Overview

overview

6

Static

static

1

BlueStacks...==.exe

windows11-21h2-x64

6

BlueStacks...==.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    79s
  • max time network
    163s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/07/2026, 13:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    BlueStacksInstaller_5.22.250.1015_native_128931b2c62a2e63073874e58374516b_MzsxNSwwOzUsNTsxNQ==.exe
  • Size 930KB
  • Sample260719-qzfflab15m
  • SHA256 2aa5edc8aa2562667bf5e7c53a34db0ec83b40c4d2058acc2bde76bf89ed265e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoveryexecution

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies Windows Firewall 2 TTPs 4 IoCs
    defense_evasion
  • Enumerates processes with tasklist 1 TTPs 5 IoCs
    discovery
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 8 IoCs
    execution
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 6 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BlueStacksInstaller_5.22.250.1015_native_128931b2c62a2e63073874e58374516b_MzsxNSwwOzUsNTsxNQ==.exe
    "C:\Users\Admin\AppData\Local\Temp\BlueStacksInstaller_5.22.250.1015_native_128931b2c62a2e63073874e58374516b_MzsxNSwwOzUsNTsxNQ==.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4108
    • C:\Users\Admin\AppData\Local\Temp\7zSC0099069\BlueStacksInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\7zSC0099069\BlueStacksInstaller.exe"
      2⤵
      • Enumerates connected drives
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:768
      • C:\Users\Admin\AppData\Local\Temp\7zSC0099069\HD-CheckCpu.exe
        "C:\Users\Admin\AppData\Local\Temp\7zSC0099069\HD-CheckCpu.exe" --cmd checkHypervEnabled
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4716
      • C:\Users\Admin\AppData\Local\Temp\7zSC0099069\HD-CheckCpu.exe
        "C:\Users\Admin\AppData\Local\Temp\7zSC0099069\HD-CheckCpu.exe" --cmd checkSSE4
        3⤵
        • Executes dropped EXE
        PID:2460
      • C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.22.250.1015_nxt.exe
        "C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.22.250.1015_nxt.exe" -s
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2972
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\BlueStacks X\green.vbs"
          4⤵
          • Executes a VBScript file via the Windows Script Host.
          PID:8408
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c green.bat
            5⤵
            • Executes a command shell one-liner
            PID:8484
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall delete rule name="BlueStacksWeb"
              6⤵
              • Modifies Windows Firewall
              PID:8532
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall delete rule name="Cloud Game"
              6⤵
              • Modifies Windows Firewall
              PID:8568
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall add rule name="BlueStacksWeb" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\BlueStacksWeb.exe"
              6⤵
              • Modifies Windows Firewall
              PID:8720
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall add rule name="Cloud Game" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\Cloud Game.exe"
              6⤵
              • Modifies Windows Firewall
              PID:8892
      • C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.22.250.1015_native_128931b2c62a2e63073874e58374516b_MzsxNSwwOzUsNTsxNQ==.exe
        "C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.22.250.1015_native_128931b2c62a2e63073874e58374516b_MzsxNSwwOzUsNTsxNQ==.exe" -versionMachineID=8d5b475a-008b-4ab1-8e33-882c0ec52189 -machineID=ab97764c-e448-4ff1-9be4-7e5b08486751 -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Pie64 -imageToLaunch=Pie64 -isSSE4Available=1 -appToLaunch=bs5 -bsxVersion=10.42.250.1001 -isWalletFeatureEnabled -discordUrl=https://discord.gg/UnXV7taVs4
        3⤵
          PID:9104
          • C:\Users\Admin\AppData\Local\Temp\7zS093EB9FB\BlueStacksInstaller.exe
            "C:\Users\Admin\AppData\Local\Temp\7zS093EB9FB\BlueStacksInstaller.exe" -versionMachineID=8d5b475a-008b-4ab1-8e33-882c0ec52189 -machineID=ab97764c-e448-4ff1-9be4-7e5b08486751 -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Pie64 -imageToLaunch=Pie64 -isSSE4Available=1 -appToLaunch=bs5 -bsxVersion=10.42.250.1001 -isWalletFeatureEnabled -discordUrl=https://discord.gg/UnXV7taVs4
            4⤵
              PID:9740
              • C:\Users\Admin\AppData\Local\Temp\7zS093EB9FB\HD-CheckCpu.exe
                "C:\Users\Admin\AppData\Local\Temp\7zS093EB9FB\HD-CheckCpu.exe" --cmd checkHypervEnabled
                5⤵
                  PID:9812
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k GPSvcGroup
          1⤵
            PID:8832
          • C:\ProgramData\BlueStacksServicesSetup.exe
            "C:\ProgramData\BlueStacksServicesSetup.exe"
            1⤵
              PID:9928
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq BlueStacksServices.exe" | find "BlueStacksServices.exe"
                2⤵
                • Executes a command shell one-liner
                PID:10112
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq BlueStacksServices.exe"
                  3⤵
                  • Enumerates processes with tasklist
                  PID:10152
                • C:\Windows\SysWOW64\find.exe
                  find "BlueStacksServices.exe"
                  3⤵
                    PID:10160
              • C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
                "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --hidden --initialLaunch
                1⤵
                  PID:5060
                  • C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
                    "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1476 --field-trial-handle=1340,i,6219414822619795904,12305994363568508771,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                    2⤵
                      PID:432
                    • C:\Windows\system32\cscript.exe
                      cscript.exe
                      2⤵
                        PID:5760
                      • C:\Windows\system32\cscript.exe
                        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKCU\SOFTWARE\BlueStacksServices
                        2⤵
                        • Executes a VBScript file via the Windows Script Host.
                        PID:5404
                      • C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
                        "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --mojo-platform-channel-handle=1924 --field-trial-handle=1340,i,6219414822619795904,12305994363568508771,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
                        2⤵
                          PID:6432
                        • C:\Windows\system32\cscript.exe
                          cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKCU\SOFTWARE\BlueStacksServices
                          2⤵
                          • Executes a VBScript file via the Windows Script Host.
                          PID:6312
                        • C:\Windows\system32\cscript.exe
                          cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regPutValue.wsf A
                          2⤵
                          • Executes a VBScript file via the Windows Script Host.
                          PID:4312
                        • C:\Windows\system32\cscript.exe
                          cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regPutValue.wsf A
                          2⤵
                          • Executes a VBScript file via the Windows Script Host.
                          PID:6212
                        • C:\Windows\system32\cscript.exe
                          cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
                          2⤵
                          • Executes a VBScript file via the Windows Script Host.
                          PID:2668
                        • C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
                          "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --app-user-model-id=com.bluestacks.services --app-path="C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2588 --field-trial-handle=1340,i,6219414822619795904,12305994363568508771,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
                          2⤵
                            PID:3892
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                            2⤵
                            • Executes a command shell one-liner
                            PID:1268
                            • C:\Windows\system32\tasklist.exe
                              tasklist /FI "IMAGENAME eq HD-Player.exe"
                              3⤵
                              • Enumerates processes with tasklist
                              PID:3496
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                            2⤵
                            • Executes a command shell one-liner
                            PID:4908
                            • C:\Windows\system32\tasklist.exe
                              tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                              3⤵
                              • Enumerates processes with tasklist
                              PID:5632
                          • C:\Windows\system32\cscript.exe
                            cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
                            2⤵
                            • Executes a VBScript file via the Windows Script Host.
                            PID:4604
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                            2⤵
                            • Executes a command shell one-liner
                            PID:7328
                            • C:\Windows\system32\tasklist.exe
                              tasklist /FI "IMAGENAME eq HD-Player.exe"
                              3⤵
                              • Enumerates processes with tasklist
                              PID:6008
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                            2⤵
                            • Executes a command shell one-liner
                            PID:7400
                            • C:\Windows\system32\tasklist.exe
                              tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                              3⤵
                              • Enumerates processes with tasklist
                              PID:2960
                          • C:\Windows\system32\cscript.exe
                            cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
                            2⤵
                            • Executes a VBScript file via the Windows Script Host.
                            PID:2728

                        Network

                              MITRE ATT&CK Enterprise v16

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              green.vbs
                              • Path C:\Program Files (x86)\BlueStacks X\green.vbs
                              • Size 66B
                              • SHA256 9aadc49b300c730ff96b3aecbd5eca60dc7d7b725b41d1c689dd58ce13421fe1
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              close_disabled.svg
                              • Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_disabled.svg
                              • Size 569B
                              • SHA256 8ee5aa84139b2ea5549f7272523aeb203d73954c5ccdcf6f7407bf1a3469f13e
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              close_hover.svg
                              • Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_hover.svg
                              • Size 653B
                              • SHA256 1bca2e912184b8168ee8961de68d1d839f4f9827fde6f48ab100fb61e82eff90
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              close_normal.svg
                              • Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_normal.svg
                              • Size 569B
                              • SHA256 92aeae68e9e0973d9e0dc575941f1cb2e24afd0574341a46b870be7384eaa537
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              close_pressed.svg
                              • Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_pressed.svg
                              • Size 653B
                              • SHA256 9585f41eb6202e89f2087266fa31852d7f41ca8cc659b907c96753fe165f937d
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              discord_icon_click.png
                              • Path C:\Users\Admin\AppData\Local\Temp\7zS093EB9FB\Assets\discord_icon_click.png
                              • Size 512B
                              • SHA256 6b126c8a7015c2274e6a2ac969e0f31ecae421e1652b446b2aafd2b03d0dc3f5
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              exit_close.png
                              • Path C:\Users\Admin\AppData\Local\Temp\7zS093EB9FB\Assets\exit_close.png
                              • Size 670B
                              • SHA256 7aaef329ba9fa052791d1a09f127551289641ea743baba171de55faa30ec1157
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              minimize_progress.png
                              • Path C:\Users\Admin\AppData\Local\Temp\7zS093EB9FB\Assets\minimize_progress.png
                              • Size 212B
                              • SHA256 2f62d4e8c643051093f907058dddc78cc525147d9c4f4a0d78b4d0e5c90979f6
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              backicon.png
                              • Path C:\Users\Admin\AppData\Local\Temp\7zSC0099069\Assets\backicon.png
                              • Size 15KB
                              • SHA256 fa64884054171515e97b78aaa1aad1ec5baa9d1daf9c682e0b3fb4a41a9cb1c1
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              change_hover.png
                              • Path C:\Users\Admin\AppData\Local\Temp\7zSC0099069\Assets\change_hover.png
                              • Size 310B
                              • SHA256 8e5847487da148ebb3ea029cc92165afd215cdc08f7122271e13eb37f94e6dc1
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              close_red.png
                              • Path C:\Users\Admin\AppData\Local\Temp\7zSC0099069\Assets\close_red.png
                              • Size 15KB
                              • SHA256 d0b6d143642d356b40c47459a996131a344cade6bb86158f1b74693426b09bfb
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              custom.png
                              • Path C:\Users\Admin\AppData\Local\Temp\7zSC0099069\Assets\custom.png
                              • Size 17KB
                              • SHA256 fbece8bb5f4dfa55dcfbf41151b10608af807b9477e99acf0940954a11e68f7b
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              discord_icon.png
                              • Path C:\Users\Admin\AppData\Local\Temp\7zSC0099069\Assets\discord_icon.png
                              • Size 564B
                              • SHA256 c29b35c6be50f9e34f1120bd346ce01884f0c7ba1121c866d95b24e46e420b0c
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              folder.png
                              • Path C:\Users\Admin\AppData\Local\Temp\7zSC0099069\Assets\folder.png
                              • Size 298B
                              • SHA256 7ffa875fab1be82e384022a27f3e627ab75131eb168be949cc83c03b6e291bbf
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              help_icon.png
                              • Path C:\Users\Admin\AppData\Local\Temp\7zSC0099069\Assets\help_icon.png
                              • Size 1KB
                              • SHA256 97c7450d55ecda9017d0a9eed0049b8176e1828f3525aaf5660985ba214010cc
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              info_icon.png
                              • Path C:\Users\Admin\AppData\Local\Temp\7zSC0099069\Assets\info_icon.png
                              • Size 929B
                              • SHA256 ee91e51aaa8356318cc75d60476d9422bf84be7d8a25e1b884aa16c3198dc764
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              installer_bg.jpg
                              • Path C:\Users\Admin\AppData\Local\Temp\7zSC0099069\Assets\installer_bg.jpg
                              • Size 78KB
                              • SHA256 4c7471c986e16de0cd451be27d4b3171e595fe2916b4b3bf7ca52df6ec368904
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              installer_logo.png
                              • Path C:\Users\Admin\AppData\Local\Temp\7zSC0099069\Assets\installer_logo.png
                              • Size 9KB
                              • SHA256 462b64f2e016d25a2a6a653ba896206129c4ac841d61a6c2fd116009606f7e1c
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              installer_minimize.png
                              • Path C:\Users\Admin\AppData\Local\Temp\7zSC0099069\Assets\installer_minimize.png
                              • Size 113B
                              • SHA256 a064f417e3c2b8f3121a14bbded268b2cdf635706880b7006f931de31476bbc2
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              loader.png
                              • Path C:\Users\Admin\AppData\Local\Temp\7zSC0099069\Assets\loader.png
                              • Size 279B
                              • SHA256 076263cc65f9824f4f82eb6beaa594d1df90218a2ee21664cf209181557e04b1
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              logo_text.png
                              • Path C:\Users\Admin\AppData\Local\Temp\7zSC0099069\Assets\logo_text.png
                              • Size 4KB
                              • SHA256 66df86129129d8aa8dd3ba014eb3b3c27a36c22e4782f3dbd6a9a4bc1f4a87bc
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              setpath.png
                              • Path C:\Users\Admin\AppData\Local\Temp\7zSC0099069\Assets\setpath.png
                              • Size 15KB
                              • SHA256 5bbb2f41f9f3a805986c3c88a639bcc22d90067d4b8de9f1e21e3cf9e5c1766b
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              BlueStacksInstaller.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\7zSC0099069\BlueStacksInstaller.exe
                              • Size 648KB
                              • SHA256 1b82009ed7d94ba568217f5f855f50fb99adcb6ad18bbc0d1abbf5e81e4de2f9
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              BlueStacksInstaller.exe.config
                              • Path C:\Users\Admin\AppData\Local\Temp\7zSC0099069\BlueStacksInstaller.exe.config
                              • Size 324B
                              • SHA256 d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              HD-CheckCpu.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\7zSC0099069\HD-CheckCpu.exe
                              • Size 200KB
                              • SHA256 2e14887f3432b4a313442247fc669f891dbdad7ef1a2d371466a2afa88074a4c
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              JSON.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\7zSC0099069\JSON.dll
                              • Size 411KB
                              • SHA256 d2c8d26f95f55431e632c8581154db7c19547b656380e051194a9d2583dd2156
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              i18n.en-US.txt
                              • Path C:\Users\Admin\AppData\Local\Temp\7zSC0099069\Locales\i18n.en-US.txt
                              • Size 22KB
                              • SHA256 8936455d79f33eb298869f1654286db493fb5b11b580ef7e8d859ce63541ba91
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ThemeFile
                              • Path C:\Users\Admin\AppData\Local\Temp\7zSC0099069\ThemeFile
                              • Size 80KB
                              • SHA256 de1a2e6b560e036da5ea6b042e29e81a5bfcf67dde89670c332fc5199e811ba6
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              installer_bg_1.jpg
                              • Path C:\Users\Admin\AppData\Local\Temp\Assets\installer_bg_1.jpg
                              • Size 30KB
                              • SHA256 873030e34515538dac3efb98edec519596439fa05b7aad37f6137ca954ba41a6
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              BgWorker.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\nsm3923.tmp\BgWorker.dll
                              • Size 12KB
                              • SHA256 a9e4f7ec65670d2ce375ffaf09b6d07f4cd531132ca002452287a4d540154a38
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              System.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\nsm3923.tmp\System.dll
                              • Size 11KB
                              • SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              nsDialogs.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\nsm3923.tmp\nsDialogs.dll
                              • Size 9KB
                              • SHA256 2bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              nsDui.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\nsm3923.tmp\nsDui.dll
                              • Size 3.0MB
                              • SHA256 1640dd756f5e7c07280144c29d7388a4c5f84c6f1058971413dd80e56c871e03
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              nsis7z.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\nsm3923.tmp\nsis7z.dll
                              • Size 434KB
                              • SHA256 a896a9ece055d334d431cd0f856113ab925d9ee86d2dee383c0bfbbef11a5b50
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Registry.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\nsqA611.tmp\Registry.dll
                              • Size 24KB
                              • SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              StdUtils.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\nsqA611.tmp\StdUtils.dll
                              • Size 100KB
                              • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              WinShell.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\nsqA611.tmp\WinShell.dll
                              • Size 3KB
                              • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              default.exc
                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
                              • Size 2B
                              • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                              • MD5 SHA1 SHA512
                              Submit Download

                              config.json
                              • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json
                              • Size 57B
                              • SHA256 50ea1f85f194aef73e3dc992de879f744e26e0f3a3572a9dad6aacfbbb3c25c6
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              config.json.tmp-4468665099be98b9
                              • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json.tmp-4468665099be98b9
                              • Size 92B
                              • SHA256 5abab3c726748cc815fd1cbb77219fa5a4dee2360420be8a509e3d21c8a8b9ab
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              memory/768-190-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                              Download

                              memory/768-141-0x00007FFA47CFF000-0x00007FFA47D00000-memory.dmp
                              Download

                              memory/768-191-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                              Download

                              memory/768-179-0x00000000207B0000-0x00000000207B8000-memory.dmp
                              Download

                              memory/768-148-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                              Download

                              memory/768-145-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                              Download

                              memory/768-144-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                              Download

                              memory/768-143-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                              Download

                              memory/768-149-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                              Download

                              memory/768-146-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                              Download

                              memory/768-142-0x0000000000FE0000-0x0000000001084000-memory.dmp
                              Download

                              memory/768-192-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                              Download

                              memory/768-150-0x000000001BD10000-0x000000001BD78000-memory.dmp
                              Download

                              memory/768-151-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                              Download

                              memory/768-154-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                              Download

                              memory/768-152-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                              Download

                              memory/768-164-0x000000001C7A0000-0x000000001C7DE000-memory.dmp
                              Download

                              memory/768-165-0x000000001C770000-0x000000001C77E000-memory.dmp
                              Download

                              memory/768-157-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                              Download

                              memory/768-162-0x0000000020840000-0x0000000020D68000-memory.dmp
                              Download

                              memory/768-163-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp
                              Download

                              memory/3892-9419-0x00007FFA68BA0000-0x00007FFA68BA1000-memory.dmp
                              Download

                              memory/3892-9424-0x00007FFA68C50000-0x00007FFA68C51000-memory.dmp
                              Download

                              memory/4108-9012-0x0000000000400000-0x000000000045D000-memory.dmp
                              Download