Overview

overview

6

Static

static

1

BlueStacks...==.exe

windows11-21h2-x64

6

BlueStacks...==.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    165s
  • max time network
    161s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    19/07/2026, 13:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    BlueStacksInstaller_5.22.250.1015_native_128931b2c62a2e63073874e58374516b_MzsxNSwwOzUsNTsxNQ==.exe
  • Size 930KB
  • Sample260719-qzfflab15m
  • SHA256 2aa5edc8aa2562667bf5e7c53a34db0ec83b40c4d2058acc2bde76bf89ed265e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Downloads MZ/PE file 1 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies Windows Firewall 2 TTPs 4 IoCs
    defense_evasion
  • Drops file in System32 directory 2 IoCs
  • Enumerates processes with tasklist 1 TTPs 27 IoCs
    discovery
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 15 IoCs
    execution
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 28 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 20 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BlueStacksInstaller_5.22.250.1015_native_128931b2c62a2e63073874e58374516b_MzsxNSwwOzUsNTsxNQ==.exe
    "C:\Users\Admin\AppData\Local\Temp\BlueStacksInstaller_5.22.250.1015_native_128931b2c62a2e63073874e58374516b_MzsxNSwwOzUsNTsxNQ==.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3056
    • C:\Users\Admin\AppData\Local\Temp\7zS0FB5AD58\BlueStacksInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS0FB5AD58\BlueStacksInstaller.exe"
      2⤵
      • Downloads MZ/PE file
      • Enumerates connected drives
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1348
      • C:\Users\Admin\AppData\Local\Temp\7zS0FB5AD58\HD-CheckCpu.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS0FB5AD58\HD-CheckCpu.exe" --cmd checkHypervEnabled
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4736
      • C:\Users\Admin\AppData\Local\Temp\7zS0FB5AD58\HD-CheckCpu.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS0FB5AD58\HD-CheckCpu.exe" --cmd checkSSE4
        3⤵
        • Executes dropped EXE
        PID:872
      • C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.22.250.1015_nxt.exe
        "C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.22.250.1015_nxt.exe" -s
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1644
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\BlueStacks X\green.vbs"
          4⤵
          • Executes a VBScript file via the Windows Script Host.
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6224
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c green.bat
            5⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:6304
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall delete rule name="BlueStacksWeb"
              6⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:5928
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall delete rule name="Cloud Game"
              6⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:6940
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall add rule name="BlueStacksWeb" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\BlueStacksWeb.exe"
              6⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:2028
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall add rule name="Cloud Game" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\Cloud Game.exe"
              6⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:7156
      • C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.22.250.1015_native_128931b2c62a2e63073874e58374516b_MzsxNSwwOzUsNTsxNQ==.exe
        "C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.22.250.1015_native_128931b2c62a2e63073874e58374516b_MzsxNSwwOzUsNTsxNQ==.exe" -versionMachineID=520eda08-7e74-4364-8ead-547819cb722e -machineID=927c1686-bcd5-492d-9f07-93532eb06909 -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Pie64 -imageToLaunch=Pie64 -isSSE4Available=1 -appToLaunch=bs5 -bsxVersion=10.42.250.1001 -country=GB -isWalletFeatureEnabled -discordUrl=https://discord.gg/UnXV7taVs4
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:7256
        • C:\Users\Admin\AppData\Local\Temp\7zS85C1D6D9\BlueStacksInstaller.exe
          "C:\Users\Admin\AppData\Local\Temp\7zS85C1D6D9\BlueStacksInstaller.exe" -versionMachineID=520eda08-7e74-4364-8ead-547819cb722e -machineID=927c1686-bcd5-492d-9f07-93532eb06909 -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Pie64 -imageToLaunch=Pie64 -isSSE4Available=1 -appToLaunch=bs5 -bsxVersion=10.42.250.1001 -country=GB -isWalletFeatureEnabled -discordUrl=https://discord.gg/UnXV7taVs4
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:6108
          • C:\Users\Admin\AppData\Local\Temp\7zS85C1D6D9\HD-CheckCpu.exe
            "C:\Users\Admin\AppData\Local\Temp\7zS85C1D6D9\HD-CheckCpu.exe" --cmd checkHypervEnabled
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4976
  • C:\Windows\system32\WerFault.exe
    "C:\Windows\system32\WerFault.exe" -k -lc WATCHDOG WATCHDOG-20260719-1442.dmp
    1⤵
      PID:984
    • C:\ProgramData\BlueStacksServicesSetup.exe
      "C:\ProgramData\BlueStacksServicesSetup.exe"
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5176
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq BlueStacksServices.exe" | find "BlueStacksServices.exe"
        2⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5216
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq BlueStacksServices.exe"
          3⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:7648
        • C:\Windows\SysWOW64\find.exe
          find "BlueStacksServices.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5224
    • C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
      "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --hidden --initialLaunch
      1⤵
      • Adds Run key to start application
      • Drops file in System32 directory
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:8124
      • C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
        "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1680,i,4319009357884730466,5567819155569686318,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        2⤵
        • Executes dropped EXE
        PID:5712
      • C:\Windows\system32\cscript.exe
        cscript.exe
        2⤵
          PID:5740
        • C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
          "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --mojo-platform-channel-handle=1936 --field-trial-handle=1680,i,4319009357884730466,5567819155569686318,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
          2⤵
          • Executes dropped EXE
          PID:5192
        • C:\Windows\system32\cscript.exe
          cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKCU\SOFTWARE\BlueStacksServices
          2⤵
          • Executes a VBScript file via the Windows Script Host.
          PID:6032
        • C:\Windows\system32\cscript.exe
          cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKCU\SOFTWARE\BlueStacksServices
          2⤵
          • Executes a VBScript file via the Windows Script Host.
          PID:5968
        • C:\Windows\system32\cscript.exe
          cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regPutValue.wsf A
          2⤵
          • Executes a VBScript file via the Windows Script Host.
          PID:2040
        • C:\Windows\system32\cscript.exe
          cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regPutValue.wsf A
          2⤵
          • Executes a VBScript file via the Windows Script Host.
          PID:2416
        • C:\Windows\system32\cscript.exe
          cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
          2⤵
          • Executes a VBScript file via the Windows Script Host.
          PID:4188
        • C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
          "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --app-user-model-id=com.bluestacks.services --app-path="C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2604 --field-trial-handle=1680,i,4319009357884730466,5567819155569686318,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
          2⤵
          • Executes dropped EXE
          PID:3152
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:6876
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq HD-Player.exe"
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:7320
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:6900
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:7208
        • C:\Windows\system32\cscript.exe
          cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
          2⤵
          • Executes a VBScript file via the Windows Script Host.
          PID:5136
        • C:\Windows\system32\cscript.exe
          cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
          2⤵
          • Executes a VBScript file via the Windows Script Host.
          PID:2500
        • C:\Windows\system32\cscript.exe
          cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
          2⤵
          • Executes a VBScript file via the Windows Script Host.
          PID:4060
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:7936
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:8076
        • C:\Windows\system32\cscript.exe
          cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
          2⤵
          • Executes a VBScript file via the Windows Script Host.
          PID:8084
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:8132
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq HD-Player.exe"
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:5856
        • C:\Windows\system32\cscript.exe
          cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
          2⤵
          • Executes a VBScript file via the Windows Script Host.
          PID:5972
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4020
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:2096
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:760
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq HD-Player.exe"
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:5212
        • C:\Windows\system32\cscript.exe
          cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
          2⤵
          • Executes a VBScript file via the Windows Script Host.
          PID:7648
        • C:\Windows\system32\cscript.exe
          cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
          2⤵
          • Executes a VBScript file via the Windows Script Host.
          PID:656
        • C:\Windows\system32\cscript.exe
          cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
          2⤵
          • Executes a VBScript file via the Windows Script Host.
          PID:5324
        • C:\Windows\system32\cscript.exe
          cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
          2⤵
          • Executes a VBScript file via the Windows Script Host.
          PID:5400
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:6364
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:6436
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:6484
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq HD-Player.exe"
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:4812
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:6600
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:6648
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:6688
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq HD-Player.exe"
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:6720
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:6792
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:7032
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:7076
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq HD-Player.exe"
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:7476
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:7524
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
            3⤵
            • Enumerates processes with tasklist
            PID:2536
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4452
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq HD-Player.exe"
            3⤵
            • Enumerates processes with tasklist
            PID:7564
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
          2⤵
          • Executes a command shell one-liner
          PID:7700
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
            3⤵
            • Enumerates processes with tasklist
            PID:7748
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
          2⤵
          • Executes a command shell one-liner
          PID:7788
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq HD-Player.exe"
            3⤵
            • Enumerates processes with tasklist
            PID:7884
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
          2⤵
          • Executes a command shell one-liner
          PID:7824
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
            3⤵
            • Enumerates processes with tasklist
            PID:6028
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
          2⤵
          • Executes a command shell one-liner
          PID:3216
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq HD-Player.exe"
            3⤵
            • Enumerates processes with tasklist
            PID:6040
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
          2⤵
          • Executes a command shell one-liner
          PID:2392
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
            3⤵
            • Enumerates processes with tasklist
            PID:1860
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
          2⤵
          • Executes a command shell one-liner
          PID:6048
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq HD-Player.exe"
            3⤵
            • Enumerates processes with tasklist
            PID:5452
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
          2⤵
          • Executes a command shell one-liner
          PID:2556
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
            3⤵
            • Enumerates processes with tasklist
            PID:5816
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
          2⤵
          • Executes a command shell one-liner
          PID:3976
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq HD-Player.exe"
            3⤵
            • Enumerates processes with tasklist
            PID:1120
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
          2⤵
          • Executes a command shell one-liner
          PID:4608
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
            3⤵
            • Enumerates processes with tasklist
            PID:5068
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
          2⤵
          • Executes a command shell one-liner
          PID:4900
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq HD-Player.exe"
            3⤵
            • Enumerates processes with tasklist
            PID:1516
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
          2⤵
          • Executes a command shell one-liner
          PID:4012
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
            3⤵
            • Enumerates processes with tasklist
            PID:2884
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
          2⤵
          • Executes a command shell one-liner
          PID:4476
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq HD-Player.exe"
            3⤵
            • Enumerates processes with tasklist
            PID:3444

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            2
            T1059

            Visual Basic

            1
            T1059.005

            Windows Command Shell

            1
            T1059.003

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            1
            T1546

            Netsh Helper DLL

            1
            T1546.007

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            1
            T1546

            Netsh Helper DLL

            1
            T1546.007

            Defense Evasion

            Impair Defenses

            1
            T1562

            Disable or Modify System Firewall

            1
            T1562.004

            Modify Registry

            1
            T1112

            Credential Access

            Discovery

            Peripheral Device Discovery

            1
            T1120

            Process Discovery

            1
            T1057

            Query Registry

            2
            T1012

            System Information Discovery

            2
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            close_disabled.svg
            • Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_disabled.svg
            • Size 569B
            • SHA256 8ee5aa84139b2ea5549f7272523aeb203d73954c5ccdcf6f7407bf1a3469f13e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            close_hover.svg
            • Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_hover.svg
            • Size 653B
            • SHA256 1bca2e912184b8168ee8961de68d1d839f4f9827fde6f48ab100fb61e82eff90
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            close_normal.svg
            • Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_normal.svg
            • Size 569B
            • SHA256 92aeae68e9e0973d9e0dc575941f1cb2e24afd0574341a46b870be7384eaa537
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            close_pressed.svg
            • Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_pressed.svg
            • Size 653B
            • SHA256 9585f41eb6202e89f2087266fa31852d7f41ca8cc659b907c96753fe165f937d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            backicon.png
            • Path C:\Users\Admin\AppData\Local\Temp\7zS0FB5AD58\Assets\backicon.png
            • Size 15KB
            • SHA256 fa64884054171515e97b78aaa1aad1ec5baa9d1daf9c682e0b3fb4a41a9cb1c1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            change_hover.png
            • Path C:\Users\Admin\AppData\Local\Temp\7zS0FB5AD58\Assets\change_hover.png
            • Size 310B
            • SHA256 8e5847487da148ebb3ea029cc92165afd215cdc08f7122271e13eb37f94e6dc1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            close_red.png
            • Path C:\Users\Admin\AppData\Local\Temp\7zS0FB5AD58\Assets\close_red.png
            • Size 15KB
            • SHA256 d0b6d143642d356b40c47459a996131a344cade6bb86158f1b74693426b09bfb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            custom.png
            • Path C:\Users\Admin\AppData\Local\Temp\7zS0FB5AD58\Assets\custom.png
            • Size 17KB
            • SHA256 fbece8bb5f4dfa55dcfbf41151b10608af807b9477e99acf0940954a11e68f7b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            discord_icon.png
            • Path C:\Users\Admin\AppData\Local\Temp\7zS0FB5AD58\Assets\discord_icon.png
            • Size 564B
            • SHA256 c29b35c6be50f9e34f1120bd346ce01884f0c7ba1121c866d95b24e46e420b0c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            folder.png
            • Path C:\Users\Admin\AppData\Local\Temp\7zS0FB5AD58\Assets\folder.png
            • Size 298B
            • SHA256 7ffa875fab1be82e384022a27f3e627ab75131eb168be949cc83c03b6e291bbf
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            help_icon.png
            • Path C:\Users\Admin\AppData\Local\Temp\7zS0FB5AD58\Assets\help_icon.png
            • Size 1KB
            • SHA256 97c7450d55ecda9017d0a9eed0049b8176e1828f3525aaf5660985ba214010cc
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            info_icon.png
            • Path C:\Users\Admin\AppData\Local\Temp\7zS0FB5AD58\Assets\info_icon.png
            • Size 929B
            • SHA256 ee91e51aaa8356318cc75d60476d9422bf84be7d8a25e1b884aa16c3198dc764
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            installer_bg.jpg
            • Path C:\Users\Admin\AppData\Local\Temp\7zS0FB5AD58\Assets\installer_bg.jpg
            • Size 78KB
            • SHA256 4c7471c986e16de0cd451be27d4b3171e595fe2916b4b3bf7ca52df6ec368904
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            installer_logo.png
            • Path C:\Users\Admin\AppData\Local\Temp\7zS0FB5AD58\Assets\installer_logo.png
            • Size 9KB
            • SHA256 462b64f2e016d25a2a6a653ba896206129c4ac841d61a6c2fd116009606f7e1c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            installer_minimize.png
            • Path C:\Users\Admin\AppData\Local\Temp\7zS0FB5AD58\Assets\installer_minimize.png
            • Size 113B
            • SHA256 a064f417e3c2b8f3121a14bbded268b2cdf635706880b7006f931de31476bbc2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            loader.png
            • Path C:\Users\Admin\AppData\Local\Temp\7zS0FB5AD58\Assets\loader.png
            • Size 279B
            • SHA256 076263cc65f9824f4f82eb6beaa594d1df90218a2ee21664cf209181557e04b1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            logo_text.png
            • Path C:\Users\Admin\AppData\Local\Temp\7zS0FB5AD58\Assets\logo_text.png
            • Size 4KB
            • SHA256 66df86129129d8aa8dd3ba014eb3b3c27a36c22e4782f3dbd6a9a4bc1f4a87bc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            setpath.png
            • Path C:\Users\Admin\AppData\Local\Temp\7zS0FB5AD58\Assets\setpath.png
            • Size 15KB
            • SHA256 5bbb2f41f9f3a805986c3c88a639bcc22d90067d4b8de9f1e21e3cf9e5c1766b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            BlueStacksInstaller.exe
            • Path C:\Users\Admin\AppData\Local\Temp\7zS0FB5AD58\BlueStacksInstaller.exe
            • Size 648KB
            • SHA256 1b82009ed7d94ba568217f5f855f50fb99adcb6ad18bbc0d1abbf5e81e4de2f9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            BlueStacksInstaller.exe.config
            • Path C:\Users\Admin\AppData\Local\Temp\7zS0FB5AD58\BlueStacksInstaller.exe.config
            • Size 324B
            • SHA256 d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            HD-CheckCpu.exe
            • Path C:\Users\Admin\AppData\Local\Temp\7zS0FB5AD58\HD-CheckCpu.exe
            • Size 200KB
            • SHA256 2e14887f3432b4a313442247fc669f891dbdad7ef1a2d371466a2afa88074a4c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            JSON.dll
            • Path C:\Users\Admin\AppData\Local\Temp\7zS0FB5AD58\JSON.dll
            • Size 411KB
            • SHA256 d2c8d26f95f55431e632c8581154db7c19547b656380e051194a9d2583dd2156
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            i18n.en-US.txt
            • Path C:\Users\Admin\AppData\Local\Temp\7zS0FB5AD58\Locales\i18n.en-US.txt
            • Size 22KB
            • SHA256 8936455d79f33eb298869f1654286db493fb5b11b580ef7e8d859ce63541ba91
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ThemeFile
            • Path C:\Users\Admin\AppData\Local\Temp\7zS0FB5AD58\ThemeFile
            • Size 80KB
            • SHA256 de1a2e6b560e036da5ea6b042e29e81a5bfcf67dde89670c332fc5199e811ba6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            discord_icon_click.png
            • Path C:\Users\Admin\AppData\Local\Temp\7zS85C1D6D9\Assets\discord_icon_click.png
            • Size 512B
            • SHA256 6b126c8a7015c2274e6a2ac969e0f31ecae421e1652b446b2aafd2b03d0dc3f5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            exit_close.png
            • Path C:\Users\Admin\AppData\Local\Temp\7zS85C1D6D9\Assets\exit_close.png
            • Size 670B
            • SHA256 7aaef329ba9fa052791d1a09f127551289641ea743baba171de55faa30ec1157
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            minimize_progress.png
            • Path C:\Users\Admin\AppData\Local\Temp\7zS85C1D6D9\Assets\minimize_progress.png
            • Size 212B
            • SHA256 2f62d4e8c643051093f907058dddc78cc525147d9c4f4a0d78b4d0e5c90979f6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            installer_bg_1.jpg
            • Path C:\Users\Admin\AppData\Local\Temp\Assets\installer_bg_1.jpg
            • Size 30KB
            • SHA256 873030e34515538dac3efb98edec519596439fa05b7aad37f6137ca954ba41a6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Registry.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsgC4ED.tmp\Registry.dll
            • Size 24KB
            • SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StdUtils.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsgC4ED.tmp\StdUtils.dll
            • Size 100KB
            • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WinShell.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsgC4ED.tmp\WinShell.dll
            • Size 3KB
            • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            BgWorker.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsoA813.tmp\BgWorker.dll
            • Size 12KB
            • SHA256 a9e4f7ec65670d2ce375ffaf09b6d07f4cd531132ca002452287a4d540154a38
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsoA813.tmp\System.dll
            • Size 11KB
            • SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsDialogs.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsoA813.tmp\nsDialogs.dll
            • Size 9KB
            • SHA256 2bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsDui.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsoA813.tmp\nsDui.dll
            • Size 3.0MB
            • SHA256 1640dd756f5e7c07280144c29d7388a4c5f84c6f1058971413dd80e56c871e03
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsis7z.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsoA813.tmp\nsis7z.dll
            • Size 434KB
            • SHA256 a896a9ece055d334d431cd0f856113ab925d9ee86d2dee383c0bfbbef11a5b50
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            default.dic
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
            • Size 2B
            • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
            • MD5 SHA1 SHA512
            Submit Download

            config.json
            • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json
            • Size 1KB
            • SHA256 58ebf57651dcb8898d1075a556837a92733520b6597090b82d7c9044ed1cde41
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            config.json
            • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json
            • Size 57B
            • SHA256 975ccaabaf76d33424f0539df15c17fed1b26494a11583535fca8878d1c37d5e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            config.json
            • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json
            • Size 119B
            • SHA256 056c4cf80d25944368fbc7298bf148acb7b2bc2aa31465ac28c6798d90ef6cf8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            config.json.tmp-4468611041186e09
            • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json.tmp-4468611041186e09
            • Size 92B
            • SHA256 0d9dd6e0827c6532c69ef9688fb15da9f73496dc9408a35be011b3894eafa9d5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            storage.json
            • Path C:\Windows\System32\storage.json
            • Size 5B
            • SHA256 1245552f1e44239aa0dfdc7aa0af24ac1e588d66abaee3ad10ddcb82a229f2ef
            • MD5 SHA1 SHA512
            Submit Download

            memory/1348-183-0x0000000000CB0000-0x0000000000CC0000-memory.dmp
            Download

            memory/1348-170-0x000000001D7B0000-0x000000001D7B8000-memory.dmp
            Download

            memory/1348-141-0x0000000000400000-0x00000000004A4000-memory.dmp
            Download

            memory/1348-156-0x0000000020BC0000-0x0000000020BCE000-memory.dmp
            Download

            memory/1348-155-0x0000000021A10000-0x0000000021A48000-memory.dmp
            Download

            memory/1348-151-0x000000001E140000-0x000000001E668000-memory.dmp
            Download

            memory/1348-182-0x0000000000CB0000-0x0000000000CC0000-memory.dmp
            Download

            memory/1348-142-0x0000000000CB0000-0x0000000000CC0000-memory.dmp
            Download

            memory/1348-149-0x0000000000CB0000-0x0000000000CC0000-memory.dmp
            Download

            memory/1348-148-0x0000000000CB0000-0x0000000000CC0000-memory.dmp
            Download

            memory/1348-144-0x000000001CD20000-0x000000001CD88000-memory.dmp
            Download

            memory/1348-181-0x0000000000CB0000-0x0000000000CC0000-memory.dmp
            Download

            memory/3056-9000-0x0000000000400000-0x000000000045D000-memory.dmp
            Download

            memory/3152-9430-0x00007FF86EB20000-0x00007FF86EB21000-memory.dmp
            Download

            memory/3152-9433-0x00007FF86DB10000-0x00007FF86DB11000-memory.dmp
            Download