Overview

overview

8

Static

static

1

URLScan

urlscan

1

https://www.bluestac...

windows10-2004-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    362s
  • max time network
    366s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/04/2026, 15:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://www.bluestacks.com/
  • Sample260427-ss7ydaev2t
Score
8/10
defense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file 4 IoCs
  • Modifies Windows Firewall 2 TTPs 4 IoCs
    defense_evasion
  • Checks computer location settings 2 TTPs 12 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 34 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Enumerates processes with tasklist 1 TTPs 19 IoCs
    discovery
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 3 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 9 IoCs
  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.bluestacks.com/
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5256
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffcdf76c728,0x7ffcdf76c734,0x7ffcdf76c740
      2⤵
        PID:2620
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,4422470126037589721,13044325484099416924,262144 --field-trial-handle=1856,i,3889771687862175158,7431031612253166679,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1848 /prefetch:2
        2⤵
          PID:4616
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,6533686209428173722,13884715833742471969,524288 --field-trial-handle=1856,i,3889771687862175158,7431031612253166679,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1972 /prefetch:3
          2⤵
          • Downloads MZ/PE file
          • System Time Discovery
          PID:4764
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,7962094755245941717,11597572604795965268,524288 --field-trial-handle=1856,i,3889771687862175158,7431031612253166679,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1884 /prefetch:8
          2⤵
            PID:4752
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3000,i,751360855722717541,12224328090406138098,2097152 --field-trial-handle=1856,i,3889771687862175158,7431031612253166679,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3024 /prefetch:1
            2⤵
              PID:5316
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3004,i,531797939372770303,6631867687004735728,2097152 --field-trial-handle=1856,i,3889771687862175158,7431031612253166679,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3068 /prefetch:1
              2⤵
                PID:5924
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4376,i,13972405611638039605,174318002067760619,2097152 --field-trial-handle=1856,i,3889771687862175158,7431031612253166679,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4388 /prefetch:2
                2⤵
                  PID:3256
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5460,i,17593551624528589533,5239430545270047412,524288 --field-trial-handle=1856,i,3889771687862175158,7431031612253166679,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5192 /prefetch:8
                  2⤵
                    PID:1596
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,8289207729394257620,486260973877288737,524288 --field-trial-handle=1856,i,3889771687862175158,7431031612253166679,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5504 /prefetch:8
                    2⤵
                      PID:1336
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,12950092081440609602,3562303946736326567,524288 --field-trial-handle=1856,i,3889771687862175158,7431031612253166679,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5388 /prefetch:8
                      2⤵
                        PID:4900
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5604,i,8446040024303327406,2820444487910104155,524288 --field-trial-handle=1856,i,3889771687862175158,7431031612253166679,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5412 /prefetch:8
                        2⤵
                          PID:5304
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4504,i,17568156433426922919,8607117823333131282,2097152 --field-trial-handle=1856,i,3889771687862175158,7431031612253166679,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4464 /prefetch:1
                          2⤵
                            PID:3512
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3628,i,550848552709549344,7737706277144557405,524288 --field-trial-handle=1856,i,3889771687862175158,7431031612253166679,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3660 /prefetch:8
                            2⤵
                              PID:5172
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=732,i,587255788632693496,16532492285954869856,2097152 --field-trial-handle=1856,i,3889771687862175158,7431031612253166679,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3040 /prefetch:1
                              2⤵
                                PID:2644
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3584,i,15272264785694481676,984770634962927047,2097152 --field-trial-handle=1856,i,3889771687862175158,7431031612253166679,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5864 /prefetch:1
                                2⤵
                                  PID:976
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5972,i,8344665038340518039,10661816541812457673,2097152 --field-trial-handle=1856,i,3889771687862175158,7431031612253166679,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5976 /prefetch:1
                                  2⤵
                                    PID:5704
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6188,i,11668026889865966268,18266297303107446268,2097152 --field-trial-handle=1856,i,3889771687862175158,7431031612253166679,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5700 /prefetch:1
                                    2⤵
                                      PID:4864
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3572,i,1551474024525588262,10088563824575510722,2097152 --field-trial-handle=1856,i,3889771687862175158,7431031612253166679,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4496 /prefetch:1
                                      2⤵
                                        PID:5692
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,4846906137751719976,5847424837392684837,524288 --field-trial-handle=1856,i,3889771687862175158,7431031612253166679,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6292 /prefetch:8
                                        2⤵
                                          PID:5388
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5728,i,3900226764717181013,3132800266243058132,524288 --field-trial-handle=1856,i,3889771687862175158,7431031612253166679,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6304 /prefetch:8
                                          2⤵
                                          • Modifies registry class
                                          • Suspicious use of SetWindowsHookEx
                                          PID:4380
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6384,i,14490117997476988065,7899103740932300959,262144 --field-trial-handle=1856,i,3889771687862175158,7431031612253166679,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=728 /prefetch:8
                                          2⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:4520
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3616,i,17056166747845808941,14255107972227466791,2097152 --field-trial-handle=1856,i,3889771687862175158,7431031612253166679,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6348 /prefetch:1
                                          2⤵
                                            PID:5372
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6520,i,17949356953194790180,1527163419488517660,2097152 --field-trial-handle=1856,i,3889771687862175158,7431031612253166679,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6436 /prefetch:1
                                            2⤵
                                              PID:4652
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6364,i,18036011157706578949,6789699135669437534,2097152 --field-trial-handle=1856,i,3889771687862175158,7431031612253166679,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6168 /prefetch:1
                                              2⤵
                                                PID:4640
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6548,i,16024751635502152048,9374658840162994953,2097152 --field-trial-handle=1856,i,3889771687862175158,7431031612253166679,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6664 /prefetch:1
                                                2⤵
                                                  PID:2016
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6880,i,5618681747595673775,10977714622315321688,524288 --field-trial-handle=1856,i,3889771687862175158,7431031612253166679,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6872 /prefetch:8
                                                  2⤵
                                                    PID:4452
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5332,i,11021729826869694683,10343318680550183119,524288 --field-trial-handle=1856,i,3889771687862175158,7431031612253166679,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6608 /prefetch:8
                                                    2⤵
                                                      PID:1140
                                                  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                    1⤵
                                                      PID:4696
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                      1⤵
                                                        PID:2388
                                                      • C:\Windows\System32\rundll32.exe
                                                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                        1⤵
                                                          PID:4116
                                                        • C:\Users\Admin\Downloads\BlueStacksInstaller_5.22.168.1001_native_059b9d8c78f1081e9c277de3a6e40533_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe
                                                          "C:\Users\Admin\Downloads\BlueStacksInstaller_5.22.168.1001_native_059b9d8c78f1081e9c277de3a6e40533_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe"
                                                          1⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5860
                                                          • C:\Users\Admin\AppData\Local\Temp\7zS4E612F99\BlueStacksInstaller.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\7zS4E612F99\BlueStacksInstaller.exe"
                                                            2⤵
                                                            • Downloads MZ/PE file
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • Enumerates connected drives
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2776
                                                            • C:\Users\Admin\AppData\Local\Temp\7zS4E612F99\HD-CheckCpu.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\7zS4E612F99\HD-CheckCpu.exe" --cmd checkHypervEnabled
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5644
                                                            • C:\Users\Admin\AppData\Local\Temp\7zS4E612F99\HD-CheckCpu.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\7zS4E612F99\HD-CheckCpu.exe" --cmd checkSSE4
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5648
                                                            • C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.22.168.1001_nxt.exe
                                                              "C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.22.168.1001_nxt.exe" -s
                                                              3⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Drops file in Program Files directory
                                                              • System Location Discovery: System Language Discovery
                                                              • Modifies registry class
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5340
                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\BlueStacks X\green.vbs"
                                                                4⤵
                                                                • Checks computer location settings
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:7224
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /c green.bat
                                                                  5⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:7304
                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                    netsh advfirewall firewall delete rule name="BlueStacksWeb"
                                                                    6⤵
                                                                    • Modifies Windows Firewall
                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:7364
                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                    netsh advfirewall firewall delete rule name="Cloud Game"
                                                                    6⤵
                                                                    • Modifies Windows Firewall
                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:7584
                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                    netsh advfirewall firewall add rule name="BlueStacksWeb" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\BlueStacksWeb.exe"
                                                                    6⤵
                                                                    • Modifies Windows Firewall
                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:7744
                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                    netsh advfirewall firewall add rule name="Cloud Game" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\Cloud Game.exe"
                                                                    6⤵
                                                                    • Modifies Windows Firewall
                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:7804
                                                            • C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.22.168.1001_native_059b9d8c78f1081e9c277de3a6e40533_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe
                                                              "C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.22.168.1001_native_059b9d8c78f1081e9c277de3a6e40533_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe" -versionMachineID=d44f1ef1-c64d-45fe-a36d-49a76fd0533b -machineID=fd50cf20-c14b-40ae-bac5-1723fac0795d -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Pie64 -imageToLaunch=Pie64 -isSSE4Available=1 -appToLaunch=bs5 -bsxVersion=10.42.168.1001 -country=GB -isWalletFeatureEnabled -discordUrl=https://discord.gg/UnXV7taVs4
                                                              3⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:9088
                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0837C17B\Bootstrapper.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\7zS0837C17B\Bootstrapper.exe" -versionMachineID=d44f1ef1-c64d-45fe-a36d-49a76fd0533b -machineID=fd50cf20-c14b-40ae-bac5-1723fac0795d -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Pie64 -imageToLaunch=Pie64 -isSSE4Available=1 -appToLaunch=bs5 -bsxVersion=10.42.168.1001 -country=GB -isWalletFeatureEnabled -discordUrl=https://discord.gg/UnXV7taVs4
                                                                4⤵
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:8356
                                                                • C:\Users\Admin\AppData\Local\Temp\7zS0837C17B\BlueStacksInstaller.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\7zS0837C17B\BlueStacksInstaller.exe" -versionMachineID="d44f1ef1-c64d-45fe-a36d-49a76fd0533b" -machineID="fd50cf20-c14b-40ae-bac5-1723fac0795d" -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName="Pie64" -imageToLaunch="Pie64" -appToLaunch="bs5" -bsxVersion="10.42.168.1001" -country="GB" -isWalletFeatureEnabled -discordUrl="https://discord.gg/UnXV7taVs4" -parentpath="C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.22.168.1001_native_059b9d8c78f1081e9c277de3a6e40533_MzsxNSwwOzUsMTsxNSw0OzE1LDU7MTU=.exe" -md5=059b9d8c78f1081e9c277de3a6e40533 -app64=
                                                                  5⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:8288
                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS0837C17B\7zr.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\7zS0837C17B\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\7zS0837C17B\CommonInstallUtils.zip" -o"C:\Users\Admin\AppData\Local\Temp\7zS0837C17B\" -aoa
                                                                    6⤵
                                                                    • Executes dropped EXE
                                                                    PID:9344
                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS0837C17B\HD-ForceGPU.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\7zS0837C17B\HD-ForceGPU.exe" 1 "C:\Program Files\BlueStacks_nxt"
                                                                    6⤵
                                                                    • Executes dropped EXE
                                                                    PID:9788
                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS0837C17B\HD-GLCheck.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\7zS0837C17B\HD-GLCheck.exe" 1 2
                                                                    6⤵
                                                                    • Executes dropped EXE
                                                                    PID:9960
                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS0837C17B\HD-GLCheck.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\7zS0837C17B\HD-GLCheck.exe" 4 2
                                                                    6⤵
                                                                    • Executes dropped EXE
                                                                    PID:10024
                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS0837C17B\HD-GLCheck.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\7zS0837C17B\HD-GLCheck.exe" 2 2
                                                                    6⤵
                                                                    • Executes dropped EXE
                                                                    PID:3796
                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS0837C17B\HD-GLCheck.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\7zS0837C17B\HD-GLCheck.exe" 1 1
                                                                    6⤵
                                                                    • Executes dropped EXE
                                                                    PID:892
                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS0837C17B\HD-GLCheck.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\7zS0837C17B\HD-GLCheck.exe" 4 1
                                                                    6⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:728
                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS0837C17B\HD-GLCheck.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\7zS0837C17B\HD-GLCheck.exe" 2 1
                                                                    6⤵
                                                                    • Executes dropped EXE
                                                                    PID:5344
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.bluestacks.com/download.html
                                                                    6⤵
                                                                      PID:4328
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://www.bluestacks.com/download.html
                                                                        7⤵
                                                                        • Checks processor information in registry
                                                                        • Enumerates system info in registry
                                                                        • Modifies data under HKEY_USERS
                                                                        • Modifies registry class
                                                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                        • Suspicious use of FindShellTrayWindow
                                                                        PID:7556
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2a8,0x7ffcace0c188,0x7ffcace0c194,0x7ffcace0c1a0
                                                                          8⤵
                                                                            PID:1204
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1940,i,15493452789777697691,6125053028099826705,262144 --field-trial-handle=1960,i,10502334011621399131,6516774849781085856,262144 --variations-seed-version --mojo-platform-channel-handle=1956 /prefetch:2
                                                                            8⤵
                                                                              PID:3760
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,12505244580831885706,17504081811555038283,524288 --field-trial-handle=1960,i,10502334011621399131,6516774849781085856,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
                                                                              8⤵
                                                                              • Downloads MZ/PE file
                                                                              • System Time Discovery
                                                                              PID:8968
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,6614354167392339896,8523884395217782426,524288 --field-trial-handle=1960,i,10502334011621399131,6516774849781085856,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
                                                                              8⤵
                                                                                PID:8784
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,14116414336504074414,7498012242547159275,2097152 --field-trial-handle=1960,i,10502334011621399131,6516774849781085856,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
                                                                                8⤵
                                                                                  PID:8540
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,13213265606699180532,13790148263309319702,2097152 --field-trial-handle=1960,i,10502334011621399131,6516774849781085856,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
                                                                                  8⤵
                                                                                    PID:8532
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,17907222129126868643,3634386352983172207,524288 --field-trial-handle=1960,i,10502334011621399131,6516774849781085856,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
                                                                                    8⤵
                                                                                      PID:9508
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,13379776208955314485,16406373140578003687,524288 --field-trial-handle=1960,i,10502334011621399131,6516774849781085856,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
                                                                                      8⤵
                                                                                        PID:9540
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,9280972588033327442,9540462475657509333,524288 --field-trial-handle=1960,i,10502334011621399131,6516774849781085856,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
                                                                                        8⤵
                                                                                          PID:9756
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,9280972588033327442,9540462475657509333,524288 --field-trial-handle=1960,i,10502334011621399131,6516774849781085856,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
                                                                                          8⤵
                                                                                            PID:9668
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,3853700466530714457,3644193594026506785,524288 --field-trial-handle=1960,i,10502334011621399131,6516774849781085856,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
                                                                                            8⤵
                                                                                              PID:2840
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6396,i,2356807385003036810,14393103826497601682,2097152 --field-trial-handle=1960,i,10502334011621399131,6516774849781085856,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1
                                                                                              8⤵
                                                                                                PID:5344
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,7325403878186329982,11149944817205654323,524288 --field-trial-handle=1960,i,10502334011621399131,6516774849781085856,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:8
                                                                                                8⤵
                                                                                                  PID:5012
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,2793536294304032343,6344472429111694547,524288 --field-trial-handle=1960,i,10502334011621399131,6516774849781085856,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:8
                                                                                                  8⤵
                                                                                                    PID:6184
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                                                                                    8⤵
                                                                                                    • Drops file in Program Files directory
                                                                                                    • Checks processor information in registry
                                                                                                    • Enumerates system info in registry
                                                                                                    • Modifies data under HKEY_USERS
                                                                                                    • Modifies registry class
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    PID:11020
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffcace0c188,0x7ffcace0c194,0x7ffcace0c1a0
                                                                                                      9⤵
                                                                                                        PID:11180
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,4919977003463062393,10962552939949494456,524288 --field-trial-handle=2236,i,15071295594065042795,2725541100639579397,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
                                                                                                        9⤵
                                                                                                        • System Time Discovery
                                                                                                        PID:6640
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,13408313720468775814,5899158017931018516,262144 --field-trial-handle=2236,i,15071295594065042795,2725541100639579397,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
                                                                                                        9⤵
                                                                                                          PID:6556
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,4429488289795613618,16352824209100397041,524288 --field-trial-handle=2236,i,15071295594065042795,2725541100639579397,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
                                                                                                          9⤵
                                                                                                            PID:6524
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,833546734176225818,13177765480938503428,524288 --field-trial-handle=2236,i,15071295594065042795,2725541100639579397,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
                                                                                                            9⤵
                                                                                                              PID:7132
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,833546734176225818,13177765480938503428,524288 --field-trial-handle=2236,i,15071295594065042795,2725541100639579397,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
                                                                                                              9⤵
                                                                                                                PID:7156
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,2154593663277746333,10681446694954437250,524288 --field-trial-handle=2236,i,15071295594065042795,2725541100639579397,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:8
                                                                                                                9⤵
                                                                                                                  PID:6548
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,177368573807664392,5493322533895250987,524288 --field-trial-handle=2236,i,15071295594065042795,2725541100639579397,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:8
                                                                                                                  9⤵
                                                                                                                    PID:6440
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,2156686341622563079,15238106732730368478,524288 --field-trial-handle=2236,i,15071295594065042795,2725541100639579397,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:8
                                                                                                                    9⤵
                                                                                                                      PID:6424
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3080,i,11984222231326664335,10438138765883071839,524288 --field-trial-handle=2236,i,15071295594065042795,2725541100639579397,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:8
                                                                                                                      9⤵
                                                                                                                        PID:4512
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2792,i,11456383360033334914,6051526990764763743,524288 --field-trial-handle=2236,i,15071295594065042795,2725541100639579397,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:8
                                                                                                                        9⤵
                                                                                                                          PID:540
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,4492776987888849472,16511692231237257776,524288 --field-trial-handle=2236,i,15071295594065042795,2725541100639579397,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
                                                                                                                          9⤵
                                                                                                                            PID:7992
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4796,i,3286207588642016359,6530671916450051460,262144 --field-trial-handle=2236,i,15071295594065042795,2725541100639579397,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
                                                                                                                            9⤵
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            PID:4840
                                                                                                          • C:\ProgramData\BlueStacksServicesSetup.exe
                                                                                                            "C:\ProgramData\BlueStacksServicesSetup.exe"
                                                                                                            1⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:8152
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq BlueStacksServices.exe" | find "BlueStacksServices.exe"
                                                                                                              2⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:8060
                                                                                                              • C:\Windows\SysWOW64\tasklist.exe
                                                                                                                tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq BlueStacksServices.exe"
                                                                                                                3⤵
                                                                                                                • Enumerates processes with tasklist
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                PID:8016
                                                                                                              • C:\Windows\SysWOW64\find.exe
                                                                                                                find "BlueStacksServices.exe"
                                                                                                                3⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:8008
                                                                                                          • C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --hidden --initialLaunch
                                                                                                            1⤵
                                                                                                            • Checks computer location settings
                                                                                                            • Executes dropped EXE
                                                                                                            • Adds Run key to start application
                                                                                                            • Drops file in System32 directory
                                                                                                            • Modifies registry class
                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                            PID:6176
                                                                                                            • C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1616 --field-trial-handle=1752,i,3130170687024351369,18337467031773906689,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                                                                                                              2⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:10316
                                                                                                            • C:\Windows\system32\cscript.exe
                                                                                                              cscript.exe
                                                                                                              2⤵
                                                                                                                PID:10328
                                                                                                              • C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --mojo-platform-channel-handle=2008 --field-trial-handle=1752,i,3130170687024351369,18337467031773906689,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
                                                                                                                2⤵
                                                                                                                • Executes dropped EXE
                                                                                                                PID:10528
                                                                                                              • C:\Windows\system32\cscript.exe
                                                                                                                cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKCU\SOFTWARE\BlueStacksServices
                                                                                                                2⤵
                                                                                                                  PID:10456
                                                                                                                • C:\Windows\system32\cscript.exe
                                                                                                                  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKCU\SOFTWARE\BlueStacksServices
                                                                                                                  2⤵
                                                                                                                    PID:10712
                                                                                                                  • C:\Windows\system32\cscript.exe
                                                                                                                    cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regPutValue.wsf A
                                                                                                                    2⤵
                                                                                                                      PID:10812
                                                                                                                    • C:\Windows\system32\cscript.exe
                                                                                                                      cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regPutValue.wsf A
                                                                                                                      2⤵
                                                                                                                        PID:10916
                                                                                                                      • C:\Windows\system32\cscript.exe
                                                                                                                        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
                                                                                                                        2⤵
                                                                                                                          PID:6456
                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --app-user-model-id=com.bluestacks.services --app-path="C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2648 --field-trial-handle=1752,i,3130170687024351369,18337467031773906689,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
                                                                                                                          2⤵
                                                                                                                          • Checks computer location settings
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:6320
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                          2⤵
                                                                                                                            PID:3272
                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                              tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                              3⤵
                                                                                                                              • Enumerates processes with tasklist
                                                                                                                              PID:7540
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                            2⤵
                                                                                                                              PID:7208
                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                3⤵
                                                                                                                                • Enumerates processes with tasklist
                                                                                                                                PID:7716
                                                                                                                            • C:\Windows\system32\cscript.exe
                                                                                                                              cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
                                                                                                                              2⤵
                                                                                                                                PID:7272
                                                                                                                              • C:\Windows\system32\cscript.exe
                                                                                                                                cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
                                                                                                                                2⤵
                                                                                                                                  PID:7300
                                                                                                                                • C:\Windows\system32\cscript.exe
                                                                                                                                  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
                                                                                                                                  2⤵
                                                                                                                                    PID:7240
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                    2⤵
                                                                                                                                      PID:4384
                                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                                        tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                        3⤵
                                                                                                                                        • Enumerates processes with tasklist
                                                                                                                                        PID:7348
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                      2⤵
                                                                                                                                        PID:7804
                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                          tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                          3⤵
                                                                                                                                          • Enumerates processes with tasklist
                                                                                                                                          PID:3716
                                                                                                                                      • C:\Windows\system32\cscript.exe
                                                                                                                                        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
                                                                                                                                        2⤵
                                                                                                                                          PID:7308
                                                                                                                                        • C:\Windows\system32\cscript.exe
                                                                                                                                          cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
                                                                                                                                          2⤵
                                                                                                                                            PID:4868
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                            2⤵
                                                                                                                                              PID:8448
                                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                                tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                3⤵
                                                                                                                                                • Enumerates processes with tasklist
                                                                                                                                                PID:5768
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                              2⤵
                                                                                                                                                PID:8432
                                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                                  tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                  3⤵
                                                                                                                                                  • Enumerates processes with tasklist
                                                                                                                                                  PID:8188
                                                                                                                                              • C:\Windows\system32\cscript.exe
                                                                                                                                                cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
                                                                                                                                                2⤵
                                                                                                                                                  PID:9844
                                                                                                                                                • C:\Windows\system32\cscript.exe
                                                                                                                                                  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
                                                                                                                                                  2⤵
                                                                                                                                                    PID:5972
                                                                                                                                                  • C:\Windows\system32\cscript.exe
                                                                                                                                                    cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:10212
                                                                                                                                                    • C:\Windows\system32\cscript.exe
                                                                                                                                                      cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
                                                                                                                                                      2⤵
                                                                                                                                                        PID:6212
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                        2⤵
                                                                                                                                                          PID:5576
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Enumerates processes with tasklist
                                                                                                                                                            PID:4640
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                          2⤵
                                                                                                                                                            PID:5432
                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                              tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                              3⤵
                                                                                                                                                              • Enumerates processes with tasklist
                                                                                                                                                              PID:4064
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                            2⤵
                                                                                                                                                              PID:6628
                                                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                                                tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                                3⤵
                                                                                                                                                                • Enumerates processes with tasklist
                                                                                                                                                                PID:6972
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                              2⤵
                                                                                                                                                                PID:6584
                                                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                                                  tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Enumerates processes with tasklist
                                                                                                                                                                  PID:7192
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:7676
                                                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                                                    tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Enumerates processes with tasklist
                                                                                                                                                                    PID:7800
                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:7752
                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                      tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Enumerates processes with tasklist
                                                                                                                                                                      PID:420
                                                                                                                                                                  • C:\Windows\system32\cscript.exe
                                                                                                                                                                    cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:5660
                                                                                                                                                                    • C:\Program Files (x86)\BlueStacks X\BlueStacks X.exe
                                                                                                                                                                      "C:\Program Files (x86)\BlueStacks X\BlueStacks X.exe"
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                      • Modifies system certificate store
                                                                                                                                                                      • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                      PID:5212
                                                                                                                                                                      • C:\Program Files (x86)\BlueStacks X\BlueStacksWeb.exe
                                                                                                                                                                        BlueStacksWeb.exe --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,NetworkServiceInProcess,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,InstalledApp,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --lang=en --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --mojo-platform-channel-handle=4948 /prefetch:1
                                                                                                                                                                        3⤵
                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                        PID:9476
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\BlueStacks X\BlueStacks-Installer_5.22.168.1001_amd64_native.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\BlueStacks X\BlueStacks-Installer_5.22.168.1001_amd64_native.exe" -s -defaultImageName Pie64 -imageToLaunch Pie64 -appToLaunch=bsx
                                                                                                                                                                        3⤵
                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:8896
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Bootstrapper.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Bootstrapper.exe" -s -defaultImageName Pie64 -imageToLaunch Pie64 -appToLaunch=bsx
                                                                                                                                                                          4⤵
                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                          PID:4460
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\BlueStacksInstaller.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\BlueStacksInstaller.exe" -s -defaultImageName="Pie64" -imageToLaunch="Pie64" -appToLaunch="bsx" -parentpath="C:\Users\Admin\AppData\Local\BlueStacks X\BlueStacks-Installer_5.22.168.1001_amd64_native.exe"
                                                                                                                                                                            5⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            PID:6440
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\7zr.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\CommonInstallUtils.zip" -o"C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\" -aoa
                                                                                                                                                                              6⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:7812
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\HD-ForceGPU.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\HD-ForceGPU.exe" 1 "C:\Program Files\BlueStacks_nxt"
                                                                                                                                                                              6⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:8272
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\HD-GLCheck.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\HD-GLCheck.exe" 1 2
                                                                                                                                                                              6⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:8292
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\HD-GLCheck.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\HD-GLCheck.exe" 4 2
                                                                                                                                                                              6⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:9112
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\HD-GLCheck.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\HD-GLCheck.exe" 2 2
                                                                                                                                                                              6⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:10944
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\HD-GLCheck.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\HD-GLCheck.exe" 1 1
                                                                                                                                                                              6⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:4508
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\HD-GLCheck.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\HD-GLCheck.exe" 4 1
                                                                                                                                                                              6⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                              PID:8568
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\HD-GLCheck.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\HD-GLCheck.exe" 2 1
                                                                                                                                                                              6⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:8016
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:7592
                                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                                          tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Enumerates processes with tasklist
                                                                                                                                                                          PID:7672
                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:7796
                                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                                            tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Enumerates processes with tasklist
                                                                                                                                                                            PID:5820
                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:852
                                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                                              tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Enumerates processes with tasklist
                                                                                                                                                                              PID:176
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:3596
                                                                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Enumerates processes with tasklist
                                                                                                                                                                                PID:3676
                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:10324
                                                                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                  tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Enumerates processes with tasklist
                                                                                                                                                                                  PID:10500
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:7980
                                                                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                    tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Enumerates processes with tasklist
                                                                                                                                                                                    PID:9592
                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:8916
                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:10188
                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:10884

                                                                                                                                                                                    Network

                                                                                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                                                                                          Reconnaissance

                                                                                                                                                                                          Resource Development

                                                                                                                                                                                          Initial Access

                                                                                                                                                                                          Execution

                                                                                                                                                                                          Persistence

                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                          1
                                                                                                                                                                                          T1547

                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                          1
                                                                                                                                                                                          T1547.001

                                                                                                                                                                                          Create or Modify System Process

                                                                                                                                                                                          1
                                                                                                                                                                                          T1543

                                                                                                                                                                                          Windows Service

                                                                                                                                                                                          1
                                                                                                                                                                                          T1543.003

                                                                                                                                                                                          Event Triggered Execution

                                                                                                                                                                                          1
                                                                                                                                                                                          T1546

                                                                                                                                                                                          Netsh Helper DLL

                                                                                                                                                                                          1
                                                                                                                                                                                          T1546.007

                                                                                                                                                                                          Privilege Escalation

                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                          1
                                                                                                                                                                                          T1547

                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                          1
                                                                                                                                                                                          T1547.001

                                                                                                                                                                                          Create or Modify System Process

                                                                                                                                                                                          1
                                                                                                                                                                                          T1543

                                                                                                                                                                                          Windows Service

                                                                                                                                                                                          1
                                                                                                                                                                                          T1543.003

                                                                                                                                                                                          Event Triggered Execution

                                                                                                                                                                                          1
                                                                                                                                                                                          T1546

                                                                                                                                                                                          Netsh Helper DLL

                                                                                                                                                                                          1
                                                                                                                                                                                          T1546.007

                                                                                                                                                                                          Defense Evasion

                                                                                                                                                                                          Impair Defenses

                                                                                                                                                                                          1
                                                                                                                                                                                          T1562

                                                                                                                                                                                          Disable or Modify System Firewall

                                                                                                                                                                                          1
                                                                                                                                                                                          T1562.004

                                                                                                                                                                                          Modify Registry

                                                                                                                                                                                          2
                                                                                                                                                                                          T1112

                                                                                                                                                                                          Subvert Trust Controls

                                                                                                                                                                                          1
                                                                                                                                                                                          T1553

                                                                                                                                                                                          Install Root Certificate

                                                                                                                                                                                          1
                                                                                                                                                                                          T1553.004

                                                                                                                                                                                          Credential Access

                                                                                                                                                                                          Credentials from Password Stores

                                                                                                                                                                                          1
                                                                                                                                                                                          T1555

                                                                                                                                                                                          Credentials from Web Browsers

                                                                                                                                                                                          1
                                                                                                                                                                                          T1555.003

                                                                                                                                                                                          Unsecured Credentials

                                                                                                                                                                                          1
                                                                                                                                                                                          T1552

                                                                                                                                                                                          Credentials In Files

                                                                                                                                                                                          1
                                                                                                                                                                                          T1552.001

                                                                                                                                                                                          Discovery

                                                                                                                                                                                          Browser Information Discovery

                                                                                                                                                                                          1
                                                                                                                                                                                          T1217

                                                                                                                                                                                          Peripheral Device Discovery

                                                                                                                                                                                          1
                                                                                                                                                                                          T1120

                                                                                                                                                                                          Process Discovery

                                                                                                                                                                                          1
                                                                                                                                                                                          T1057

                                                                                                                                                                                          Query Registry

                                                                                                                                                                                          5
                                                                                                                                                                                          T1012

                                                                                                                                                                                          System Information Discovery

                                                                                                                                                                                          5
                                                                                                                                                                                          T1082

                                                                                                                                                                                          System Location Discovery

                                                                                                                                                                                          1
                                                                                                                                                                                          T1614

                                                                                                                                                                                          System Language Discovery

                                                                                                                                                                                          1
                                                                                                                                                                                          T1614.001

                                                                                                                                                                                          System Time Discovery

                                                                                                                                                                                          1
                                                                                                                                                                                          T1124

                                                                                                                                                                                          Lateral Movement

                                                                                                                                                                                          Collection

                                                                                                                                                                                          Data from Local System

                                                                                                                                                                                          1
                                                                                                                                                                                          T1005

                                                                                                                                                                                          Command and Control

                                                                                                                                                                                          Exfiltration

                                                                                                                                                                                          Impact

                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                          Downloads

                                                                                                                                                                                          BlueStacks X.exe
                                                                                                                                                                                          • Path C:\Program Files (x86)\BlueStacks X\BlueStacks X.exe
                                                                                                                                                                                          • Size 496KB
                                                                                                                                                                                          • SHA256 5c3d7b15523faabc67ce368d38eb240581ba4edfdfb9993ca0d9277959a5e114
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          close_disabled.svg
                                                                                                                                                                                          • Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_disabled.svg
                                                                                                                                                                                          • Size 569B
                                                                                                                                                                                          • SHA256 8ee5aa84139b2ea5549f7272523aeb203d73954c5ccdcf6f7407bf1a3469f13e
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          close_hover.svg
                                                                                                                                                                                          • Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_hover.svg
                                                                                                                                                                                          • Size 653B
                                                                                                                                                                                          • SHA256 1bca2e912184b8168ee8961de68d1d839f4f9827fde6f48ab100fb61e82eff90
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          close_normal.svg
                                                                                                                                                                                          • Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_normal.svg
                                                                                                                                                                                          • Size 569B
                                                                                                                                                                                          • SHA256 92aeae68e9e0973d9e0dc575941f1cb2e24afd0574341a46b870be7384eaa537
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          close_pressed.svg
                                                                                                                                                                                          • Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_pressed.svg
                                                                                                                                                                                          • Size 653B
                                                                                                                                                                                          • SHA256 9585f41eb6202e89f2087266fa31852d7f41ca8cc659b907c96753fe165f937d
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          keys.json
                                                                                                                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping11020_1549662633\keys.json
                                                                                                                                                                                          • Size 8KB
                                                                                                                                                                                          • SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          manifest.json
                                                                                                                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping11020_1549662633\manifest.json
                                                                                                                                                                                          • Size 79B
                                                                                                                                                                                          • SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          54b043f1f72ad7872ebbec9fd8b88a46-RnJpLCAxMCBKYW4gMjAyNSAxMzoxMjo0MiBHTVQ=
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\BlueStacks X\Banner\54b043f1f72ad7872ebbec9fd8b88a46-RnJpLCAxMCBKYW4gMjAyNSAxMzoxMjo0MiBHTVQ=
                                                                                                                                                                                          • Size 71KB
                                                                                                                                                                                          • SHA256 c7b5a12071ca2a358d20dfc8793ac28c5413212e54ec4fb5ea9d6f6338ea8382
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Impression.json
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\BlueStacks X\LocalGames\Impression.json
                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                          • SHA256 8848154e2f1b5aed2785c4fd4bdd04669102914737370f586602df4a88d2c7f6
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          log.txt
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\BlueStacks X\Log\log.txt
                                                                                                                                                                                          • Size 772B
                                                                                                                                                                                          • SHA256 a22226601696d5ff8b1172284581425ad0af3091be99c623b39d28c073981a91
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          log.txt
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\BlueStacks X\Log\log.txt
                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                          • SHA256 f6bc8ad3ebfd79767f548287631798c2170f36a9f16fb7840cf1f6641bbb9736
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          log.txt
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\BlueStacks X\Log\log.txt
                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                          • SHA256 32f7cd9e6bf24e70d1634ab8b1799f2c58b1037f4bf30314b1382cc5be9b1f6e
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          log.txt
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\BlueStacks X\Log\log.txt
                                                                                                                                                                                          • Size 5KB
                                                                                                                                                                                          • SHA256 bd2d53ee29b13a3a0942556da5d02e685c489e8ab52b805f18fe70f89d491417
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\BlueStacks X\QtWebEngine\Default\Network Persistent State
                                                                                                                                                                                          • Size 583B
                                                                                                                                                                                          • SHA256 84c5e02dbfa937439b00d9c652f8720d9b3b7db45be5b26035c81509e8247792
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          TransportSecurity
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\BlueStacks X\QtWebEngine\Default\TransportSecurity
                                                                                                                                                                                          • Size 539B
                                                                                                                                                                                          • SHA256 6dfe457b6ccf5076579d45d6c4bd8d9b8e8caf19674f1d91e80917000621e141
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          TransportSecurity
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\BlueStacks X\QtWebEngine\Default\TransportSecurity
                                                                                                                                                                                          • Size 706B
                                                                                                                                                                                          • SHA256 60a708dc102b5af1e0e582b32727da6f79b627fb6f523ef0d9fa8615c57cff66
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          TransportSecurity~RFe5c4398.TMP
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\BlueStacks X\QtWebEngine\Default\TransportSecurity~RFe5c4398.TMP
                                                                                                                                                                                          • Size 539B
                                                                                                                                                                                          • SHA256 f86be215cea0483e4f36ecdb6c3bc6c9a5518ad6c4a0ddb900863e96a7e8b887
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          data_0
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\QtWebEngine\Default\Cache\data_0
                                                                                                                                                                                          • Size 8KB
                                                                                                                                                                                          • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          data_2
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\QtWebEngine\Default\Cache\data_2
                                                                                                                                                                                          • Size 8KB
                                                                                                                                                                                          • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          data_3
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\QtWebEngine\Default\Cache\data_3
                                                                                                                                                                                          • Size 8KB
                                                                                                                                                                                          • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          f_000010
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\QtWebEngine\Default\Cache\f_000010
                                                                                                                                                                                          • Size 90KB
                                                                                                                                                                                          • SHA256 58eb46e2217c709086f24352bd0c81d3809b1b209c9efa8b64943d33062ebbd1
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          f_000014
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\QtWebEngine\Default\Cache\f_000014
                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                          • SHA256 11f3849795b1871889a64b1a0ddcf6d66fa1894a76dbb199f6ca244707d858a4
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          f_000015
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\QtWebEngine\Default\Cache\f_000015
                                                                                                                                                                                          • Size 98KB
                                                                                                                                                                                          • SHA256 21ec52cf2d5be1500fa6d9ac473ab1ac60db5cdb120de7e1d4a3c8d8c03286b5
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          f_000016
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\QtWebEngine\Default\Cache\f_000016
                                                                                                                                                                                          • Size 89KB
                                                                                                                                                                                          • SHA256 7183592ec54c374496394e3e6cfb953afb420d9cc67e53d2ea981c3870344e0c
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          f_000017
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\QtWebEngine\Default\Cache\f_000017
                                                                                                                                                                                          • Size 132KB
                                                                                                                                                                                          • SHA256 ca85e4aa7f06e0c787ced7a2de1700a684ddd2c6b4c2f12f7232c4cd3a72dc37
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          f_000018
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\QtWebEngine\Default\Cache\f_000018
                                                                                                                                                                                          • Size 147KB
                                                                                                                                                                                          • SHA256 67b5a190b3700e223aa82b99a4d21baf58141638824d19d8dc92566360f53b06
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          BlueStacks-Installer_5.22.168.1001.log
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Bluestacks\BlueStacks-Installer_5.22.168.1001.log
                                                                                                                                                                                          • Size 187KB
                                                                                                                                                                                          • SHA256 ca5734e87b8136a804ceb2de76cc4b3bca51519e589316c9b559d1b2bf88c4ad
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          BookmarkMergedSurfaceOrdering
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                                                                          • Size 6B
                                                                                                                                                                                          • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          f_000016
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016
                                                                                                                                                                                          • Size 927KB
                                                                                                                                                                                          • SHA256 1b92384637507dee9fd2a36df3531241351ca90c866f6589961eb320d850b607
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          f_00002e
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002e
                                                                                                                                                                                          • Size 361KB
                                                                                                                                                                                          • SHA256 02ff49f4431a46d64078b37db37186bd2f8c65655c9a81086ff174ead4486a18
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          f_00004d
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004d
                                                                                                                                                                                          • Size 74KB
                                                                                                                                                                                          • SHA256 c53faff52d0e438b822bf81b5545a12deb8565c9805ec7349c2547c80184db5a
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          the-real-index
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                          • SHA256 687e1537c3dfa1678f9d130a5b72ee2d72f2f8b6798cf79e6de82b59ca041036
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          the-real-index
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                          • Size 456B
                                                                                                                                                                                          • SHA256 c7a9414a5f9ba620206adaf573052fa531976c58c3262d960b37e4f65aefa3a4
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          the-real-index
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                          • SHA256 95638a5d9a5669779a7d5451ac908f1dee3c864a4b8d7d19427aab49433c45b0
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                          • Size 13KB
                                                                                                                                                                                          • SHA256 27df1392576602c1cca7b59182ab2438f29db22e5fcf4376760c161bccdd6a25
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                          • Size 6KB
                                                                                                                                                                                          • SHA256 d717edf500d44bdead8b709dd7513b97ccf72d1ca04ba01b497518348a200c2f
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                          • Size 16KB
                                                                                                                                                                                          • SHA256 798568f12003fa629d74f3660ff3beb8c0dd37172694d532739b416f8a7e88b8
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          SCT Auditing Pending Reports
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                          • Size 2B
                                                                                                                                                                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Preferences
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                          • Size 12KB
                                                                                                                                                                                          • SHA256 03f028e60ba9f4793ba8e402da321a70f619ddf1b79898d3c6b32009b46402f0
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Preferences
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                          • Size 14KB
                                                                                                                                                                                          • SHA256 b1233e13077b20f5a9de9d7012405f66e9c8c1a8959015f58e4f3eb4cb522533
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Preferences
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                          • Size 14KB
                                                                                                                                                                                          • SHA256 af51260cc13619193ea46185422a0044028a3a7c8708fea757b63fbdc6fb9446
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Preferences
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                          • Size 14KB
                                                                                                                                                                                          • SHA256 43425daaeaf7d637f6de95ea9daa3fe1a42031fecb503c1dbda147dbadfc2a1d
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Preferences
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                          • Size 15KB
                                                                                                                                                                                          • SHA256 664e190f317ec345c25896a5a4ce19d961f1249c154f145aaf3b29ea959f5a36
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Preferences
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                          • Size 15KB
                                                                                                                                                                                          • SHA256 83afd191546220fb3b29d10cd823118371a21b143d6f8499a3f4893b56babccd
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Preferences
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                          • Size 15KB
                                                                                                                                                                                          • SHA256 d592c58f813dd80bbf588172ccaebd42f6a0b2cd2c39571a502ab4f4f555f774
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Preferences
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                          • Size 15KB
                                                                                                                                                                                          • SHA256 4fe0c9297267094741a66a86bf9a3d3507e9b7bae5af7324b15560895e0469d0
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Preferences
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                          • Size 13KB
                                                                                                                                                                                          • SHA256 e1fdb7beb27d43b57820b87249604f8caf6729c7aeb4646e610ce273e9cff7e4
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Secure Preferences
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                          • Size 17KB
                                                                                                                                                                                          • SHA256 faf205f38f14aaebb964cc4c6cac86c1d9eed1cc4597cf300d120c12563fcb8a
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          the-real-index
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                                          • Size 120B
                                                                                                                                                                                          • SHA256 4b59fd77d7003bb568bc1f2c67ff4c3c71546919a982e3cba43157281f110301
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          the-real-index
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                                          • Size 144B
                                                                                                                                                                                          • SHA256 0d9c19bb10d04cbe4e20c8ca161b7dca45d7fbca938bef1a3f47772421b28b43
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          the-real-index~RFe58683b.TMP
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58683b.TMP
                                                                                                                                                                                          • Size 96B
                                                                                                                                                                                          • SHA256 72acd7ea6ec284dd31f53df424a50e40a1e580de3cf3965a84cc388d66639d7c
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          the-real-index
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
                                                                                                                                                                                          • Size 72B
                                                                                                                                                                                          • SHA256 941151d6164a46056a1dbc4e8e1a8122106f51e677c524555c5ce3cd7d354c33
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          f61ba801-cf35-4545-b072-4b754588feb6.tmp
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f61ba801-cf35-4545-b072-4b754588feb6.tmp
                                                                                                                                                                                          • Size 414B
                                                                                                                                                                                          • SHA256 8d9bb79224fb57b685fa409be0ef17c20ecb24a81b274e6e54c02e1d1e81a655
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Local State
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                          • Size 89KB
                                                                                                                                                                                          • SHA256 5bcf32d55d9d4964ca971c390a9a1f85de8eea09aa87bb1cd320bfe4f2c79143
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Local State
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                          • Size 90KB
                                                                                                                                                                                          • SHA256 4e3657e60d28244eba71e67bc813993593fd901910c1df8a23ab3aee3156ae57
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Local State
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                          • Size 90KB
                                                                                                                                                                                          • SHA256 dc355565133908d9484450e01b6fabbe242e9a66272838c99ebff83128fd1906
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Local State
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                          • Size 91KB
                                                                                                                                                                                          • SHA256 ed26f95b5205b423f74bec0dc93d46209f4e0f05a82c04f84f828cf6a378be4e
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Local State
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                          • Size 91KB
                                                                                                                                                                                          • SHA256 3d2430ac6369d202ad53f7060b30fbc247066b1cb569f04c7c5573e8c819ddca
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Local State
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                          • Size 91KB
                                                                                                                                                                                          • SHA256 bf979194acd28329bc1c6ee389974680669ef52201702bd14bb13c98cc6f18ce
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Local State
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                          • Size 91KB
                                                                                                                                                                                          • SHA256 8fbb70b32d87da5dfa7d72749958d0ebde00f175487093cfa17e0e0dae4f2904
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          settings.dat
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                          • Size 280B
                                                                                                                                                                                          • SHA256 cd04dec9a65c9ebbd9698b7d59631c916e6b6a0a7afdb22ef48d8a4a82d902d0
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          settings.dat
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                          • Size 280B
                                                                                                                                                                                          • SHA256 c7296caf0e9cce556825f28f3642cb5ac31e31a0ff760d227744d879c3a93dee
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          settings.dat
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                          • Size 280B
                                                                                                                                                                                          • SHA256 a4836dbaf78096bd27813596167584c682487ec87cfd0465e188bc58a9318295
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          settings.dat
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                          • Size 280B
                                                                                                                                                                                          • SHA256 5f806ea702c2bdb8a9677dbdf857f0fda3766130f88e4ffb438111d47138ae38
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          settings.dat
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                          • Size 280B
                                                                                                                                                                                          • SHA256 88e88e53920029a69225cf9aff5269b42955e95a56938ba33a98c15aff64803e
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          BrowsingTopicsState
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                                                                                                                                                                          • Size 414B
                                                                                                                                                                                          • SHA256 7a4555ae7960850140ef296454665f121530c030be6788a5501a2aedf9c3b200
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          f_00008e
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
                                                                                                                                                                                          • Size 107KB
                                                                                                                                                                                          • SHA256 b75793e2f108f176af15fdd89a480711aabf67e65f7216e8b90faf84677af52d
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          the-real-index
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                          • SHA256 5553c9d6b4f5cadeac6dcef801c968fe52d05d32d9bf4f541141502c3db00d5b
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          the-real-index~RFe5bb9e6.TMP
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5bb9e6.TMP
                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                          • SHA256 8a63b7edc56641c6509e67c49bcd0d48b0b2be81657b607883a89b5115f470f6
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          SiteList-Enterprise.json
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                                                          • Size 2B
                                                                                                                                                                                          • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          data_1
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
                                                                                                                                                                                          • Size 264KB
                                                                                                                                                                                          • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          HubApps
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                                                                                                                          • Size 106KB
                                                                                                                                                                                          • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                          • Size 5KB
                                                                                                                                                                                          • SHA256 2f317cccfd1ee2d1781634fc3543903bf33ebe7af63020e6b49ebe8de69c90a1
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                          • Size 5KB
                                                                                                                                                                                          • SHA256 89c9a0232d02a5af60f871628239d3a5aadecba56596d4274fd4fe57b9efd4c9
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Sdch Dictionaries
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                                                                          • Size 40B
                                                                                                                                                                                          • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Preferences
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                          • Size 17KB
                                                                                                                                                                                          • SHA256 3f970d29db941b33c931575dc4304a6f66b968847fccda415ce92a15c758e18e
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Preferences
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                          • Size 16KB
                                                                                                                                                                                          • SHA256 4e6c25de31aeb00462dfaacbba6c653706c4dcadd3de14270a93bcd4f810f041
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Secure Preferences
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                                          • Size 35KB
                                                                                                                                                                                          • SHA256 3bdef975d483acb3695887b9f48b3d9e69d1020fcba96a2d05edb620e1db4ffe
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          CURRENT
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
                                                                                                                                                                                          • Size 16B
                                                                                                                                                                                          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          MANIFEST-000001
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
                                                                                                                                                                                          • Size 41B
                                                                                                                                                                                          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          sync_diagnostic.log
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                                                          • Size 23KB
                                                                                                                                                                                          • SHA256 47fca4120d7836d8512d412d1962ed5c45f7bacc98ea8cb804b5cadf9df16ec6
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Local State
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                          • Size 25KB
                                                                                                                                                                                          • SHA256 23a2c317cfc6f2f26a3ef00049c13b958d906f028e33e392335a4b64781081f7
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Local State
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                          • Size 26KB
                                                                                                                                                                                          • SHA256 904725ea7cd0d6784553f73364da9d0a1eca7fabb405f4cc626dd0b3b75359ef
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Local State
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                          • Size 33KB
                                                                                                                                                                                          • SHA256 645c3566c7cc255fae84b5280278e2274722188ba67bd3557ff6cbb8a61f2f34
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Local State
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                          • Size 27KB
                                                                                                                                                                                          • SHA256 b25e6ab38623fb15f9cbe7c2bf4eaf597f78461901055ab82d0bb67c69515edb
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Local State
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                          • Size 27KB
                                                                                                                                                                                          • SHA256 97bf2b49a3cd68ca26458fedf8b819cd4ff16b5b4a89e50d35a2edf7e3fc3bbc
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Local State
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                          • Size 29KB
                                                                                                                                                                                          • SHA256 623b27fb4c487fe529cd297e82c48a9e16ba8b7c830b3dbd998fd07122c67408
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          metadata.json
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                          • SHA256 1e3ffd30014b729494af4bf2189499583a73e14e899275ff78a0a2e8e7724b00
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                                                                                                                                                                          • Size 147KB
                                                                                                                                                                                          • SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          metadata.json
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                                                                                                          • Size 132B
                                                                                                                                                                                          • SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                          • SHA256 048f482107a6fa4c90af2faf454a45ebfcd362766e79758555975625fd6b2661
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          discord_icon_click.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0837C17B\Assets\discord_icon_click.png
                                                                                                                                                                                          • Size 512B
                                                                                                                                                                                          • SHA256 6b126c8a7015c2274e6a2ac969e0f31ecae421e1652b446b2aafd2b03d0dc3f5
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          exit_close.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0837C17B\Assets\exit_close.png
                                                                                                                                                                                          • Size 670B
                                                                                                                                                                                          • SHA256 7aaef329ba9fa052791d1a09f127551289641ea743baba171de55faa30ec1157
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          minimize_progress.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0837C17B\Assets\minimize_progress.png
                                                                                                                                                                                          • Size 212B
                                                                                                                                                                                          • SHA256 2f62d4e8c643051093f907058dddc78cc525147d9c4f4a0d78b4d0e5c90979f6
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Bootstrapper.exe
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0837C17B\Bootstrapper.exe
                                                                                                                                                                                          • Size 153KB
                                                                                                                                                                                          • SHA256 0b5398615c74dd2b1d4d07982d6d7e8c29c5c7ad60f00cb5897170470dc3b15e
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          7zr.exe
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\7zr.exe
                                                                                                                                                                                          • Size 1.3MB
                                                                                                                                                                                          • SHA256 9f30c03c3ba88154e069b2e9cf320448192351272ae265bcc3009784dd9f7503
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          checked_gray.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Assets\checked_gray.png
                                                                                                                                                                                          • Size 538B
                                                                                                                                                                                          • SHA256 d8e502fab00b0c6f06ba6abede6922ab3b423fe6f2d2f56941dabc887b229ad3
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          checked_gray_hover.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Assets\checked_gray_hover.png
                                                                                                                                                                                          • Size 412B
                                                                                                                                                                                          • SHA256 d7c79677d2ef897fa0ad1efc90e916c46da29f571208f78f24505603b7165c20
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          close_red_click.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Assets\close_red_click.png
                                                                                                                                                                                          • Size 15KB
                                                                                                                                                                                          • SHA256 d5a7e6fc5e92e0b29a4f65625030447f3379b4e3ac4bed051a0646a7932ce0cd
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          close_red_hover.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Assets\close_red_hover.png
                                                                                                                                                                                          • Size 15KB
                                                                                                                                                                                          • SHA256 7c625ae4668cc03e37e4ffc478b87eace06b49b77e71e3209f431c23d98acdd0
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          custom_click.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Assets\custom_click.png
                                                                                                                                                                                          • Size 15KB
                                                                                                                                                                                          • SHA256 1318e0f34a551edae1e82818fdf7de5ac627493db5b24556d919f525052d5b90
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          custom_hover.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Assets\custom_hover.png
                                                                                                                                                                                          • Size 15KB
                                                                                                                                                                                          • SHA256 d588ef0eaa334ed8482f32e5839a7ee0d0b544d5b8d5f7720b8c57010e080424
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          error_icon.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Assets\error_icon.png
                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                          • SHA256 666ad4fe456216ddc06618967846ed31f81d8db5be97da6531842c0667352b89
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          error_icon_72.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Assets\error_icon_72.png
                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                          • SHA256 84e59d14d9433e6c3d92daeb8c443063b5e3be6c0b297f0403dbde473a05cb3f
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          exit_close_hover.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Assets\exit_close_hover.png
                                                                                                                                                                                          • Size 575B
                                                                                                                                                                                          • SHA256 bcc053a9a087e077d58114106d29701a34f7851f4052f3157102811355d3e709
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          installer_minimize_click.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Assets\installer_minimize_click.png
                                                                                                                                                                                          • Size 112B
                                                                                                                                                                                          • SHA256 2599d6a55a8e12b1f05a6e8982d55559151a25ae3690e6637510b6283622dd95
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          installer_minimize_hover.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Assets\installer_minimize_hover.png
                                                                                                                                                                                          • Size 112B
                                                                                                                                                                                          • SHA256 57aae4bf49dcbb0ad6cff6263200015c89d7752dc75c2ad918bf846e1ce9646d
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          installer_upgrade_image_bg.jpg
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Assets\installer_upgrade_image_bg.jpg
                                                                                                                                                                                          • Size 19KB
                                                                                                                                                                                          • SHA256 b7f75233e633107d50f24ca82099225c83a832571cd2ce92901f2db3897f058b
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          link.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Assets\link.png
                                                                                                                                                                                          • Size 306B
                                                                                                                                                                                          • SHA256 28c0abc6bfe7a155815104883a37a53dd783d142300471064c95eddf3cae0eaf
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          minimize_progress_hover.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Assets\minimize_progress_hover.png
                                                                                                                                                                                          • Size 214B
                                                                                                                                                                                          • SHA256 1a4aaa46893e2a9b011c478fbb0cd0e84c199f9f3520703189640088969ef5cd
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          powered_by_bs.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Assets\powered_by_bs.png
                                                                                                                                                                                          • Size 9KB
                                                                                                                                                                                          • SHA256 3d2afe5236ec813d9e8063bc43eb34b88c2155784e1bce19c6a533c32767af35
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          setpath_click.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Assets\setpath_click.png
                                                                                                                                                                                          • Size 15KB
                                                                                                                                                                                          • SHA256 c94924e95a49b175c8fc00bdc2821bb70a85b864cc193becc553b32f0024dde1
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          setpath_hover.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Assets\setpath_hover.png
                                                                                                                                                                                          • Size 15KB
                                                                                                                                                                                          • SHA256 2da3f9367c847e47131370dd163f611c4639287512a47f487e0025c5665830e0
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          unchecked_gray.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Assets\unchecked_gray.png
                                                                                                                                                                                          • Size 192B
                                                                                                                                                                                          • SHA256 671f26795b12008fbea1943143f660095f3dca5d925f67d765e2352fd7ee2396
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          unchecked_gray_hover.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Assets\unchecked_gray_hover.png
                                                                                                                                                                                          • Size 176B
                                                                                                                                                                                          • SHA256 a631e26bd5b6ea19c8c65b766a056c92ba8a47e1483768dcf12b05293c9a7a0d
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          BlueStacksInstaller.exe.config
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\BlueStacksInstaller.exe.config
                                                                                                                                                                                          • Size 392B
                                                                                                                                                                                          • SHA256 4b7df915d706af6459c38d75b09c5e14f951842ae0678078400f204ad1c7a7c2
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          HD-ForceGPU.exe
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\HD-ForceGPU.exe
                                                                                                                                                                                          • Size 169KB
                                                                                                                                                                                          • SHA256 34a91c71a440e330bd0999c048df5a572d65fe61a8d7af77a60a42fe386f4c7d
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          HD-GLCheck.exe
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\HD-GLCheck.exe
                                                                                                                                                                                          • Size 223KB
                                                                                                                                                                                          • SHA256 e6c83610e43ab0622fda1acde343656bd8f4e9247ca88ad7f96069f601553efd
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          i18n.ar-EG.txt
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Locales\i18n.ar-EG.txt
                                                                                                                                                                                          • Size 28KB
                                                                                                                                                                                          • SHA256 6686465cb54bb125f41c0e378c843a14c4504115b94cd94aeab3290fc02c1498
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          i18n.ar-IL.txt
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Locales\i18n.ar-IL.txt
                                                                                                                                                                                          • Size 14KB
                                                                                                                                                                                          • SHA256 65e7b0f37b5e2aa805ac8d57969804d803430186f34e9703ca9fa09ba908ef90
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          i18n.de-DE.txt
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Locales\i18n.de-DE.txt
                                                                                                                                                                                          • Size 24KB
                                                                                                                                                                                          • SHA256 e829dca27a11d357d67234b858d22969fbc39103e3bce8f6a887e7ab41183303
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          i18n.es-ES.txt
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Locales\i18n.es-ES.txt
                                                                                                                                                                                          • Size 23KB
                                                                                                                                                                                          • SHA256 f63122ace78900fa73d94ad2e1cdf230116e7d8d9c39872142b126e839b78165
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          i18n.fr-FR.txt
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Locales\i18n.fr-FR.txt
                                                                                                                                                                                          • Size 24KB
                                                                                                                                                                                          • SHA256 47239ca5bd5578436784c12728242f36e2e47e12ce08816a222f358b9ba0eb00
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          i18n.id-ID.txt
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Locales\i18n.id-ID.txt
                                                                                                                                                                                          • Size 22KB
                                                                                                                                                                                          • SHA256 73abcf287d8494fe1b15d0f55df3820f92e31779b0998b91254289c3e0c6c7f2
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          i18n.it-IT.txt
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Locales\i18n.it-IT.txt
                                                                                                                                                                                          • Size 23KB
                                                                                                                                                                                          • SHA256 57860d69389b1d5155314cbf1e270a7c61a35f170a04ce550df785e38899f1ff
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          i18n.ja-JP.txt
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Locales\i18n.ja-JP.txt
                                                                                                                                                                                          • Size 27KB
                                                                                                                                                                                          • SHA256 0f9815626f26cfb4a90aaa4471e30191f0edcc2130322145c1eff636c5537dd3
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          i18n.ko-KR.txt
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Locales\i18n.ko-KR.txt
                                                                                                                                                                                          • Size 24KB
                                                                                                                                                                                          • SHA256 85f4ea4e1e923b798adaeef29729dabab8367582c10c8efc41965b3482ec9e6f
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          i18n.pl-PL.txt
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Locales\i18n.pl-PL.txt
                                                                                                                                                                                          • Size 23KB
                                                                                                                                                                                          • SHA256 0da7567e1ec905767d53f71b0d2d13f66be67e645f5edfc54fe413e96beb7714
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          i18n.pt-BR.txt
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Locales\i18n.pt-BR.txt
                                                                                                                                                                                          • Size 23KB
                                                                                                                                                                                          • SHA256 3fb5b9611acd0332ec94e23dc60637fad134cfff39f5b401b8cbc576d7fe6953
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          i18n.ru-RU.txt
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Locales\i18n.ru-RU.txt
                                                                                                                                                                                          • Size 32KB
                                                                                                                                                                                          • SHA256 bac2ce43ff30124440a2bae2fb2187f785d4e0287ad1a10839261a03ffccc9fd
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          i18n.th-TH.txt
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Locales\i18n.th-TH.txt
                                                                                                                                                                                          • Size 37KB
                                                                                                                                                                                          • SHA256 b723648c0d747e7557daaa52941e9718862d1edb8f96aa85f4b28395a1dfa870
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          i18n.tr-TR.txt
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Locales\i18n.tr-TR.txt
                                                                                                                                                                                          • Size 23KB
                                                                                                                                                                                          • SHA256 1374bd6fe30a6149256c87805e70f3509dacaa7a0642badc5be037fbf732f6cf
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          i18n.vi-VN.txt
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Locales\i18n.vi-VN.txt
                                                                                                                                                                                          • Size 26KB
                                                                                                                                                                                          • SHA256 2d0875082c04453666df118b7b2204a43706e9d6ce4db78666da2c5b11be1671
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          i18n.zh-CN.txt
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Locales\i18n.zh-CN.txt
                                                                                                                                                                                          • Size 19KB
                                                                                                                                                                                          • SHA256 91b5f5dfbc4eeccb59e37af2caa8658ac36f25d3baaf0df783e62e26fb0281a7
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          i18n.zh-TW.txt
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS0C2949BD\Locales\i18n.zh-TW.txt
                                                                                                                                                                                          • Size 20KB
                                                                                                                                                                                          • SHA256 a50ce58912dc63a21099a7e1caaa43388b1dd105a1dd40bc2565754f50896726
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          backicon.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E612F99\Assets\backicon.png
                                                                                                                                                                                          • Size 15KB
                                                                                                                                                                                          • SHA256 fa64884054171515e97b78aaa1aad1ec5baa9d1daf9c682e0b3fb4a41a9cb1c1
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          change_hover.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E612F99\Assets\change_hover.png
                                                                                                                                                                                          • Size 310B
                                                                                                                                                                                          • SHA256 8e5847487da148ebb3ea029cc92165afd215cdc08f7122271e13eb37f94e6dc1
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          close_red.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E612F99\Assets\close_red.png
                                                                                                                                                                                          • Size 15KB
                                                                                                                                                                                          • SHA256 d0b6d143642d356b40c47459a996131a344cade6bb86158f1b74693426b09bfb
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          custom.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E612F99\Assets\custom.png
                                                                                                                                                                                          • Size 17KB
                                                                                                                                                                                          • SHA256 fbece8bb5f4dfa55dcfbf41151b10608af807b9477e99acf0940954a11e68f7b
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          discord_icon.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E612F99\Assets\discord_icon.png
                                                                                                                                                                                          • Size 564B
                                                                                                                                                                                          • SHA256 c29b35c6be50f9e34f1120bd346ce01884f0c7ba1121c866d95b24e46e420b0c
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          folder.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E612F99\Assets\folder.png
                                                                                                                                                                                          • Size 298B
                                                                                                                                                                                          • SHA256 7ffa875fab1be82e384022a27f3e627ab75131eb168be949cc83c03b6e291bbf
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          help_icon.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E612F99\Assets\help_icon.png
                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                          • SHA256 97c7450d55ecda9017d0a9eed0049b8176e1828f3525aaf5660985ba214010cc
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          info_icon.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E612F99\Assets\info_icon.png
                                                                                                                                                                                          • Size 929B
                                                                                                                                                                                          • SHA256 ee91e51aaa8356318cc75d60476d9422bf84be7d8a25e1b884aa16c3198dc764
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          installer_bg.jpg
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E612F99\Assets\installer_bg.jpg
                                                                                                                                                                                          • Size 78KB
                                                                                                                                                                                          • SHA256 4c7471c986e16de0cd451be27d4b3171e595fe2916b4b3bf7ca52df6ec368904
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          installer_logo.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E612F99\Assets\installer_logo.png
                                                                                                                                                                                          • Size 9KB
                                                                                                                                                                                          • SHA256 462b64f2e016d25a2a6a653ba896206129c4ac841d61a6c2fd116009606f7e1c
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          installer_minimize.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E612F99\Assets\installer_minimize.png
                                                                                                                                                                                          • Size 113B
                                                                                                                                                                                          • SHA256 a064f417e3c2b8f3121a14bbded268b2cdf635706880b7006f931de31476bbc2
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          loader.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E612F99\Assets\loader.png
                                                                                                                                                                                          • Size 279B
                                                                                                                                                                                          • SHA256 076263cc65f9824f4f82eb6beaa594d1df90218a2ee21664cf209181557e04b1
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          logo_text.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E612F99\Assets\logo_text.png
                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                          • SHA256 66df86129129d8aa8dd3ba014eb3b3c27a36c22e4782f3dbd6a9a4bc1f4a87bc
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          setpath.png
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E612F99\Assets\setpath.png
                                                                                                                                                                                          • Size 15KB
                                                                                                                                                                                          • SHA256 5bbb2f41f9f3a805986c3c88a639bcc22d90067d4b8de9f1e21e3cf9e5c1766b
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          BlueStacksInstaller.exe
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E612F99\BlueStacksInstaller.exe
                                                                                                                                                                                          • Size 642KB
                                                                                                                                                                                          • SHA256 046be8853ea9646a0c9c4309edf850aea355889549ee4c3c0670386881cdf56e
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          BlueStacksInstaller.exe.config
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E612F99\BlueStacksInstaller.exe.config
                                                                                                                                                                                          • Size 324B
                                                                                                                                                                                          • SHA256 d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          HD-CheckCpu.exe
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E612F99\HD-CheckCpu.exe
                                                                                                                                                                                          • Size 200KB
                                                                                                                                                                                          • SHA256 2e14887f3432b4a313442247fc669f891dbdad7ef1a2d371466a2afa88074a4c
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          JSON.dll
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E612F99\JSON.dll
                                                                                                                                                                                          • Size 411KB
                                                                                                                                                                                          • SHA256 d2c8d26f95f55431e632c8581154db7c19547b656380e051194a9d2583dd2156
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          i18n.en-US.txt
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E612F99\Locales\i18n.en-US.txt
                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                          • SHA256 945cbd36495c301dcf1cad837a4147479077974bce2790a3cb3961c9c71f22e2
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          ThemeFile
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E612F99\ThemeFile
                                                                                                                                                                                          • Size 80KB
                                                                                                                                                                                          • SHA256 de1a2e6b560e036da5ea6b042e29e81a5bfcf67dde89670c332fc5199e811ba6
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          9db862fd-d42e-472d-b7ea-f4a2efae1157.tmp
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\9db862fd-d42e-472d-b7ea-f4a2efae1157.tmp
                                                                                                                                                                                          • Size 1B
                                                                                                                                                                                          • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          installer_bg_1.jpg
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\Assets\installer_bg_1.jpg
                                                                                                                                                                                          • Size 30KB
                                                                                                                                                                                          • SHA256 873030e34515538dac3efb98edec519596439fa05b7aad37f6137ca954ba41a6
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          BgWorker.dll
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nse17FF.tmp\BgWorker.dll
                                                                                                                                                                                          • Size 12KB
                                                                                                                                                                                          • SHA256 a9e4f7ec65670d2ce375ffaf09b6d07f4cd531132ca002452287a4d540154a38
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          System.dll
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nse17FF.tmp\System.dll
                                                                                                                                                                                          • Size 11KB
                                                                                                                                                                                          • SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          nsDialogs.dll
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nse17FF.tmp\nsDialogs.dll
                                                                                                                                                                                          • Size 9KB
                                                                                                                                                                                          • SHA256 2bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          nsDui.dll
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nse17FF.tmp\nsDui.dll
                                                                                                                                                                                          • Size 3.0MB
                                                                                                                                                                                          • SHA256 d770758471fc58d94ddd6adc4c8a59f40f7ebd580ea0bb9de4968446fb7f7332
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          nsis7z.dll
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nse17FF.tmp\nsis7z.dll
                                                                                                                                                                                          • Size 434KB
                                                                                                                                                                                          • SHA256 a896a9ece055d334d431cd0f856113ab925d9ee86d2dee383c0bfbbef11a5b50
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Registry.dll
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nso5419.tmp\Registry.dll
                                                                                                                                                                                          • Size 24KB
                                                                                                                                                                                          • SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          StdUtils.dll
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nso5419.tmp\StdUtils.dll
                                                                                                                                                                                          • Size 100KB
                                                                                                                                                                                          • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          System.dll
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nso5419.tmp\System.dll
                                                                                                                                                                                          • Size 12KB
                                                                                                                                                                                          • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          WinShell.dll
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nso5419.tmp\WinShell.dll
                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                          • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          nsExec.dll
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nso5419.tmp\nsExec.dll
                                                                                                                                                                                          • Size 6KB
                                                                                                                                                                                          • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          nsis7z.dll
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nso5419.tmp\nsis7z.dll
                                                                                                                                                                                          • Size 424KB
                                                                                                                                                                                          • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          default.dic
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                                                                                                                                          • Size 2B
                                                                                                                                                                                          • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\Network\Network Persistent State
                                                                                                                                                                                          • Size 766B
                                                                                                                                                                                          • SHA256 22e3859faea96c19b7f43c224d27ad797a72b7b6ba00818a88b7ac679805a22c
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\Network\Network Persistent State
                                                                                                                                                                                          • Size 59B
                                                                                                                                                                                          • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          config.json
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json
                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                          • SHA256 2f23c6357d5ab60a0dde964fdeceb3efa46ca7cd3d284e126a343e89a67cd718
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          config.json
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json
                                                                                                                                                                                          • Size 57B
                                                                                                                                                                                          • SHA256 bb3dea7d890d0ee6e9f17171e9d09c39e82775b76c4b8ecffe2f750058a32bf9
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          config.json
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json
                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                          • SHA256 f81233d306b9a19dd808fdce0dffafa30531298341f5de88db4368885758b0ed
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          config.json.tmp-7303710808b1627c
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json.tmp-7303710808b1627c
                                                                                                                                                                                          • Size 92B
                                                                                                                                                                                          • SHA256 9e5473189b020813e119e19841ead049a11c92b2e30ff5eb9cc6094b21aa77cd
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          config.json.tmp-7303710964f88d70
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json.tmp-7303710964f88d70
                                                                                                                                                                                          • Size 119B
                                                                                                                                                                                          • SHA256 1a0ebe1041686f700f77ed76811c461e60a57ceebc38d5dea126dd9b28334e9c
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          config.json.tmp-730375365463170a
                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json.tmp-730375365463170a
                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                          • SHA256 6ddd639b66dd25f972c31b2b01f3ac8ae0f81af1eeffdde16b76b79cc222cbda
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          storage.json
                                                                                                                                                                                          • Path C:\Windows\System32\storage.json
                                                                                                                                                                                          • Size 51B
                                                                                                                                                                                          • SHA256 3cb23b535845ddd6fd6160dbb5fb6b14096161d3e632e0dc424a788875c85094
                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                          Submit Download

                                                                                                                                                                                          memory/2776-10393-0x000000001AD40000-0x000000001ADED000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/2776-9644-0x000000001AD40000-0x000000001ADED000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/2776-606-0x000000001C3A0000-0x000000001C8C8000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/2776-609-0x000000001EE70000-0x000000001EEA8000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/2776-637-0x000000001AD40000-0x000000001ADED000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/2776-600-0x000000001AFF0000-0x000000001B058000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/2776-638-0x0000000002340000-0x0000000002348000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/2776-10392-0x0000000002310000-0x000000000231C000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/2776-10394-0x0000000002340000-0x0000000002348000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/2776-598-0x0000000000130000-0x00000000001D4000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/2776-636-0x0000000002310000-0x000000000231C000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/2776-610-0x000000001EE40000-0x000000001EE4E000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/2776-624-0x000000001F750000-0x000000001F758000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4868-10355-0x000001E36DA60000-0x000001E36DB0D000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/4868-10356-0x000001E36D5B0000-0x000001E36D5BC000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5340-4243-0x0000000000680000-0x00000000006DF000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5340-9406-0x0000000000680000-0x00000000006DF000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5860-10395-0x00000000028B0000-0x000000000290F000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5860-635-0x00000000028B0000-0x000000000290F000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5972-10585-0x000001B603760000-0x000001B60376C000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/5972-10584-0x000001B603690000-0x000001B60373D000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/6176-10494-0x000001AE7D4E0000-0x000001AE7D58D000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/6176-10495-0x000001AE00430000-0x000001AE00438000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/6320-10102-0x00007FFCEEAA0000-0x00007FFCEEAA1000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/6320-10101-0x00007FFCEE960000-0x00007FFCEE961000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/6320-10594-0x00000206D6040000-0x00000206D60ED000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/6456-10082-0x00000292F0D60000-0x00000292F0D6C000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/6456-10081-0x00000292F2A30000-0x00000292F2ADD000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/7224-9399-0x00000000006F0000-0x000000000074F000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/7224-9402-0x0000000003470000-0x00000000034AD000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/7224-9401-0x0000000003450000-0x000000000346C000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/7224-9400-0x0000000003420000-0x0000000003445000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/7240-10352-0x0000019B105B0000-0x0000019B105BC000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/7240-10351-0x0000019B12040000-0x0000019B120ED000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/7272-10347-0x000002428A300000-0x000002428A3AD000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/7272-10348-0x000002428A4C0000-0x000002428A4CC000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/7300-10349-0x00000184FFD40000-0x00000184FFDED000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/7300-10350-0x00000184FE570000-0x00000184FE57C000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/7308-10354-0x0000028FC18B0000-0x0000028FC18BC000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/7308-10353-0x0000028FC1C20000-0x0000028FC1CCD000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/7364-9407-0x0000000002800000-0x000000000285F000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/7584-9412-0x00000000012D0000-0x000000000132F000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/7744-9414-0x0000000002900000-0x000000000295F000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/7804-9415-0x0000000002B60000-0x0000000002BBF000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/8016-9664-0x00000000027F0000-0x000000000284F000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/8152-10065-0x0000000000750000-0x00000000007AF000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/8288-10374-0x000000001AF50000-0x000000001AFFD000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/8288-10033-0x000000001C850000-0x000000001C858000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/8288-10373-0x00000000008B0000-0x00000000008BC000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/8288-9665-0x0000000020670000-0x00000000206F0000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/8288-10014-0x000000001BDC0000-0x000000001BDC8000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/8288-10012-0x00000000008B0000-0x00000000008BC000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/8288-9639-0x00000000003B0000-0x0000000000408000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/8288-10375-0x000000001BDC0000-0x000000001BDC8000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/8288-10013-0x000000001AF50000-0x000000001AFFD000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/8288-10034-0x000000001C890000-0x000000001C8B2000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/8356-9638-0x000000001BA60000-0x000000001BB4E000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/8356-9637-0x0000000000DC0000-0x0000000000DE8000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/8356-10382-0x0000000001590000-0x000000000163D000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/8356-10011-0x0000000001590000-0x000000000163D000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/9088-10009-0x00000000021D0000-0x000000000222F000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/9088-10383-0x00000000021D0000-0x000000000222F000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/9844-10579-0x00000267B44F0000-0x00000267B459D000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/9844-10580-0x00000267B44D0000-0x00000267B44DC000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/10212-10628-0x000001A025190000-0x000001A02519C000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/10316-10505-0x000001E882FA0000-0x000001E88304D000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/10456-10070-0x000001D25FC00000-0x000001D25FCAD000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/10456-10071-0x000001D25F770000-0x000001D25F77C000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/10528-10506-0x00000252981F0000-0x000002529829D000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/10528-10507-0x0000025298350000-0x0000025298358000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/10712-10073-0x0000014DE08B0000-0x0000014DE08BC000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/10712-10072-0x0000014DE06E0000-0x0000014DE078D000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/10812-10074-0x00000241E9520000-0x00000241E95CD000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/10812-10075-0x00000241E7A70000-0x00000241E7A7C000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/10916-10076-0x000001F1FCF10000-0x000001F1FCFBD000-memory.dmp
                                                                                                                                                                                          Download

                                                                                                                                                                                          memory/10916-10077-0x000001F1FE880000-0x000001F1FE88C000-memory.dmp
                                                                                                                                                                                          Download