Overview

overview

8

Static

static

1

BlueStacks...E1.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    98s
  • max time network
    155s
  • platform
    windows11-21h2_x64
  • resource
    win11-20231215-en
  • resource tags

    arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    23-01-2024 13:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    BlueStacks10Installer_10.10.1.1001_native_e102f155e72119eb701f5777ef98fbbe_MDs1LDM7MTUsMTsxNSw0OzE1.exe

  • Size

    910KB

  • MD5

    94f20d2390faa0459452a717aedf5b73

  • SHA1

    da9bf054847414bc8f2ff334529d5e18c1c40bb2

  • SHA256

    194f0e652f991394872e5b6413754bbd80ff6712b2923f1ad87169bfde7ccde9

  • SHA512

    988fc2a6827469f064bc855bf8ecef292c427f7b6375b929a8eec5fa353ef2b3109ddabc3ca50ca715369e6a51c979cb56d1a9bc3cffda8d39c55183fdb73284

  • SSDEEP

    12288:SivtCXQd0gjKX7zuqGK4D779TxgE98I9Le3/m7nmJg8zpTHpNF2uqED4228vs8s:SivtCXWeGKw9Txt9pLePMmTP2uqEt2gs

Score
8/10
discoveryevasion

Malware Config

Signatures

  • Modifies Windows Firewall 1 TTPs 4 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates processes with tasklist 1 TTPs 11 IoCs
  • Modifies registry class 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BlueStacks10Installer_10.10.1.1001_native_e102f155e72119eb701f5777ef98fbbe_MDs1LDM7MTUsMTsxNSw0OzE1.exe
    "C:\Users\Admin\AppData\Local\Temp\BlueStacks10Installer_10.10.1.1001_native_e102f155e72119eb701f5777ef98fbbe_MDs1LDM7MTUsMTsxNSw0OzE1.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3440
    • C:\Users\Admin\AppData\Local\Temp\7zS07D64DA7\BlueStacksInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS07D64DA7\BlueStacksInstaller.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:840
      • C:\Users\Admin\AppData\Local\Temp\7zS07D64DA7\HD-CheckCpu.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS07D64DA7\HD-CheckCpu.exe" --cmd checkHypervEnabled
        3⤵
        • Executes dropped EXE
        PID:2328
      • C:\Users\Admin\AppData\Local\Temp\7zS07D64DA7\HD-CheckCpu.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS07D64DA7\HD-CheckCpu.exe" --cmd checkSSE4
        3⤵
        • Executes dropped EXE
        PID:5092
      • C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.20.10.1003_nxt.exe
        "C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.20.10.1003_nxt.exe" -s
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1812
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\BlueStacks X\green.vbs"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:10624
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c green.bat
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:6052
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall delete rule name="BlueStacksWeb"
              6⤵
              • Modifies Windows Firewall
              PID:4896
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall delete rule name="Cloud Game"
              6⤵
              • Modifies Windows Firewall
              PID:3880
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall add rule name="BlueStacksWeb" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\BlueStacksWeb.exe"
              6⤵
              • Modifies Windows Firewall
              PID:1508
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall add rule name="Cloud Game" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\Cloud Game.exe"
              6⤵
              • Modifies Windows Firewall
              PID:10560
      • C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacks10Installer_10.10.1.1001_native_e102f155e72119eb701f5777ef98fbbe_MDs1LDM7MTUsMTsxNSw0OzE1.exe
        "C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacks10Installer_10.10.1.1001_native_e102f155e72119eb701f5777ef98fbbe_MDs1LDM7MTUsMTsxNSw0OzE1.exe" -versionMachineID=740c090e-2ea1-4cd3-810e-dd7baa0b5970 -machineID=32556281-18f9-431c-a03c-5dc9266426d6 -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Nougat32 -imageToLaunch=Nougat32 -isSSE4Available=1 -appToLaunch=bsx -bsxVersion=10.10.1.1001 -country=GB -skipBinaryShortcuts -isWalletFeatureEnabled
        3⤵
          PID:7960
          • C:\Users\Admin\AppData\Local\Temp\7zS81F7BF39\BlueStacksInstaller.exe
            "C:\Users\Admin\AppData\Local\Temp\7zS81F7BF39\BlueStacksInstaller.exe" -versionMachineID=740c090e-2ea1-4cd3-810e-dd7baa0b5970 -machineID=32556281-18f9-431c-a03c-5dc9266426d6 -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Nougat32 -imageToLaunch=Nougat32 -isSSE4Available=1 -appToLaunch=bsx -bsxVersion=10.10.1.1001 -country=GB -skipBinaryShortcuts -isWalletFeatureEnabled
            4⤵
              PID:4436
              • C:\Users\Admin\AppData\Local\Temp\7zS81F7BF39\HD-CheckCpu.exe
                "C:\Users\Admin\AppData\Local\Temp\7zS81F7BF39\HD-CheckCpu.exe" --cmd checkHypervEnabled
                5⤵
                  PID:6252
        • C:\ProgramData\BlueStacksServicesSetup.exe
          "C:\ProgramData\BlueStacksServicesSetup.exe"
          1⤵
            PID:6332
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq BlueStacksServices.exe" | find "BlueStacksServices.exe"
              2⤵
                PID:6452
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq BlueStacksServices.exe"
                  3⤵
                  • Enumerates processes with tasklist
                  PID:6504
                • C:\Windows\SysWOW64\find.exe
                  find "BlueStacksServices.exe"
                  3⤵
                    PID:6512
              • C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
                "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --hidden --initialLaunch
                1⤵
                  PID:7404
                  • C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
                    "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1488 --field-trial-handle=1704,i,9443956761324426148,2580783378338492289,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                    2⤵
                      PID:8284
                    • C:\Windows\system32\cscript.exe
                      cscript.exe
                      2⤵
                        PID:7692
                      • C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
                        "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --mojo-platform-channel-handle=1952 --field-trial-handle=1704,i,9443956761324426148,2580783378338492289,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
                        2⤵
                          PID:8248
                        • C:\Windows\system32\cscript.exe
                          cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKCU\SOFTWARE\BlueStacksServices
                          2⤵
                            PID:7680
                          • C:\Windows\system32\cscript.exe
                            cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKCU\SOFTWARE\BlueStacksServices
                            2⤵
                              PID:7604
                            • C:\Windows\system32\cscript.exe
                              cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regPutValue.wsf A
                              2⤵
                                PID:2880
                              • C:\Windows\system32\cscript.exe
                                cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regPutValue.wsf A
                                2⤵
                                  PID:5324
                                • C:\Windows\system32\cscript.exe
                                  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
                                  2⤵
                                    PID:5292
                                  • C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
                                    "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --app-user-model-id=com.bluestacks.services --app-path="C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2576 --field-trial-handle=1704,i,9443956761324426148,2580783378338492289,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
                                    2⤵
                                      PID:10568
                                    • C:\Windows\system32\cscript.exe
                                      cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
                                      2⤵
                                        PID:8668
                                      • C:\Windows\system32\cscript.exe
                                        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
                                        2⤵
                                          PID:8580
                                        • C:\Windows\system32\cscript.exe
                                          cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
                                          2⤵
                                            PID:8552
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                            2⤵
                                              PID:8536
                                              • C:\Windows\system32\tasklist.exe
                                                tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                3⤵
                                                • Enumerates processes with tasklist
                                                PID:9048
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                              2⤵
                                                PID:8504
                                                • C:\Windows\system32\tasklist.exe
                                                  tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                  3⤵
                                                  • Enumerates processes with tasklist
                                                  PID:9012
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                2⤵
                                                  PID:3860
                                                  • C:\Windows\system32\tasklist.exe
                                                    tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                    3⤵
                                                    • Enumerates processes with tasklist
                                                    PID:1528
                                                • C:\Windows\system32\cscript.exe
                                                  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
                                                  2⤵
                                                    PID:9124
                                                  • C:\Windows\system32\cscript.exe
                                                    cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
                                                    2⤵
                                                      PID:2784
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                      2⤵
                                                        PID:10900
                                                        • C:\Windows\system32\tasklist.exe
                                                          tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                          3⤵
                                                          • Enumerates processes with tasklist
                                                          PID:3984
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                        2⤵
                                                          PID:9388
                                                          • C:\Windows\system32\tasklist.exe
                                                            tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                            3⤵
                                                            • Enumerates processes with tasklist
                                                            PID:9416
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                          2⤵
                                                            PID:4544
                                                            • C:\Windows\system32\tasklist.exe
                                                              tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                              3⤵
                                                              • Enumerates processes with tasklist
                                                              PID:9492
                                                          • C:\Windows\system32\cscript.exe
                                                            cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
                                                            2⤵
                                                              PID:9600
                                                            • C:\Windows\system32\cscript.exe
                                                              cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
                                                              2⤵
                                                                PID:9644
                                                              • C:\Windows\system32\cscript.exe
                                                                cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
                                                                2⤵
                                                                  PID:9736
                                                                • C:\Windows\system32\cscript.exe
                                                                  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
                                                                  2⤵
                                                                    PID:9808
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                    2⤵
                                                                      PID:9848
                                                                      • C:\Windows\system32\tasklist.exe
                                                                        tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                        3⤵
                                                                        • Enumerates processes with tasklist
                                                                        PID:10116
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                      2⤵
                                                                        PID:10112
                                                                        • C:\Windows\system32\tasklist.exe
                                                                          tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                          3⤵
                                                                          • Enumerates processes with tasklist
                                                                          PID:10144
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                        2⤵
                                                                          PID:10764
                                                                          • C:\Windows\system32\tasklist.exe
                                                                            tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                            3⤵
                                                                            • Enumerates processes with tasklist
                                                                            PID:10948
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                          2⤵
                                                                            PID:10772
                                                                            • C:\Windows\system32\tasklist.exe
                                                                              tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                              3⤵
                                                                              • Enumerates processes with tasklist
                                                                              PID:10984
                                                                        • C:\Program Files (x86)\BlueStacks X\BlueStacks X.exe
                                                                          "C:\Program Files (x86)\BlueStacks X\BlueStacks X.exe" BlueStacksX:{}
                                                                          1⤵
                                                                            PID:10388

                                                                          Network

                                                                          MITRE ATT&CK Enterprise v15

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads

                                                                          • C:\Program Files (x86)\BlueStacks X\BlueStacks X.exe
                                                                            Filesize

                                                                            17KB

                                                                            MD5

                                                                            7b6ce88b70de63672b6f22693a0519b9

                                                                            SHA1

                                                                            9113e6d080905414b2e2678200675ec87150f7ec

                                                                            SHA256

                                                                            9751dd6d54f2fd39e7151be7f95215f9665f9687db93238d17397bc22cdca1ed

                                                                            SHA512

                                                                            902ea1194673da9612e1ca80a320dc5cd38c218f3b9c76080c8261fd5101a30dcbafb4a2ca20fcbc7ac62a957dccc6ca16476eca1e2ec5bf12640b5d6fb41579

                                                                            Download Submit

                                                                          • C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_disabled.svg
                                                                            Filesize

                                                                            569B

                                                                            MD5

                                                                            e7fdf6a9c8cae1fc1108dc5a803a1905

                                                                            SHA1

                                                                            2853f9ff5e63685ebb1449dcf693176b17e4ab60

                                                                            SHA256

                                                                            8ee5aa84139b2ea5549f7272523aeb203d73954c5ccdcf6f7407bf1a3469f13e

                                                                            SHA512

                                                                            a6388b24926934e20ccf7fcab41bd219dc6c0053428481d7f466bf89f26bf1a36fdff716a9ddd9ab268df73b04dff1449c6bac1f5c707e31ae2ee71c2087e0d9

                                                                            Download Submit

                                                                          • C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_hover.svg
                                                                            Filesize

                                                                            653B

                                                                            MD5

                                                                            76166804e6ce35e8a0c92917b8abc071

                                                                            SHA1

                                                                            8bd38726a11a9633ac937b9c6f205ce5d36348b0

                                                                            SHA256

                                                                            1bca2e912184b8168ee8961de68d1d839f4f9827fde6f48ab100fb61e82eff90

                                                                            SHA512

                                                                            93c4f1af7e9f89091a207ab308e05ddd4c92406c039f7465d3b8aca7e0cc7a6c922a22e1eee2f5c88db5e89016ef69294b2a0905d7d6a90fd32835bc11929005

                                                                            Download Submit

                                                                          • C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_normal.svg
                                                                            Filesize

                                                                            569B

                                                                            MD5

                                                                            3221ac69d7facd8aa90ffa15aea991b0

                                                                            SHA1

                                                                            e0571f30f4708ec78addc726a743679ca0f05e45

                                                                            SHA256

                                                                            92aeae68e9e0973d9e0dc575941f1cb2e24afd0574341a46b870be7384eaa537

                                                                            SHA512

                                                                            5e2de0abfe60a4db16ea5e8739260c19962fbfc60869a77bde6ab3547ad8ee3ad88e74e97da31fa23be096afddad018e431d152d6d0fa21a75357a11dacb1328

                                                                            Download Submit

                                                                          • C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_pressed.svg
                                                                            Filesize

                                                                            653B

                                                                            MD5

                                                                            dfddf8d0788988c3e48fcbfb2a76cd20

                                                                            SHA1

                                                                            463bb61f0012289e860c32f1885a3a8f57467f2e

                                                                            SHA256

                                                                            9585f41eb6202e89f2087266fa31852d7f41ca8cc659b907c96753fe165f937d

                                                                            SHA512

                                                                            e708c5114c60f7574589d6a56c9faedda26ee4a40f0eeb25f5e12eadcf790f24fdbf393fa0aa6ad449b5337d625b092d6f8822472fa8a6ce1339aca59c50c3ca

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\BlueStacks X\Log\log.txt
                                                                            Filesize

                                                                            768B

                                                                            MD5

                                                                            87ad77d94a7f2f95c843ead674874815

                                                                            SHA1

                                                                            19c594a8a17e86b4bb0ce350ee073e24ab40e441

                                                                            SHA256

                                                                            0437e224c7d2ac29088c38e7311c4a21c280311820594d195d7edb494f5575e6

                                                                            SHA512

                                                                            e02d1860315a42dcf00f8a621e292b60e8787e01a16af72ff27ae7791176bd84b89642d31cf314d39bebbadda07523985e639b69dd732de802dc354049f49c09

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\BlueStacks X\Log\log.txt
                                                                            Filesize

                                                                            1KB

                                                                            MD5

                                                                            60f76f5c98ff44f583077c15a221bed7

                                                                            SHA1

                                                                            f5ca80e3db4516570aca61a3533585ca89c0c897

                                                                            SHA256

                                                                            599c7081e55c8a5fbd60d9c1ac5181e8d21b3434ae7d96b05e3c4547d1482d44

                                                                            SHA512

                                                                            91b9f6a36b40d56df0f2105a596262cb64ce09ee4dda9d4c694529535cb997683180b1a0979ef3ab288864f002279174914206602c4ced07feafef15d54a93a7

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\BlueStacks X\Log\log.txt
                                                                            Filesize

                                                                            2KB

                                                                            MD5

                                                                            03c87cd0ea081a830e34f80f90669506

                                                                            SHA1

                                                                            4f8ac9551a136a13c807fc03fe41fccc26710bd3

                                                                            SHA256

                                                                            93036d8eaac5e7a28f5dd7c397123b545e7a1185020dca74ad62af617c49a711

                                                                            SHA512

                                                                            4053701a9869c6a56ffad98594f025c3856b5052ca238171008a65471699fb719ee749fd833c5aa0ceff5e8232bf1e14101e1d874cd8623155b72175c034e5a9

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.20.10.1003_nxt.exe
                                                                            Filesize

                                                                            1.6MB

                                                                            MD5

                                                                            4bc0add73baa3dcd77dd1671b855ec20

                                                                            SHA1

                                                                            98dff01b7b8025f47c21d7c0cac5d35baea43d0f

                                                                            SHA256

                                                                            9c03f12f85ebc314f7e4b07b78e11c982f99d8bd88d049a3751d9220078c7dfb

                                                                            SHA512

                                                                            1ae5340c41a81c4c3c5548464976f8107b988037a1b47ecf783f26f3830e461e71690e039e34953c18c275f09551ce5b3cb614a784198caa0a4dcaf229a95e91

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.20.10.1003_nxt.exe
                                                                            Filesize

                                                                            1.3MB

                                                                            MD5

                                                                            83072796c9c38726d6e1c095a0cd1d48

                                                                            SHA1

                                                                            478c93e7d4d0d1a34540d9121626a3ce8bd383b1

                                                                            SHA256

                                                                            5938fa176296f46633703786adf99aa5fd50ad95a3587c1fd6ba89110d616b60

                                                                            SHA512

                                                                            c777445caaa613767f1195b687be45791dcb2319d8e3e7c13943c4f878c73f24f204c2a5f92f3f8028eb8d6dba923d6094792d1015a1305fe25130228e7ca065

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
                                                                            Filesize

                                                                            69.0MB

                                                                            MD5

                                                                            abbe08bda87737c5c90b59cb4b32bed3

                                                                            SHA1

                                                                            c120558f0c08ff84795c69e501df9e2a4f91545f

                                                                            SHA256

                                                                            ef74248730c8c943c3ef2ab6799c6a038e435bd115e093fb3b57265b1347368b

                                                                            SHA512

                                                                            f358aa2af7978a4b0e0a8a123c717b6a14b67ef73375f28f7bd7de8aee53aea42e427de50a18da532bb62e29ea68698ff2f8400b47d4af737bbc046f7079af65

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS07D64DA7\Assets\backicon.png
                                                                            Filesize

                                                                            15KB

                                                                            MD5

                                                                            7ff5dc8270b5fa7ef6c4a1420bd67a7f

                                                                            SHA1

                                                                            b224300372feaa97d882ca2552b227c0f2ef4e3e

                                                                            SHA256

                                                                            fa64884054171515e97b78aaa1aad1ec5baa9d1daf9c682e0b3fb4a41a9cb1c1

                                                                            SHA512

                                                                            f0d5a842a01b99f189f3d46ab59d2c388a974951b042b25bbce54a15f5a3f386984d19cfca22ba1440eebd79260066a37dfeff6cb0d1332fca136add14488eef

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS07D64DA7\Assets\close_red.png
                                                                            Filesize

                                                                            15KB

                                                                            MD5

                                                                            93216b2f9d66d423b3e1311c0573332d

                                                                            SHA1

                                                                            5efaebec5f20f91f164f80d1e36f98c9ddaff805

                                                                            SHA256

                                                                            d0b6d143642d356b40c47459a996131a344cade6bb86158f1b74693426b09bfb

                                                                            SHA512

                                                                            922a7292de627c5e637818556d25d9842a88e89f2b198885835925679500dfd44a1e25ce79e521e63c4f84a6b0bd6bf98e46143ad8cee80ecdbaf3d3bc0f3a32

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS07D64DA7\Assets\custom.png
                                                                            Filesize

                                                                            17KB

                                                                            MD5

                                                                            03b17f0b1c067826b0fcc6746cced2cb

                                                                            SHA1

                                                                            e07e4434e10df4d6c81b55fceb6eca2281362477

                                                                            SHA256

                                                                            fbece8bb5f4dfa55dcfbf41151b10608af807b9477e99acf0940954a11e68f7b

                                                                            SHA512

                                                                            67c78ec01e20e9c8d9cdbba665bb2fd2bb150356f30b88d3d400bbdb0ae92010f5d7bcb683dcf6f895722a9151d8e669d8bef913eb6e728ba56bb02f264573b2

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS07D64DA7\Assets\error_icon_72.png
                                                                            Filesize

                                                                            1KB

                                                                            MD5

                                                                            4aaf83d2b3fd56ad806708e60474df39

                                                                            SHA1

                                                                            144777a265879b69fadea3eb3ac6939458918578

                                                                            SHA256

                                                                            84e59d14d9433e6c3d92daeb8c443063b5e3be6c0b297f0403dbde473a05cb3f

                                                                            SHA512

                                                                            3b8485f054fe6ed2374bc81cb1786f09741219fbfcb22503707b11cf5db1ab262ba4349633597d5d9ddabc3415b170fa8eebc932f58d211d7092b8fb96fa1304

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS07D64DA7\Assets\exit_close.png
                                                                            Filesize

                                                                            670B

                                                                            MD5

                                                                            26eb04b9e0105a7b121ea9c6601bbf2a

                                                                            SHA1

                                                                            efc08370d90c8173df8d8c4b122d2bb64c07ccd8

                                                                            SHA256

                                                                            7aaef329ba9fa052791d1a09f127551289641ea743baba171de55faa30ec1157

                                                                            SHA512

                                                                            9df3c723314d11a6b4ce0577eb61488061f2f96a9746a944eb6a4ee8c0c4d29131231a1b20988ef5454b79f9475b43d62c710839ecc0a9c98324f977cab6db68

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS07D64DA7\Assets\installer_bg.jpg
                                                                            Filesize

                                                                            78KB

                                                                            MD5

                                                                            3478e24ba1dd52c80a0ff0d43828b6b5

                                                                            SHA1

                                                                            b5b13bbf3fb645efb81d3562296599e76a2abac0

                                                                            SHA256

                                                                            4c7471c986e16de0cd451be27d4b3171e595fe2916b4b3bf7ca52df6ec368904

                                                                            SHA512

                                                                            5c8c9cc76d6dbc7ce482d0d1b6c2f3d48a7a510cd9ed01c191328763e1bccb56daeb3d18c33a9b10ac7c9780127007aa13799fa82d838de27fbe0a02ad98119d

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS07D64DA7\Assets\installer_logo.png
                                                                            Filesize

                                                                            14KB

                                                                            MD5

                                                                            e33432b5d6dafb8b58f161cf38b8f177

                                                                            SHA1

                                                                            d7f520887ce1bfa0a1abd49c5a7b215c24cbbf6a

                                                                            SHA256

                                                                            9f3104493216c1fa114ff935d23e3e41c7c3511792a30b10a40b507936c0d183

                                                                            SHA512

                                                                            520dc99f3176117ebc28da5ef5439b132486ef67d02fa17f28b7eab0c59db0fa99566e44c0ca7bb75c9e7bd5244e4a23d87611a55c841c6f9c9776e457fb1cbf

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS07D64DA7\Assets\installer_minimize.png
                                                                            Filesize

                                                                            113B

                                                                            MD5

                                                                            38b539a1e4229738e5c196eedb4eb225

                                                                            SHA1

                                                                            f027b08dce77c47aaed75a28a2fce218ff8c936c

                                                                            SHA256

                                                                            a064f417e3c2b8f3121a14bbded268b2cdf635706880b7006f931de31476bbc2

                                                                            SHA512

                                                                            2ce433689a94fae454ef65e0e9ec33657b89718bbb5a038bf32950f6d68722803922f3a427278bad432395a1716523e589463fcce4279dc2a895fd77434821cc

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS07D64DA7\Assets\link.png
                                                                            Filesize

                                                                            306B

                                                                            MD5

                                                                            ae2c73ee43d722c327c7fb6fdbee905c

                                                                            SHA1

                                                                            96f238bf53ac80f5b7a9ad6ef2531e8e3f274628

                                                                            SHA256

                                                                            28c0abc6bfe7a155815104883a37a53dd783d142300471064c95eddf3cae0eaf

                                                                            SHA512

                                                                            5a1e341f727cf1cb4832cced8e96c5a74971451629603c48bfb91ceb4561d0122ab9ae701f8b34681d5f13115a384467d430ccb8282494b40f4577ebc3ad825b

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS07D64DA7\Assets\loader.png
                                                                            Filesize

                                                                            279B

                                                                            MD5

                                                                            03903fd42ed2ee3cb014f0f3b410bcb4

                                                                            SHA1

                                                                            762a95240607fe8a304867a46bc2d677f494f5c2

                                                                            SHA256

                                                                            076263cc65f9824f4f82eb6beaa594d1df90218a2ee21664cf209181557e04b1

                                                                            SHA512

                                                                            8b0e717268590e5287c07598a06d89220c5e9a33cd1c29c55f8720321f4b3efc869d20c61fcc892e13188d77f0fdc4c73a2ee6dece174bf876fcc3a6c5683857

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS07D64DA7\Assets\minimize_progress.png
                                                                            Filesize

                                                                            212B

                                                                            MD5

                                                                            1504b80f2a6f2d3fefc305da54a2a6c2

                                                                            SHA1

                                                                            432a9d89ebc2f693836d3c2f0743ea5d2077848d

                                                                            SHA256

                                                                            2f62d4e8c643051093f907058dddc78cc525147d9c4f4a0d78b4d0e5c90979f6

                                                                            SHA512

                                                                            675db04baf3199c8d94af30a1f1c252830a56a90f633c3a72aa9841738b04242902a5e7c56dd792626338e8b7eabc1f359514bb3a2e62bc36c16919e196cfd94

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS07D64DA7\Assets\setpath.png
                                                                            Filesize

                                                                            15KB

                                                                            MD5

                                                                            b2e7f40179744c74fded932e829cb12a

                                                                            SHA1

                                                                            a0059ab8158a497d2cf583a292b13f87326ec3f0

                                                                            SHA256

                                                                            5bbb2f41f9f3a805986c3c88a639bcc22d90067d4b8de9f1e21e3cf9e5c1766b

                                                                            SHA512

                                                                            b95b7ebdb4a74639276eaa5c055fd8d9431e2f58a5f7c57303f7cf22e8b599f6f2a7852074cf71b19b49eb31cc9bf2509aedf41d608981d116e49a00030c797c

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS07D64DA7\Assets\unchecked_gray.png
                                                                            Filesize

                                                                            192B

                                                                            MD5

                                                                            e50df2a0768f7fc4c3fe8d784564fea3

                                                                            SHA1

                                                                            d1fc4db50fe8e534019eb7ce70a61fd4c954621a

                                                                            SHA256

                                                                            671f26795b12008fbea1943143f660095f3dca5d925f67d765e2352fd7ee2396

                                                                            SHA512

                                                                            c87a8308a73b17cbdd179737631fb1ba7fdaeb65e82263f6617727519b70a81266bb695867b9e599c1306ee2cf0de525452f77ce367ca89bf870ea3ae7189998

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS07D64DA7\BlueStacksInstaller.exe
                                                                            Filesize

                                                                            622KB

                                                                            MD5

                                                                            e17f025367db5a0c872d49887cf1a692

                                                                            SHA1

                                                                            3990603e2125ab444656db3b8d5ce8f584b6d77f

                                                                            SHA256

                                                                            131e6fc90940fab3af9a7048fc31eff2c300a1cc230d2d55e2f6516e12d947ac

                                                                            SHA512

                                                                            a46d665c995dda59e9a8e135e4916b9c96a660cb1da29466a15950e55cf09d56e19423f5c4c9d106a677269ca8a8422f886a482a82669b3a17243dec5bbe39a7

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS07D64DA7\BlueStacksInstaller.exe.config
                                                                            Filesize

                                                                            324B

                                                                            MD5

                                                                            1b456d88546e29f4f007cd0bf1025703

                                                                            SHA1

                                                                            e5c444fcfe5baf2ef71c1813afc3f2c1100cab86

                                                                            SHA256

                                                                            d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb

                                                                            SHA512

                                                                            c545e416c841b8786e4589fc9ca2b732b16cdd759813ec03f558332f2436f165ec1ad2fbc65012b5709fa19ff1e8396639c17bfad150cabeb51328a39ea556e6

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS07D64DA7\HD-CheckCpu.exe
                                                                            Filesize

                                                                            200KB

                                                                            MD5

                                                                            81234fd9895897b8d1f5e6772a1b38d0

                                                                            SHA1

                                                                            80b2fec4a85ed90c4db2f09b63bd8f37038db0d3

                                                                            SHA256

                                                                            2e14887f3432b4a313442247fc669f891dbdad7ef1a2d371466a2afa88074a4c

                                                                            SHA512

                                                                            4c924d6524dc2c7d834bfc1a0d98b21753a7bf1e94b1c2c6650f755e6f265512d3a963bc7bc745351f79f547add57c37e29ba9270707edbf62b60df3a541bc16

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS07D64DA7\JSON.dll
                                                                            Filesize

                                                                            411KB

                                                                            MD5

                                                                            f5fd966e29f5c359f78cb61a571d1be4

                                                                            SHA1

                                                                            a55e7ed593b4bc7a77586da0f1223cfd9d51a233

                                                                            SHA256

                                                                            d2c8d26f95f55431e632c8581154db7c19547b656380e051194a9d2583dd2156

                                                                            SHA512

                                                                            d99e6fe250bb106257f86135938635f6e7ad689b2c11a96bb274f4c4c5e9a85cfacba40122dbc953f77b5d33d886c6af30bff821f10945e15b21a24b66f6c8be

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS07D64DA7\Locales\i18n.en-US.txt
                                                                            Filesize

                                                                            19KB

                                                                            MD5

                                                                            db367e1d7bdd012a13ad503c10ce9f64

                                                                            SHA1

                                                                            440e54ac0de670a906c19ce655c121b4a6302528

                                                                            SHA256

                                                                            3d7c1f55ab295d712811940e9390c40181a24f175ab1f6360665fbcfccdb1d14

                                                                            SHA512

                                                                            7ae15fa35ee5bdbee0f2b71c2a67ef2575af77466704d0e496431091a1a7d198548b9d6df0d4355936d12844671f094e56ca9964a7d51c11cd46700f9fd980a3

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS07D64DA7\ThemeFile
                                                                            Filesize

                                                                            80KB

                                                                            MD5

                                                                            c3e6bab4f92ee40b9453821136878993

                                                                            SHA1

                                                                            94493a6b3dfb3135e5775b7d3be227659856fbc4

                                                                            SHA256

                                                                            de1a2e6b560e036da5ea6b042e29e81a5bfcf67dde89670c332fc5199e811ba6

                                                                            SHA512

                                                                            a64b6b06b3a0f3591892b60e59699682700f4018b898efe55d6bd5fb417965a55027671c58092d1eb7e21c2dbac42bc68dfb8c70468d98bed45a8cff0e945895

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\nso6597.tmp\Registry.dll
                                                                            Filesize

                                                                            24KB

                                                                            MD5

                                                                            2b7007ed0262ca02ef69d8990815cbeb

                                                                            SHA1

                                                                            2eabe4f755213666dbbbde024a5235ddde02b47f

                                                                            SHA256

                                                                            0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d

                                                                            SHA512

                                                                            aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\nso6597.tmp\StdUtils.dll
                                                                            Filesize

                                                                            100KB

                                                                            MD5

                                                                            c6a6e03f77c313b267498515488c5740

                                                                            SHA1

                                                                            3d49fc2784b9450962ed6b82b46e9c3c957d7c15

                                                                            SHA256

                                                                            b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

                                                                            SHA512

                                                                            9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\nso6597.tmp\System.dll
                                                                            Filesize

                                                                            12KB

                                                                            MD5

                                                                            0d7ad4f45dc6f5aa87f606d0331c6901

                                                                            SHA1

                                                                            48df0911f0484cbe2a8cdd5362140b63c41ee457

                                                                            SHA256

                                                                            3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

                                                                            SHA512

                                                                            c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\nso6597.tmp\WinShell.dll
                                                                            Filesize

                                                                            3KB

                                                                            MD5

                                                                            1cc7c37b7e0c8cd8bf04b6cc283e1e56

                                                                            SHA1

                                                                            0b9519763be6625bd5abce175dcc59c96d100d4c

                                                                            SHA256

                                                                            9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

                                                                            SHA512

                                                                            7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\nso6597.tmp\nsExec.dll
                                                                            Filesize

                                                                            6KB

                                                                            MD5

                                                                            ec0504e6b8a11d5aad43b296beeb84b2

                                                                            SHA1

                                                                            91b5ce085130c8c7194d66b2439ec9e1c206497c

                                                                            SHA256

                                                                            5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

                                                                            SHA512

                                                                            3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\nso6597.tmp\nsis7z.dll
                                                                            Filesize

                                                                            424KB

                                                                            MD5

                                                                            80e44ce4895304c6a3a831310fbf8cd0

                                                                            SHA1

                                                                            36bd49ae21c460be5753a904b4501f1abca53508

                                                                            SHA256

                                                                            b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

                                                                            SHA512

                                                                            c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\nsz758A.tmp\BgWorker.dll
                                                                            Filesize

                                                                            12KB

                                                                            MD5

                                                                            36c81676ada53ceb99e06693108d8cce

                                                                            SHA1

                                                                            d31fa4aebd584238b3edc4768dd5414494610889

                                                                            SHA256

                                                                            a9e4f7ec65670d2ce375ffaf09b6d07f4cd531132ca002452287a4d540154a38

                                                                            SHA512

                                                                            1300de7b3e1ac9e706e0aad0b70e3e2a21db8c860e05b314a52e63dd66b5dffdf6be1e38ab6ede13bfd3a64631cc909486bf4b1403e7d821e3b566edc514c63c

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\nsz758A.tmp\System.dll
                                                                            Filesize

                                                                            11KB

                                                                            MD5

                                                                            959ea64598b9a3e494c00e8fa793be7e

                                                                            SHA1

                                                                            40f284a3b92c2f04b1038def79579d4b3d066ee0

                                                                            SHA256

                                                                            03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b

                                                                            SHA512

                                                                            5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\nsz758A.tmp\nsDialogs.dll
                                                                            Filesize

                                                                            9KB

                                                                            MD5

                                                                            f7b92b78f1a00a872c8a38f40afa7d65

                                                                            SHA1

                                                                            872522498f69ad49270190c74cf3af28862057f2

                                                                            SHA256

                                                                            2bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e

                                                                            SHA512

                                                                            3ad6afa6269b48f238b48cf09eeefdef03b58bab4e25282c8c2887b4509856cf5cbb0223fbb06c822fb745aeea000dd1eee878df46ad0ba7f2ef520a7a607f79

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\nsz758A.tmp\nsDui.dll
                                                                            Filesize

                                                                            256KB

                                                                            MD5

                                                                            fad30df2efd685f8466f35616a0773f7

                                                                            SHA1

                                                                            ea839fb6e838dc4935d9a0aab53553b02e68e1d5

                                                                            SHA256

                                                                            5bd25e7c5af11a8ab93b5ab5141c2a481d98f71c0ba45b39923f10573cdc956a

                                                                            SHA512

                                                                            2821515dc95f0cdcd085e61753545d27d84ea38d963b68691964035cfa11be9b341b98ebba4a372476088a59dc8ca121240fa5740803585944cfe9673fda5fce

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\nsz758A.tmp\nsis7z.dll
                                                                            Filesize

                                                                            434KB

                                                                            MD5

                                                                            95f6f6ab9509bc366ab9215defe4251a

                                                                            SHA1

                                                                            e3f4a6effd6ca5838cfe91a01967cb72edcc7b0b

                                                                            SHA256

                                                                            a896a9ece055d334d431cd0f856113ab925d9ee86d2dee383c0bfbbef11a5b50

                                                                            SHA512

                                                                            a853f70d2ea7f384df99be067724bf3ca73c63f3c3573c112f5528fc86a96bd34509d934b038e2a81833f3abb3eedbc5894921291139100e01df6e35696c0ecc

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                            Filesize

                                                                            2B

                                                                            MD5

                                                                            f3b25701fe362ec84616a93a45ce9998

                                                                            SHA1

                                                                            d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                                                            SHA256

                                                                            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                                                            SHA512

                                                                            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json
                                                                            Filesize

                                                                            920B

                                                                            MD5

                                                                            689946672e463cce7e99299665f009f3

                                                                            SHA1

                                                                            61a49b93c91ff0cc087a353beb03e991f7184e90

                                                                            SHA256

                                                                            2c84c2f79f53222f34ef5a04d207f907d7408edbfee6643b4924fa3e4aa1ea38

                                                                            SHA512

                                                                            c11093b0a330c7f2c31f426236e3ec4054389463952bc6e14cac859d642c01e8f22a0a6a4bf554e8f926e8f68a5a732a1de02737170e5d57dd4d11757091be09

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json
                                                                            Filesize

                                                                            57B

                                                                            MD5

                                                                            94dfcc62625e5904f2624bc30bcd412b

                                                                            SHA1

                                                                            31abbbce802d32b77939defa6ab407b98169a3c2

                                                                            SHA256

                                                                            e547e690251cfd702cc80b92b037a3989046ed222c2803a7ea2f8ab6b19f0989

                                                                            SHA512

                                                                            1a0e8709515b1ff81d1fadefda1a67202ae494dacc9cc1ea26aeacab3375d88efe3974591e2050395d7ffb56cfbd9d987e67edd2b9f5d3b9fbbaf650e71531a4

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json
                                                                            Filesize

                                                                            119B

                                                                            MD5

                                                                            08892bdb7b7836022adb9c25d7dd0e1d

                                                                            SHA1

                                                                            357c1eb048f8df0f01457666341e6fd91295c86b

                                                                            SHA256

                                                                            c6acb7fa3b0bda6937bae256886d335f91d0a898c7f73a0963e9fe0a4112f45b

                                                                            SHA512

                                                                            2744bc8ce2b9cab8e4c20c1edb4f6f294e1494502bcb10bb12cbcad97413e017ddbfbc782b1b88f4da10d7d0c1d511033d6a50440e4e5792d8c5c1b11bf27781

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json
                                                                            Filesize

                                                                            950B

                                                                            MD5

                                                                            0a92f8f2d33053d82535ca38b18bbd3c

                                                                            SHA1

                                                                            e7fe9a215eef75602fcb406ce34a5167558feaa9

                                                                            SHA256

                                                                            eb34ff3993fb245d9faa79a9755dcbe08f780629e6f28ce278f14df9cfec02e8

                                                                            SHA512

                                                                            7a1eae65133d9031aa1e8e9a3b11ee27d8ad1a4793223551189574b38bc62d75e2132e1232e0b4b814cc7f750feef1d2bfcff730c74c5d113cc65dd89f5eda34

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json.tmp-60166375929c3eae
                                                                            Filesize

                                                                            92B

                                                                            MD5

                                                                            5eddfe82b20df9090fb93cdf1be35798

                                                                            SHA1

                                                                            9dd7b3e5b01d552fed33240118be7d132184e87b

                                                                            SHA256

                                                                            564554153adb7ec5e00ed5306d26eaa95cf533e4f9dfe06b3cdfdfc5a6ed579a

                                                                            SHA512

                                                                            c1a64e5c76dfe0dcf56921ddb77e6e5939c58895c8b796bdbc450fbc75f4d30e5caaab49987e1edc1a1ca4d9702c7d2f6624dd97fb877595d5ab2991b36f69d6

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json.tmp-6016648651668cbc
                                                                            Filesize

                                                                            1KB

                                                                            MD5

                                                                            d49c63fa27180881e97d5798f3a38fb1

                                                                            SHA1

                                                                            f5e5d7d4228bcd7d09969448e3fc75b1ccedade3

                                                                            SHA256

                                                                            fe58b518081e8fb10e34f16228e0c6e318c2f2d7e1237400a936187904f2e989

                                                                            SHA512

                                                                            161ff12414743118365502ab08e0ac5761fe2cf370c6ebad58a313ca4c01e4af218bdedf3dc8ca00d75d51bb89556456842bd9d1f9d0cfec6f245f731764d9e2

                                                                            Download Submit

                                                                          • memory/840-127-0x000000001B920000-0x000000001B930000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                            Download

                                                                          • memory/840-147-0x000000001B920000-0x000000001B930000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                            Download

                                                                          • memory/840-119-0x0000000000AB0000-0x0000000000B4E000-memory.dmp

                                                                            Filesize

                                                                            632KB

                                                                            Download

                                                                          • memory/840-136-0x000000001B920000-0x000000001B930000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                            Download

                                                                          • memory/840-138-0x000000001C2F0000-0x000000001C2FE000-memory.dmp

                                                                            Filesize

                                                                            56KB

                                                                            Download

                                                                          • memory/840-137-0x000000001C320000-0x000000001C358000-memory.dmp

                                                                            Filesize

                                                                            224KB

                                                                            Download

                                                                          • memory/840-133-0x000000001CD50000-0x000000001D278000-memory.dmp

                                                                            Filesize

                                                                            5.2MB

                                                                            Download

                                                                          • memory/840-128-0x000000001B920000-0x000000001B930000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                            Download

                                                                          • memory/840-148-0x0000000002D10000-0x0000000002D18000-memory.dmp

                                                                            Filesize

                                                                            32KB

                                                                            Download

                                                                          • memory/840-123-0x000000001B8B0000-0x000000001B918000-memory.dmp

                                                                            Filesize

                                                                            416KB

                                                                            Download

                                                                          • memory/840-13492-0x00007FFE231D0000-0x00007FFE23C92000-memory.dmp

                                                                            Filesize

                                                                            10.8MB

                                                                            Download

                                                                          • memory/840-120-0x00007FFE231D0000-0x00007FFE23C92000-memory.dmp

                                                                            Filesize

                                                                            10.8MB

                                                                            Download

                                                                          • memory/840-121-0x000000001B920000-0x000000001B930000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                            Download

                                                                          • memory/840-146-0x000000001B920000-0x000000001B930000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                            Download

                                                                          • memory/840-143-0x00007FFE231D0000-0x00007FFE23C92000-memory.dmp

                                                                            Filesize

                                                                            10.8MB

                                                                            Download

                                                                          • memory/840-145-0x000000001B920000-0x000000001B930000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                            Download

                                                                          • memory/840-144-0x000000001B920000-0x000000001B930000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                            Download

                                                                          • memory/4436-13279-0x00007FFE231D0000-0x00007FFE23C92000-memory.dmp

                                                                            Filesize

                                                                            10.8MB

                                                                            Download

                                                                          • memory/4436-13340-0x000000001AEA0000-0x000000001AEB0000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                            Download

                                                                          • memory/4436-13343-0x000000001AEA0000-0x000000001AEB0000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                            Download

                                                                          • memory/4436-13344-0x000000001AEA0000-0x000000001AEB0000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                            Download

                                                                          • memory/4436-12758-0x000000001AEA0000-0x000000001AEB0000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                            Download

                                                                          • memory/4436-13424-0x00007FFE231D0000-0x00007FFE23C92000-memory.dmp

                                                                            Filesize

                                                                            10.8MB

                                                                            Download

                                                                          • memory/4436-12756-0x000000001AEA0000-0x000000001AEB0000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                            Download

                                                                          • memory/4436-12755-0x00007FFE231D0000-0x00007FFE23C92000-memory.dmp

                                                                            Filesize

                                                                            10.8MB

                                                                            Download

                                                                          • memory/4436-12759-0x000000001AEA0000-0x000000001AEB0000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                            Download

                                                                          • memory/10388-13473-0x00000000029E0000-0x00000000029F0000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                            Download

                                                                          • memory/10568-13284-0x00007FFE439F0000-0x00007FFE439F1000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/10568-13280-0x00007FFE43C20000-0x00007FFE43C21000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download