68a1a51861e504f213788ebb999da7a8d2002f6e5708fae336792a8641b937c3

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
24-04-2024 10:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BlueStacks10Installer_10.31.1.1002_native_475fe5e476ba55b11f80e35bdb61cf2b_MzsxNSwwOzUsMTsxNSw0OzE1.exe
Size

911KB
MD5

18a7a0c695eb57f4de65cb2079ea29d8
SHA1

66c76f2c42912faacf59a0fdb9859899d4376174
SHA256

68a1a51861e504f213788ebb999da7a8d2002f6e5708fae336792a8641b937c3
SHA512

98692f52db96c88045f06aac27af1af79a9d9a07747492913e84bbaef957a16448115c9608cb51febca0364146acf48d20489984c00f67e359e337f2edf31777
SSDEEP

12288:yivtCXQd0gjKX7zuqGKSD779TxgE98I17YpNgc8gJ6POq3cBtHTAKA8kUCOTdodb:yivtCXWeGK29Txt9OkcOTuZvkUhTPs1

Score

7^/10

discovery evasion persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.BlueStacks Services = "C:\\Users\\Admin\\AppData\\Local\\Programs\\bluestacks-services\\BlueStacksServices.exe --hidden"	BlueStacksServices.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 4 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
6180	netsh.exe
8100	netsh.exe
8152	netsh.exe
3588	netsh.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\BlueStacks X\image\checkBox\checked_normal.svg	BSX-Setup-5.21.111.1002_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\checkBox\uncheck_normal.svg	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\image\MyGames\no_game_bg.png	BSX-Setup-5.21.111.1002_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\TypeIndicator\PremiumGame.svg	BSX-Setup-5.21.111.1002_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\family\Rubik-Regular.ttf	BSX-Setup-5.21.111.1002_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\TypeIndicator\Setting.svg	BSX-Setup-5.21.111.1002_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\language\pt.qm	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\audio_filter\libmono_plugin.dll	BSX-Setup-5.21.111.1002_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\audio_filter\libsamplerate_plugin.dll	BSX-Setup-5.21.111.1002_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\access\libfilesystem_plugin.dll	BSX-Setup-5.21.111.1002_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\cef\locales\am.pak	BSX-Setup-5.21.111.1002_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\cef\locales\pl.pak	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\image\Gallery\close_disabled.svg	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\image\Tutorial\InstantPlay\Icon_tip1.svg	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\translations\qt_da.qm	BSX-Setup-5.21.111.1002_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\codec\libcdg_plugin.dll	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\misc\libfingerprinter_plugin.dll	BSX-Setup-5.21.111.1002_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\cef\locales\fi.pak	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\image\settings\remove_pressed.svg	BSX-Setup-5.21.111.1002_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\LocalAPK\icon_upload.svg	BSX-Setup-5.21.111.1002_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\resources\qtwebengine_resources_200p.pak	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\translations\qtwebengine_locales\el.pak	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\audio_output\libamem_plugin.dll	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\video_filter\libmagnify_plugin.dll	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\image\CloudMode\Icon_popular.svg	BSX-Setup-5.21.111.1002_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\dialog\min.svg	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\cef\libcef.dll	BSX-Setup-5.21.111.1002_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\MyGames\mgr_hover.svg	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\image\restore_normal.svg	BSX-Setup-5.21.111.1002_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\codec\libschroedinger_plugin.dll	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\cef\locales\fa.pak	BSX-Setup-5.21.111.1002_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\stream_filter\librecord_plugin.dll	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\cef\locales\de.pak	BSX-Setup-5.21.111.1002_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\account\logo.svg	BSX-Setup-5.21.111.1002_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\TypeIndicator\home_on.svg	BSX-Setup-5.21.111.1002_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\translations\qtwebengine_locales\lt.pak	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\translations\qtwebengine_locales\ml.pak	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\www\js\jquery.min.js	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\vccorlib140.dll	BSX-Setup-5.21.111.1002_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\translations	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\image\MyGames\NavigatorBack_Click.svg	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\translations\qtwebengine_locales\hu.pak	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\translations\qt_tr.qm	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\plugins\access\libdvdnav_plugin.dll	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\image\boot_logo.svg	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\api-ms-win-crt-runtime-l1-1-0.dll	BSX-Setup-5.21.111.1002_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\meta_engine\libtaglib_plugin.dll	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\image\more.svg	BSX-Setup-5.21.111.1002_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\audio_output\libwaveout_plugin.dll	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\image\TypeIndicator\MyGame_on.svg	BSX-Setup-5.21.111.1002_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\www\images\noNetwork.svg	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\libvlc.dll	BSX-Setup-5.21.111.1002_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\MyGames\pre_hover.svg	BSX-Setup-5.21.111.1002_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\iconengines\qsvgicon.dll	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\mediaservice\dsengine.dll	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\cef\locales\hu.pak	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\image\Gallery\pre_disabled.svg	BSX-Setup-5.21.111.1002_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\Search\Result_NoResult.svg	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\family\arialbd.ttf	BSX-Setup-5.21.111.1002_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\plugins\stream_filter\libinflate_plugin.dll	BSX-Setup-5.21.111.1002_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\translations\qtwebengine_locales\pt-BR.pak	BSX-Setup-5.21.111.1002_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\cef\icudtl.dat	BSX-Setup-5.21.111.1002_nxt.exe
File created	C:\Program Files (x86)\BlueStacks X\image\CloudGame\TitlebarRestore.svg	BSX-Setup-5.21.111.1002_nxt.exe
File opened for modification	C:\Program Files (x86)\BlueStacks X\image\TypeIndicator\web3.svg	BSX-Setup-5.21.111.1002_nxt.exe

Executes dropped EXE 14 IoCs

pid	Process
2540	BlueStacksInstaller.exe
4208	HD-CheckCpu.exe
2420	HD-CheckCpu.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
8504	BlueStacksInstaller.exe
5472	HD-CheckCpu.exe
8688	BlueStacksServicesSetup.exe
5880	BlueStacksServices.exe
2276	BlueStacksServices.exe
2592	BlueStacksServices.exe
6188	BlueStacksServices.exe
7548	BlueStacks X.exe
4248	BlueStacksWeb.exe
8820	BlueStacksWeb.exe

Loads dropped DLL 64 IoCs

pid	Process
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	BlueStacks X.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	BlueStacks X.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	BlueStacks X.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	BlueStacks X.exe

Enumerates processes with tasklist 1 TTPs 21 IoCs

Process Discovery

T1057

pid	Process
6736	tasklist.exe
1124	tasklist.exe
1940	tasklist.exe
2420	tasklist.exe
3080	tasklist.exe
4032	tasklist.exe
4208	tasklist.exe
7464	tasklist.exe
7416	tasklist.exe
5684	tasklist.exe
9184	tasklist.exe
5348	tasklist.exe
4832	tasklist.exe
7148	tasklist.exe
7196	tasklist.exe
4484	tasklist.exe
8672	tasklist.exe
7904	tasklist.exe
8044	tasklist.exe
6064	tasklist.exe
2904	tasklist.exe

Modifies registry class 20 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\URL Protocol	BSX-Setup-5.21.111.1002_nxt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\shell\open\	BSX-Setup-5.21.111.1002_nxt.exe
Key created	\REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000_Classes\bstsrvs	BlueStacksServices.exe
Key created	\REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000_Classes\bstsrvs\shell\open\command	BlueStacksServices.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX	BSX-Setup-5.21.111.1002_nxt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\shell	BSX-Setup-5.21.111.1002_nxt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000_Classes\bstsrvs\URL Protocol	BlueStacksServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\DefaultIcon\ = "C:\\Program Files (x86)\\BlueStacks X\\BlueStacks X.exe,0"	BSX-Setup-5.21.111.1002_nxt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\shell\open\command\ = "\"C:\\Program Files (x86)\\BlueStacks X\\BlueStacks X.exe\" -open \"%1\""	BSX-Setup-5.21.111.1002_nxt.exe
Key created	\REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000_Classes\Local Settings	BSX-Setup-5.21.111.1002_nxt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000_Classes\bstsrvs\ = "URL:bstsrvs"	BlueStacksServices.exe
Key created	\REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000_Classes\bstsrvs\shell	BlueStacksServices.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000_Classes\bstsrvs\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\bluestacks-services\\BlueStacksServices.exe\" \"%1\""	BlueStacksServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\ = "URL:BlueStacksX Protocol Handler"	BSX-Setup-5.21.111.1002_nxt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\DefaultIcon	BSX-Setup-5.21.111.1002_nxt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\shell\	BSX-Setup-5.21.111.1002_nxt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\shell\open	BSX-Setup-5.21.111.1002_nxt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksX\shell\open\command	BSX-Setup-5.21.111.1002_nxt.exe
Key created	\REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000_Classes\bstsrvs\shell\open	BlueStacksServices.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3263309122-2820180308-3568046652-1000\{9AFEB83E-628C-4142-84EF-EA9DBFC2A623}	BlueStacks X.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	BlueStacks X.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	BlueStacks X.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	BlueStacks X.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	BlueStacks X.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	BlueStacks X.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	BlueStacks X.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
7548	BlueStacks X.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2540	BlueStacksInstaller.exe
2540	BlueStacksInstaller.exe
2540	BlueStacksInstaller.exe
2540	BlueStacksInstaller.exe
2540	BlueStacksInstaller.exe
2540	BlueStacksInstaller.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
2732	BSX-Setup-5.21.111.1002_nxt.exe
8504	BlueStacksInstaller.exe
8504	BlueStacksInstaller.exe
8504	BlueStacksInstaller.exe
8504	BlueStacksInstaller.exe
8504	BlueStacksInstaller.exe
8504	BlueStacksInstaller.exe
8688	BlueStacksServicesSetup.exe
8688	BlueStacksServicesSetup.exe
5348	tasklist.exe
5348	tasklist.exe
4248	BlueStacksWeb.exe
8820	BlueStacksWeb.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
7548	BlueStacks X.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2540	BlueStacksInstaller.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2540	BlueStacksInstaller.exe
Token: SeSecurityPrivilege	2732	BSX-Setup-5.21.111.1002_nxt.exe
Token: SeDebugPrivilege	8504	BlueStacksInstaller.exe
Token: SeDebugPrivilege	5348	tasklist.exe
Token: SeSecurityPrivilege	8688	BlueStacksServicesSetup.exe
Token: SeShutdownPrivilege	5880	BlueStacksServices.exe
Token: SeCreatePagefilePrivilege	5880	BlueStacksServices.exe
Token: SeDebugPrivilege	6736	tasklist.exe
Token: SeDebugPrivilege	4832	tasklist.exe
Token: SeDebugPrivilege	7148	tasklist.exe
Token: SeDebugPrivilege	7196	tasklist.exe
Token: SeShutdownPrivilege	5880	BlueStacksServices.exe
Token: SeCreatePagefilePrivilege	5880	BlueStacksServices.exe
Token: SeShutdownPrivilege	5880	BlueStacksServices.exe
Token: SeCreatePagefilePrivilege	5880	BlueStacksServices.exe
Token: SeShutdownPrivilege	5880	BlueStacksServices.exe
Token: SeCreatePagefilePrivilege	5880	BlueStacksServices.exe
Token: SeShutdownPrivilege	5880	BlueStacksServices.exe
Token: SeCreatePagefilePrivilege	5880	BlueStacksServices.exe
Token: SeShutdownPrivilege	5880	BlueStacksServices.exe
Token: SeCreatePagefilePrivilege	5880	BlueStacksServices.exe
Token: SeDebugPrivilege	7464	tasklist.exe
Token: SeDebugPrivilege	7416	tasklist.exe
Token: SeShutdownPrivilege	5880	BlueStacksServices.exe
Token: SeCreatePagefilePrivilege	5880	BlueStacksServices.exe
Token: SeShutdownPrivilege	5880	BlueStacksServices.exe
Token: SeCreatePagefilePrivilege	5880	BlueStacksServices.exe
Token: SeShutdownPrivilege	5880	BlueStacksServices.exe
Token: SeCreatePagefilePrivilege	5880	BlueStacksServices.exe
Token: SeShutdownPrivilege	5880	BlueStacksServices.exe
Token: SeCreatePagefilePrivilege	5880	BlueStacksServices.exe
Token: SeShutdownPrivilege	5880	BlueStacksServices.exe
Token: SeCreatePagefilePrivilege	5880	BlueStacksServices.exe
Token: SeDebugPrivilege	7904	tasklist.exe
Token: SeDebugPrivilege	5684	tasklist.exe
Token: SeShutdownPrivilege	5880	BlueStacksServices.exe
Token: SeCreatePagefilePrivilege	5880	BlueStacksServices.exe
Token: SeShutdownPrivilege	5880	BlueStacksServices.exe
Token: SeCreatePagefilePrivilege	5880	BlueStacksServices.exe
Token: SeShutdownPrivilege	5880	BlueStacksServices.exe
Token: SeCreatePagefilePrivilege	5880	BlueStacksServices.exe
Token: SeShutdownPrivilege	5880	BlueStacksServices.exe
Token: SeCreatePagefilePrivilege	5880	BlueStacksServices.exe
Token: SeShutdownPrivilege	5880	BlueStacksServices.exe
Token: SeCreatePagefilePrivilege	5880	BlueStacksServices.exe
Token: SeDebugPrivilege	1124	tasklist.exe
Token: SeShutdownPrivilege	5880	BlueStacksServices.exe
Token: SeCreatePagefilePrivilege	5880	BlueStacksServices.exe
Token: SeDebugPrivilege	3080	tasklist.exe
Token: SeShutdownPrivilege	5880	BlueStacksServices.exe
Token: SeCreatePagefilePrivilege	5880	BlueStacksServices.exe
Token: SeShutdownPrivilege	5880	BlueStacksServices.exe
Token: SeCreatePagefilePrivilege	5880	BlueStacksServices.exe
Token: SeShutdownPrivilege	5880	BlueStacksServices.exe
Token: SeCreatePagefilePrivilege	5880	BlueStacksServices.exe
Token: SeShutdownPrivilege	5880	BlueStacksServices.exe
Token: SeCreatePagefilePrivilege	5880	BlueStacksServices.exe
Token: SeShutdownPrivilege	5880	BlueStacksServices.exe
Token: SeCreatePagefilePrivilege	5880	BlueStacksServices.exe
Token: SeDebugPrivilege	4032	tasklist.exe
Token: SeDebugPrivilege	8044	tasklist.exe
Token: SeShutdownPrivilege	5880	BlueStacksServices.exe
Token: SeCreatePagefilePrivilege	5880	BlueStacksServices.exe
Token: SeShutdownPrivilege	5880	BlueStacksServices.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
5880	BlueStacksServices.exe
5880	BlueStacksServices.exe
5880	BlueStacksServices.exe
5880	BlueStacksServices.exe
5880	BlueStacksServices.exe
5880	BlueStacksServices.exe
5880	BlueStacksServices.exe
5880	BlueStacksServices.exe
5880	BlueStacksServices.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
5880	BlueStacksServices.exe
5880	BlueStacksServices.exe
5880	BlueStacksServices.exe
5880	BlueStacksServices.exe
5880	BlueStacksServices.exe
5880	BlueStacksServices.exe
5880	BlueStacksServices.exe
5880	BlueStacksServices.exe
5880	BlueStacksServices.exe
5880	BlueStacksServices.exe
5880	BlueStacksServices.exe
5880	BlueStacksServices.exe
5880	BlueStacksServices.exe
5880	BlueStacksServices.exe
5880	BlueStacksServices.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
7548	BlueStacks X.exe
7548	BlueStacks X.exe
7548	BlueStacks X.exe
7548	BlueStacks X.exe
7548	BlueStacks X.exe
7548	BlueStacks X.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 2540	3296	BlueStacks10Installer_10.31.1.1002_native_475fe5e476ba55b11f80e35bdb61cf2b_MzsxNSwwOzUsMTsxNSw0OzE1.exe	78
PID 3296 wrote to memory of 2540	3296	BlueStacks10Installer_10.31.1.1002_native_475fe5e476ba55b11f80e35bdb61cf2b_MzsxNSwwOzUsMTsxNSw0OzE1.exe	78
PID 2540 wrote to memory of 4208	2540	BlueStacksInstaller.exe	81
PID 2540 wrote to memory of 4208	2540	BlueStacksInstaller.exe	81
PID 2540 wrote to memory of 4208	2540	BlueStacksInstaller.exe	81
PID 2540 wrote to memory of 2420	2540	BlueStacksInstaller.exe	83
PID 2540 wrote to memory of 2420	2540	BlueStacksInstaller.exe	83
PID 2540 wrote to memory of 2420	2540	BlueStacksInstaller.exe	83
PID 2540 wrote to memory of 2732	2540	BlueStacksInstaller.exe	86
PID 2540 wrote to memory of 2732	2540	BlueStacksInstaller.exe	86
PID 2540 wrote to memory of 2732	2540	BlueStacksInstaller.exe	86
PID 2732 wrote to memory of 7928	2732	BSX-Setup-5.21.111.1002_nxt.exe	87
PID 2732 wrote to memory of 7928	2732	BSX-Setup-5.21.111.1002_nxt.exe	87
PID 2732 wrote to memory of 7928	2732	BSX-Setup-5.21.111.1002_nxt.exe	87
PID 7928 wrote to memory of 5576	7928	WScript.exe	88
PID 7928 wrote to memory of 5576	7928	WScript.exe	88
PID 7928 wrote to memory of 5576	7928	WScript.exe	88
PID 5576 wrote to memory of 3588	5576	cmd.exe	90
PID 5576 wrote to memory of 3588	5576	cmd.exe	90
PID 5576 wrote to memory of 3588	5576	cmd.exe	90
PID 5576 wrote to memory of 6180	5576	cmd.exe	92
PID 5576 wrote to memory of 6180	5576	cmd.exe	92
PID 5576 wrote to memory of 6180	5576	cmd.exe	92
PID 5576 wrote to memory of 8100	5576	cmd.exe	93
PID 5576 wrote to memory of 8100	5576	cmd.exe	93
PID 5576 wrote to memory of 8100	5576	cmd.exe	93
PID 5576 wrote to memory of 8152	5576	cmd.exe	94
PID 5576 wrote to memory of 8152	5576	cmd.exe	94
PID 5576 wrote to memory of 8152	5576	cmd.exe	94
PID 2540 wrote to memory of 8220	2540	BlueStacksInstaller.exe	95
PID 2540 wrote to memory of 8220	2540	BlueStacksInstaller.exe	95
PID 2540 wrote to memory of 8220	2540	BlueStacksInstaller.exe	95
PID 8220 wrote to memory of 8504	8220	BlueStacks10Installer_10.31.1.1002_native_475fe5e476ba55b11f80e35bdb61cf2b_MzsxNSwwOzUsMTsxNSw0OzE1.exe	96
PID 8220 wrote to memory of 8504	8220	BlueStacks10Installer_10.31.1.1002_native_475fe5e476ba55b11f80e35bdb61cf2b_MzsxNSwwOzUsMTsxNSw0OzE1.exe	96
PID 8504 wrote to memory of 5472	8504	BlueStacksInstaller.exe	97
PID 8504 wrote to memory of 5472	8504	BlueStacksInstaller.exe	97
PID 8504 wrote to memory of 5472	8504	BlueStacksInstaller.exe	97
PID 8688 wrote to memory of 8776	8688	BlueStacksServicesSetup.exe	100
PID 8688 wrote to memory of 8776	8688	BlueStacksServicesSetup.exe	100
PID 8688 wrote to memory of 8776	8688	BlueStacksServicesSetup.exe	100
PID 8776 wrote to memory of 5348	8776	cmd.exe	102
PID 8776 wrote to memory of 5348	8776	cmd.exe	102
PID 8776 wrote to memory of 5348	8776	cmd.exe	102
PID 8776 wrote to memory of 5356	8776	cmd.exe	103
PID 8776 wrote to memory of 5356	8776	cmd.exe	103
PID 8776 wrote to memory of 5356	8776	cmd.exe	103
PID 5880 wrote to memory of 2276	5880	BlueStacksServices.exe	105
PID 5880 wrote to memory of 2276	5880	BlueStacksServices.exe	105
PID 5880 wrote to memory of 2276	5880	BlueStacksServices.exe	105
PID 5880 wrote to memory of 2276	5880	BlueStacksServices.exe	105
PID 5880 wrote to memory of 2276	5880	BlueStacksServices.exe	105
PID 5880 wrote to memory of 2276	5880	BlueStacksServices.exe	105
PID 5880 wrote to memory of 2276	5880	BlueStacksServices.exe	105
PID 5880 wrote to memory of 2276	5880	BlueStacksServices.exe	105
PID 5880 wrote to memory of 2276	5880	BlueStacksServices.exe	105
PID 5880 wrote to memory of 2276	5880	BlueStacksServices.exe	105
PID 5880 wrote to memory of 2276	5880	BlueStacksServices.exe	105
PID 5880 wrote to memory of 2276	5880	BlueStacksServices.exe	105
PID 5880 wrote to memory of 2276	5880	BlueStacksServices.exe	105
PID 5880 wrote to memory of 2276	5880	BlueStacksServices.exe	105
PID 5880 wrote to memory of 2276	5880	BlueStacksServices.exe	105
PID 5880 wrote to memory of 2276	5880	BlueStacksServices.exe	105
PID 5880 wrote to memory of 2276	5880	BlueStacksServices.exe	105
PID 5880 wrote to memory of 2276	5880	BlueStacksServices.exe	105

C:\Users\Admin\AppData\Local\Temp\BlueStacks10Installer_10.31.1.1002_native_475fe5e476ba55b11f80e35bdb61cf2b_MzsxNSwwOzUsMTsxNSw0OzE1.exe
"C:\Users\Admin\AppData\Local\Temp\BlueStacks10Installer_10.31.1.1002_native_475fe5e476ba55b11f80e35bdb61cf2b_MzsxNSwwOzUsMTsxNSw0OzE1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Users\Admin\AppData\Local\Temp\7zS0EC56B47\BlueStacksInstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS0EC56B47\BlueStacksInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Users\Admin\AppData\Local\Temp\7zS0EC56B47\HD-CheckCpu.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS0EC56B47\HD-CheckCpu.exe" --cmd checkHypervEnabled
    3⤵
    - Executes dropped EXE
    PID:4208
- - C:\Users\Admin\AppData\Local\Temp\7zS0EC56B47\HD-CheckCpu.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS0EC56B47\HD-CheckCpu.exe" --cmd checkSSE4
    3⤵
    - Executes dropped EXE
    PID:2420
- - C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.21.111.1002_nxt.exe
    "C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.21.111.1002_nxt.exe" -s
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\BlueStacks X\green.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:7928
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c green.bat
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5576
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall delete rule name="BlueStacksWeb"
        6⤵
        Modifies Windows Firewall
        
        PID:3588
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall delete rule name="Cloud Game"
        6⤵
        Modifies Windows Firewall
        
        PID:6180
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="BlueStacksWeb" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\BlueStacksWeb.exe"
        6⤵
        Modifies Windows Firewall
        
        PID:8100
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="Cloud Game" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\Cloud Game.exe"
        6⤵
        Modifies Windows Firewall
        
        PID:8152
- - C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacks10Installer_10.31.1.1002_native_475fe5e476ba55b11f80e35bdb61cf2b_MzsxNSwwOzUsMTsxNSw0OzE1.exe
    "C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacks10Installer_10.31.1.1002_native_475fe5e476ba55b11f80e35bdb61cf2b_MzsxNSwwOzUsMTsxNSw0OzE1.exe" -versionMachineID=e916d56a-6b50-47c1-ae7c-c3824d64680e -machineID=96fc0909-b55a-412b-a7d7-da02a3f2082f -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Pie64 -imageToLaunch=Pie64 -isSSE4Available=1 -appToLaunch=bsx -bsxVersion=10.31.1.1002 -country=US -skipBinaryShortcuts -isWalletFeatureEnabled
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:8220
  - - C:\Users\Admin\AppData\Local\Temp\7zSC1096B28\BlueStacksInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\7zSC1096B28\BlueStacksInstaller.exe" -versionMachineID=e916d56a-6b50-47c1-ae7c-c3824d64680e -machineID=96fc0909-b55a-412b-a7d7-da02a3f2082f -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Pie64 -imageToLaunch=Pie64 -isSSE4Available=1 -appToLaunch=bsx -bsxVersion=10.31.1.1002 -country=US -skipBinaryShortcuts -isWalletFeatureEnabled
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:8504
    - - C:\Users\Admin\AppData\Local\Temp\7zSC1096B28\HD-CheckCpu.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zSC1096B28\HD-CheckCpu.exe" --cmd checkHypervEnabled
        5⤵
        Executes dropped EXE
        
        PID:5472

C:\ProgramData\BlueStacksServicesSetup.exe
"C:\ProgramData\BlueStacksServicesSetup.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:8688
- C:\Windows\SysWOW64\cmd.exe
  cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq BlueStacksServices.exe" | find "BlueStacksServices.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:8776
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq BlueStacksServices.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5348
- - C:\Windows\SysWOW64\find.exe
    find "BlueStacksServices.exe"
    3⤵
    PID:5356

C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
"C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --hidden --initialLaunch
1⤵
- Adds Run key to start application
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5880
- C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
  "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1664 --field-trial-handle=1724,i,14791702924699154747,11314856719557341864,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\system32\cscript.exe
  cscript.exe
  2⤵
  PID:756
- C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
  "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --mojo-platform-channel-handle=1968 --field-trial-handle=1724,i,14791702924699154747,11314856719557341864,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKCU\SOFTWARE\BlueStacksServices
  2⤵
  PID:236
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKCU\SOFTWARE\BlueStacksServices
  2⤵
  PID:3108
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regPutValue.wsf A
  2⤵
  PID:2220
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regPutValue.wsf A
  2⤵
  PID:2264
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
  2⤵
  PID:3596
- C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
  "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --app-user-model-id=com.bluestacks.services --app-path="C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2584 --field-trial-handle=1724,i,14791702924699154747,11314856719557341864,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Executes dropped EXE
  PID:6188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
  2⤵
  PID:6304
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:6736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
  2⤵
  PID:7940
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq BlueStacks X.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4832
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
  2⤵
  PID:6332
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
  2⤵
  PID:6328
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
  2⤵
  PID:6344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
  2⤵
  PID:4072
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:7148
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
  2⤵
  PID:7992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
  2⤵
  PID:7052
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq BlueStacks X.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:7196
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
  2⤵
  PID:5044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
  2⤵
  PID:7336
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:7464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
  2⤵
  PID:7328
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq BlueStacks X.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:7416
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
  2⤵
  PID:7492
- C:\Program Files (x86)\BlueStacks X\BlueStacks X.exe
  "C:\Program Files (x86)\BlueStacks X\BlueStacks X.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:7548
- - C:\Program Files (x86)\BlueStacks X\BlueStacksWeb.exe
    BlueStacksWeb.exe --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,NetworkServiceInProcess,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,InstalledApp,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --lang=en --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --mojo-platform-channel-handle=3720 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4248
- - C:\Program Files (x86)\BlueStacks X\BlueStacksWeb.exe
    BlueStacksWeb.exe --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,NetworkServiceInProcess,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,InstalledApp,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --lang=en --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=3764 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:8820
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
  2⤵
  PID:8804
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
  2⤵
  PID:4320
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
  2⤵
  PID:8768
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
  2⤵
  PID:5356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
  2⤵
  PID:8880
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:7904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
  2⤵
  PID:5180
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq BlueStacks X.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
  2⤵
  PID:1036
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
  2⤵
  PID:7628
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq BlueStacks X.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
  2⤵
  PID:1140
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
  2⤵
  PID:3720
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq BlueStacks X.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:8044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
  2⤵
  PID:5412
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq BlueStacks X.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:4208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
  2⤵
  PID:7016
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:1940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
  2⤵
  PID:4948
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq BlueStacks X.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:9184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
  2⤵
  PID:9156
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:2420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
  2⤵
  PID:5592
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq BlueStacks X.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:6064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
  2⤵
  PID:4512
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:2904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
  2⤵
  PID:8688
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq BlueStacks X.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:4484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
  2⤵
  PID:5332
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq HD-Player.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:8672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\BlueStacks X\BlueStacks X.exe

Filesize
476KB

MD5
93dae9e3e1e670ae92b4ddd5c0d750f8

SHA1
dfce77bd5075a75c53932b402500c6852d59b6e2

SHA256
784ef196941ecaa7723ecbb8f31483ad261fc1a376e88938ddc5bcbb43175ea8

SHA512
60b7f2f53e64446ddda244555445a6cb343f3c2e299596b75e23081776e22b5d334c277ba07049dc62edb0b6c8c5c3ef137fc9bc5ef70b6f4d8ecf28865a3dde

Download Submit
C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_disabled.svg

Filesize
569B

MD5
e7fdf6a9c8cae1fc1108dc5a803a1905

SHA1
2853f9ff5e63685ebb1449dcf693176b17e4ab60

SHA256
8ee5aa84139b2ea5549f7272523aeb203d73954c5ccdcf6f7407bf1a3469f13e

SHA512
a6388b24926934e20ccf7fcab41bd219dc6c0053428481d7f466bf89f26bf1a36fdff716a9ddd9ab268df73b04dff1449c6bac1f5c707e31ae2ee71c2087e0d9

Download Submit
C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_hover.svg

Filesize
653B

MD5
76166804e6ce35e8a0c92917b8abc071

SHA1
8bd38726a11a9633ac937b9c6f205ce5d36348b0

SHA256
1bca2e912184b8168ee8961de68d1d839f4f9827fde6f48ab100fb61e82eff90

SHA512
93c4f1af7e9f89091a207ab308e05ddd4c92406c039f7465d3b8aca7e0cc7a6c922a22e1eee2f5c88db5e89016ef69294b2a0905d7d6a90fd32835bc11929005

Download Submit
C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_normal.svg

Filesize
569B

MD5
3221ac69d7facd8aa90ffa15aea991b0

SHA1
e0571f30f4708ec78addc726a743679ca0f05e45

SHA256
92aeae68e9e0973d9e0dc575941f1cb2e24afd0574341a46b870be7384eaa537

SHA512
5e2de0abfe60a4db16ea5e8739260c19962fbfc60869a77bde6ab3547ad8ee3ad88e74e97da31fa23be096afddad018e431d152d6d0fa21a75357a11dacb1328

Download Submit
C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_pressed.svg

Filesize
653B

MD5
dfddf8d0788988c3e48fcbfb2a76cd20

SHA1
463bb61f0012289e860c32f1885a3a8f57467f2e

SHA256
9585f41eb6202e89f2087266fa31852d7f41ca8cc659b907c96753fe165f937d

SHA512
e708c5114c60f7574589d6a56c9faedda26ee4a40f0eeb25f5e12eadcf790f24fdbf393fa0aa6ad449b5337d625b092d6f8822472fa8a6ce1339aca59c50c3ca

Download Submit
C:\Users\Admin\AppData\Local\BlueStacks X\Log\log.txt

Filesize
768B

MD5
fa1ccdec5a0b5bcafb88a637bfb333a5

SHA1
866410b2f137bc578c19d818c6841c0ad14c1b31

SHA256
981df8f8f86ac09a37f1c4b7215078dfddfbb9b64b0cf67970ba5b74cfcf2ac9

SHA512
0992b79f42a46d8de0b41bd27c1ceb5b5f6d7476f02c382004585633710a7125f0f9e8fcc9815edd263a77b78811ded4b011cb91da896da2a1ff0ca6fd41ee02

Download Submit
C:\Users\Admin\AppData\Local\BlueStacks X\Log\log.txt

Filesize
4KB

MD5
366c470a85366043b40107933404e17a

SHA1
9bd663bb1863cc89452f85e8a3743070b4276be6

SHA256
1133011a279d3a89a33d5541706b26530eb7c7ee24748ad8ce89660dec25e5d0

SHA512
30a6f13dc9ccbc4a2bbe3e84fefc03b10b513bbe784dd3e1f84e03c04ff4b8c8ebf5f525b142087b8a639370e6762f3908b202cbf49d46b83a9813cf959a95a6

Download Submit
C:\Users\Admin\AppData\Local\BlueStacks X\QtWebEngine\Default\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\BlueStacks X\QtWebEngine\Default\Platform Notifications\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\BlueStacks X\QtWebEngine\Default\TransportSecurity

Filesize
706B

MD5
a7b214a9d377eca29d083634f69c4051

SHA1
35d9a1a65f760fe2ba86ced6dabca27f8e09a4bc

SHA256
824e7a035dc900331d9cdf3519325b2cbed03d3f24f08939e2e66cb30dde7970

SHA512
512a82a02d740280bef40e559714bfd5eab8c3fee931b832e89ce5b14700bf055f12fc60b70164aca4c27b8168af45f360b1b88fa0b953323f833215fdd1e4ef

Download Submit
C:\Users\Admin\AppData\Local\BlueStacks X\QtWebEngine\Default\TransportSecurity~RFe599c07.TMP

Filesize
539B

MD5
7605090cc37fbd828426b154fffcbbbc

SHA1
b77b85183989c5d32139c59d966ce093be700ea6

SHA256
dc3dc5227e48bf06670d682af0242203a1d63ef989581df85eca558db1ad66ec

SHA512
84455feb1f411957d0a1f7ccdebb37308d7f68d82feb94c532416d21946d4988266bd3de8a8e281654584e8d60d1fbcbf4cf3393ea2c06578e2c65939d9d668e

Download Submit
C:\Users\Admin\AppData\Local\BlueStacks X\cache\QtWebEngine\Default\Cache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\BlueStacks X\cache\QtWebEngine\Default\Cache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\BlueStacks X\cache\QtWebEngine\Default\Cache\f_000015

Filesize
31KB

MD5
b8daab5e3dfa4ce14eeec21987341053

SHA1
4372b8d3e43d8fa892015c6c38921f6dcf510c01

SHA256
402f188eedca43781fc07609737aeadc8f5f96e7512a910dd60270e68df37ff4

SHA512
6bda9765e7b40bfac60c9b4302655480deaf79638b2a170c0b2c70b80c419ffa6b2aa31ae2ff6f62dc219f34d4e22fa775e6137a81b91b5a62758bf57490b97c

Download Submit
C:\Users\Admin\AppData\Local\BlueStacks X\cache\icons\com.whatsapp.w4b

Filesize
140KB

MD5
0ea04619e610a8cdabb5da7fbffddcb8

SHA1
7d5b359a207bc7254524a37f797b43315d68cdfe

SHA256
51aad19c3f8dd9e5c53b2f93e93a9b3ea33c348ef02b79baca02824e3beb93d1

SHA512
1e9425b6b02bb667d1dc33e943ab563b9f0e5fda77d19e6878a42c62f87266c0aba8bf8f1732835dc78273894fc95b8ca803d882508f672b46da2d680df11ff8

Download Submit
C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.21.111.1002_nxt.exe

Filesize
160.0MB

MD5
990bfc0f5cb1e2ef4907a22601a387bb

SHA1
d36d68aa649eaa1e1810e0d32d2d9bb2b79d3044

SHA256
bb8874e883d3a41d4b60cc50ca5236eeb782116bf6cafdb5e6ec14853a750c41

SHA512
016a32663395edc07737e8452a355c17032100034f6f8082d2544e85a81e2595ba8c898f9043d887313a63e8a07a1a9abe8bbff5a4f199412c61cd559fa250a1

Download Submit
C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe

Filesize
154.7MB

MD5
1a2fe315268cba55150e11582a5397f6

SHA1
ead9ab9f86ee90aa4527c9c861c2a765036cc034

SHA256
54c05545717eb4125673931783a0f1e81e50f1b880b42eb9be3e2f43514f68b2

SHA512
cc2b811173f599344fe7f72fe68a8904f4e3fd173d716c489517f7cf2b356a81a3670fa3836be1e13f5490e2e4819a4fd3a73c8232ade4806f5ba9ce7ea2cdf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0EC56B47\Assets\backicon.png

Filesize
15KB

MD5
7ff5dc8270b5fa7ef6c4a1420bd67a7f

SHA1
b224300372feaa97d882ca2552b227c0f2ef4e3e

SHA256
fa64884054171515e97b78aaa1aad1ec5baa9d1daf9c682e0b3fb4a41a9cb1c1

SHA512
f0d5a842a01b99f189f3d46ab59d2c388a974951b042b25bbce54a15f5a3f386984d19cfca22ba1440eebd79260066a37dfeff6cb0d1332fca136add14488eef

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0EC56B47\Assets\close_red.png

Filesize
15KB

MD5
93216b2f9d66d423b3e1311c0573332d

SHA1
5efaebec5f20f91f164f80d1e36f98c9ddaff805

SHA256
d0b6d143642d356b40c47459a996131a344cade6bb86158f1b74693426b09bfb

SHA512
922a7292de627c5e637818556d25d9842a88e89f2b198885835925679500dfd44a1e25ce79e521e63c4f84a6b0bd6bf98e46143ad8cee80ecdbaf3d3bc0f3a32

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0EC56B47\Assets\custom.png

Filesize
17KB

MD5
03b17f0b1c067826b0fcc6746cced2cb

SHA1
e07e4434e10df4d6c81b55fceb6eca2281362477

SHA256
fbece8bb5f4dfa55dcfbf41151b10608af807b9477e99acf0940954a11e68f7b

SHA512
67c78ec01e20e9c8d9cdbba665bb2fd2bb150356f30b88d3d400bbdb0ae92010f5d7bcb683dcf6f895722a9151d8e669d8bef913eb6e728ba56bb02f264573b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0EC56B47\Assets\installer_bg.jpg

Filesize
78KB

MD5
3478e24ba1dd52c80a0ff0d43828b6b5

SHA1
b5b13bbf3fb645efb81d3562296599e76a2abac0

SHA256
4c7471c986e16de0cd451be27d4b3171e595fe2916b4b3bf7ca52df6ec368904

SHA512
5c8c9cc76d6dbc7ce482d0d1b6c2f3d48a7a510cd9ed01c191328763e1bccb56daeb3d18c33a9b10ac7c9780127007aa13799fa82d838de27fbe0a02ad98119d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0EC56B47\Assets\installer_logo.png

Filesize
14KB

MD5
e33432b5d6dafb8b58f161cf38b8f177

SHA1
d7f520887ce1bfa0a1abd49c5a7b215c24cbbf6a

SHA256
9f3104493216c1fa114ff935d23e3e41c7c3511792a30b10a40b507936c0d183

SHA512
520dc99f3176117ebc28da5ef5439b132486ef67d02fa17f28b7eab0c59db0fa99566e44c0ca7bb75c9e7bd5244e4a23d87611a55c841c6f9c9776e457fb1cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0EC56B47\Assets\installer_minimize.png

Filesize
113B

MD5
38b539a1e4229738e5c196eedb4eb225

SHA1
f027b08dce77c47aaed75a28a2fce218ff8c936c

SHA256
a064f417e3c2b8f3121a14bbded268b2cdf635706880b7006f931de31476bbc2

SHA512
2ce433689a94fae454ef65e0e9ec33657b89718bbb5a038bf32950f6d68722803922f3a427278bad432395a1716523e589463fcce4279dc2a895fd77434821cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0EC56B47\Assets\loader.png

Filesize
279B

MD5
03903fd42ed2ee3cb014f0f3b410bcb4

SHA1
762a95240607fe8a304867a46bc2d677f494f5c2

SHA256
076263cc65f9824f4f82eb6beaa594d1df90218a2ee21664cf209181557e04b1

SHA512
8b0e717268590e5287c07598a06d89220c5e9a33cd1c29c55f8720321f4b3efc869d20c61fcc892e13188d77f0fdc4c73a2ee6dece174bf876fcc3a6c5683857

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0EC56B47\Assets\setpath.png

Filesize
15KB

MD5
b2e7f40179744c74fded932e829cb12a

SHA1
a0059ab8158a497d2cf583a292b13f87326ec3f0

SHA256
5bbb2f41f9f3a805986c3c88a639bcc22d90067d4b8de9f1e21e3cf9e5c1766b

SHA512
b95b7ebdb4a74639276eaa5c055fd8d9431e2f58a5f7c57303f7cf22e8b599f6f2a7852074cf71b19b49eb31cc9bf2509aedf41d608981d116e49a00030c797c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0EC56B47\Assets\unchecked_gray.png

Filesize
192B

MD5
e50df2a0768f7fc4c3fe8d784564fea3

SHA1
d1fc4db50fe8e534019eb7ce70a61fd4c954621a

SHA256
671f26795b12008fbea1943143f660095f3dca5d925f67d765e2352fd7ee2396

SHA512
c87a8308a73b17cbdd179737631fb1ba7fdaeb65e82263f6617727519b70a81266bb695867b9e599c1306ee2cf0de525452f77ce367ca89bf870ea3ae7189998

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0EC56B47\BlueStacksInstaller.exe

Filesize
623KB

MD5
8007eb7227eda02f9fdee2395506f9c2

SHA1
b9191318e251a3f1173800984bc9fa610fa12efd

SHA256
dd955e15042037745408344d697d1edf27674594eb6950fb80b365d583fc3806

SHA512
9eabf22f0131c833286c01d069411c6b0995710e1f39ba9155394f9b3570385aa40311ec88ffff80ba6d58d17bf7f5c443933bf6e7cc0362a20af32a44048a05

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0EC56B47\BlueStacksInstaller.exe.config

Filesize
324B

MD5
1b456d88546e29f4f007cd0bf1025703

SHA1
e5c444fcfe5baf2ef71c1813afc3f2c1100cab86

SHA256
d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb

SHA512
c545e416c841b8786e4589fc9ca2b732b16cdd759813ec03f558332f2436f165ec1ad2fbc65012b5709fa19ff1e8396639c17bfad150cabeb51328a39ea556e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0EC56B47\HD-CheckCpu.exe

Filesize
200KB

MD5
81234fd9895897b8d1f5e6772a1b38d0

SHA1
80b2fec4a85ed90c4db2f09b63bd8f37038db0d3

SHA256
2e14887f3432b4a313442247fc669f891dbdad7ef1a2d371466a2afa88074a4c

SHA512
4c924d6524dc2c7d834bfc1a0d98b21753a7bf1e94b1c2c6650f755e6f265512d3a963bc7bc745351f79f547add57c37e29ba9270707edbf62b60df3a541bc16

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0EC56B47\JSON.dll

Filesize
411KB

MD5
f5fd966e29f5c359f78cb61a571d1be4

SHA1
a55e7ed593b4bc7a77586da0f1223cfd9d51a233

SHA256
d2c8d26f95f55431e632c8581154db7c19547b656380e051194a9d2583dd2156

SHA512
d99e6fe250bb106257f86135938635f6e7ad689b2c11a96bb274f4c4c5e9a85cfacba40122dbc953f77b5d33d886c6af30bff821f10945e15b21a24b66f6c8be

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0EC56B47\Locales\i18n.en-US.txt

Filesize
19KB

MD5
206562eed57e938afe21fc6942fa8e59

SHA1
779e90fec866c0fd2f47da020651db71c89ec3dd

SHA256
27d611a71edf36307a7ed0651f6c5910292ac7e2b68074a7e33d306b3d93ec45

SHA512
275c3192a7aee28fad31beb521cf5e7c66010e7562ce244ba9fc4de352f35b4ab63180ed12a56ea0b1458c185e076e2d07ba6d8797467177d3c5b2ac14371b26

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0EC56B47\ThemeFile

Filesize
80KB

MD5
c3e6bab4f92ee40b9453821136878993

SHA1
94493a6b3dfb3135e5775b7d3be227659856fbc4

SHA256
de1a2e6b560e036da5ea6b042e29e81a5bfcf67dde89670c332fc5199e811ba6

SHA512
a64b6b06b3a0f3591892b60e59699682700f4018b898efe55d6bd5fb417965a55027671c58092d1eb7e21c2dbac42bc68dfb8c70468d98bed45a8cff0e945895

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC1096B28\Assets\exit_close.png

Filesize
670B

MD5
26eb04b9e0105a7b121ea9c6601bbf2a

SHA1
efc08370d90c8173df8d8c4b122d2bb64c07ccd8

SHA256
7aaef329ba9fa052791d1a09f127551289641ea743baba171de55faa30ec1157

SHA512
9df3c723314d11a6b4ce0577eb61488061f2f96a9746a944eb6a4ee8c0c4d29131231a1b20988ef5454b79f9475b43d62c710839ecc0a9c98324f977cab6db68

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC1096B28\Assets\minimize_progress.png

Filesize
212B

MD5
1504b80f2a6f2d3fefc305da54a2a6c2

SHA1
432a9d89ebc2f693836d3c2f0743ea5d2077848d

SHA256
2f62d4e8c643051093f907058dddc78cc525147d9c4f4a0d78b4d0e5c90979f6

SHA512
675db04baf3199c8d94af30a1f1c252830a56a90f633c3a72aa9841738b04242902a5e7c56dd792626338e8b7eabc1f359514bb3a2e62bc36c16919e196cfd94

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD0F8.tmp\Registry.dll

Filesize
24KB

MD5
2b7007ed0262ca02ef69d8990815cbeb

SHA1
2eabe4f755213666dbbbde024a5235ddde02b47f

SHA256
0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d

SHA512
aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD0F8.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD0F8.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD0F8.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD0F8.tmp\nsExec.dll

Filesize
6KB

MD5
ec0504e6b8a11d5aad43b296beeb84b2

SHA1
91b5ce085130c8c7194d66b2439ec9e1c206497c

SHA256
5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

SHA512
3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD0F8.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszDE6A.tmp\BgWorker.dll

Filesize
12KB

MD5
36c81676ada53ceb99e06693108d8cce

SHA1
d31fa4aebd584238b3edc4768dd5414494610889

SHA256
a9e4f7ec65670d2ce375ffaf09b6d07f4cd531132ca002452287a4d540154a38

SHA512
1300de7b3e1ac9e706e0aad0b70e3e2a21db8c860e05b314a52e63dd66b5dffdf6be1e38ab6ede13bfd3a64631cc909486bf4b1403e7d821e3b566edc514c63c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszDE6A.tmp\System.dll

Filesize
11KB

MD5
959ea64598b9a3e494c00e8fa793be7e

SHA1
40f284a3b92c2f04b1038def79579d4b3d066ee0

SHA256
03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b

SHA512
5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszDE6A.tmp\nsDialogs.dll

Filesize
9KB

MD5
f7b92b78f1a00a872c8a38f40afa7d65

SHA1
872522498f69ad49270190c74cf3af28862057f2

SHA256
2bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e

SHA512
3ad6afa6269b48f238b48cf09eeefdef03b58bab4e25282c8c2887b4509856cf5cbb0223fbb06c822fb745aeea000dd1eee878df46ad0ba7f2ef520a7a607f79

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszDE6A.tmp\nsDui.dll

Filesize
3.0MB

MD5
fdee692c0f32e845216ec9f293143f19

SHA1
56d53fc173f3c85a5067eab93199ea2b568c6938

SHA256
d0c01042acf332e605f071c7a688fedf4518dca65d2f7db6d33a577b2e95423d

SHA512
a1c163165d6cc8a6365bc0edda9800b02aa2a379c6502dfd9b81c5e28eba6ae0c8cb6eae039cb13f527c61d209ded0e23d83f31734f62a715179e7ae40356454

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszDE6A.tmp\nsis7z.dll

Filesize
434KB

MD5
95f6f6ab9509bc366ab9215defe4251a

SHA1
e3f4a6effd6ca5838cfe91a01967cb72edcc7b0b

SHA256
a896a9ece055d334d431cd0f856113ab925d9ee86d2dee383c0bfbbef11a5b50

SHA512
a853f70d2ea7f384df99be067724bf3ca73c63f3c3573c112f5528fc86a96bd34509d934b038e2a81833f3abb3eedbc5894921291139100e01df6e35696c0ecc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json

Filesize
92B

MD5
85844b2ab05b7e2fa29458706d7f5cd5

SHA1
771630466ae4c54d645ce967f7c4ad77254492df

SHA256
af5633e1ad76e00fff34cf7f9db8ca1ff6dea01c54794dad0e5e570f23170d28

SHA512
1eebeda9e7105706e758f29386726a2f85590110e4f6ea08e96e5a1c5cdc2b8181d0e1c81ab0633ccbf043e8780ce6044e6f91499700b80e1c0bace1bbd666bc

Download Submit
C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json

Filesize
119B

MD5
3e95e13d6de21f002e77d91a0265f52d

SHA1
9e080f23677ced9d82028cb6611cf9a1f92ff722

SHA256
e3ffa0c653602829854602f2c8ab8f38e17f8f2689e3cb2c161ecb44056f24f7

SHA512
09ff8f8d46e8a6c8d9130c414ca5a8b88ec847c30e36a6ea0acc07c7780cfd50fc462bb8f60b6ddc2731c69cc755d6dc6e9e4324440412e7ac19cf4a393a5498

Download Submit
C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json

Filesize
920B

MD5
ee2b95580f7a57061c053033ba8ffe78

SHA1
058041461c8764c26c9abf36de329082ad408c71

SHA256
5e3b64876eed08e77b47cfa5673b5f84c2bcaa3ae5a29432acffd1373d522074

SHA512
80e8c372056cce029ce02514dbeb379914ad7e04e7a9e59b716a0c1df48204f642c7648353a1db3e2315b588fe5f4d901da75e7c2290394f21009a27ba1e791e

Download Submit
C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json

Filesize
950B

MD5
130233cb47f3dc1c689586fabbe02290

SHA1
3e95471564c815dfeab8167333dfee092736c13c

SHA256
1329a8d2eb5069acd058671c1b051c93e2e1b6b6ad9eb3d0783b21f343132b7d

SHA512
3531e061b44b4f9fa2b0392b353a8933736c90976761fc25289e441655f410e1a1692b187f0290562071eec7809ccb00986f4f64592d656d31a002b0cc1ea3d9

Download Submit
C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json

Filesize
57B

MD5
e071e12e1c0ad7fe4201bbffce36afd8

SHA1
b8fd2088348fcea2a5d7b10e9297cd003f9bd587

SHA256
7950999ab695b94647134850e9b45f6814d04b86f7c456dd16c7470dce4a87d1

SHA512
04c4287c7ce1b77c9279d4a24d775c444f4c46f329eceb5a235334ec2826a85f6da6e41379111db09f5ffb8010a781d1283ee794d361b0172b885e017e7d64ac

Download Submit
C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json.tmp-39538311198ccb24

Filesize
1KB

MD5
1dfd808336a9a5d19654bd07cf26e1a4

SHA1
2674d2fbc496bd7dc37e6a28c81b8a1a28e7daeb

SHA256
198e1a9a4b47697180c15dbe5d889ff3270bcdfa9bbc65f8d95b2bd28f5311dc

SHA512
d5764ebd62b5e3c9ec433e7d5b813e66b4d94e083f06ae231bf154cbe0d07971d797ea200187feb6377307fed7f08357eb0d2ff70e21453f60390231807b59fb

Download Submit
C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json.tmp-3953845926b165b7

Filesize
982B

MD5
9a209668d1eeacd130d851bf9045939b

SHA1
6cd171ae334c09268ef92639f09246a62ca935b2

SHA256
244ed17a850139eb54bc01244cff1fbeaa913c6fedfe224b90e1ec5381560619

SHA512
93569482473ad4e36867d48919d5151802161d08bfc406a918fafe31547a76043dfd6b80e22095918b86078d0e743fdb559b41da59b1021fa5fcfaa98d9f992f

Download Submit
C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json.tmp-39538459693980cf

Filesize
1015B

MD5
5e322b74cc09eed3ffcce3e6b26411c0

SHA1
8b99bea2c793ddb62386f8e3ca407b0aa58744e4

SHA256
b251f8df84a327b4dd06bfce5dc49f07b84655506a1d0bcd283f37319436ea46

SHA512
7530e88bb36e0f06f22b391d35c5fec4fd58c51f323038905c438d42afb6b7e59b439b36f185c272b13fd965f1dc7dbb96535847115b1305fa766bfade382bf8

Download Submit
memory/2540-123-0x000000001B3B0000-0x000000001B418000-memory.dmp

Filesize
416KB

Download
memory/2540-134-0x000000001B5E0000-0x000000001B5F0000-memory.dmp

Filesize
64KB

Download
memory/2540-149-0x000000001B5E0000-0x000000001B5F0000-memory.dmp

Filesize
64KB

Download
memory/2540-150-0x000000001B5E0000-0x000000001B5F0000-memory.dmp

Filesize
64KB

Download
memory/2540-151-0x000000001B5E0000-0x000000001B5F0000-memory.dmp

Filesize
64KB

Download
memory/2540-128-0x000000001B5E0000-0x000000001B5F0000-memory.dmp

Filesize
64KB

Download
memory/2540-119-0x0000000000770000-0x000000000080E000-memory.dmp

Filesize
632KB

Download
memory/2540-13205-0x00007FFEE8290000-0x00007FFEE8D52000-memory.dmp

Filesize
10.8MB

Download
memory/2540-152-0x000000001B5E0000-0x000000001B5F0000-memory.dmp

Filesize
64KB

Download
memory/2540-121-0x000000001B5E0000-0x000000001B5F0000-memory.dmp

Filesize
64KB

Download
memory/2540-146-0x000000001C040000-0x000000001C048000-memory.dmp

Filesize
32KB

Download
memory/2540-136-0x000000001CB10000-0x000000001CB1E000-memory.dmp

Filesize
56KB

Download
memory/2540-135-0x000000001CB40000-0x000000001CB78000-memory.dmp

Filesize
224KB

Download
memory/2540-148-0x00007FFEE8290000-0x00007FFEE8D52000-memory.dmp

Filesize
10.8MB

Download
memory/2540-132-0x000000001CC10000-0x000000001D138000-memory.dmp

Filesize
5.2MB

Download
memory/2540-120-0x00007FFEE8290000-0x00007FFEE8D52000-memory.dmp

Filesize
10.8MB

Download
memory/6188-13307-0x00007FFF08530000-0x00007FFF08531000-memory.dmp

Filesize
4KB

Download
memory/6188-13308-0x00007FFF08540000-0x00007FFF08541000-memory.dmp

Filesize
4KB

Download
memory/6188-15393-0x000001D4A47C0000-0x000001D4A4F6E000-memory.dmp

Filesize
7.7MB

Download
memory/7548-24239-0x0000000069180000-0x000000006918F000-memory.dmp

Filesize
60KB

Download
memory/7548-24254-0x0000000069030000-0x0000000069040000-memory.dmp

Filesize
64KB

Download
memory/7548-24124-0x0000000069490000-0x00000000694A7000-memory.dmp

Filesize
92KB

Download
memory/7548-24123-0x00000000694B0000-0x00000000694BF000-memory.dmp

Filesize
60KB

Download
memory/7548-24125-0x0000000069470000-0x000000006948D000-memory.dmp

Filesize
116KB

Download
memory/7548-24126-0x0000000069440000-0x0000000069467000-memory.dmp

Filesize
156KB

Download
memory/7548-24127-0x0000000069420000-0x0000000069432000-memory.dmp

Filesize
72KB

Download
memory/7548-24128-0x0000000069410000-0x000000006941E000-memory.dmp

Filesize
56KB

Download
memory/7548-24129-0x00000000693D0000-0x000000006940D000-memory.dmp

Filesize
244KB

Download
memory/7548-24130-0x00000000693A0000-0x00000000693CC000-memory.dmp

Filesize
176KB

Download
memory/7548-24134-0x0000000069380000-0x0000000069394000-memory.dmp

Filesize
80KB

Download
memory/7548-24121-0x000000006BE00000-0x000000006BE2F000-memory.dmp

Filesize
188KB

Download
memory/7548-13367-0x0000000002900000-0x0000000002910000-memory.dmp

Filesize
64KB

Download
memory/7548-24223-0x0000000069300000-0x0000000069316000-memory.dmp

Filesize
88KB

Download
memory/7548-24231-0x00000000692F0000-0x00000000692FE000-memory.dmp

Filesize
56KB

Download
memory/7548-24233-0x0000000069290000-0x00000000692D9000-memory.dmp

Filesize
292KB

Download
memory/7548-24235-0x00000000691D0000-0x000000006925D000-memory.dmp

Filesize
564KB

Download
memory/7548-24238-0x0000000069190000-0x000000006919E000-memory.dmp

Filesize
56KB

Download
memory/7548-24278-0x0000000068C00000-0x0000000068C12000-memory.dmp

Filesize
72KB

Download
memory/7548-24242-0x0000000069150000-0x000000006915E000-memory.dmp

Filesize
56KB

Download
memory/7548-24240-0x0000000069160000-0x0000000069174000-memory.dmp

Filesize
80KB

Download
memory/7548-24237-0x00000000691A0000-0x00000000691B0000-memory.dmp

Filesize
64KB

Download
memory/7548-24236-0x00000000691B0000-0x00000000691C6000-memory.dmp

Filesize
88KB

Download
memory/7548-24234-0x0000000069260000-0x0000000069281000-memory.dmp

Filesize
132KB

Download
memory/7548-24232-0x00000000692E0000-0x00000000692EE000-memory.dmp

Filesize
56KB

Download
memory/7548-24184-0x0000000069320000-0x000000006934A000-memory.dmp

Filesize
168KB

Download
memory/7548-24167-0x0000000069350000-0x0000000069372000-memory.dmp

Filesize
136KB

Download
memory/7548-24244-0x0000000069120000-0x000000006912F000-memory.dmp

Filesize
60KB

Download
memory/7548-24246-0x00000000690E0000-0x00000000690FE000-memory.dmp

Filesize
120KB

Download
memory/7548-24248-0x00000000690A0000-0x00000000690B1000-memory.dmp

Filesize
68KB

Download
memory/7548-24251-0x0000000069070000-0x000000006907E000-memory.dmp

Filesize
56KB

Download
memory/7548-24252-0x0000000069050000-0x0000000069067000-memory.dmp

Filesize
92KB

Download
memory/7548-24253-0x0000000069040000-0x000000006904E000-memory.dmp

Filesize
56KB

Download
memory/7548-24122-0x000000006BB40000-0x000000006BDD4000-memory.dmp

Filesize
2.6MB

Download
memory/7548-24255-0x0000000069020000-0x000000006902E000-memory.dmp

Filesize
56KB

Download
memory/7548-24250-0x0000000069080000-0x0000000069090000-memory.dmp

Filesize
64KB

Download
memory/7548-24249-0x0000000069090000-0x000000006909F000-memory.dmp

Filesize
60KB

Download
memory/7548-24247-0x00000000690C0000-0x00000000690D5000-memory.dmp

Filesize
84KB

Download
memory/7548-24245-0x0000000069100000-0x000000006911F000-memory.dmp

Filesize
124KB

Download
memory/7548-24243-0x0000000069130000-0x0000000069144000-memory.dmp

Filesize
80KB

Download
memory/7548-24256-0x0000000068FF0000-0x000000006901C000-memory.dmp

Filesize
176KB

Download
memory/7548-24257-0x0000000068FE0000-0x0000000068FF0000-memory.dmp

Filesize
64KB

Download
memory/7548-24258-0x0000000068FD0000-0x0000000068FDF000-memory.dmp

Filesize
60KB

Download
memory/7548-24260-0x0000000068FB0000-0x0000000068FC0000-memory.dmp

Filesize
64KB

Download
memory/7548-24261-0x0000000068E30000-0x0000000068FA7000-memory.dmp

Filesize
1.5MB

Download
memory/7548-24259-0x0000000068FC0000-0x0000000068FD0000-memory.dmp

Filesize
64KB

Download
memory/7548-24263-0x0000000068E10000-0x0000000068E1F000-memory.dmp

Filesize
60KB

Download
memory/7548-24264-0x0000000068E00000-0x0000000068E0F000-memory.dmp

Filesize
60KB

Download
memory/7548-24262-0x0000000068E20000-0x0000000068E30000-memory.dmp

Filesize
64KB

Download
memory/7548-24265-0x0000000068CF0000-0x0000000068DFB000-memory.dmp

Filesize
1.0MB

Download
memory/7548-24266-0x0000000068CD0000-0x0000000068CEF000-memory.dmp

Filesize
124KB

Download
memory/7548-24267-0x0000000068CC0000-0x0000000068CD0000-memory.dmp

Filesize
64KB

Download
memory/7548-24271-0x0000000068C80000-0x0000000068C8F000-memory.dmp

Filesize
60KB

Download
memory/7548-24270-0x0000000068C90000-0x0000000068CA1000-memory.dmp

Filesize
68KB

Download
memory/7548-24269-0x0000000068CB0000-0x0000000068CBF000-memory.dmp

Filesize
60KB

Download
memory/7548-24272-0x0000000068C70000-0x0000000068C7E000-memory.dmp

Filesize
56KB

Download
memory/7548-24273-0x0000000068C60000-0x0000000068C6E000-memory.dmp

Filesize
56KB

Download
memory/7548-24274-0x0000000068C50000-0x0000000068C5E000-memory.dmp

Filesize
56KB

Download
memory/7548-24275-0x0000000068C40000-0x0000000068C4E000-memory.dmp

Filesize
56KB

Download
memory/7548-24276-0x0000000068C30000-0x0000000068C3F000-memory.dmp

Filesize
60KB

Download
memory/7548-24277-0x0000000068C20000-0x0000000068C2F000-memory.dmp

Filesize
60KB

Download
memory/8504-12795-0x00007FFEE8290000-0x00007FFEE8D52000-memory.dmp

Filesize
10.8MB

Download
memory/8504-13152-0x00007FFEE8290000-0x00007FFEE8D52000-memory.dmp

Filesize
10.8MB

Download
memory/8504-12799-0x0000000002830000-0x0000000002840000-memory.dmp

Filesize
64KB

Download
memory/8504-12797-0x0000000002830000-0x0000000002840000-memory.dmp

Filesize
64KB

Download
memory/8504-12796-0x0000000002830000-0x0000000002840000-memory.dmp

Filesize
64KB

Download