped EXE
      PID:3696
  - - C:\Users\Admin\AppData\Local\Temp\7zS4C2A397F\HD-CheckCpu.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS4C2A397F\HD-CheckCpu.exe" --cmd checkSSE4
      4⤵
      Executes dropped EXE
      PID:4180
  - - C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.11.41.1005.exe
      "C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.11.41.1005.exe" -s
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Modifies registry class
      PID:4388
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\BlueStacks X\green.vbs"
        5⤵
        Checks computer location settings
        
        PID:5880
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c green.bat
        6⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall delete rule name="BlueStacksWeb"
        7⤵
        Modifies Windows Firewall
        
        PID:4048
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall delete rule name="Cloud Game"
        7⤵
        Modifies Windows Firewall
        
        PID:6128
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="BlueStacksWeb" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\BlueStacksWeb.exe"
        7⤵
        Modifies Windows Firewall
        
        PID:4240
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="Cloud Game" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\Cloud Game.exe"
        7⤵
        Modifies Windows Firewall
        
        PID:3020
  - - C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.11.41.1005_native_96b729ce04fedd1fd61feffb1077ea5c_MzsxNSwwOzUsMTsxNSw0OzE1.exe
      "C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.11.41.1005_native_96b729ce04fedd1fd61feffb1077ea5c_MzsxNSwwOzUsMTsxNSw0OzE1.exe" -versionMachineID=00bd287b-007b-43bc-8e5f-ce808b89f9a6 -machineID=06561155-f922-4c8f-8651-3acda385132b -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Nougat32 -imageToLaunch=Nougat32 -isSSE4Available=1 -appToLaunch=bs5 -bsxVersion=10.0.6.1001 -country=US
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\Bootstrapper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\Bootstrapper.exe" -versionMachineID=00bd287b-007b-43bc-8e5f-ce808b89f9a6 -machineID=06561155-f922-4c8f-8651-3acda385132b -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Nougat32 -imageToLaunch=Nougat32 -isSSE4Available=1 -appToLaunch=bs5 -bsxVersion=10.0.6.1001 -country=US
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:5972
      - C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\BlueStacksInstaller.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\BlueStacksInstaller.exe" -versionMachineID="00bd287b-007b-43bc-8e5f-ce808b89f9a6" -machineID="06561155-f922-4c8f-8651-3acda385132b" -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName="Nougat32" -imageToLaunch="Nougat32" -appToLaunch="bs5" -bsxVersion="10.0.6.1001" -country="US" -parentpath="C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.11.41.1005_native_96b729ce04fedd1fd61feffb1077ea5c_MzsxNSwwOzUsMTsxNSw0OzE1.exe" -md5=96b729ce04fedd1fd61feffb1077ea5c -app64=
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\7zr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\CommonInstallUtils.zip" -o"C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\" -aoa
        7⤵
        Executes dropped EXE
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\7zr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\QtRedistx64.zip" -o"C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\" -aoa
        7⤵
        Executes dropped EXE
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\HD-ForceGPU.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\HD-ForceGPU.exe" 1 "C:\Program Files\BlueStacks_nxt"
        7⤵
        Executes dropped EXE
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\HD-GLCheck.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\HD-GLCheck.exe" 1 2
        7⤵
        Executes dropped EXE
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\HD-GLCheck.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\HD-GLCheck.exe" 4 2
        7⤵
        Executes dropped EXE
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\HD-CheckCpu.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\HD-CheckCpu.exe" --cmd checkSSE4
        7⤵
        Executes dropped EXE
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\HD-GLCheck.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\HD-GLCheck.exe" 1 1
        7⤵
        Executes dropped EXE
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\7zr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\PF.zip" -o"C:\Program Files\BlueStacks_nxt" -aoa
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\HD-GLCheck.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\HD-GLCheck.exe" 4 1
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\HD-GLCheck.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\HD-GLCheck.exe" 1 2
        7⤵
        Executes dropped EXE
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\HD-GLCheck.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\HD-GLCheck.exe" 4 2
        7⤵
        Executes dropped EXE
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\HD-GLCheck.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\\HD-GLCheck.exe" 2
        7⤵
        Executes dropped EXE
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\HD-GLCheck.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\\HD-GLCheck.exe" 3
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\HD-GLCheck.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\\HD-GLCheck.exe" 1
        7⤵
        Executes dropped EXE
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\7zr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\QtRedistx64.zip" -o"C:\Program Files\BlueStacks_nxt" -aoa
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\7zr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\PD.zip" -o"C:\ProgramData\BlueStacks_nxt" -aoa
        7⤵
        Executes dropped EXE
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\7zr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\7zr.exe" x "C:\ProgramData\Nougat32_5.11.41.1005.exe" -o"C:\ProgramData\BlueStacks_nxt\Engine\Nougat32" -aoa
        7⤵
        Executes dropped EXE
        
        PID:5136
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh.exe" advfirewall firewall delete rule name="BlueStacks Service"
        7⤵
        Modifies Windows Firewall
        
        PID:1908
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh.exe" advfirewall firewall add rule name="BlueStacks Service" dir=in action=allow program="C:\Program Files\BlueStacks_nxt\HD-Player.exe" enable=yes
        7⤵
        Modifies Windows Firewall
        
        PID:5680
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh.exe" advfirewall firewall delete rule name="BlueStacksAppplayerWeb"
        7⤵
        Modifies Windows Firewall
        
        PID:6040
        
        C:\Windows\SYSTEM32\netsh.exe
        
        "netsh.exe" advfirewall firewall add rule name="BlueStacksAppplayerWeb" dir=in action=allow program="C:\Program Files\BlueStacks_nxt\BlueStacksAppplayerWeb.exe" enable=yes
        7⤵
        Modifies Windows Firewall
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\HD-CheckCpu.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\HD-CheckCpu.exe" --cmd checkSSE3
        7⤵
        Executes dropped EXE
        
        PID:4260
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c "sc.exe delete BlueStacksDrv_nxt"
        7⤵
        
        PID:4940
        
        C:\Windows\system32\sc.exe
        
        sc.exe delete BlueStacksDrv_nxt
        8⤵
        Launches sc.exe
        
        PID:3360
        
        C:\Windows\SYSTEM32\reg.exe
        
        "reg.exe" EXPORT HKLM\Software\BlueStacks_nxt "C:\Users\Admin\AppData\Local\Temp\3tdradl0.bzq\RegHKLM.txt"
        7⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\7zr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\7zr.exe" a "C:\Users\Admin\AppData\Local\Temp\Installer.zip" -m0=LZMA:a=2 "C:\Users\Admin\AppData\Local\Temp\3tdradl0.bzq\*"
        7⤵
        Executes dropped EXE
        
        PID:5784

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1164

C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe
C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe --mod=servicesvc
1⤵
- Executes dropped EXE
PID:3552

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2040

C:\ProgramData\BlueStacksServices.exe
"C:\ProgramData\BlueStacksServices.exe"
1⤵
- Executes dropped EXE
PID:5588

C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
"C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --hidden --initialLaunch
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1076
- C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
  "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1772,i,16798440997583328336,17106061205303888906,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\system32\cscript.exe
  cscript.exe
  2⤵
  PID:5004
- C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
  "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --mojo-platform-channel-handle=2140 --field-trial-handle=1772,i,16798440997583328336,17106061205303888906,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:5776
- C:\Windows\system32\cscript.exe
  cscript.exe
  2⤵
  PID:5536
- C:\Windows\system32\cscript.exe
  cscript.exe
  2⤵
  PID:5952
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
  2⤵
  PID:644
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
  2⤵
  PID:3592
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKCU\SOFTWARE\BlueStacksServices
  2⤵
  PID:4528
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
  2⤵
  PID:4500
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKCU\SOFTWARE\BlueStacksServices
  2⤵
  PID:2032
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKCU\SOFTWARE\BlueStacksServices
  2⤵
  PID:4420
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regPutValue.wsf A
  2⤵
  PID:2556
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regPutValue.wsf A
  2⤵
  PID:2016
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
  2⤵
  PID:5252
- C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
  "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 --field-trial-handle=1772,i,16798440997583328336,17106061205303888906,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  PID:5476

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\BlueStacks X\BlueStacks X.exe

Filesize
470KB

MD5
6427b01a1e0fec25f3559a8b16122a19

SHA1
7d0673b65e0dc83e630b41ac34f4d6913fbe247c

SHA256
7d079b85ce32f2334dd5526b5fa469a43c4dbc21f1dc4194881ce806eba1007f

SHA512
4545527a248dd3c462ea5a4b2eeeb01fea555f89404c0ab0c97e227945ceb6158e85b0a759f5d245da99b980b6fe1ded71dc428756fbff50b08141faa444e133

Download Submit
C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_disabled.svg

Filesize
569B

MD5
e7fdf6a9c8cae1fc1108dc5a803a1905

SHA1
2853f9ff5e63685ebb1449dcf693176b17e4ab60

SHA256
8ee5aa84139b2ea5549f7272523aeb203d73954c5ccdcf6f7407bf1a3469f13e

SHA512
a6388b24926934e20ccf7fcab41bd219dc6c0053428481d7f466bf89f26bf1a36fdff716a9ddd9ab268df73b04dff1449c6bac1f5c707e31ae2ee71c2087e0d9

Download Submit
C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_hover.svg

Filesize
653B

MD5
76166804e6ce35e8a0c92917b8abc071

SHA1
8bd38726a11a9633ac937b9c6f205ce5d36348b0

SHA256
1bca2e912184b8168ee8961de68d1d839f4f9827fde6f48ab100fb61e82eff90

SHA512
93c4f1af7e9f89091a207ab308e05ddd4c92406c039f7465d3b8aca7e0cc7a6c922a22e1eee2f5c88db5e89016ef69294b2a0905d7d6a90fd32835bc11929005

Download Submit
C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_normal.svg

Filesize
569B

MD5
3221ac69d7facd8aa90ffa15aea991b0

SHA1
e0571f30f4708ec78addc726a743679ca0f05e45

SHA256
92aeae68e9e0973d9e0dc575941f1cb2e24afd0574341a46b870be7384eaa537

SHA512
5e2de0abfe60a4db16ea5e8739260c19962fbfc60869a77bde6ab3547ad8ee3ad88e74e97da31fa23be096afddad018e431d152d6d0fa21a75357a11dacb1328

Download Submit
C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_pressed.svg

Filesize
653B

MD5
dfddf8d0788988c3e48fcbfb2a76cd20

SHA1
463bb61f0012289e860c32f1885a3a8f57467f2e

SHA256
9585f41eb6202e89f2087266fa31852d7f41ca8cc659b907c96753fe165f937d

SHA512
e708c5114c60f7574589d6a56c9faedda26ee4a40f0eeb25f5e12eadcf790f24fdbf393fa0aa6ad449b5337d625b092d6f8822472fa8a6ce1339aca59c50c3ca

Download Submit
C:\Program Files\BlueStacks_nxt\7zr.exe

Filesize
731KB

MD5
396a7f916e29cee10a5711f708722f7f

SHA1
506b090c2d036e19202424dbf5ff891884be2684

SHA256
bbf0118b4408c72431dd02e1b68f5effc94a239ae6e664b1e884321e996ebc7a

SHA512
f8e67b47724d631cb0d5fb1e62344aadc70ded0d787b65e6f1c2c25d4f0d6101757dad9d6f5d4f3ce278bd8de595b86b66940641459d7cbc5777098f4c14d392

Download Submit
C:\Program Files\BlueStacks_nxt\Assets\checked_gray.png

Filesize
538B

MD5
ce144d2aab3bf213af693d4e18f87a59

SHA1
df59dc3dbba88bdc5ffc25f2e5e7b73ac3de5afa

SHA256
d8e502fab00b0c6f06ba6abede6922ab3b423fe6f2d2f56941dabc887b229ad3

SHA512
0f930edd485a0d49ef157f6cc8856609c087c91b77845adeb5cc8c8a80ebc7ec5416df351ffa1af780caad884dbb49dcc778b0b30de6fb7c85ffef22d7220ebe

Download Submit
C:\Program Files\BlueStacks_nxt\Assets\checked_gray_hover.png

Filesize
412B

MD5
ea22933e94c7ab813b639627f2b38286

SHA1
c5358c5cb7fb1a0744c775f8148c2376928fb509

SHA256
d7c79677d2ef897fa0ad1efc90e916c46da29f571208f78f24505603b7165c20

SHA512
ba447a1aedec49419e2b4a8de85c6047886f1a5ebb94f1c45e205a3780c6826f412a3892e97115b35e43839f43e346f3c72ffbf0c57d57f6d26b360ae61b3964

Download Submit
C:\Program Files\BlueStacks_nxt\Assets\close_red.png

Filesize
15KB

MD5
93216b2f9d66d423b3e1311c0573332d

SHA1
5efaebec5f20f91f164f80d1e36f98c9ddaff805

SHA256
d0b6d143642d356b40c47459a996131a344cade6bb86158f1b74693426b09bfb

SHA512
922a7292de627c5e637818556d25d9842a88e89f2b198885835925679500dfd44a1e25ce79e521e63c4f84a6b0bd6bf98e46143ad8cee80ecdbaf3d3bc0f3a32

Download Submit
C:\Program Files\BlueStacks_nxt\Assets\close_red_click.png

Filesize
15KB

MD5
6db7460b73a6641c7621d0a6203a0a90

SHA1
d39b488b96f3e5b5fe93ee3eecb6d28bb5b03cf3

SHA256
d5a7e6fc5e92e0b29a4f65625030447f3379b4e3ac4bed051a0646a7932ce0cd

SHA512
a0e6911853f51d73605e8f1a61442391fad25ff7b50a3f84d140d510fd98e262c971f130fb8a237a63704b8162c24b8440a5f235f51a5c343389f64e67c1c852

Download Submit
C:\Program Files\BlueStacks_nxt\Assets\close_red_hover.png

Filesize
15KB

MD5
5ceab43aa527bc146f9453a1586ddf03

SHA1
88ffb3cadccb54d4be3aabf31cf4d64210b5f553

SHA256
7c625ae4668cc03e37e4ffc478b87eace06b49b77e71e3209f431c23d98acdd0

SHA512
8a5c81c048fb7d02b246ed23a098ae5f95cdf6f4ca58fd3d30e4fe3001c933444310ca6391096cfaeed86b13f568236f84df4ea9a3d205c0677e31025616f19e

Download Submit
C:\Program Files\BlueStacks_nxt\Assets\installer_bg.jpg

Filesize
78KB

MD5
3478e24ba1dd52c80a0ff0d43828b6b5

SHA1
b5b13bbf3fb645efb81d3562296599e76a2abac0

SHA256
4c7471c986e16de0cd451be27d4b3171e595fe2916b4b3bf7ca52df6ec368904

SHA512
5c8c9cc76d6dbc7ce482d0d1b6c2f3d48a7a510cd9ed01c191328763e1bccb56daeb3d18c33a9b10ac7c9780127007aa13799fa82d838de27fbe0a02ad98119d

Download Submit
C:\Program Files\BlueStacks_nxt\Assets\installer_logo.png

Filesize
14KB

MD5
e33432b5d6dafb8b58f161cf38b8f177

SHA1
d7f520887ce1bfa0a1abd49c5a7b215c24cbbf6a

SHA256
9f3104493216c1fa114ff935d23e3e41c7c3511792a30b10a40b507936c0d183

SHA512
520dc99f3176117ebc28da5ef5439b132486ef67d02fa17f28b7eab0c59db0fa99566e44c0ca7bb75c9e7bd5244e4a23d87611a55c841c6f9c9776e457fb1cbf

Download Submit
C:\Program Files\BlueStacks_nxt\Assets\powered_by_bs.png

Filesize
9KB

MD5
7a2e5c21140aa8269c2aafd207f5dbaa

SHA1
4e0d9e7e1b09e67eba10100d73dc51623517821e

SHA256
3d2afe5236ec813d9e8063bc43eb34b88c2155784e1bce19c6a533c32767af35

SHA512
63f512559f2068a9702c7c527c126f6017cd8d1d16af52e41b884aa9a64ff4294a57243ec78c3a416f70fb6178a79877d68345357725ff92c935709a2ef8adde

Download Submit
C:\Program Files\BlueStacks_nxt\Assets\unchecked_gray.png

Filesize
192B

MD5
e50df2a0768f7fc4c3fe8d784564fea3

SHA1
d1fc4db50fe8e534019eb7ce70a61fd4c954621a

SHA256
671f26795b12008fbea1943143f660095f3dca5d925f67d765e2352fd7ee2396

SHA512
c87a8308a73b17cbdd179737631fb1ba7fdaeb65e82263f6617727519b70a81266bb695867b9e599c1306ee2cf0de525452f77ce367ca89bf870ea3ae7189998

Download Submit
C:\Program Files\BlueStacks_nxt\Assets\unchecked_gray_hover.png

Filesize
176B

MD5
62d7f14c26608f8392537d68f43dece1

SHA1
add4f30e7c3af4f7622e6bc55d960db612f3bb0a

SHA256
a631e26bd5b6ea19c8c65b766a056c92ba8a47e1483768dcf12b05293c9a7a0d

SHA512
e41210a78e6076954f75a2f73c0f7628e8604a09ecbb1d2ee0972741d4ef1d814b366828977c02944736b03ed116bc559a2ae47ddb7cbc6f4e54578c8263edf4

Download Submit
C:\Program Files\BlueStacks_nxt\BlueStacksUninstaller.exe.config

Filesize
392B

MD5
ca0a329097316832e4a6ea5d870c9268

SHA1
4a36b93361d3dc9df9b00313f2c2b394be9e1e72

SHA256
4b7df915d706af6459c38d75b09c5e14f951842ae0678078400f204ad1c7a7c2

SHA512
51f9a874e84f130be4fa29fcc4bc934105318234b5dd9ceedaf569e3f0e6b38e29f3bec056044724476ae24295a510b16d8a737b994fd6f1268609defa315271

Download Submit
C:\Program Files\BlueStacks_nxt\HD-ForceGPU.exe

Filesize
169KB

MD5
8345c2b216092b8f726f5c94a1fd3abb

SHA1
d1594ed8152159b03647f57345f3bfbd6aeb5d2b

SHA256
27b0c2de9779e02b0b6757b4ea069395266fa4c2726527d17ef00320618ade1b

SHA512
b50b55b9805a914e78c0c228954f56b5dca4cd832b2d453d69a286da99f0c856762c7530c835765d185b4890c48707aafb4bc27fc4b76a2d15f0f9de0ceeaa57

Download Submit
C:\Program Files\BlueStacks_nxt\HD-GLCheck.exe

Filesize
223KB

MD5
f48fb4ce0cb9971b77a442ad9d40a8db

SHA1
ebd387cbd30266782c6011d2f218128a08678d8e

SHA256
7fc3024be282f7ce3b01d7ae2d68e9eda065c0575d9189ba6c3470eeceef6306

SHA512
9056c899e98e08d42aa3b338b6359d5659618203cdcb3ee7ba9718c791aec5ef95e0c5c2e031ad6acc0a79bcd345d6be03d76a56d376e3fcacc352efb80df1e6

Download Submit
C:\Program Files\BlueStacks_nxt\ProductLogo.ico

Filesize
131KB

MD5
169706218f98a42594a8c5c5a65771fe

SHA1
b8ded94180212578d86a031eb71ef93dcffe1a26

SHA256
3803045963af064936d7071c178de8e40854968b3d3f9171c57a182c869f3697

SHA512
1c3f18ed0a24ffa78fe938826eb88531eb8be134d6f209b87d7af5d0e8c4829f01947d7b0048996b9755562bbb7f52e000bcd15d07d646cacb2989ac881ce448

Download Submit
C:\Program Files\BlueStacks_nxt\resources\icudtl.dat

Filesize
10.0MB

MD5
03205e5952ea7b803839ecfe3bb000d6

SHA1
74146e76e31fd1e75ae1c34fa8194bc291b34a40

SHA256
8364e6c6bf5744357199de0de3f6ba30846ccda70288675b75059e6fd52241f3

SHA512
badb8843f9a483329cc4f559f95bd07a8cc1f9383e0e67dddacf74e586541067ca452a7fc28b63dcd28edc434c3be8ddc733dcbad0e06d973dafc99242f0b192

Download Submit
C:\Program Files\BlueStacks_nxt\resources\qtwebengine_resources.pak

Filesize
2.4MB

MD5
aed2766cd70116ab1e0c430001a30b8f

SHA1
a06c62b35c333412dd61c493d6a6520a8c04537c

SHA256
4ed3a10f1bbc40b9a2ce3b8cb6dab6f00fe922d0c0e1c6ab5adfd8617cec9389

SHA512
a1ca058b88c1a6839b2e329b08423ee115800864f580f832bbc4f4720f0965984f893d210437951bd79dcfd3b917137b0b2e8f381e50d2a1bc2de37ca5555961

Download Submit
C:\Program Files\BlueStacks_nxt\resources\qtwebengine_resources_100p.pak

Filesize
191KB

MD5
8615f18dea34c152e8aeb8f4e01fd17b

SHA1
032b7bab09943cc5c8a380b0aba29652d5539153

SHA256
e7e2cd13fa9fbaa33c537e8eecfd542e4ce4a621bc0b94159ef9e6e4541652a6

SHA512
2a68ba854d473883f20e1a26375fa39b689cd39d2e284a963b07f25fa3eb6865ff3d8fea2241af23ffc731b83e20ec5b8147486de0a507e83413f75d71eab248

Download Submit
C:\Program Files\BlueStacks_nxt\resources\qtwebengine_resources_200p.pak

Filesize
250KB

MD5
de5e6a97c80d698256369b10255ce45d

SHA1
8d4b979a8c2ee33c2dbc01ed13a165b455a5fdfc

SHA256
669f9d3388438377c440419e5c62973362e33e84a5b247ddd0dd4568da75eb13

SHA512
5609ca5053f581e636c0fe10def704f076c7acf5d958e235991fec32a2ddebd72b312f36a6648d2462766d1cb141f3df12d39df1a344e0dfb4a9e2946dcf1206

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\am.pak

Filesize
420KB

MD5
2a8ca8692a60fe8d33d51d99c9084a9d

SHA1
919d8adacce240fd394d6faf2aa41d2e5b8460ec

SHA256
73f0a7c7632313613814b3ccf5962962aff99de940e084e0b609ecbad1ec1d44

SHA512
080e56cce041226592e7fa816fe8c5e362a1f172a8c671bda4092ff127f0cbe8238c40d41751099f6bac8f02c71faccc011df270b1c1bb8b772286ab95f5f1ea

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\ar.pak

Filesize
441KB

MD5
143ffa8ca3ac0e6dca9a8b3e8ba3f3f5

SHA1
6186940350b3fdd936f6ce41f3091bbca397e9a2

SHA256
3f35466a80f4ca5a5167b2d3a3278e75afd90821206ac98801210a2117c913e2

SHA512
a12b5e3ae821e08aa76657cf84bd79def6f8fdb413e908b13944f6c2bc1aa9724193d0a9a0abd5dc0b87e0845d61b021d39024a5048443531dafa19de707944e

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\bg.pak

Filesize
475KB

MD5
154217351d415b13dca71e28727902c4

SHA1
096a1640b5e83a7b20afdfa7cfe2507b4128e0a5

SHA256
da4bb8513745180a0eb26228a315786a6bfb98d6594173491d25cdf9d59c5bcf

SHA512
f1676a8b05c00588308c57b2290c00a6d844811e9ad4495ba94d62ae71a8c58d504ccd2697cfbf822fd5c2ce6423f76da8a901b4eae55095dc4b9667d9c2a8eb

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\bn.pak

Filesize
624KB

MD5
304432105fbe28b1625f0d7b6be3e7bf

SHA1
2d5474854bc0bca3f3ead1b9199d76ef533f0850

SHA256
ac282f17c5f25b55d368d06b305b89b614949d41c2a1377f1dd5aecb57d1ca8e

SHA512
8ab35cf2069f70a3a99dde98a7b7782821000abcefa97eaeb07b8a717d26a7b6c5461d5bcd39110b47db98aad9c56e463ca2707b7e6b71cda1092b8cf3a91ab8

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\ca.pak

Filesize
294KB

MD5
a2c61a98fe7407ded9ece126c4c9d057

SHA1
c7d64d8bdc2fd9e7f1c62dff79e0e56e13f9cd69

SHA256
4d583b753104ae98a1e5858bfe38dfa3195d477128441ca59c882d158d52ebf8

SHA512
7522ee10397140b5eb45ec3d5cb32e9212a7d3cae8fbc377b270872aaf6c7077e7b13465f6005a85b5fdd4d2e86b1731c3366ddfb2e4bccae4ae2d1a178e0b1c

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\cs.pak

Filesize
303KB

MD5
c0bb82986abc67281d8067e5f20625c7

SHA1
e7cc8888dd95d9edf226893f0e4c12e572bf6bf8

SHA256
217718dd6d64f45da33db0629e6d56da8084ae0fd8123eafda909e662a5e5b50

SHA512
80f4542345cc6e0d3589aeb76e0e5f19a824f2d3186d397c8fb71c1e9d6c056108df7f9a192a6515eb9ee43505b7844c0bf76b77596adcaa3c0ee783dd590ad9

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\da.pak

Filesize
271KB

MD5
5eba7377be8e34dd03db766300039ed2

SHA1
b3460fa050b93454b9e05586d86d7cf67881f557

SHA256
94157ad608b35b29dd176a3106caa4613ed6d4c20268ce00ac4ccf13a9950f94

SHA512
7d24210b60fe38b42fc6a4437ffb1e06333b7084025efe462b66e086cdee953254a1d6fec69ab3c8569118156f3a4a957aed5259e1432772ab46cf7905aa4385

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\de.pak

Filesize
292KB

MD5
01cc5b8a05a435482dc692baef032d3a

SHA1
229a4d1c9aea9111bb46895d096dfcaf488b8d4a

SHA256
53d5743a2606d6b553e8dbff871f2f1d3d53666baeb9ecca5b1ed624d48d5835

SHA512
082654e8385811d4e0f35544c017704b0f13638f850947d76c9abe093333fdaf9d1d08c184bb8107d16b0eae6ebcbe0c522ed18138dcee30a71d9d75ea8c3488

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\el.pak

Filesize
522KB

MD5
26afc001a706679413f5deaa3c6603e4

SHA1
c9d780d930775cfc17cf9160712a2e90ca55106e

SHA256
4c2a3552e84fdd08852073d25c99727c4270160260d159572715c7d37e5861bc

SHA512
743380b99f6d55ad892296e8361b74cf90254403fef15de37c3e5fc302bae2991f5bb4ae21ba84bddc30da3b5b31fb4e741b0c524feede1656bcd2d531d76ea1

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\en-GB.pak

Filesize
239KB

MD5
06da37b66f4dbbe8c5ae1bd7e4addc99

SHA1
ac190bbb14b76d14143dcc088f460d1be2ba2886

SHA256
60f87ec2b06329bdea7f835a61e9893fae147343f133caa2bfa5215797881ee0

SHA512
c436359e259c0a1cdc0dea1bb9ecd2bc22fe1124d76b9deac7e8c7751d97d66cbe61739aecef650908ed05363156fa11453490a9c9f23c74c683ac4e8c7c8c3e

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\en-US.pak

Filesize
242KB

MD5
1e958f35257ef1e2e5115d860602a593

SHA1
688afb781ce3c4c9a55fee9696145260d2ce1400

SHA256
4a65112f4d03cf38abf2ccff5e3fe8e161cb3e47d588b510504007c9bb876b37

SHA512
a996e8708f4e92794cf3eb6b7780d9ac8e567b1359aface4fd50d427630e4219678f4cdcd58764123ab6baf12a9c87a08b6ba5767fa8f6042a7319fb45b72a27

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\es-419.pak

Filesize
289KB

MD5
f21b0783d062082ee46aa573eff68df0

SHA1
84f62d15eb68858245e56bef0cf317e273918044

SHA256
859cb8ad8666e97a47f0e24df4ae85aad80002fbf842b4e68afd0a308d6597fe

SHA512
d87e2d51cedba8ba4eba3b0fd390bfb32b25c5cda98a0d6465b5ae351dc745a67ac174c223e7def8b02c9f00729244026e895791add2611680579dfec4b7b07b

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\es.pak

Filesize
293KB

MD5
03265b1a7f6a996513067866d55f3bcb

SHA1
427eecd7810cf24c8758dc9beae18afc9d8969a0

SHA256
516234550bfda93687b28c5cb3b7b5362212bf41b900d790ade52747bcf766da

SHA512
d6ace0340666eaffe28f57fb070eb4504460bd47517cf3c0b9c07671a605ec017c4fb45a38fbb96b9c54887dcee639b41ef03b2fd85ed9a666af56dbb73023dc

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\et.pak

Filesize
261KB

MD5
73e6f20f0c75a9beb72798167f8c6f91

SHA1
d01932a69626d23e8ce9e9bc240f6d99dd155fb4

SHA256
ff1b0d50f6f067b291199578b6a7757797bd7fdc6b0ac472c9361076bf9eadaf

SHA512
98966566211bba402352607a0622dca7f64ad4c056cec2b40cb70572cd1ce5ed92556490b4399a32ed1c04a14d80a3841fd1a758225120ee416c68e9314316db

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\fa.pak

Filesize
422KB

MD5
f913ea1db8c9c99bff701ceeaf8138f3

SHA1
6bef3ff865b3a95dc1900ba3c94c5bf556c695a1

SHA256
b4e0d3f7cb858ce12b5a75a71ef14f2a36494cd4138181b29f6fb3d6bd386c4c

SHA512
edca9b945c6dc90586f6d20e73316f620d5fff61f3ad4fd35c7e9064f55b1988cc77d372a97d100cbf572a2906cd193777a18ace98fabadea1604df42c8823a5

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\fi.pak

Filesize
269KB

MD5
f55358f58eb17b4bc6abb19592c1aba7

SHA1
6dc1d99757bc5a447b9761a4a0c90a2be521c6b0

SHA256
cf3b9a857c63022d671f4cc335728c270935628f085ac9a17568a2529daeb4c1

SHA512
d7cb03ec31a3cd8c7f13e1bae1439fbba3b76636f1f254ba5376c5da82b9a98e93684fc3cab3bbe8a4c892ba42f17c0db1eec1531950e17932aee16007081aab

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\fil.pak

Filesize
301KB

MD5
f5257136ed900e1715979c9a96de292d

SHA1
217cbe02931f6466bdbdb27c85c876b851610b23

SHA256
98a20cd0e9fae36f22de4a4db7b515532b4327e6d475d4e39ae93ea45b76cd90

SHA512
c38828d2736ba26ad0bff9976adc9d3910df7a417aad8cf6e3cf6383688a56ad2581cbda520403d44b010562b56d6107211385fc80988ac57e930199415ca654

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\fr.pak

Filesize
318KB

MD5
75575474726cc8d98def90e0dbddcb0f

SHA1
3e62e3b73bab73597a01c3ece5871c64b142391f

SHA256
d37509844342371b4026b720dc00f77ff88fe2e7c2b27861e3ca66b10e76ca94

SHA512
37e8e5cc44ee4433b0206cd1baedb955947d0fdf172e69a28fb7bc09f2a57c4f27fb45c12a0a49753281cb2e2a92792b67d568f3cd4f90c9c87337249d031fc0

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\gu.pak

Filesize
596KB

MD5
e245057bea15117bed15bc3ee2911d74

SHA1
c8e2d5f85a974fa989c0d0f64121d2836a13bb84

SHA256
4ea64678c7c551c2b2088b9417bcc76218822f3213e9b8028d618864035b97a5

SHA512
a72a1c259332f279f976403034c9d2356a437a1677c0e20c243f23ac246a8ab65bf150a610867687eef48a0b7c87d23f0e357ef21bb1791386790243803ee70f

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\he.pak

Filesize
368KB

MD5
8c02d30c68c4abb4b1a7c2493d8fde51

SHA1
2cbe2f537d59971296f2180d146d9c2905d2a76f

SHA256
e37f0e2516799f320e4ac1a872d0ab7108c4f63d9ad33a17a4008923c7f93e9a

SHA512
9155cb07b6a23d7f73bf8f68af44ee3bc1e25c6ca643c2f8d64a808d3f78076e3ee60f68d3be9cfe3a6dcfbbfd4595e58c897cb4f8b92272e8ffb443cdf6f3a6

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\hi.pak

Filesize
618KB

MD5
61838bdf13a1d60545d15e9cc49866be

SHA1
64bec7fe42caf53f192b58e4e5b068e56d835cec

SHA256
9a399dd9dac62ea30d700f94e83dd79d54827eac8b9cbce0343ad2dc0f4809a1

SHA512
7e9e0c3aabebd6f0c221918b6790d096824ee1c5f7338a21ac489952b8260b1e59be423005ce34bd5039cb38fa7c9197cf48b77974ed8f6b7ab2a2472e3daecf

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\hr.pak

Filesize
290KB

MD5
a621446d9e94b0d47935bf3310c385b5

SHA1
5cb954846bd2a2c477cb28b99545cd9bc0fbe990

SHA256
93f7fbaf2c7e5f52187fc4a2b5726387e84decebd1efd8b922665bb831e5b842

SHA512
80c5ddea81bf8d1721a2c6cf094cb2c99a10a9aa443193bb2942360de9783da75292eaa341711700281626cc0c8a8f9dc071bd8bb589444f764ea307c4b9de37

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\hu.pak

Filesize
312KB

MD5
3c70ba470c8503cae9407540d070f506

SHA1
0b841228d28e8605c37df79f1a3714402d2b18df

SHA256
0770854f32f041df5ee0190164aa24a1ad06e199c79efd46f3ab65e12129023e

SHA512
ded69524127431d1b6a68bcf85119079a57d3aae5c5be7fd8f215090ecc74570b899e8ec70d6cf74da49833d903f8ec2cbb06738a1c917efc5e19a44167183c1

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\id.pak

Filesize
259KB

MD5
fc2cd7f4af1976579f6b0eae3ab2d874

SHA1
c4e434b9d0d95a505947c97d396b05c9a18f3983

SHA256
48b670c94216623a0c81ad611cc3b47a47dc9368215e065fd02448b4ebf808ef

SHA512
9e355bcfcc31535755233cdd7a521b0bc68f897d85a22da658e3fe5bfa388ce8d8dfa7c01087ea04cd268d44d43862c5acf5b305e45b4572dcb25884e45a4535

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\it.pak

Filesize
285KB

MD5
56c13472d7efdb4466d5189af2d06ce6

SHA1
84025c148e10e1885125893dd286d0f9e751e101

SHA256
7114d3e0c7de30f25c789a1dcc7c50e85985b8ff35afce4600128e85318b4af4

SHA512
fa9b17d387585a281ef1582b8596cb61dc79658bf3b121f6fb6355bd6584c517d938e21d1a0b1be6491c01e5c15c2da666d9f77000a12a2da137c040046957f8

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\ja.pak

Filesize
351KB

MD5
9705a8fcead214aa619f1be816135ea0

SHA1
f10d22cdbf5d7960aeaa13c98cf8f7de41034760

SHA256
c8db5560edd42f1a6acc4efd10865ce39c15dadd3b7dbdaaa28922e1f9c86320

SHA512
6d82ae6023e48ef54d6903a13b6f07069fdd5c87aa0e7b1219c0797bf49cc789170b3677d572fb1b63feda138e624f71e7175022eb7928db0dd413cc8652c6af

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\kn.pak

Filesize
693KB

MD5
2e9a1e91aa149308dde43e0b357e1c8a

SHA1
d657811a3b3dabe519fb7b5fad46977674234f51

SHA256
2a0411a1368fd5f342581b00fb3b451f89ad593fa49f0f79fd9abd5ee0d5f5e1

SHA512
d7b612562fb04a89dac28f51e691f42af39cf61bbd2199c4f652a3096330a99084c0f410bf0c449403031b9a264769ba2932cdae8b0c49bcf92b5ae7a4e8fe9b

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\ko.pak

Filesize
296KB

MD5
2a0bc83152bfbc0f365d3a85fd1e1832

SHA1
9b972a8e823ff6f161ca2aadac11043b054b3146

SHA256
ae1cdf9a4cef3a86d3550f7501e5c650cc1e0924c9ab84900df702ea7e351f8f

SHA512
2c3ae97d3c78310cafe92620c0438dde4c624353cd682f3087c92050870d768e6f7071248e55d03232739a2dd94c7694975b0b329f1ffc6148221a18effa9088

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\lt.pak

Filesize
313KB

MD5
7769b6273b1519ea1a8ac9f059e78c93

SHA1
6d8807f4af484041bac83d5d8873d639d5f07d0e

SHA256
e88897c766d8746b9ad859123742dc84b4dc9e6bd05d10a9262b15055a67758a

SHA512
9c91942cb73bc0c2dfdd94a93759520d9a3ac7f6b43ac826d00d2ff46c6335ed87126024bfa955e9c9e744d437a832188d66ad238ae66378a23210b9d1e740ae

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\lv.pak

Filesize
310KB

MD5
17b9ff8c299fff962e9b9bc0d5f2f15b

SHA1
6224d9bf81c4771033e14477da0a652336326036

SHA256
7e4a42d3cc06b7c9cfebad08391de3a275ec129ac20d36ec90ac136ee88223f0

SHA512
8bd3f102b933b94cd0da09e77c78369a156e2ac22f29888ac0c9db8d9d4e2a7e4eeac99942ae7a8785c6207a0277c374c1727712a932922c10646e3fec609963

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\ml.pak

Filesize
728KB

MD5
df01088842b8c05568fce402a69bb595

SHA1
4b97c244ee85efb9c35b69f65f64d9cfcb2d25aa

SHA256
9f1fe59eb3d0da8d36715d63da958b5773ced3967e04c5314b3d5aaad2f3c579

SHA512
b434a12884f7a1d417c02de2fd27955e6af2329d8d8d0db9781675a16396556b89e2f46dc951e070c4077073e126d492a5db7a077b7ac3b1f80fe4fab4d68125

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\mr.pak

Filesize
584KB

MD5
f40f6817a07049b8589310b7dba04534

SHA1
93afea27adbd165aa1e3261cb67d5ab719ea02db

SHA256
5429e2696d32638253c4372cc427b3fa154d7c997dc13aab90411fdf98c8f6d3

SHA512
450039cebfebd9b5dd012c2980587e78b64e777bb2ed7cebd1f3174b5e88f0a018cbd60af18ef3eaeeecf9729b420a0216a0b167867be4a2814744217bbf84e6

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\ms.pak

Filesize
269KB

MD5
901240b9cb3a7a635c2d56d6ff1b3966

SHA1
c1fdd4ccf213bf1822696061d64930f47a017cdf

SHA256
a750d091e4ca00bdc647ca36c2a22cf9199126c69607fc14f468f6b3b588e55e

SHA512
2b316bc8d5f27f6f90434fa61d270a28f5aef2b9808b1467697c5671aedcfd99d7cf99d72f11d05dee06e73949ab2b22627ea1e925ce8b1ec65b4cd43d03eca4

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\nb.pak

Filesize
264KB

MD5
5c901b43287edab65f05464dbad3e301

SHA1
d76444677a7eeafdfe0bc27a0ff892f028144d67

SHA256
0bdd86ed3444e7e5508dfe4ec483673c2744925accaa5529bff4037cd1b0c2ed

SHA512
46fbe41905a44fe034f3b0798459a2b5bfb4ac408bb90fb5f0f9e82c91407e4b6eddaa82173c0926784881acee514da71284ed02decb49d99cb235784d072da2

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\nl.pak

Filesize
275KB

MD5
884f7faf0e79d04c6536506d6f95eab1

SHA1
39334913aa447b35012a8d7100e7f91e805c7e9d

SHA256
b4d9d873df0ab126f4a312755fde331d4d246519f1757f32087b36714ef4249f

SHA512
77a4379e148c7886950b92bdf8959c12c8695b7121be89142f4d4190cf32c43b8accb77f0c40718cd3c7e3ac0f90e99f3dcf5992140a5769821fc2adac988e18

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\pl.pak

Filesize
301KB

MD5
41ad390a8cc5fbd5b1f352e838b42ce1

SHA1
9efa8f2e5a0312e83f737929765a86112a874272

SHA256
979c4336b428df84e37a2a51a7c5f311ac33ef6e4edc309c138ab2866dd065c0

SHA512
1beb3c66c5b4f9d128e8badcaa8b9dfa9908d74ea910c40a7cde8be3b9b704525e7ddf1e646013cfecf7c66585975b8a8e640b43b27771335bbaa90158f45d01

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\pt-BR.pak

Filesize
285KB

MD5
4792f1e39c6875d8aa5e911f16ed638d

SHA1
c04ecb497096be4173f9aae3f0ae6accc8324156

SHA256
a39bf79dce50c0ef227c3f326728d12c7675a79ab5d4b891fc56913bcbe83e5e

SHA512
5fabf0e030f94c959eac797ae401f28b76ad63816e88d26e3875168978d7448317e3f86aa99b15c0ff266505c5dcb30124c796c6c46c0b90e09ce21b77324d69

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\pt-PT.pak

Filesize
288KB

MD5
0db54f0f25ec3a19dff541ba223bd5b4

SHA1
dc1f0c9b1c2578490af5923df179a92814c04904

SHA256
ff89da2b21c03475373f3839615c570d15b9929fa2cea991105915ef4e648d69

SHA512
96060c6c548085f019f3f127c4250ae6620c2b4f206da9203db94a7d2146c945b5384a661494ad886ceb35cf3f45500302b01009e08b43e549e17ddc318bc48c

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\ro.pak

Filesize
297KB

MD5
14ee5c1a362e753a5c44b11343430fdb

SHA1
b87e4750d5319c5c695f1581feaacdd71abe0cda

SHA256
ac3134a201073f6482a4cceb29a745104325ac76b7ad0d262ac7567584f450a1

SHA512
ed647aa3f3ccd5033e41c8cbb8f85d1bd0dbf783472668abb9a7e83ce5ce05706b9d67d5cfb4c28791414e77b5ea9ca5335189545ee79475d3f7cf58c1f12377

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\ru.pak

Filesize
477KB

MD5
3d28ef9e25426b08409db5379cfd55e3

SHA1
25fefc87d6233da5b287dbbf04a63c34cb9c5571

SHA256
b81a0b0175225dbdf35150dcc0c36154cfc042c1525df216d68034f0ae609057

SHA512
210b8bf28519c1e1576dfaa76260ceb6fe5dc46d23a6c74f1eaba9e08abb310b34989f0e667b6839999f765cb9bb77d35636db63ba082d471c6b73819b357995

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\sk.pak

Filesize
308KB

MD5
b37b81799942fc174e05b6aac03ea4c3

SHA1
788d6d10c82614465628f79bbe1f2346839a582e

SHA256
579a167528badf2a6feafbab487bd2314dd6107d0cc87df17a88ae325ef16319

SHA512
31bb82eb4434665a1b22a21e3e91b48fb2fe78913aac18475f8f328f05fafb2e4bffdd1565b8f48c67061fbf760ad217300882b5871d1753255d969be2b49b44

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\sl.pak

Filesize
294KB

MD5
4138dc422fc6a5afb1a855ffe0caba32

SHA1
8b23cb3c91167908e181eb0ce9d730ca5b3179e7

SHA256
7904fb9153a65105690d76ebda6e9edef2852b868f6a8d2e989b2013d40ffc3b

SHA512
a578919421c6458fd187d5985d721257cfb7bc3404f174dff413c211f29cb2d4552699fe10f0c01a651e224c1c7f3189706aaf71107187120a4260214881e531

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\sr.pak

Filesize
451KB

MD5
97ef86fc3b66a0a3aa4e1be4555369f0

SHA1
bbe68527d0c4c9e6624920d548c0ab0c09dbac88

SHA256
d5a48e324fba0fe6ad0b08da12fa2f4b9279b6271d36710663b3462794a0c7fb

SHA512
fd7802060a8891df3ad2df1252e0fe09f227c7ca81715917fe0020277d28788326d9798cb62acb8820f4701fb18627f78b6d22d9ee8ee402abcfeb4704718ef3

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\sv.pak

Filesize
266KB

MD5
f2bf46d97477489d80659d0be53d9d05

SHA1
a76378ec45dcdef0c596aebe8a4cf36dd3f9c01c

SHA256
196265eea8a2d8746953564b11d64dfc38acc9b17d3e38965f3ae1ba78841e32

SHA512
d65d27d04beacb20d3367af016ef55bea774c782475271e0a0573d2bff2912835d96a803c216ca5f43b56d142e6a77b41a67f35c5bc704c10f5e2aee5d6b7348

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\sw.pak

Filesize
273KB

MD5
e99bc71c3caeae580ef7060155ddd0ff

SHA1
d6986e1fe1dd6c110b05f44f84e956ecac188b97

SHA256
4282f200af58345ac756dbf88d0b898d26750f5aa16b7d2557b4d31c0ec126c8

SHA512
6bef16c9633387a3a0557cb644f152210d75157ac9b8ab1af6b94bdbdfb48b2511d0adc84d269ad16a439415ec46b78ff9a2e743bf72238cc5f25a4ce5bbd7f0

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\ta.pak

Filesize
703KB

MD5
48554783d89587fe96d94cc1afb58248

SHA1
be0843e27225df82cbb27f017acb7bac27c92c5e

SHA256
df0d976ad84bd0dc165f341ca9c5dfe7995a4f676c1c0a09d7a4716747e94896

SHA512
2ec38646a550e86bd6634247de2a49be20e9f3c09820284da82f7aaa6ceabe32920c4395d3bcd728e3370f8342627a9a9f12b6a222de145213efe57239183784

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\te.pak

Filesize
658KB

MD5
079fbd6adf806504199dd0b05c87c697

SHA1
4fec8c3bae9b48f92e35b609fc3977eda5de2039

SHA256
ee2697e8850803f08bee80e461833bd9f4232532c3f569f56521b1320c99e5e2

SHA512
722c6f3f6f61a8eea6965eae290e580a3263b894e07f7aac08fb6cca67e668db92a874728e32764ee0c10f5307b753d1589b8cae5c8a39edb29c7253591c017d

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\th.pak

Filesize
556KB

MD5
433dbeabe2d4c70255f1685ece8fb97b

SHA1
966c16c364b4f3ae6ccb8c5019c0b6bca75b593e

SHA256
dedb178d79730bb0282605f7bbc6e410b03ee7bdcee1a64c08d9e9c442f49942

SHA512
b5f3d434f71b62136647700e7d4c4e207bafeeb20cdb03019c6cd6580e61f88f596a4f2a0ca77b010f38b41a3eaf5df8e2a00e06764db17244083cb95703213c

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\tr.pak

Filesize
282KB

MD5
1a505f3f30511c2b05eb29ee0e0bff26

SHA1
08d4002d32dc5ea8a9476495786f5d5c1bae7ea6

SHA256
27627a61c6857b80b5eec4f6720b585f82b38271b7470c00a444735beee254e0

SHA512
d925f59cc9af4d55ad5daee42094ddf5d120eae816cddb56e906cd8da47039502f7608e9c4af77994ee7db585697fb26dbbd1c2e7c0bee4e3b194c9eee80eeff

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\uk.pak

Filesize
478KB

MD5
e21f45d7685b75be483013e1e8dc8237

SHA1
8f4cdd3dea580d7671117e9c49891212ab950686

SHA256
dd57df6e7b591b3bd6663743c52f4c5f3a7a24e90fd8045b03479707f25702b3

SHA512
b29d8c67a259e4221e9cbb082f41a1b008f665e18dac568c7ac75fd40ee1e1e00df8bcd65825fbac63d51b1bf555c5c3752b96a9c8a4a153cd325377a165a048

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\vi.pak

Filesize
332KB

MD5
561050669f78bd04d0431de3eb98d160

SHA1
028a78bbaabe19ac338648ac95a8b944254e8d3d

SHA256
922eb514cc20dbb44f41745c9e793756f8b46892504207e75de188be0aca6333

SHA512
2df7ff472a616c9271da813a66c6bd98809d788c7dc752ff0f3f68423f245cadd6945a5424af740b17d14f4f6935a2f2bf030b369dc8a39fa6e968d7f2a1897d

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\zh-CN.pak

Filesize
245KB

MD5
54415acf2d54c65718c99ed78b4bf3e5

SHA1
311937480b01256a1e50d0556df9b4f9f9a46424

SHA256
3648945ec3205f590da62f76af957d8a4175890e6ddb5fd1103beeaf66728c7a

SHA512
4eba5d0f1be81e72699d8429252877096524b4e27fd7d8ac480ec13cb60a83f4b8288823299c1c4e210699278588662e578814b8061bd5b72b5179b956624fc9

Download Submit
C:\Program Files\BlueStacks_nxt\translations\qtwebengine_locales\zh-TW.pak

Filesize
245KB

MD5
c709c2e92d4c0a1a2fd30f5350bed636

SHA1
31c8463300bdfe0238f167451a1adffc4fa899a3

SHA256
37a8707ce5a07b4363579e2d411a1c641913ed1e0377ae1e8cdf70146cee889e

SHA512
38f8da72ecbf73f10a8109ba51f162e77b0f567f7415fe2fa17a2bd7677d9562ff8bd5c136251f44c192c7618cdf72684dfe11070f478255828a5bcc5df8c01d

Download Submit
C:\ProgramData\AweSun\agent\AweSun.exe

Filesize
16.3MB

MD5
4cdc1317995650d6121fa557f084d2a6

SHA1
ada852278247f6f96137c48fd3d720045b6b7c11

SHA256
600445b009b59642393feb3397eff4163080c2203dd511c82997b88780a042bb

SHA512
c4e87fa8724f08b792562d4969daf7ee37672cff59923878f5fe651dbd8009f8b5600a3d7adb54a3b949c6d67d759235052d5b8808a0afb22d8e8b523bc3cac5

Download Submit
C:\ProgramData\AweSun\agent\AweSun.exe

Filesize
16.3MB

MD5
4cdc1317995650d6121fa557f084d2a6

SHA1
ada852278247f6f96137c48fd3d720045b6b7c11

SHA256
600445b009b59642393feb3397eff4163080c2203dd511c82997b88780a042bb

SHA512
c4e87fa8724f08b792562d4969daf7ee37672cff59923878f5fe651dbd8009f8b5600a3d7adb54a3b949c6d67d759235052d5b8808a0afb22d8e8b523bc3cac5

Download Submit
C:\ProgramData\AweSun\agent\AweSun.exe

Filesize
16.3MB

MD5
4cdc1317995650d6121fa557f084d2a6

SHA1
ada852278247f6f96137c48fd3d720045b6b7c11

SHA256
600445b009b59642393feb3397eff4163080c2203dd511c82997b88780a042bb

SHA512
c4e87fa8724f08b792562d4969daf7ee37672cff59923878f5fe651dbd8009f8b5600a3d7adb54a3b949c6d67d759235052d5b8808a0afb22d8e8b523bc3cac5

Download Submit
C:\ProgramData\AweSun\config.ini

Filesize
139B

MD5
d98b9b5fc90283cd454fd33f8c3732d1

SHA1
68b685566ce61147b127f648c0af68c89d9489b2

SHA256
1bbd2662e5022c2c330d6934b34c86117f936e3a13bcc59c2e3ed90c2ca66aff

SHA512
7e5dfa674ddc1c46428b99341062303bd12bde671d599cfb5c5b573cb0b8b544989ac0d9058e5fe5047252cc191e1027e7deaebc91006557fd31478f8548063f

Download Submit
C:\ProgramData\AweSun\config.ini

Filesize
139B

MD5
61e0a71d7b751a443bd94636bc9df99a

SHA1
e05ccb5f3fa296171c2f07d2d37c24b1c13405f4

SHA256
1142c6b6cbbbedf52acd44d062df57b3b138298f9eb7f673fb3e67f637da3571

SHA512
8c3b250d75c8ad097683acf88d960f8882249c822bdee1ef5f43702627dabd929299f81fe155d75a14a43e0ed3a237395be8601496489106eb8acb5549925acc

Download Submit
C:\ProgramData\AweSun\config.ini

Filesize
139B

MD5
61e0a71d7b751a443bd94636bc9df99a

SHA1
e05ccb5f3fa296171c2f07d2d37c24b1c13405f4

SHA256
1142c6b6cbbbedf52acd44d062df57b3b138298f9eb7f673fb3e67f637da3571

SHA512
8c3b250d75c8ad097683acf88d960f8882249c822bdee1ef5f43702627dabd929299f81fe155d75a14a43e0ed3a237395be8601496489106eb8acb5549925acc

Download Submit
C:\ProgramData\AweSun\config.ini

Filesize
197B

MD5
8ecab004f1a124cc25c19ead525e08ff

SHA1
8edd6321bf536c8f10f69ea0c0c41012fecb93a2

SHA256
9643ca04e449b518b11f1ae6aa968d4a5dcd2bb3ab481dafa03c1ba25c1be491

SHA512
a8c7d3d3ad7bfb20d74d310aacad3495aac61d50bcbbcda059ad172e901e9f9ce97b443ce873c8dbc1fd071bc3e1d546ee5d68510a1407185e1ea0daf6cf81f3

Download Submit
C:\ProgramData\AweSun\config.ini

Filesize
197B

MD5
8ecab004f1a124cc25c19ead525e08ff

SHA1
8edd6321bf536c8f10f69ea0c0c41012fecb93a2

SHA256
9643ca04e449b518b11f1ae6aa968d4a5dcd2bb3ab481dafa03c1ba25c1be491

SHA512
a8c7d3d3ad7bfb20d74d310aacad3495aac61d50bcbbcda059ad172e901e9f9ce97b443ce873c8dbc1fd071bc3e1d546ee5d68510a1407185e1ea0daf6cf81f3

Download Submit
C:\ProgramData\AweSun\config.ini

Filesize
197B

MD5
8ecab004f1a124cc25c19ead525e08ff

SHA1
8edd6321bf536c8f10f69ea0c0c41012fecb93a2

SHA256
9643ca04e449b518b11f1ae6aa968d4a5dcd2bb3ab481dafa03c1ba25c1be491

SHA512
a8c7d3d3ad7bfb20d74d310aacad3495aac61d50bcbbcda059ad172e901e9f9ce97b443ce873c8dbc1fd071bc3e1d546ee5d68510a1407185e1ea0daf6cf81f3

Download Submit
C:\ProgramData\AweSun\config.ini

Filesize
605B

MD5
fbe3b3e8f50c1e2c85da74d757e003bd

SHA1
c3959563c3671faa0e0d08b111db48fe6adaade1

SHA256
88761d3e5667d4d4ce8f260d702c62fada8a2ef508c08f0a781f47d2efce5ecf

SHA512
751a8ffeb7210427b5887de695b49fc89a836fca8240a63ea8315f0120f29ffd79582871fab7b246de911ea4ff99e0431722422bd934ad0d7122e3fbc2fe8792

Download Submit
C:\ProgramData\AweSun\config.ini

Filesize
666B

MD5
54f2368d22d0a9a832ec63c1d2888e1d

SHA1
a8ef6f352c0ef1f9b45526227709b64de64cf3e7

SHA256
dc3ffaf4631e532b6f97124f0814ce3fbe620b143d5a94cf150cafb93c4eee42

SHA512
c509fcac59bb5c161a649b1c546709d6847ab6041b8015c13e0970893290ba258f54ea84949a562775c6c6e024da6781d1a9132d5a2f7af14268aa88fec6e2db

Download Submit
C:\ProgramData\AweSun\config.ini

Filesize
666B

MD5
54f2368d22d0a9a832ec63c1d2888e1d

SHA1
a8ef6f352c0ef1f9b45526227709b64de64cf3e7

SHA256
dc3ffaf4631e532b6f97124f0814ce3fbe620b143d5a94cf150cafb93c4eee42

SHA512
c509fcac59bb5c161a649b1c546709d6847ab6041b8015c13e0970893290ba258f54ea84949a562775c6c6e024da6781d1a9132d5a2f7af14268aa88fec6e2db

Download Submit
C:\ProgramData\AweSun\config.ini

Filesize
745B

MD5
6b755bc16cc5bb8a2d34c277767df2b0

SHA1
357fc32d0d2f4119e910475f47bda8321fc7c23e

SHA256
517e1011406749286ce6b18237c384bce16e75a04f48755d52ae635e96f3a9b6

SHA512
471b29115c12730e687b8fdbdbea0998cd6fa9e0e80b78ccbd5156d0568d80fa0dc387a0c2495f524ba018b296ff9aadfbf5d1de65b08becae452e6335480bfc

Download Submit
C:\ProgramData\AweSun\config.ini

Filesize
745B

MD5
6b755bc16cc5bb8a2d34c277767df2b0

SHA1
357fc32d0d2f4119e910475f47bda8321fc7c23e

SHA256
517e1011406749286ce6b18237c384bce16e75a04f48755d52ae635e96f3a9b6

SHA512
471b29115c12730e687b8fdbdbea0998cd6fa9e0e80b78ccbd5156d0568d80fa0dc387a0c2495f524ba018b296ff9aadfbf5d1de65b08becae452e6335480bfc

Download Submit
C:\ProgramData\AweSun\config.ini

Filesize
870B

MD5
a3ad8361e267c377e1b16bad1c92cedf

SHA1
f6923b04de7f93be260b93816f89757c760bca26

SHA256
8aa88bcc7f4c315acefeed6fbccd1b5bb83a0dc422796cdae0c7ea2a964ca9bc

SHA512
92aca504e5bbc3d0b4d9666c3e8c0038c1c3b84f828ff6767a2fa07a9bdab740ba2017ffcc979b6e7a60e52dccd4d823c3e2a7a4b0f0bacca3900244699e1f74

Download Submit
C:\ProgramData\AweSun\config.ini

Filesize
870B

MD5
ccbb2a6961d1196d4ca6b563190a2169

SHA1
9622f8f5a5039bbb756f0d89ce21f5929fcac932

SHA256
8b95027a1c37e9c9596aa901962a73d469ec050c4194b7e70e848440a6de6976

SHA512
925b42019732cc80f6e6a438fed9881988a6f7450eb6c1e1a1dd5e34cef64a944f3eb96c5d9d99a849ea02f876a1c86c2bad41c1f49f7c69b570d2f11c70cf14

Download Submit
C:\ProgramData\AweSun\config.ini

Filesize
870B

MD5
ccbb2a6961d1196d4ca6b563190a2169

SHA1
9622f8f5a5039bbb756f0d89ce21f5929fcac932

SHA256
8b95027a1c37e9c9596aa901962a73d469ec050c4194b7e70e848440a6de6976

SHA512
925b42019732cc80f6e6a438fed9881988a6f7450eb6c1e1a1dd5e34cef64a944f3eb96c5d9d99a849ea02f876a1c86c2bad41c1f49f7c69b570d2f11c70cf14

Download Submit
C:\ProgramData\BlueStacks_nxt\Client\Assets\exit_close_click.png

Filesize
447B

MD5
b09525b48c0023f893d6b64d06add4b1

SHA1
10ecd439ea04e02eefe17f6c110d0c0a78a1db21

SHA256
caa2a8fe9b282939a21b86f8f61fb0c9452222cc3409f06cbb0dcc45613aca8e

SHA512
c6f5a7014c24133eb576708ca17d15becf2b45ec278b3f94e5275e47c78cf0f2eb8bb1a17d277d1a665039f38f2e25faf830e275f426b0a94c6a3da096b6204f

Download Submit
C:\ProgramData\BlueStacks_nxt\Client\Assets\radio_selected_hover.png

Filesize
577B

MD5
47ff3e4cc15b8c4a07e3ceb6cb619b62

SHA1
0318e54c613b8ff00f54d843e90ef88310c1a96f

SHA256
4786cfb7c98edcf01d6b670abf19c50891d56a4de87b96a5e17be142b1af666a

SHA512
0212bd7f6cee390d3bc221a22189b75407fa660a0951c7f768645bf97e7b61ee86fa9b1de6f546ff1151560dcb3b071db8c14a7b08b0e771b539a817b31b154e

Download Submit
C:\ProgramData\BlueStacks_nxt\Client\Assets\radio_unselected_hover.png

Filesize
480B

MD5
22efccf38e15df945962ac85ac3aa3b7

SHA1
b94a8615dc92982e1637680446896080f97c2564

SHA256
0ec39ed4bf89a341f1b5aea56d0e99ff5c923b9c3a6a81adeb9ff21764136f92

SHA512
41a4dbb57abed1a16aa84c72c202da461ca45cbaf68f69a10cb3e5529e8dff659e89f7f4459d1e2e8f3549c6fd51f23fc8422f86667577ebed5ab5df149c79ee

Download Submit
C:\ProgramData\BlueStacks_nxt\Locales\ProblemCategories\ReportProblemCategories.Json

Filesize
4KB

MD5
9e1141a44519e9359739464310857bf8

SHA1
abb797ee7b512c77741978330292287d9c0d92e4

SHA256
42d8b6964164aa0e53cd0d5b7c59541bfca32b04f54b3a3cb07d9080eb60bf0f

SHA512
caced755aee6096103a067648ab069d517769bf4e89634cb0c96f00d264af786dc1e236f09652cb161c62c48df5fc30504025d0dddde709a05c87497dbc0daa2

Download Submit
C:\ProgramData\BlueStacks_nxt\Locales\i18n.ar-EG.txt

Filesize
22KB

MD5
085adbcde5168ad200bce79951ec090a

SHA1
e9c50d7fdd6d1e087323891d72f181ee7a5450a0

SHA256
e2daf9c68ff6b7f8328193af8158ee48a49c5dd3b8ea1ab3096d6af1703ac4a3

SHA512
0215a5c35b34a46f93d365809cb2ddfad180a0269fcc96d1da0a57af6204c124e8160c9e3defcd2233e26beae2916894127f747374d608a268c19b0ec8ca25af

Download Submit
C:\ProgramData\BlueStacks_nxt\Locales\i18n.ar-IL.txt

Filesize
14KB

MD5
9fb07e066cc2f213a64d35a97a8c2922

SHA1
a70db989f5c562bc69caad89a1402c8ad7c9b80e

SHA256
65e7b0f37b5e2aa805ac8d57969804d803430186f34e9703ca9fa09ba908ef90

SHA512
81680bff55b475a62a4bf29a8c219230b84894c1165f60e372209a5aacdba8e4819c3dfb76f3b55c15d472ababeabf0cd4b30c04e7daa26df63c8a5101970c3c

Download Submit
C:\ProgramData\BlueStacks_nxt\Locales\i18n.de-DE.txt

Filesize
19KB

MD5
1e79353c6b6fbe60948f4359a2d8bd66

SHA1
f5f2959507dea35effed05ce77221ded3e8d3ab6

SHA256
23253731b7e15ba400ae22c5841f6746dbbfde4ca7cbc28cbe07d231dc2963ce

SHA512
731cc28fce6a64ac732d271a87c5ddcc83ec848b74d0d26998de7fc3c9417894e226c797c8c9bebd6b515a372fc59c4a3fdfdd80136f908edd9fc4ba799ed6af

Download Submit
C:\ProgramData\BlueStacks_nxt\Locales\i18n.en-US.txt

Filesize
17KB

MD5
afdab4141bdd259bdf57c3459887e0d7

SHA1
b1405390b7f11212ea7c97c68aadf43d2accd410

SHA256
64447fd07169bcac318a5d0050163d9c35461559f078d808013717a73c74da80

SHA512
bcd6fa7e8688f43b291710ec14f14164e344371350486b103270bbe7a7d0faded58ca0129bce9d58441cdcb1812c0169f5179788f4e5c24d68955038c9ecce68

Download Submit
C:\ProgramData\BlueStacks_nxt\Locales\i18n.es-ES.txt

Filesize
18KB

MD5
0b843fcc897581c745d43f27b97893e6

SHA1
aa482650dadb04db84eab1b32760bfbb7fbe3964

SHA256
d3588a1a63607f10c14d7f77d5b231c6c91e7d99f33d9fa8f34be34b728487e2

SHA512
d99a39024cd28e3c715ff7335dc4e2b5cc5c7f4a31989d61d36272b863e956433e1cc20a7cd3959f2d6b19cc232b2c7597705109461ce4a40ababe4912f82968

Download Submit
C:\ProgramData\BlueStacks_nxt\Locales\i18n.fr-FR.txt

Filesize
19KB

MD5
dd859551ff8d3353c76d3431c7d0f167

SHA1
10dcaacbc907dcedcfbf80e20490b2046bdcdc45

SHA256
c8fd9539264ca15cd29474786780c5851c02f395842dddb5ca897680e7c73776

SHA512
78f7ae8b7736002bcafbccffd028b68ac03494e86bee5dd077c502210c084fad74c65db99e1959403e14767c263ac2439bb5079d81421287a9db48a80ce44c1a

Download Submit
C:\ProgramData\BlueStacks_nxt\Locales\i18n.id-ID.txt

Filesize
17KB

MD5
a56ef01059e82cb120798cdced712332

SHA1
4f5513e536dbacdd6453e62bdd4e4c5d0232a28e

SHA256
5bcfc3265adb3dbc8a17352fbf087740fe8bf039c35f00c5040468b2c3e1ffbf

SHA512
1caba879acc8519b8ad4b495d0e07aacce20cc8e4822af8ab6bde54eb430f66456c0a69dc87a726bcd7f56b27533932a13c89a4266e68ffbbf527d8b8838af7c

Download Submit
C:\ProgramData\BlueStacks_nxt\Locales\i18n.it-IT.txt

Filesize
18KB

MD5
b49d2a9e86a2da5f1f1f94c001fd1ffc

SHA1
4aec1d70d01bdb75d0c7cceb0bbe5441f74ec1ce

SHA256
b2bedfbb108857c558d6b18f07b3fe11191ce79424a7a8c107f69c39c353a875

SHA512
55638eb869c75a5abf54ac7eeafba160dce2bcfab6c8429db499a442b2fd1b3744928983f9fc6c30208be78338a8f904a8068eea17dd309fe0dc01d55b20592c

Download Submit
C:\ProgramData\BlueStacks_nxt\Locales\i18n.ja-JP.txt

Filesize
21KB

MD5
7ba627a33030cce61657009102e1dc67

SHA1
a8e919b0d9981da7b749ec2408d6cb64924dfc84

SHA256
fecd2ea2e436b489c5ca8b4b6cc527275150ef0fc202cbc6812b130c47617121

SHA512
852618b5a6999ac63740ee6557dce33fc293b21bb7702ea00562195560466a63d374f3fa607f15cadb9a1324a99f69c46be2fbda532952b212593094c56de8bd

Download Submit
C:\ProgramData\BlueStacks_nxt\Locales\i18n.ko-KR.txt

Filesize
19KB

MD5
de53f30572bf85eb0a1234366c2a4ce2

SHA1
c30cb36d8f204085850377e6ca755af500f912b8

SHA256
755d515dcf5b0aaf84b121c3b09fcd7d734e6c248e5bd6fa16035203b6db0846

SHA512
469715c73584764a772f1b09383383172c09fc0154d1053a33b381451f49198f7f835629ffb090dc1114b5b260244f863b6ecd0544ae921d08acceb384ab6a5f

Download Submit
C:\ProgramData\BlueStacks_nxt\Locales\i18n.pl-PL.txt

Filesize
18KB

MD5
462dfa48b125524eab443b0808075b14

SHA1
f64458897d1d9d7b7d639be783d203eaac0ca064

SHA256
3be59c96e62ae9a235a71489e8831070fa5eaaf206c1064497d270bf522a3719

SHA512
9bc9888a8c419c1c1484d848ea76bd3dc5fc457f5a28d51f8795cf0a73bd199e2af008926e221722e18c9bbd5bdb6a14479b9de06ce489e67d2844a3d9324e30

Download Submit
C:\ProgramData\BlueStacks_nxt\Locales\i18n.pt-BR.txt

Filesize
18KB

MD5
f4c3e02158737ed49b87ae889f01b4c4

SHA1
2a9051f4a08e60105dc252df1a2484006b9fe75a

SHA256
879ab13159e85cdde4601e43db9ef02e79ae389e394953e9c8700f1fa044fb19

SHA512
74032477f79499bf297d4d1d3e3bf92a59812e4eb24c7a710e06c26d5d18d181c251d09167e3207716cf24e98785b4b8a2a4d5a7bf56e559bcc26386516ed18e

Download Submit
C:\ProgramData\BlueStacks_nxt\Locales\i18n.ru-RU.txt

Filesize
25KB

MD5
80ebb077860319dbb0fcb7cdf0b027d5

SHA1
6476428cfdbe755f0e63e1bbd2e7804c3151a050

SHA256
3e7483f91bed5b0232fedaf477eee58e69f063a793b92f6f7d899fe783305d33

SHA512
322e11b38efe189ed570ff25932233b8638fe5b623dcb4e87572bcbbaa6a79d690997def8674d1330cb8747ff14b4eb4a522282a8cdd8d5986c0fd20b00d2039

Download Submit
C:\ProgramData\BlueStacks_nxt\Locales\i18n.th-TH.txt

Filesize
30KB

MD5
f28be3c34575da2bdd145c29fc60c583

SHA1
8b587bd82e80c7686e3d95f5b1fd7ced1cb80b5a

SHA256
8d13595bfe54368239d45cf5b567a89deead621627c68802c894c89dd62d22b4

SHA512
8be0f6a7755f50a69f7650d7931abd050cb80ae2b2e9e30ae255c740e86b5d6c51124d1df3600500e70848e941216c29aba2756cf8a42c3ff36b32ac28493100

Download Submit
C:\ProgramData\BlueStacks_nxt\Locales\i18n.tr-TR.txt

Filesize
18KB

MD5
17d4c9a1795c555a68e197a687b54c73

SHA1
e1cd689cfc74be1b7628c5f5112b5af0f5326b8a

SHA256
ed71933650269386fab39b0b4641c5545b8cfb2c3b7e7dcb9232d49f85f0b7c4

SHA512
607d4f89590ba3946b5cfa133ff627a8521a574fcbef67d59630c9f753aa4fc896a2f9f5096267a32efe5ed38ef679272344db710f6217476d6a845dcf990743

Download Submit
C:\ProgramData\BlueStacks_nxt\Locales\i18n.vi-VN.txt

Filesize
20KB

MD5
070957515414923b09287ea6ec3e0f88

SHA1
13ef2ef5ee0f0c4b3618eecdd16724041963a252

SHA256
788c51fbcf8e933eb8f773ea5ddf1388b2c10f1098006337f230d4b84eab2ed6

SHA512
c04671f82be4e6716dfaf8649941b15bb2640f7c670f14732c896b39294f884e8bb8d98e9b26a3e0f4b82cefd0cea959ac5d4c57d1f0e3b6d3ff412340803808

Download Submit
C:\ProgramData\BlueStacks_nxt\Locales\i18n.zh-CN.txt

Filesize
16KB

MD5
03554f5a09fed3d02a48089aeb7780a7

SHA1
d2ed30330899c2b0ba88efd48f3fbf8359a4c679

SHA256
0e6bce6718e6c11ee40d4c19691ddd1c0d575c895eadedf33a3b873b6b8cc96c

SHA512
60410db57b3500a6dd972d3e438825859fe910bbde2ac10c3b11b0ab55435ef24bb5cd5f7b9d387a1808d4914c583222df70dfcd749897e1c9297081991bbd50

Download Submit
C:\ProgramData\BlueStacks_nxt\Locales\i18n.zh-TW.txt

Filesize
16KB

MD5
3f63ee9a3cbd75eaad9fea4ebcbeed1c

SHA1
79933655500c2b95511746d229cad8d5ab40ed0e

SHA256
aeff3999bf7c1d93b7bd30bee90d4e8194009c4b0ffb15abd3ece8af8e530042

SHA512
e02c4b5c36678fee33d1f045515d7e22390046eb9808f5c6a13e0e951822d3372308413974268abed0bb2391e821d4ef5ab00a83460c3fe8501fdd4a9e40fe2b

Download Submit
C:\ProgramData\OrayClient\sensors\distinct

Filesize
36B

MD5
1aabc80c94fc5792645c858294d6dc26

SHA1
48f3ce7b5cf70ef83fa133f5ed3fef5ea0eeffc3

SHA256
9d6279781e7ff46d77604287d714588249b1f50c6a8e26075541b41c580c9caf

SHA512
f40c5bc7f813e4105b7772ac5c3734eff1a8aa3bf103e15aac14418394a4ccfa6269b86fdee41bcc781beb8cbc072421c09ab107561cf30e972801f1732d5fec

Download Submit
C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.11.41.1005_native_96b729ce04fedd1fd61feffb1077ea5c_MzsxNSwwOzUsMTsxNSw0OzE1.exe

Filesize
114.9MB

MD5
ed47261b99536f357dfb186ce44bfb04

SHA1
6f2f798a87122055eb0378a7991dcb5b4b454a42

SHA256
8a8cc279bb09a3486470912e6af6e16592fc30a25c3a9665463ccfd0ae138b6c

SHA512
600ae110fe7e76a09d7219caf80ad87d943e2fbdd0b52464c60d9b3766256b644f8e9abafd309d74da5ca1bdf5ca90ca4ce80901fc797fe39c66421c9ed3a3a1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
33cdb7599a276a0ab54109d5794a658d

SHA1
77a8ceae1bb0394f5bd4a28aa211961667fb2230

SHA256
7d775f204a9c99f3facde14e9d5477c00490942b1015e8c2d24d9dcbd71165b8

SHA512
dfc2acd050758e5b7ef24ff6b5cc4386136afc193277f2bcd328cdde2d104d4cc68d55b79193622dffba4cac69784090eec85448992befc4ab6f73852ee6e5b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
d4377e9b06bc8e6bc0bb9343a6d0e087

SHA1
fa15ffba58646b360939141d228dbf8cc35b5d1c

SHA256
e8ecfcdc280078fdf489aaf53d84665e83e17e20580bfc36779ca6ddefecce15

SHA512
cd445fc8e844e5bd92775333a420fee632760d579d889bd46717a512601a2cc00fc0e8cafc6cec7cba721c82e8f16b576bef1bc71f0408abe76ebafbdcb2a5d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
b0a56448ea3461e3affb6a8e20ac7749

SHA1
0cc2439e1fda130aeafea6fcb819ef74a1728649

SHA256
9f3365022d8d59999a4a8841aada408277684b3519c7017162923a72b283d507

SHA512
f32f0dfa7692f3ab4f8ca80c8756747f5355e6737837b20853b581f9b99d75f8b46c1a37e5571f85ac5b0086ff15a07755d7635cb2c35a147fa2271ad19a9897

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
8f3efa4fc200c03f298d0a7df932d3bb

SHA1
a5847525d2e7f5a1489d4946b1d3f964be5f70e2

SHA256
149b04fdc82e9191b7f3bf6979ce91328764409fa77b1b9a23c8d8beea9fe2ae

SHA512
1e390f7054f6bb80a73b55baaba5563b4cf96719a0902c607aa8062ab2f41ad2bd6047c05d04b9ced8310c71d7e783cbdf2ad305e745ac2f33f8de4de7b9d1ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
3d35bc2690d8546c2cc4ffc0e76b57eb

SHA1
f2849858104f174e860d2578e11447463d6c0ac6

SHA256
61b52c257be97938564ac28741a220ab8eda576019701cee1f554aa8e6de35f0

SHA512
ca348a504eea65dee91c907c3258237b2e5cd5179db8a8e355e1d21837594865523647bd5fcf9c3153e294928ee5f615a28ec8c6d38ea226e44cf42c57a694a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
b8dd29d320a29918a29b1a5c624ce6b9

SHA1
fcc294f97dc400c6461747fde94e561f086bd44d

SHA256
450f3730531a93d6ea29ca479728927736b72e57acf172456e7aaaaddf3b715e

SHA512
9dd8c0f78d620a16fa5536c71ffe42df16b8b063b6a31b799be2681825bb7a1dff8e5890242d690e8d2d3a4ca0990d50bb42e82ae65642cff4a9a39cc5e8cd34

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
955B

MD5
c1adb9465b820c85fae4d4ba1f73bedf

SHA1
ec3be14710b13a7d03ca3cbe7c35a63250b913b5

SHA256
c738f3fa09ddeb2db1972d2fee4b33a872bea418bd5fc1f34d10ab69159a1ed6

SHA512
e45fb6f25e3449d1a04087f59a1740abeeb1cb8fdbe2ac676bd6aa964e7d61bf3553141f7d64bf0fb8832d708ac7eb2de79874d3c0de7e32318252d274647dbd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
3277767f47995af5c73335f75273a05b

SHA1
0738d2f330d477f166c7da9cea285e09f4681c4b

SHA256
e9f5c48ac5ea5eeca365088e985d10448c11a17711f4ba2f185f76fc5b775884

SHA512
296ed9b1c3b75e73eabfc837cfc55b69a3435887b06574573834d1a2d2c148690598ff6189b00a91b7a46b1b65564dbcc1695674b50d24be8907d3244f51109d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\f2354544-884f-4d00-ade6-441c7b8553a7.tmp

Filesize
2KB

MD5
f4858ad2db518ec468367f095abf659f

SHA1
885cb780efc66316cef994a1900fc96fce7d7940

SHA256
9013e07b527631254f52652034160aa46e07012fb62752a4c82beef16408543f

SHA512
94d059b0ab29a353b62c73b7ac9bccb28cb8cfaf6b8372869a3edf52bf2fcb8cedd1342aa791702c6516df81d6484c4a33ec3448ca71ca64ed6d904e65365e7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
6a26e6e45545fe284be375ec336fd545

SHA1
50b2ddfb00e9b955764ae280ba95096a6f012ef5

SHA256
8bd213250317297b3c3818391f433fb1e7216a377f783cfcd2877136aca7a84f

SHA512
5dfcf027164be63893edf2fe12d60e76f07794e6b4f8b68ecc6e0b99a09f5a54fcf8ff48248d24ae3d689e1d8fddb1025d5450ed5475786e2bc7e058726be79b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
f280a83fb75a9d3a88243d1e83721c17

SHA1
96e079c05667c9738cfe2b38b9e5d22acb2b8643

SHA256
6fc264a72a633febd2be5055e10c80f91a051517196ea47978e2a59676c1004e

SHA512
0a0ab50ad0c7289977eaf69b794bf70cf5f38f5dd14e6c504e2fb3b0a5d3fb4d29e0d83272b4f14cfc25b3946ddccf6b619ade5702a02e1d4d5ace181220ed78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
355c9bf23caa6ed97e476ccdff306975

SHA1
534344c4830a608e586333cb333b7bf81c6c237d

SHA256
ab9d1cc212c6e28dfcd694cd34077c508d0242f56a45587dfa105b85176760d2

SHA512
fffd4ac7ffa4663faf435b8d86a9dd0e9e0b878e02400f1a2f88e8e62e058861815083f526c0094e586888cc16d3f8ff0d93424efffb7affe43c60d6f941f160

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c492d9bd57a48c91c72e88b5be923870

SHA1
18a6a96d10c0309af3d38d6f20f4a3ea1267c58f

SHA256
65067bfd8c7176993f9d8d8603ecbcf04df2da87a4aeeedca7dcfa4463350fd0

SHA512
1844368f75cb092c40fc952dbec265e2b1f25e2c67d687d83db05f7c23803ad402d53e987d8ea07a64910c520e4465bad4f275aeec4cd96652756074e3f7a42c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
28ee26825ad154608c9190cf1a594419

SHA1
643e577fa61336d8d631c26e5f6f00c0cb273774

SHA256
a64a474dbbfe26321435533e6bd77b65949a0c18e4310bc333c65f661b693501

SHA512
cc1d6662e453ff0ce0d432c734f7aa0804cc034a636b449259c5a2ac8dfed29291c4ba8e9b0a9324d52621ef4c8e90a959790f45190a5c4b6c4d8043e4db8293

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
757a2aac94ed5733bd8cfdd92e7289a9

SHA1
bc245f771d05e08124e686e2f34031011e973d76

SHA256
34a777acbafe2bdc4465e83ee43abdd966c8e492dcdeab384dc612d6a63e9849

SHA512
a5a225ed9e0d21ce28ae99fc2bfcd2fe192bec4e3beb9089d1c776d669a2baba84c431b20b531c9850b7f586fefd9d381f8d4c62ba0db0f366baab7bb230e772

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
584373772f6ae490640b626ab893c346

SHA1
feaf200062714c2efc089cc6eb5a8adfd6a6c340

SHA256
01bcf62d6c52631ba0d6946cb21bd41dca906f5efe316505aa9d6bfb61738347

SHA512
660ca30a8a363c4b1888f5cfa8843b0b1227f06ba01315cfcebaaff932573ed86b1ae09f899a4a6f3c800e6d70546faaf97c8ded09992d94f2e3816d4fe883d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
6f177749e264875510e4f4af8d3e3320

SHA1
cef782d234cc82ea341c3ec6b51263fea33ce067

SHA256
58d0aea8b0a6c90da090c4bb2638e0eac47df39d3ac8c36c6d4064fd88209943

SHA512
cc65ac138ecceb4413aa7145d30ac2badce840e2a7178e99b830c2df32e2f60060ee4a6a17696a18c9776a301700c05f613ddd2d58e06f7294209cb97e3bc3a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
56B

MD5
ae1bccd6831ebfe5ad03b482ee266e4f

SHA1
01f4179f48f1af383b275d7ee338dd160b6f558a

SHA256
1b11047e738f76c94c9d15ee981ec46b286a54def1a7852ca1ade7f908988649

SHA512
baf7ff6747f30e542c254f46a9678b9dbf42312933962c391b79eca6fcb615e4ba9283c00f554d6021e594f18c087899bc9b5362c41c0d6f862bba7fb9f83038

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5f46e5.TMP

Filesize
120B

MD5
27996b5e5ec152d61950a2cc3d003b62

SHA1
4053132c74d79445250cfc72b7ae6cbb76a8429b

SHA256
753cc726e548cc8274b8975fdaefe7bc24df0990ee55baf2db4d57bc272b9681

SHA512
2f472ff470cbb718ec2d971d14a1dbf48f516885fc7fe4edecb8cd14fff08048d1e36c561aa6f80c6306e542e947fa1ef52549b5e32b536b9fe09d787365eb65

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
173KB

MD5
8c7b96c0fc20d51438d60caaa8553e74

SHA1
5ab45d799930d7426e207113afd950ea46970bf0

SHA256
6dfe48ed2a0e2f964b025f36c17b173442be5a3c8a9342f2253d3ae5b9f3f676

SHA512
7f592aaf72b9263ae9065def4598014a8116d976925c973650bd77fec52f201cc21998675b9cbfcda752ea771e9f5ece1d5af7d046fa9ee12d47dda981a9e845

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
173KB

MD5
69068a7f631731ad1cae5ed2574fe24c

SHA1
8b70b7b7c6d0d423603f350f767f5145badf2ffa

SHA256
8cf98797255c5748128a3288801ee44f1dd232b690c36f5e177df8292d37c43e

SHA512
578833924dff627fd27da8b00af2dde66af3b2c75dd3bd3c6c5b89f66b501630e6c4c9b1aeb454afa85ea372bb1782dffe930efc93a529659050010f14b23a6c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
173KB

MD5
616620956a8ddf9dff661dd02b772a67

SHA1
35389e0baa6b29f0fabd806a82305856271a579a

SHA256
8c21bd7ebc816c1d23f3b3d4400ba364ed238762fda6ee83abf7c2a9d220157d

SHA512
d1b816c5b61c255a40bd19ee1fff4ae4d0257e7509f8505c6844811262f15d2d125251e8b5740f91122b212826178a2574cf884b81597f8c3514e9daa7089e42

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
110KB

MD5
173ca9439ae0afd06b104965549efeeb

SHA1
23087b581ab1868ddb0403cc705961eb9a56c101

SHA256
92c26e8c9df588b6fe05f4146ba077e123550c082dc71e2e00aa30cdc7eb95c8

SHA512
54d454476690fe05a1f3941640b819a792f8bb74f32d27f5fb486ae192c7f052338125f55df35a6d4e9645f85d5179054eb9748c354961f21f99a548fd208e9a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
114KB

MD5
b80f3549a8d6497c9e3b5216b5e05491

SHA1
c27fc5b83740fe74a4e5b08c5ca2c5fd82ea0054

SHA256
3aaf78259e0daf9acce1b607f2bdcbe60a739f1a302229e4cf5b4776b4364764

SHA512
93267fdbea2ef86dfd12e59b6b0a86096ac83e0bde3dbb314ceea7bc9bc9c6fa12b500d4be956a9246b1f3078af5c374ee073a8eddb011fa98b0af0c87043379

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe580923.TMP

Filesize
103KB

MD5
49db8720cd34df2a01b5837f84734dac

SHA1
99aa73290f0c3762a1e0c5b06e84630807d3350d

SHA256
6444c660605b0c244333e2e809758d90931cca16a45a7603413b1c8aa77e9fe1

SHA512
3bbe52d741a4c866c89f42c2c378f8aab2814a1b3428762c4d5ac86a4049208b9afcccb3e99c837128b4b8dfdb0c10e1f3756efa9f73681408bfafa6877ba8bc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\3tdradl0.bzq\BlueStacks-Installer_5.11.41.1005.log

Filesize
128KB

MD5
7909f20426cac187aef15f0d70fb718b

SHA1
1212b863fb20827e81723c3218355c5df635bb5b

SHA256
b263346372f3d2ba838fcd861e38a5320c01cde9ef1c8bdc47ef98f0cf9caea1

SHA512
d52c5497acd9726c15b3d3b2bba69946e5d10a9000e3f7b1a207c0a7ae927c7025ce2d6656a6b1f1115f2abcdafeecd5f8b6602fbcc631f504853a3f011665e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4C2A397F\Assets\close_red.png

Filesize
15KB

MD5
93216b2f9d66d423b3e1311c0573332d

SHA1
5efaebec5f20f91f164f80d1e36f98c9ddaff805

SHA256
d0b6d143642d356b40c47459a996131a344cade6bb86158f1b74693426b09bfb

SHA512
922a7292de627c5e637818556d25d9842a88e89f2b198885835925679500dfd44a1e25ce79e521e63c4f84a6b0bd6bf98e46143ad8cee80ecdbaf3d3bc0f3a32

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4C2A397F\Assets\installer_minimize.png

Filesize
113B

MD5
38b539a1e4229738e5c196eedb4eb225

SHA1
f027b08dce77c47aaed75a28a2fce218ff8c936c

SHA256
a064f417e3c2b8f3121a14bbded268b2cdf635706880b7006f931de31476bbc2

SHA512
2ce433689a94fae454ef65e0e9ec33657b89718bbb5a038bf32950f6d68722803922f3a427278bad432395a1716523e589463fcce4279dc2a895fd77434821cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4C2A397F\Assets\loader.png

Filesize
279B

MD5
03903fd42ed2ee3cb014f0f3b410bcb4

SHA1
762a95240607fe8a304867a46bc2d677f494f5c2

SHA256
076263cc65f9824f4f82eb6beaa594d1df90218a2ee21664cf209181557e04b1

SHA512
8b0e717268590e5287c07598a06d89220c5e9a33cd1c29c55f8720321f4b3efc869d20c61fcc892e13188d77f0fdc4c73a2ee6dece174bf876fcc3a6c5683857

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4C2A397F\BlueStacksInstaller.exe

Filesize
595KB

MD5
7a65bebe590be86801f151541d8af5bd

SHA1
1dfaceb3afdd7e6d6e0fa0d54515828d16ee95dc

SHA256
22634196d540cdcf2b713ae0bd507f0fdecc0d4f66759be0d6585c3461e7d721

SHA512
4437ecf9b2ee8e3ec3fe91e6325d36c25febf15cab4ecfb7874e73f502f3e469301125e1b6f148d567a4b763e41660325aba462efd1ec4b983cfbab99334b5af

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4C2A397F\BlueStacksInstaller.exe

Filesize
595KB

MD5
7a65bebe590be86801f151541d8af5bd

SHA1
1dfaceb3afdd7e6d6e0fa0d54515828d16ee95dc

SHA256
22634196d540cdcf2b713ae0bd507f0fdecc0d4f66759be0d6585c3461e7d721

SHA512
4437ecf9b2ee8e3ec3fe91e6325d36c25febf15cab4ecfb7874e73f502f3e469301125e1b6f148d567a4b763e41660325aba462efd1ec4b983cfbab99334b5af

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4C2A397F\BlueStacksInstaller.exe

Filesize
595KB

MD5
7a65bebe590be86801f151541d8af5bd

SHA1
1dfaceb3afdd7e6d6e0fa0d54515828d16ee95dc

SHA256
22634196d540cdcf2b713ae0bd507f0fdecc0d4f66759be0d6585c3461e7d721

SHA512
4437ecf9b2ee8e3ec3fe91e6325d36c25febf15cab4ecfb7874e73f502f3e469301125e1b6f148d567a4b763e41660325aba462efd1ec4b983cfbab99334b5af

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4C2A397F\BlueStacksInstaller.exe.config

Filesize
324B

MD5
1b456d88546e29f4f007cd0bf1025703

SHA1
e5c444fcfe5baf2ef71c1813afc3f2c1100cab86

SHA256
d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb

SHA512
c545e416c841b8786e4589fc9ca2b732b16cdd759813ec03f558332f2436f165ec1ad2fbc65012b5709fa19ff1e8396639c17bfad150cabeb51328a39ea556e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4C2A397F\HD-CheckCpu.exe

Filesize
211KB

MD5
764ac83167adcd8d2273f6bff7d769b2

SHA1
bf6a46b8c03d7efb16fdd6e4ce0a5e4362f41957

SHA256
e81e0444ba2deb4056872d1c4f9b01971bb4fb376c6434c942718da7c39190bf

SHA512
a3a484aaf5cfdff1c198c37f3055409dc066646db3d61e74bfef2b4ce212d95fd43d3e3b239e080ba9fab62eae23cd4b54b6b466fad3192845b43d4212ccd667

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4C2A397F\HD-CheckCpu.exe

Filesize
211KB

MD5
764ac83167adcd8d2273f6bff7d769b2

SHA1
bf6a46b8c03d7efb16fdd6e4ce0a5e4362f41957

SHA256
e81e0444ba2deb4056872d1c4f9b01971bb4fb376c6434c942718da7c39190bf

SHA512
a3a484aaf5cfdff1c198c37f3055409dc066646db3d61e74bfef2b4ce212d95fd43d3e3b239e080ba9fab62eae23cd4b54b6b466fad3192845b43d4212ccd667

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4C2A397F\HD-CheckCpu.exe

Filesize
211KB

MD5
764ac83167adcd8d2273f6bff7d769b2

SHA1
bf6a46b8c03d7efb16fdd6e4ce0a5e4362f41957

SHA256
e81e0444ba2deb4056872d1c4f9b01971bb4fb376c6434c942718da7c39190bf

SHA512
a3a484aaf5cfdff1c198c37f3055409dc066646db3d61e74bfef2b4ce212d95fd43d3e3b239e080ba9fab62eae23cd4b54b6b466fad3192845b43d4212ccd667

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4C2A397F\JSON.dll

Filesize
411KB

MD5
f5fd966e29f5c359f78cb61a571d1be4

SHA1
a55e7ed593b4bc7a77586da0f1223cfd9d51a233

SHA256
d2c8d26f95f55431e632c8581154db7c19547b656380e051194a9d2583dd2156

SHA512
d99e6fe250bb106257f86135938635f6e7ad689b2c11a96bb274f4c4c5e9a85cfacba40122dbc953f77b5d33d886c6af30bff821f10945e15b21a24b66f6c8be

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4C2A397F\Locales\i18n.en-US.txt

Filesize
17KB

MD5
afdab4141bdd259bdf57c3459887e0d7

SHA1
b1405390b7f11212ea7c97c68aadf43d2accd410

SHA256
64447fd07169bcac318a5d0050163d9c35461559f078d808013717a73c74da80

SHA512
bcd6fa7e8688f43b291710ec14f14164e344371350486b103270bbe7a7d0faded58ca0129bce9d58441cdcb1812c0169f5179788f4e5c24d68955038c9ecce68

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4C2A397F\ThemeFile

Filesize
80KB

MD5
c3e6bab4f92ee40b9453821136878993

SHA1
94493a6b3dfb3135e5775b7d3be227659856fbc4

SHA256
de1a2e6b560e036da5ea6b042e29e81a5bfcf67dde89670c332fc5199e811ba6

SHA512
a64b6b06b3a0f3591892b60e59699682700f4018b898efe55d6bd5fb417965a55027671c58092d1eb7e21c2dbac42bc68dfb8c70468d98bed45a8cff0e945895

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\Assets\exit_close.png

Filesize
670B

MD5
26eb04b9e0105a7b121ea9c6601bbf2a

SHA1
efc08370d90c8173df8d8c4b122d2bb64c07ccd8

SHA256
7aaef329ba9fa052791d1a09f127551289641ea743baba171de55faa30ec1157

SHA512
9df3c723314d11a6b4ce0577eb61488061f2f96a9746a944eb6a4ee8c0c4d29131231a1b20988ef5454b79f9475b43d62c710839ecc0a9c98324f977cab6db68

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\Assets\minimize_progress.png

Filesize
212B

MD5
1504b80f2a6f2d3fefc305da54a2a6c2

SHA1
432a9d89ebc2f693836d3c2f0743ea5d2077848d

SHA256
2f62d4e8c643051093f907058dddc78cc525147d9c4f4a0d78b4d0e5c90979f6

SHA512
675db04baf3199c8d94af30a1f1c252830a56a90f633c3a72aa9841738b04242902a5e7c56dd792626338e8b7eabc1f359514bb3a2e62bc36c16919e196cfd94

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\Bootstrapper.exe

Filesize
153KB

MD5
49b4e9ea48785967899479b095d95354

SHA1
b9f415003d768ada47e1676d4c14b0cefd1d1135

SHA256
8af64bcfc233487613d502eeb62d8a48a33f2b762ab1f538d755f822d7f504a7

SHA512
3108344901a11e51f09da4a1d3cc2f73adac0027480c8e1206d78c23430df78ef78bc708d0d11728ad40733921908b08cefb5901c840e0ae6e7413cedb1a8115

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8151F7C2\HD-CheckCpu.exe

Filesize
211KB

MD5
764ac83167adcd8d2273f6bff7d769b2

SHA1
bf6a46b8c03d7efb16fdd6e4ce0a5e4362f41957

SHA256
e81e0444ba2deb4056872d1c4f9b01971bb4fb376c6434c942718da7c39190bf

SHA512
a3a484aaf5cfdff1c198c37f3055409dc066646db3d61e74bfef2b4ce212d95fd43d3e3b239e080ba9fab62eae23cd4b54b6b466fad3192845b43d4212ccd667

Download Submit
C:\Users\Admin\AppData\Local\Temp\Installer.zip_bst

Filesize
13KB

MD5
81aa8a10c2c2c5ab8c00e32c4d687636

SHA1
1e2951a71bc78b724deee4b98b2f04aafa9f65dd

SHA256
6956a7d2be883cfa6a9a43a8afdfefd1cd54bd46627854ba2e6ce791ad00e74e

SHA512
f776eb4fdd22f5e13f70832ce01a20b6a6bcfa567e1b459106916e981d66d9bed59bc66b5448f6834522247d9b3f49bfffbdb8cee85b783596ccf18689696227

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse3DE9.tmp\BgWorker.dll

Filesize
11KB

MD5
4908fd4ede7b20e3bddb898a4b1dfe87

SHA1
9eb6b8adea38282ea5e113d86179b15d71f270d7

SHA256
b7997801ed63a13e23b0f93f1efd36e8b1d0259a3da7f1932c90a869c2295d58

SHA512
478f868c5f72dc54ce31f89eaec6539d0c149bc272ad300d83b61296589ad847001e5c31cf0d5c3f831bfbba3bca3e8469e0c84edf1ef625ef0486ebf6a69c43

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse3DE9.tmp\System.dll

Filesize
19KB

MD5
55b1f5fb63896e30d78a14aa4aa3b8df

SHA1
e881520cb5c147ab50705529783fe93720d05acc

SHA256
7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa

SHA512
239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse3DE9.tmp\nsDui.dll

Filesize
3.0MB

MD5
c2d5fa0c27dbcd8db6ea3f6e85774b9f

SHA1
33f6fa4574c4e6b914280316e41f38a44d1b081e

SHA256
f0b6f0b252f88546646890489cf1a6295b1fdfc5272e0c1e1b78951cb9b0421c

SHA512
02830f7f1d91a8c4e80ae13dbb569bced4330995907277fd89c5357e245456466a35b5f0dc1355ac3c512c71e1413c8a4cd50a4fe74a3ee2691d145c169f2041

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiF39.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiF39.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiF39.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
C:\Users\Admin\AppData\Local\Temp\u2i0.0

Filesize
1KB

MD5
8d6ebedf43e0dcc74095cbb195e363c0

SHA1
66e42e24989acfcc2800baddf99e124a5d01f500

SHA256
5839ef0d24cd1a6d35cc176569004f90fa28f2de6e8721f3505305c7d5efb51f

SHA512
1a8107a95ce538ff39dd429c361e47a47b55d90e8b239514eaedbadf8349f52841fde0a0fbd6be2b36a856419f1e762e04a7dbae2201c9ab3aadc3e51cbb7313

Download Submit
C:\Users\Admin\AppData\Roaming\AweSun\log\green_shell.20230401-125835.log

Filesize
1KB

MD5
d4785f53e8bf35b05f9aab46d01e9bb8

SHA1
5a6a4bd96d750f15c17f8a5dd938598365420e73

SHA256
5b763b0cc123863db0546e50a4cac3963a9cff1b41190028a606c50bb8e2d576

SHA512
3b5897dbf69588bdbccfc31cde613dbe043e217691ae45d1f27aa46e027cb4ca1881e916649072e1789eccd7b86f7b9e57b0bcd13905a1326a9acd8572b20c7c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\bluestacks-services\Local Storage\leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\bluestacks-services\Network\Network Persistent State

Filesize
615B

MD5
a75ac5760b0cca6a5fe82eeeaf4b4bbf

SHA1
cb8c048fd2b2780a432a3cedb8015ef5e11dd8f5

SHA256
34bcb5b2e9b6fea40d75d7d9a458867916f1f22e85afd7b3912345eb1c4cd991

SHA512
a7823f4b769a5b6277b87bed8b70ba96ca335204c29db97183ef34fb71ad5034b2d56f2056a6ce66ff4ad63c9d5460ba37d199f7ff6f1e0768783072306f0f5d

Download Submit
C:\Users\Admin\AppData\Roaming\bluestacks-services\Network\Network Persistent State~RFe64accb.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe

Filesize
23.4MB

MD5
c8f2d7a8ec0fdd9666aa35aa5197a02b

SHA1
4a065f650b99dd00df393769ab20f2c26de3adf4

SHA256
3d14e696b705581be3fda26eed77a9f2b020fe17b0cd751b603fe1278cb19c76

SHA512
9e39ae4b6ec5769fda7dd1e51ee706f4b932b6756d63d82bfecd96f2190c62b081cf654a02466ed7dae97ce5c2ee8437b20167689c0efa986eb707cbe2314528

Download Submit
C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe

Filesize
23.4MB

MD5
c8f2d7a8ec0fdd9666aa35aa5197a02b

SHA1
4a065f650b99dd00df393769ab20f2c26de3adf4

SHA256
3d14e696b705581be3fda26eed77a9f2b020fe17b0cd751b603fe1278cb19c76

SHA512
9e39ae4b6ec5769fda7dd1e51ee706f4b932b6756d63d82bfecd96f2190c62b081cf654a02466ed7dae97ce5c2ee8437b20167689c0efa986eb707cbe2314528

Download Submit
C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe

Filesize
23.4MB

MD5
c8f2d7a8ec0fdd9666aa35aa5197a02b

SHA1
4a065f650b99dd00df393769ab20f2c26de3adf4

SHA256
3d14e696b705581be3fda26eed77a9f2b020fe17b0cd751b603fe1278cb19c76

SHA512
9e39ae4b6ec5769fda7dd1e51ee706f4b932b6756d63d82bfecd96f2190c62b081cf654a02466ed7dae97ce5c2ee8437b20167689c0efa986eb707cbe2314528

Download Submit
C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe

Filesize
23.4MB

MD5
c8f2d7a8ec0fdd9666aa35aa5197a02b

SHA1
4a065f650b99dd00df393769ab20f2c26de3adf4

SHA256
3d14e696b705581be3fda26eed77a9f2b020fe17b0cd751b603fe1278cb19c76

SHA512
9e39ae4b6ec5769fda7dd1e51ee706f4b932b6756d63d82bfecd96f2190c62b081cf654a02466ed7dae97ce5c2ee8437b20167689c0efa986eb707cbe2314528

Download Submit
C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe

Filesize
23.4MB

MD5
c8f2d7a8ec0fdd9666aa35aa5197a02b

SHA1
4a065f650b99dd00df393769ab20f2c26de3adf4

SHA256
3d14e696b705581be3fda26eed77a9f2b020fe17b0cd751b603fe1278cb19c76

SHA512
9e39ae4b6ec5769fda7dd1e51ee706f4b932b6756d63d82bfecd96f2190c62b081cf654a02466ed7dae97ce5c2ee8437b20167689c0efa986eb707cbe2314528

Download Submit
C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe

Filesize
23.4MB

MD5
c8f2d7a8ec0fdd9666aa35aa5197a02b

SHA1
4a065f650b99dd00df393769ab20f2c26de3adf4

SHA256
3d14e696b705581be3fda26eed77a9f2b020fe17b0cd751b603fe1278cb19c76

SHA512
9e39ae4b6ec5769fda7dd1e51ee706f4b932b6756d63d82bfecd96f2190c62b081cf654a02466ed7dae97ce5c2ee8437b20167689c0efa986eb707cbe2314528

Download Submit
C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe

Filesize
23.4MB

MD5
c8f2d7a8ec0fdd9666aa35aa5197a02b

SHA1
4a065f650b99dd00df393769ab20f2c26de3adf4

SHA256
3d14e696b705581be3fda26eed77a9f2b020fe17b0cd751b603fe1278cb19c76

SHA512
9e39ae4b6ec5769fda7dd1e51ee706f4b932b6756d63d82bfecd96f2190c62b081cf654a02466ed7dae97ce5c2ee8437b20167689c0efa986eb707cbe2314528

Download Submit
C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe

Filesize
23.4MB

MD5
c8f2d7a8ec0fdd9666aa35aa5197a02b

SHA1
4a065f650b99dd00df393769ab20f2c26de3adf4

SHA256
3d14e696b705581be3fda26eed77a9f2b020fe17b0cd751b603fe1278cb19c76

SHA512
9e39ae4b6ec5769fda7dd1e51ee706f4b932b6756d63d82bfecd96f2190c62b081cf654a02466ed7dae97ce5c2ee8437b20167689c0efa986eb707cbe2314528

Download Submit
C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe

Filesize
23.4MB

MD5
c8f2d7a8ec0fdd9666aa35aa5197a02b

SHA1
4a065f650b99dd00df393769ab20f2c26de3adf4

SHA256
3d14e696b705581be3fda26eed77a9f2b020fe17b0cd751b603fe1278cb19c76

SHA512
9e39ae4b6ec5769fda7dd1e51ee706f4b932b6756d63d82bfecd96f2190c62b081cf654a02466ed7dae97ce5c2ee8437b20167689c0efa986eb707cbe2314528

Download Submit
C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe

Filesize
23.4MB

MD5
c8f2d7a8ec0fdd9666aa35aa5197a02b

SHA1
4a065f650b99dd00df393769ab20f2c26de3adf4

SHA256
3d14e696b705581be3fda26eed77a9f2b020fe17b0cd751b603fe1278cb19c76

SHA512
9e39ae4b6ec5769fda7dd1e51ee706f4b932b6756d63d82bfecd96f2190c62b081cf654a02466ed7dae97ce5c2ee8437b20167689c0efa986eb707cbe2314528

Download Submit
C:\Users\Admin\Downloads\Aweray_Remote_2.0.0.45399_x64.exe

Filesize
23.4MB

MD5
c8f2d7a8ec0fdd9666aa35aa5197a02b

SHA1
4a065f650b99dd00df393769ab20f2c26de3adf4

SHA256
3d14e696b705581be3fda26eed77a9f2b020fe17b0cd751b603fe1278cb19c76

SHA512
9e39ae4b6ec5769fda7dd1e51ee706f4b932b6756d63d82bfecd96f2190c62b081cf654a02466ed7dae97ce5c2ee8437b20167689c0efa986eb707cbe2314528

Download Submit
C:\Users\Admin\Downloads\BlueStacksInstaller_5.11.41.1005_native_96b729ce04fedd1fd61feffb1077ea5c_MzsxNSwwOzUsMTsxNSw0OzE1.exe

Filesize
899KB

MD5
9f8a38bb72af8005f9ee7ad03d091aae

SHA1
b1bb8838168cce0bec65209d6d9f677f8faefe39

SHA256
9204ba83eb7eb818bc2b0e4d627e2bda31ce3aee8ee578115442262276e11746

SHA512
1ca6e93f32aeef525554fc71330fb6c738a83307a55bc628d023ef59025960df03b8df0e43773e708236771b29cac25e981f6860d144c08f359ef3ff86fcfd82

Download Submit
C:\Users\Admin\Downloads\BlueStacksInstaller_5.11.41.1005_native_96b729ce04fedd1fd61feffb1077ea5c_MzsxNSwwOzUsMTsxNSw0OzE1.exe

Filesize
899KB

MD5
9f8a38bb72af8005f9ee7ad03d091aae

SHA1
b1bb8838168cce0bec65209d6d9f677f8faefe39

SHA256
9204ba83eb7eb818bc2b0e4d627e2bda31ce3aee8ee578115442262276e11746

SHA512
1ca6e93f32aeef525554fc71330fb6c738a83307a55bc628d023ef59025960df03b8df0e43773e708236771b29cac25e981f6860d144c08f359ef3ff86fcfd82

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 679025.crdownload

Filesize
23.4MB

MD5
c8f2d7a8ec0fdd9666aa35aa5197a02b

SHA1
4a065f650b99dd00df393769ab20f2c26de3adf4

SHA256
3d14e696b705581be3fda26eed77a9f2b020fe17b0cd751b603fe1278cb19c76

SHA512
9e39ae4b6ec5769fda7dd1e51ee706f4b932b6756d63d82bfecd96f2190c62b081cf654a02466ed7dae97ce5c2ee8437b20167689c0efa986eb707cbe2314528

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 828529.crdownload

Filesize
899KB

MD5
9f8a38bb72af8005f9ee7ad03d091aae

SHA1
b1bb8838168cce0bec65209d6d9f677f8faefe39

SHA256
9204ba83eb7eb818bc2b0e4d627e2bda31ce3aee8ee578115442262276e11746

SHA512
1ca6e93f32aeef525554fc71330fb6c738a83307a55bc628d023ef59025960df03b8df0e43773e708236771b29cac25e981f6860d144c08f359ef3ff86fcfd82

Download Submit
memory/1608-262-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/1608-300-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/1608-451-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/1608-277-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/2364-529-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/2364-478-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/2364-491-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/2364-525-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/3156-287-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/3156-278-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/3156-289-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/3156-276-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/3156-291-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/3156-295-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/3156-285-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/3240-301-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/3240-309-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/3500-243-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/3552-307-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/4084-479-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/4152-252-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/4492-1102-0x0000000001000000-0x0000000001010000-memory.dmp

Filesize
64KB

Download
memory/4492-1101-0x0000000001000000-0x0000000001010000-memory.dmp

Filesize
64KB

Download
memory/4492-1100-0x0000000001000000-0x0000000001010000-memory.dmp

Filesize
64KB

Download
memory/4492-1099-0x0000000001000000-0x0000000001010000-memory.dmp

Filesize
64KB

Download
memory/4492-1073-0x0000000002B80000-0x0000000002BE8000-memory.dmp

Filesize
416KB

Download
memory/4492-1087-0x000000001CFC0000-0x000000001CFCE000-memory.dmp

Filesize
56KB

Download
memory/4492-1086-0x000000001DB30000-0x000000001DB68000-memory.dmp

Filesize
224KB

Download
memory/4492-1084-0x000000001E1C0000-0x000000001E6E8000-memory.dmp

Filesize
5.2MB

Download
memory/4492-1133-0x0000000001000000-0x0000000001010000-memory.dmp

Filesize
64KB

Download
memory/4492-1132-0x0000000001000000-0x0000000001010000-memory.dmp

Filesize
64KB

Download
memory/4492-1071-0x00000000007E0000-0x0000000000878000-memory.dmp

Filesize
608KB

Download
memory/4492-1105-0x00000000216A0000-0x00000000216A8000-memory.dmp

Filesize
32KB

Download
memory/4520-520-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/4520-502-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/4520-494-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/4520-512-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/4520-470-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/4520-516-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/4520-498-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/4520-508-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/4520-490-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/4520-524-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/4520-528-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/4924-433-0x00007FF698000000-0x00007FF69C3EC000-memory.dmp

Filesize
67.9MB

Download
memory/5820-12676-0x000000001B4C0000-0x000000001B4E2000-memory.dmp

Filesize
136KB

Download
memory/5820-11225-0x000000001B610000-0x000000001B620000-memory.dmp

Filesize
64KB

Download
memory/5820-11728-0x000000001B610000-0x000000001B620000-memory.dmp

Filesize
64KB

Download
memory/5820-11640-0x000000001B610000-0x000000001B620000-memory.dmp

Filesize
64KB

Download
memory/5820-11229-0x000000001B610000-0x000000001B620000-memory.dmp

Filesize
64KB

Download
memory/5820-11326-0x000000001B610000-0x000000001B620000-memory.dmp

Filesize
64KB

Download
memory/5820-11224-0x00000000009A0000-0x00000000009F2000-memory.dmp

Filesize
328KB

Download
memory/5820-11228-0x000000001B610000-0x000000001B620000-memory.dmp

Filesize
64KB

Download
memory/5820-11227-0x000000001D1F0000-0x000000001D270000-memory.dmp

Filesize
512KB

Download
memory/5820-12675-0x000000001B480000-0x000000001B488000-memory.dmp

Filesize
32KB

Download
memory/5820-11325-0x000000001B610000-0x000000001B620000-memory.dmp

Filesize
64KB

Download
memory/5820-11226-0x000000001B610000-0x000000001B620000-memory.dmp

Filesize
64KB

Download
memory/5972-11221-0x0000000000A60000-0x0000000000A88000-memory.dmp

Filesize
160KB

Download
memory/5972-11222-0x000000001B640000-0x000000001B722000-memory.dmp

Filesize
904KB

Download