Malware Analysis Report

2025-08-10 12:06

Sample ID 240222-zqqdwafa8y
Target bluestacks-app-player-5-10-220-1008.exe
SHA256 0dea8d9c4d6d02eb64746fe2faee139f67a50168be426cb88c8943fcd554f999
Tags
discovery evasion
score
6/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
6/10

SHA256

0dea8d9c4d6d02eb64746fe2faee139f67a50168be426cb88c8943fcd554f999

Threat Level: Shows suspicious behavior

The file bluestacks-app-player-5-10-220-1008.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery evasion

Modifies Windows Firewall

Drops file in Program Files directory

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-22 20:55

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-22 20:55

Reported

2024-02-22 20:58

Platform

win11-20240221-en

Max time kernel

145s

Max time network

107s

Command Line

"C:\Users\Admin\AppData\Local\Temp\bluestacks-app-player-5-10-220-1008.exe"

Signatures

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\BlueStacks X\cef\locales\zh-CN.pak C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_hover.svg C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\translations\qtwebengine_locales\hr.pak C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\cef\d3dcompiler_47.dll C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\msvcp140_atomic_wait.dll C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\image\MyGames\next_enable.svg C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File created C:\Program Files (x86)\BlueStacks X\image\Promote\RolePlayingL.png C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\translations\qtwebengine_locales\bg.pak C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\plugins\audio_filter\libequalizer_plugin.dll C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\plugins\audio_output\libmmdevice_plugin.dll C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File created C:\Program Files (x86)\BlueStacks X\plugins\audio_output\libamem_plugin.dll C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\plugins\mux\libmux_mpjpeg_plugin.dll C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\xplugins\PcGamesPlugin.dll C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File created C:\Program Files (x86)\BlueStacks X\cef\icudtl.dat C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\cef\locales\sl.pak C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\image\Gallery\close_normal.svg C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\translations\qtwebengine_locales\pt-PT.pak C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\plugins\access\libftp_plugin.dll C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\cef\locales\pl.pak C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File created C:\Program Files (x86)\BlueStacks X\api-ms-win-crt-conio-l1-1-0.dll C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File created C:\Program Files (x86)\BlueStacks X\plugins\audio_filter\libaudio_format_plugin.dll C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\plugins\video_chroma\libyuy2_i422_plugin.dll C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File created C:\Program Files (x86)\BlueStacks X\xplugins\AccountPlugin.dll C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File created C:\Program Files (x86)\BlueStacks X\image\browser_loading.gif C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\image\settings\remove_pressed.svg C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\plugins\stream_filter\libadf_plugin.dll C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\Qt5WebChannel.dll C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\language C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File created C:\Program Files (x86)\BlueStacks X\image\account\Choose_img7.png C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File created C:\Program Files (x86)\BlueStacks X\image\checkBox\checked_hover.svg C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File created C:\Program Files (x86)\BlueStacks X\translations\qtwebengine_locales\ja.pak C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File created C:\Program Files (x86)\BlueStacks X\plugins\audio_filter\libscaletempo_pitch_plugin.dll C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\image\MyGames\addApk_hover.svg C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\image\MyGames\NavigatorForward_Click.svg C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File created C:\Program Files (x86)\BlueStacks X\cef\libEGL.dll C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File created C:\Program Files (x86)\BlueStacks X\plugins\lua\liblua_plugin.dll C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\plugins\video_filter\libgrain_plugin.dll C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\image\account\Default_login_img.svg C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File created C:\Program Files (x86)\BlueStacks X\image\account\facebook.svg C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\image\checkBox\uncheck_normal.svg C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File created C:\Program Files (x86)\BlueStacks X\plugins\access\libdvdnav_plugin.dll C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File created C:\Program Files (x86)\BlueStacks X\plugins\video_chroma\libi420_yuy2_mmx_plugin.dll C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File created C:\Program Files (x86)\BlueStacks X\7z.dll C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\plugins\codec\libavcodec_plugin.dll C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File created C:\Program Files (x86)\BlueStacks X\image\account\icon_ photoicon_camera.svg C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\image\Promote\EditorS.png C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File created C:\Program Files (x86)\BlueStacks X\image\Search\SearchClose_hover.svg C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\image\TypeIndicator\AndroidGame_on.svg C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File created C:\Program Files (x86)\BlueStacks X\translations\qtwebengine_locales\el.pak C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\plugins\video_output\libyuv_plugin.dll C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\xplugins\CommandLinePlugin.dll C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\cef\locales\ko.pak C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File created C:\Program Files (x86)\BlueStacks X\image\TypeIndicator\CS_on.svg C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\plugins\audio_filter\libscaletempo_pitch_plugin.dll C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File created C:\Program Files (x86)\BlueStacks X\plugins\aws\aws-crt-cpp.dll C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File created C:\Program Files (x86)\BlueStacks X\plugins\mux\libmux_mpjpeg_plugin.dll C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File created C:\Program Files (x86)\BlueStacks X\cef\locales\tr.pak C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File created C:\Program Files (x86)\BlueStacks X\image\account\to.svg C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File opened for modification C:\Program Files (x86)\BlueStacks X\image\error.svg C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File created C:\Program Files (x86)\BlueStacks X\image\MyGames\addApk.svg C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File created C:\Program Files (x86)\BlueStacks X\plugins\access\libaccess_concat_plugin.dll C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File created C:\Program Files (x86)\BlueStacks X\plugins\video_filter\libmagnify_plugin.dll C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File created C:\Program Files (x86)\BlueStacks X\Qt5Svg.dll C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
File created C:\Program Files (x86)\BlueStacks X\Qt5Widgets.dll C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X\ = "URL:BlueStacks X Protocol Handler" C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X\URL Protocol C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X\DefaultIcon C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X\shell C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X\shell\open C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X\DefaultIcon\ = "C:\\Program Files (x86)\\BlueStacks X\\BlueStacks X.exe,0" C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X\shell\ C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X\shell\open\ C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X\shell\open\command C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacks X\shell\open\command\ = "\"C:\\Program Files (x86)\\BlueStacks X\\BlueStacks X.exe\" -open \"%1\"" C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\BlueStacksInstaller.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\BlueStacksInstaller.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zS00B229D8\BlueStacksInstaller.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1252 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\bluestacks-app-player-5-10-220-1008.exe C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\BlueStacksInstaller.exe
PID 1252 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\bluestacks-app-player-5-10-220-1008.exe C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\BlueStacksInstaller.exe
PID 2640 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\BlueStacksInstaller.exe C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\HD-CheckCpu.exe
PID 2640 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\BlueStacksInstaller.exe C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\HD-CheckCpu.exe
PID 2640 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\BlueStacksInstaller.exe C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\HD-CheckCpu.exe
PID 2640 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\BlueStacksInstaller.exe C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\HD-CheckCpu.exe
PID 2640 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\BlueStacksInstaller.exe C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\HD-CheckCpu.exe
PID 2640 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\BlueStacksInstaller.exe C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\HD-CheckCpu.exe
PID 2640 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\BlueStacksInstaller.exe C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe
PID 2640 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\BlueStacksInstaller.exe C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe
PID 2640 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\BlueStacksInstaller.exe C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe
PID 3668 wrote to memory of 3808 N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe C:\Windows\SysWOW64\WScript.exe
PID 3668 wrote to memory of 3808 N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe C:\Windows\SysWOW64\WScript.exe
PID 3668 wrote to memory of 3808 N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe C:\Windows\SysWOW64\WScript.exe
PID 3808 wrote to memory of 3440 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3808 wrote to memory of 3440 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3808 wrote to memory of 3440 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3440 wrote to memory of 4208 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 3440 wrote to memory of 4208 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 3440 wrote to memory of 4208 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 3440 wrote to memory of 3000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 3440 wrote to memory of 3000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 3440 wrote to memory of 3000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 3440 wrote to memory of 4664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 3440 wrote to memory of 4664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 3440 wrote to memory of 4664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 3440 wrote to memory of 4628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 3440 wrote to memory of 4628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 3440 wrote to memory of 4628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2640 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\BlueStacksInstaller.exe C:\Users\Admin\AppData\Local\BlueStacksSetup\bluestacks-app-player-5-10-220-1008.exe
PID 2640 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\BlueStacksInstaller.exe C:\Users\Admin\AppData\Local\BlueStacksSetup\bluestacks-app-player-5-10-220-1008.exe
PID 2640 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\BlueStacksInstaller.exe C:\Users\Admin\AppData\Local\BlueStacksSetup\bluestacks-app-player-5-10-220-1008.exe
PID 2816 wrote to memory of 6320 N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\bluestacks-app-player-5-10-220-1008.exe C:\Users\Admin\AppData\Local\Temp\7zS00B229D8\BlueStacksInstaller.exe
PID 2816 wrote to memory of 6320 N/A C:\Users\Admin\AppData\Local\BlueStacksSetup\bluestacks-app-player-5-10-220-1008.exe C:\Users\Admin\AppData\Local\Temp\7zS00B229D8\BlueStacksInstaller.exe
PID 6320 wrote to memory of 720 N/A C:\Users\Admin\AppData\Local\Temp\7zS00B229D8\BlueStacksInstaller.exe C:\Users\Admin\AppData\Local\Temp\7zS00B229D8\HD-CheckCpu.exe
PID 6320 wrote to memory of 720 N/A C:\Users\Admin\AppData\Local\Temp\7zS00B229D8\BlueStacksInstaller.exe C:\Users\Admin\AppData\Local\Temp\7zS00B229D8\HD-CheckCpu.exe
PID 6320 wrote to memory of 720 N/A C:\Users\Admin\AppData\Local\Temp\7zS00B229D8\BlueStacksInstaller.exe C:\Users\Admin\AppData\Local\Temp\7zS00B229D8\HD-CheckCpu.exe

Processes

C:\Users\Admin\AppData\Local\Temp\bluestacks-app-player-5-10-220-1008.exe

"C:\Users\Admin\AppData\Local\Temp\bluestacks-app-player-5-10-220-1008.exe"

C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\BlueStacksInstaller.exe

"C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\BlueStacksInstaller.exe"

C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\HD-CheckCpu.exe

"C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\HD-CheckCpu.exe" --cmd checkHypervEnabled

C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\HD-CheckCpu.exe

"C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\HD-CheckCpu.exe" --cmd checkSSE4

C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe

"C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe" -s

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\BlueStacks X\green.vbs"

C:\Windows\SysWOW64\netsh.exe

netsh advfirewall firewall delete rule name="BlueStacksWeb"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c green.bat

C:\Windows\SysWOW64\netsh.exe

netsh advfirewall firewall delete rule name="Cloud Game"

C:\Windows\SysWOW64\netsh.exe

netsh advfirewall firewall add rule name="BlueStacksWeb" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\BlueStacksWeb.exe"

C:\Windows\SysWOW64\netsh.exe

netsh advfirewall firewall add rule name="Cloud Game" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\Cloud Game.exe"

C:\Users\Admin\AppData\Local\BlueStacksSetup\bluestacks-app-player-5-10-220-1008.exe

"C:\Users\Admin\AppData\Local\BlueStacksSetup\bluestacks-app-player-5-10-220-1008.exe" -versionMachineID=990e7948-d7a7-497a-9a44-5bc28b0a0a76 -machineID=b5896458-bff5-45a8-8dba-cd23683de7cd -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Nougat32 -imageToLaunch=Nougat32 -isSSE4Available=1 -appToLaunch=bs5 -bsxVersion=10.0.1.1003 -country=GB

C:\Users\Admin\AppData\Local\Temp\7zS00B229D8\BlueStacksInstaller.exe

"C:\Users\Admin\AppData\Local\Temp\7zS00B229D8\BlueStacksInstaller.exe" -versionMachineID=990e7948-d7a7-497a-9a44-5bc28b0a0a76 -machineID=b5896458-bff5-45a8-8dba-cd23683de7cd -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Nougat32 -imageToLaunch=Nougat32 -isSSE4Available=1 -appToLaunch=bs5 -bsxVersion=10.0.1.1003 -country=GB

C:\Users\Admin\AppData\Local\Temp\7zS00B229D8\HD-CheckCpu.exe

"C:\Users\Admin\AppData\Local\Temp\7zS00B229D8\HD-CheckCpu.exe" --cmd checkHypervEnabled

Network

Country Destination Domain Proto
US 8.8.8.8:53 cloud.bluestacks.com udp
US 34.160.86.181:443 cloud.bluestacks.com tcp
US 34.160.86.181:443 cloud.bluestacks.com tcp
US 8.8.8.8:53 181.86.160.34.in-addr.arpa udp
US 34.96.124.47:443 wallet.now.gg tcp
GB 104.91.71.132:443 cdn-bgp.bluestacks.com tcp
DE 52.85.92.110:443 cdn3.bluestacks.com tcp
GB 104.91.71.133:443 ak-build.bluestacks.com tcp
US 34.160.86.181:443 cloud.bluestacks.com tcp
US 34.160.86.181:443 cloud.bluestacks.com tcp
N/A 127.0.0.1:49932 tcp
N/A 127.0.0.1:49945 tcp
US 34.160.86.181:443 cloud.bluestacks.com tcp
N/A 127.0.0.1:59827 tcp
US 34.160.86.181:443 cloud.bluestacks.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\BlueStacksInstaller.exe

MD5 dd8c6a226eb25dc74b9b6cbb0ed9323a
SHA1 3529c21d0aecc9378ef977a99e35e8d281660dac
SHA256 97eb6baf91e43397f01451cef98860e7fb9741eb329072e6795312ed58da8a7a
SHA512 f3f30efbbb2ea7d1b563946a5a3e10d535fc04b23eba941832f51295c3bf37b445ade0ab34d7fe7ed8b7b6bd3d049cb1cf1c0bdfa9d3fb1a49eb4b6a3d5d8087

C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\BlueStacksInstaller.exe.config

MD5 1b456d88546e29f4f007cd0bf1025703
SHA1 e5c444fcfe5baf2ef71c1813afc3f2c1100cab86
SHA256 d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb
SHA512 c545e416c841b8786e4589fc9ca2b732b16cdd759813ec03f558332f2436f165ec1ad2fbc65012b5709fa19ff1e8396639c17bfad150cabeb51328a39ea556e6

memory/2640-117-0x0000000000FE0000-0x0000000001072000-memory.dmp

memory/2640-118-0x00007FFD5A960000-0x00007FFD5B422000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\JSON.dll

MD5 f5fd966e29f5c359f78cb61a571d1be4
SHA1 a55e7ed593b4bc7a77586da0f1223cfd9d51a233
SHA256 d2c8d26f95f55431e632c8581154db7c19547b656380e051194a9d2583dd2156
SHA512 d99e6fe250bb106257f86135938635f6e7ad689b2c11a96bb274f4c4c5e9a85cfacba40122dbc953f77b5d33d886c6af30bff821f10945e15b21a24b66f6c8be

memory/2640-120-0x000000001BD70000-0x000000001BDD8000-memory.dmp

memory/2640-121-0x000000001BD60000-0x000000001BD70000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\Locales\i18n.en-US.txt

MD5 d8316371294c2e3fd9cded40261e0e17
SHA1 39a33c431d2a5085fa421f7183cd705d8282d010
SHA256 2b8f16a7ba900b7d5602697c2a028cf4a55f451394ef36ad1b83fe94aa5f534d
SHA512 98e55fdaec682e1ac92386115862a17df2ba14f6991125b548bcd1699ecf88043ba26ad28772434a9e25e50f46ed24ffd03414ce4f01be630b2daf15e4ad55e8

C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\HD-CheckCpu.exe

MD5 764ac83167adcd8d2273f6bff7d769b2
SHA1 bf6a46b8c03d7efb16fdd6e4ce0a5e4362f41957
SHA256 e81e0444ba2deb4056872d1c4f9b01971bb4fb376c6434c942718da7c39190bf
SHA512 a3a484aaf5cfdff1c198c37f3055409dc066646db3d61e74bfef2b4ce212d95fd43d3e3b239e080ba9fab62eae23cd4b54b6b466fad3192845b43d4212ccd667

memory/2640-126-0x000000001BD60000-0x000000001BD70000-memory.dmp

memory/2640-127-0x000000001BD60000-0x000000001BD70000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\Assets\loader.png

MD5 03903fd42ed2ee3cb014f0f3b410bcb4
SHA1 762a95240607fe8a304867a46bc2d677f494f5c2
SHA256 076263cc65f9824f4f82eb6beaa594d1df90218a2ee21664cf209181557e04b1
SHA512 8b0e717268590e5287c07598a06d89220c5e9a33cd1c29c55f8720321f4b3efc869d20c61fcc892e13188d77f0fdc4c73a2ee6dece174bf876fcc3a6c5683857

memory/2640-131-0x000000001D250000-0x000000001D778000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\ThemeFile

MD5 c3e6bab4f92ee40b9453821136878993
SHA1 94493a6b3dfb3135e5775b7d3be227659856fbc4
SHA256 de1a2e6b560e036da5ea6b042e29e81a5bfcf67dde89670c332fc5199e811ba6
SHA512 a64b6b06b3a0f3591892b60e59699682700f4018b898efe55d6bd5fb417965a55027671c58092d1eb7e21c2dbac42bc68dfb8c70468d98bed45a8cff0e945895

memory/2640-134-0x000000001F900000-0x000000001F938000-memory.dmp

memory/2640-133-0x000000001BD60000-0x000000001BD70000-memory.dmp

memory/2640-135-0x000000001C850000-0x000000001C85E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\Assets\installer_minimize.png

MD5 38b539a1e4229738e5c196eedb4eb225
SHA1 f027b08dce77c47aaed75a28a2fce218ff8c936c
SHA256 a064f417e3c2b8f3121a14bbded268b2cdf635706880b7006f931de31476bbc2
SHA512 2ce433689a94fae454ef65e0e9ec33657b89718bbb5a038bf32950f6d68722803922f3a427278bad432395a1716523e589463fcce4279dc2a895fd77434821cc

C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\Assets\close_red.png

MD5 93216b2f9d66d423b3e1311c0573332d
SHA1 5efaebec5f20f91f164f80d1e36f98c9ddaff805
SHA256 d0b6d143642d356b40c47459a996131a344cade6bb86158f1b74693426b09bfb
SHA512 922a7292de627c5e637818556d25d9842a88e89f2b198885835925679500dfd44a1e25ce79e521e63c4f84a6b0bd6bf98e46143ad8cee80ecdbaf3d3bc0f3a32

C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\Assets\installer_logo.png

MD5 d6f746b61d5c91d6688faab54ecc74c3
SHA1 9581cafbc93d6189c7e0633bd43dfd017510f731
SHA256 ed7e205b0ccdd454d4fa47c48834ad36a6e9fb51f4042a2dcd39a7fe01244d95
SHA512 0139711388976628ebd46a2f1dc7e0c38184d3b4ab63a8f2b6c8cd9e6032cddcd2dafb8ce4ab3ba8008beba9d6c3e444577cd7953bb48e39635e5c9666fdf478

C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\Assets\custom.png

MD5 03b17f0b1c067826b0fcc6746cced2cb
SHA1 e07e4434e10df4d6c81b55fceb6eca2281362477
SHA256 fbece8bb5f4dfa55dcfbf41151b10608af807b9477e99acf0940954a11e68f7b
SHA512 67c78ec01e20e9c8d9cdbba665bb2fd2bb150356f30b88d3d400bbdb0ae92010f5d7bcb683dcf6f895722a9151d8e669d8bef913eb6e728ba56bb02f264573b2

C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\Assets\checked_gray.png

MD5 ce144d2aab3bf213af693d4e18f87a59
SHA1 df59dc3dbba88bdc5ffc25f2e5e7b73ac3de5afa
SHA256 d8e502fab00b0c6f06ba6abede6922ab3b423fe6f2d2f56941dabc887b229ad3
SHA512 0f930edd485a0d49ef157f6cc8856609c087c91b77845adeb5cc8c8a80ebc7ec5416df351ffa1af780caad884dbb49dcc778b0b30de6fb7c85ffef22d7220ebe

C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\Assets\unchecked_gray.png

MD5 e50df2a0768f7fc4c3fe8d784564fea3
SHA1 d1fc4db50fe8e534019eb7ce70a61fd4c954621a
SHA256 671f26795b12008fbea1943143f660095f3dca5d925f67d765e2352fd7ee2396
SHA512 c87a8308a73b17cbdd179737631fb1ba7fdaeb65e82263f6617727519b70a81266bb695867b9e599c1306ee2cf0de525452f77ce367ca89bf870ea3ae7189998

C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\Assets\setpath.png

MD5 b2e7f40179744c74fded932e829cb12a
SHA1 a0059ab8158a497d2cf583a292b13f87326ec3f0
SHA256 5bbb2f41f9f3a805986c3c88a639bcc22d90067d4b8de9f1e21e3cf9e5c1766b
SHA512 b95b7ebdb4a74639276eaa5c055fd8d9431e2f58a5f7c57303f7cf22e8b599f6f2a7852074cf71b19b49eb31cc9bf2509aedf41d608981d116e49a00030c797c

C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\Assets\backicon.png

MD5 7ff5dc8270b5fa7ef6c4a1420bd67a7f
SHA1 b224300372feaa97d882ca2552b227c0f2ef4e3e
SHA256 fa64884054171515e97b78aaa1aad1ec5baa9d1daf9c682e0b3fb4a41a9cb1c1
SHA512 f0d5a842a01b99f189f3d46ab59d2c388a974951b042b25bbce54a15f5a3f386984d19cfca22ba1440eebd79260066a37dfeff6cb0d1332fca136add14488eef

memory/2640-146-0x0000000020630000-0x0000000020638000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zS4E425B47\Assets\installer_bg.jpg

MD5 162c23f5962381efba79be503b41089c
SHA1 fc5a95e6eb2bb015fe27457873528c24b3bc459d
SHA256 04d70d0968675290294df78800ed48fe4a681a72803405fbdc541b927b445457
SHA512 9bd6e634d6cb362ab40f2646ca59a865f05e6049ac55b9d03b3df1f8e853715119438771196a351ca98c6cb61a212bbc0bedb7bf2d306563f6198353a7680c54

memory/2640-159-0x00007FFD5A960000-0x00007FFD5B422000-memory.dmp

C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe

MD5 03d3742b61d67372d3e99cb408b8ab4a
SHA1 253db688467420f44ab58a253f37d71e1fa3fa82
SHA256 85a1c92b986ab43aeb2137024029b9d4bcfcf638c195664b6f2ba849279689dc
SHA512 bf930dd19ab48958b2b7093b5ca19f40980d1d707a22f4ec81b278af76bf21504c81ee6b777ceada44dd814f0b0935d43e581261cb152349262ed7686fbda00b

C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.10.220.1008.exe

MD5 06b8114a2c57181b44a02ad8e10981a1
SHA1 040a736b651a4651eda1d0436e4ff5623290d39e
SHA256 1cae158ecbc9361e285428665beb45fde08bd72e88b674a9ea8bb19406a5fb50
SHA512 96be67c93c934b589e67a99994a53f7bf9fe98cbddde19303ee2ceb5d1a4ea5e251ab4d23a4559e45b068404b022447bc15edf7f31185da271b5dd6297d775cd

C:\Users\Admin\AppData\Local\Temp\nsbC862.tmp\BgWorker.dll

MD5 4908fd4ede7b20e3bddb898a4b1dfe87
SHA1 9eb6b8adea38282ea5e113d86179b15d71f270d7
SHA256 b7997801ed63a13e23b0f93f1efd36e8b1d0259a3da7f1932c90a869c2295d58
SHA512 478f868c5f72dc54ce31f89eaec6539d0c149bc272ad300d83b61296589ad847001e5c31cf0d5c3f831bfbba3bca3e8469e0c84edf1ef625ef0486ebf6a69c43

memory/2640-170-0x000000001BD60000-0x000000001BD70000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsbC862.tmp\nsDui.dll

MD5 c2d5fa0c27dbcd8db6ea3f6e85774b9f
SHA1 33f6fa4574c4e6b914280316e41f38a44d1b081e
SHA256 f0b6f0b252f88546646890489cf1a6295b1fdfc5272e0c1e1b78951cb9b0421c
SHA512 02830f7f1d91a8c4e80ae13dbb569bced4330995907277fd89c5357e245456466a35b5f0dc1355ac3c512c71e1413c8a4cd50a4fe74a3ee2691d145c169f2041

C:\Users\Admin\AppData\Local\Temp\nsbC862.tmp\nsDialogs.dll

MD5 a687ad6a55a325cf425fc3d0119a018c
SHA1 40d32e19ca4943a22f92203d70467911c9a286f3
SHA256 9933f4a2f589b874e782eee6fd0518529bdcb9baf2bc72eb6166ff664fdfcb8f
SHA512 99b5a9a7762b325b4f8ae355eafbc65b68b73db686fee285f26285fbabcff5caeed77d7ea867133e5160f714f0329e0555faf85ae36a17a874eab175e3630020

C:\Users\Admin\AppData\Local\Temp\nsbC862.tmp\BgWorker.dll

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\nsbC862.tmp\System.dll

MD5 55b1f5fb63896e30d78a14aa4aa3b8df
SHA1 e881520cb5c147ab50705529783fe93720d05acc
SHA256 7d31195d18d166c76d3ad56044d73ab76c5bd19e92be10c46648c58b776396fa
SHA512 239b385f90796a6eb848262d0fd5faeb8cf8bc157e5efecc101d3dca21eb02faabdec835758945d52adc5f410a12c2939c0b926e007c83a250f70d6cd0fc8220

C:\Users\Admin\AppData\Local\Temp\nsbC862.tmp\nsis7z.dll

MD5 509715e6a06460142f777ac80652f50b
SHA1 52ffc1f903015467dc28d7707e6e6f558526e20a
SHA256 56cb147d8ada5d266f1e0f7e8745b00cd4756d426ab043bb66a045f98898032f
SHA512 afc620f0a007e8055426e971e16d498a030ef8cc7e34f4218b6baed0e204a6da5719751d504033b51f03f803e54f6675d61e1d53996903a73e1f52b4f09f4d0e

memory/2640-2810-0x000000001BD60000-0x000000001BD70000-memory.dmp

memory/2640-2811-0x000000001BD60000-0x000000001BD70000-memory.dmp

C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_pressed.svg

MD5 dfddf8d0788988c3e48fcbfb2a76cd20
SHA1 463bb61f0012289e860c32f1885a3a8f57467f2e
SHA256 9585f41eb6202e89f2087266fa31852d7f41ca8cc659b907c96753fe165f937d
SHA512 e708c5114c60f7574589d6a56c9faedda26ee4a40f0eeb25f5e12eadcf790f24fdbf393fa0aa6ad449b5337d625b092d6f8822472fa8a6ce1339aca59c50c3ca

C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_normal.svg

MD5 3221ac69d7facd8aa90ffa15aea991b0
SHA1 e0571f30f4708ec78addc726a743679ca0f05e45
SHA256 92aeae68e9e0973d9e0dc575941f1cb2e24afd0574341a46b870be7384eaa537
SHA512 5e2de0abfe60a4db16ea5e8739260c19962fbfc60869a77bde6ab3547ad8ee3ad88e74e97da31fa23be096afddad018e431d152d6d0fa21a75357a11dacb1328

C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_hover.svg

MD5 76166804e6ce35e8a0c92917b8abc071
SHA1 8bd38726a11a9633ac937b9c6f205ce5d36348b0
SHA256 1bca2e912184b8168ee8961de68d1d839f4f9827fde6f48ab100fb61e82eff90
SHA512 93c4f1af7e9f89091a207ab308e05ddd4c92406c039f7465d3b8aca7e0cc7a6c922a22e1eee2f5c88db5e89016ef69294b2a0905d7d6a90fd32835bc11929005

C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_disabled.svg

MD5 e7fdf6a9c8cae1fc1108dc5a803a1905
SHA1 2853f9ff5e63685ebb1449dcf693176b17e4ab60
SHA256 8ee5aa84139b2ea5549f7272523aeb203d73954c5ccdcf6f7407bf1a3469f13e
SHA512 a6388b24926934e20ccf7fcab41bd219dc6c0053428481d7f466bf89f26bf1a36fdff716a9ddd9ab268df73b04dff1449c6bac1f5c707e31ae2ee71c2087e0d9

memory/2640-9690-0x000000001BD60000-0x000000001BD70000-memory.dmp

C:\Program Files (x86)\BlueStacks X\BlueStacks X.exe

MD5 f832df4c197381dad8e57f413a36c3bc
SHA1 a54b52b92d16839dc7eb194e8149737e442b1a9e
SHA256 1d6492b6a81c48b21c060876205f7efafa7e13535175f96a56f6068625b09131
SHA512 193eab9e5fe10bfbf15f28e07c5a67d5e46aa6b2b2221a49061be959515f2f5e38cb04f6e356e4e68bc5c3dd0af03fcd99d2804d8760d020cbd0b4fc81cec68b

C:\Users\Admin\AppData\Local\Temp\7zS00B229D8\Assets\minimize_progress.png

MD5 1504b80f2a6f2d3fefc305da54a2a6c2
SHA1 432a9d89ebc2f693836d3c2f0743ea5d2077848d
SHA256 2f62d4e8c643051093f907058dddc78cc525147d9c4f4a0d78b4d0e5c90979f6
SHA512 675db04baf3199c8d94af30a1f1c252830a56a90f633c3a72aa9841738b04242902a5e7c56dd792626338e8b7eabc1f359514bb3a2e62bc36c16919e196cfd94

C:\Users\Admin\AppData\Local\Temp\7zS00B229D8\Assets\exit_close.png

MD5 26eb04b9e0105a7b121ea9c6601bbf2a
SHA1 efc08370d90c8173df8d8c4b122d2bb64c07ccd8
SHA256 7aaef329ba9fa052791d1a09f127551289641ea743baba171de55faa30ec1157
SHA512 9df3c723314d11a6b4ce0577eb61488061f2f96a9746a944eb6a4ee8c0c4d29131231a1b20988ef5454b79f9475b43d62c710839ecc0a9c98324f977cab6db68

memory/6320-10195-0x00007FFD5A960000-0x00007FFD5B422000-memory.dmp

memory/6320-10196-0x000000001B230000-0x000000001B240000-memory.dmp

memory/6320-10198-0x000000001B230000-0x000000001B240000-memory.dmp

memory/6320-10199-0x000000001B230000-0x000000001B240000-memory.dmp

memory/6320-10203-0x00007FFD5A960000-0x00007FFD5B422000-memory.dmp

memory/6320-10205-0x000000001B230000-0x000000001B240000-memory.dmp

memory/6320-10206-0x000000001B230000-0x000000001B240000-memory.dmp

memory/6320-10208-0x000000001B230000-0x000000001B240000-memory.dmp