06cb3f619a7554dc955214e33358fb7ce6f4e734bf3020846ce5d4b7040fdf7e

Resubmissions

20/07/2026, 22:35

260720-2h4yeahz8s7

20/07/2026, 22:26

260720-2csceshy916

20/07/2026, 22:22

260720-2af7dahy6z6

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BlueStacksMicroInstaller_5.22.75.6322_native.exe
Size 1.1MB
Sample260720-2csceshy91
SHA256 06cb3f619a7554dc955214e33358fb7ce6f4e734bf3020846ce5d4b7040fdf7e
MD5 bbeb9e9aa01a83708a0e4b966b0ca877
SHA1 32f55edb8c00dc3d746a414d1067430b8aaf6f67
SHA512 f40e2ec422a475c212b31118ff672d9ec6c09f84bec3c428ccd4a897d57a922d3e6e69bfe6cbf21440d49c11776cb5df1258e5a0739c9be8bc04a7d170cad7ca
SSDEEP 24576:wivtCX8jD0MhSq73WMGYPmjDhUGhPmQYuXh6a5S0crqHGFA:1tCX8P0Mhb7DGYahhPXYGh5cDm
TLSH
T12245F1440B4AC4F4C09622F15FD28230AB7D96768FFFC142AAF16F1CC7366ED59616A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
37	5112	BlueStacksInstaller.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	BlueStacksInstaller.exe

Modifies Windows Firewall 2 TTPs 4 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1128	netsh.exe
2220	netsh.exe
1260	netsh.exe
2900	netsh.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	BlueStacksMicroInstaller_5.22.75.6322_native.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	BSX-Setup-5.22.75.6322_msi5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4468	WScript.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 4 IoCs

pid	Process
5112	BlueStacksInstaller.exe
4940	HD-CheckCpu.exe
4856	HD-CheckCpu.exe
1296	BSX-Setup-5.22.75.6322_msi5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3224	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BSX-Setup-5.22.75.6322_msi5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD-CheckCpu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BlueStacksMicroInstaller_5.22.75.6322_native.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD-CheckCpu.exe

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksXmsi5\URL Protocol	BSX-Setup-5.22.75.6322_msi5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksXmsi5\DefaultIcon	BSX-Setup-5.22.75.6322_msi5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksXmsi5\DefaultIcon\ = "C:\\Program Files (x86)\\BlueStacks X_msi5\\MSI App Player.exe,0"	BSX-Setup-5.22.75.6322_msi5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksXmsi5\shell\open	BSX-Setup-5.22.75.6322_msi5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksXmsi5\shell\open\	BSX-Setup-5.22.75.6322_msi5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksXmsi5\shell\open\command	BSX-Setup-5.22.75.6322_msi5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksXmsi5\shell\open\command\ = "\"C:\\Program Files (x86)\\BlueStacks X_msi5\\MSI App Player.exe\" -open \"%1\""	BSX-Setup-5.22.75.6322_msi5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksXmsi5	BSX-Setup-5.22.75.6322_msi5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksXmsi5\shell	BSX-Setup-5.22.75.6322_msi5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksXmsi5\shell\	BSX-Setup-5.22.75.6322_msi5.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	BSX-Setup-5.22.75.6322_msi5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BlueStacksXmsi5\ = "URL:BlueStacksXmsi5 Protocol Handler"	BSX-Setup-5.22.75.6322_msi5.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5112	BlueStacksInstaller.exe
5112	BlueStacksInstaller.exe
5112	BlueStacksInstaller.exe
5112	BlueStacksInstaller.exe
5112	BlueStacksInstaller.exe
5112	BlueStacksInstaller.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5112	BlueStacksInstaller.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 5112	3500	BlueStacksMicroInstaller_5.22.75.6322_native.exe	85
PID 5112 wrote to memory of 4940	5112	BlueStacksInstaller.exe	87
PID 5112 wrote to memory of 4856	5112	BlueStacksInstaller.exe	89
PID 5112 wrote to memory of 1296	5112	BlueStacksInstaller.exe	101
PID 4468 wrote to memory of 3224	4468	WScript.exe	103
PID 3224 wrote to memory of 2220	3224	cmd.exe	105
PID 3224 wrote to memory of 1260	3224	cmd.exe	106
PID 3224 wrote to memory of 2900	3224	cmd.exe	107
PID 3224 wrote to memory of 1128	3224	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\BlueStacksMicroInstaller_5.22.75.6322_native.exe
"C:\Users\Admin\AppData\Local\Temp\BlueStacksMicroInstaller_5.22.75.6322_native.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Users\Admin\AppData\Local\Temp\7zSCAD01E08\BlueStacksInstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\7zSCAD01E08\BlueStacksInstaller.exe"
  2⤵
  - Downloads MZ/PE file
  - Enumerates connected drives
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Users\Admin\AppData\Local\Temp\7zSCAD01E08\HD-CheckCpu.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSCAD01E08\HD-CheckCpu.exe" --cmd checkHypervEnabled
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4940
- - C:\Users\Admin\AppData\Local\Temp\7zSCAD01E08\HD-CheckCpu.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSCAD01E08\HD-CheckCpu.exe" --cmd checkSSE4
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4856
- - C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.22.75.6322_msi5.exe
    "C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.22.75.6322_msi5.exe" -s
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1296
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\BlueStacks X_msi5\green.vbs"
      4⤵
      Checks computer location settings
      Executes a VBScript file via the Windows Script Host.
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4468
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c green.bat
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3224
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall delete rule name="BlueStacksWeb"
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:2220
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall delete rule name="Cloud Game"
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:1260
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="BlueStacksWeb" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X_msi5\BlueStacksWeb.exe"
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:2900
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="Cloud Game" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X_msi5\Cloud Game.exe"
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:1128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

backicon.png

Path C:\Users\Admin\AppData\Local\Temp\7zSCAD01E08\Assets\backicon.png
Size 778B
SHA256 77533707194f691af85e6c990d852b949c09018378c8f9d87763b54b1c118f67
MD5 bb32b6c0cb2fd3b9329f0813e1b4239d
SHA1 241b75e5e21aa3e7a6aae5066de65d65db49651f
SHA512 e3aa89c3ba19f4d0a26fc6f3fd725c5201f3609b7e3f91bd8fa1fe95aa8cfdac5d684893ccac3e81b290ad241c048264d12bb1c6aa4b9646e604879b54bb9d33
TLSH
T118014163ED891988428A58B2FA4E056AE177C8925BFB503FEA49053CD016596839AA82
MD5 SHA1 SHA512 TLSH

Submit Download

change_hover.png

Path C:\Users\Admin\AppData\Local\Temp\7zSCAD01E08\Assets\change_hover.png
Size 310B
SHA256 8e5847487da148ebb3ea029cc92165afd215cdc08f7122271e13eb37f94e6dc1
MD5 57092634754fc26e5515e3ed5ca7d461
SHA1 3ae4d01db9d6bba535f5292298502193dfc02710
SHA512 553baf9967847292c8e9249dc3b1d55069f51c79f4d1d3832a0036e79691f433a3ce8296a68c774b5797caf7000037637ce61b8365885d2a4eed3ff0730e5e2a
TLSH
T14AE02DC28308903CC3070C22602281E6E63E04D4292238024890C2382E64D0CD4187B1
MD5 SHA1 SHA512 TLSH

Submit Download

close_red.png

Path C:\Users\Admin\AppData\Local\Temp\7zSCAD01E08\Assets\close_red.png
Size 1KB
SHA256 8cd75e91be69cf7cc6e6979c14b394a11fe683be7b62d5163da1073bb568b7d9
MD5 3759fdf92c29556e5740a6282507e1f9
SHA1 23960cb0edd610083edd8f817c03add5e883453d
SHA512 d0773ead77552514a2cd7fd7e55abe730579b4fab24981eb976ac43a821fc5a06ae02626e48dff83a58acb37db23d5527444faf5d4b7cb2fc78df33b065b80d3
TLSH
T15821E7DBCECCF1658D180C7B82E211C256AB8C2A0B034400E58D9C940FB8B2B97E4834
MD5 SHA1 SHA512 TLSH

Submit Download

custom.png

Path C:\Users\Admin\AppData\Local\Temp\7zSCAD01E08\Assets\custom.png
Size 580B
SHA256 8eaab641d186f93f50d2d2bbae6ac5b3c937ca30665bf916321a35c83253eca3
MD5 07c7f00c7498d32e8045c1a0eda0727d
SHA1 bebf52df35cf5a95dd6ff5da778b83c5eafeb052
SHA512 142752b1ab40a23f654293a15e075321020322fc0f19efdab93e69716cc0ff5dc2148a83f7db149b7dcd8c30b7f542c0f89ac52bd50470e756b07b00ec78f5b9
TLSH
T101F04712EF1645B58D79965D80E370B1B4714001A2D02843131309C1757C2E72ACD3F6
MD5 SHA1 SHA512 TLSH

Submit Download

discord_icon.png

Path C:\Users\Admin\AppData\Local\Temp\7zSCAD01E08\Assets\discord_icon.png
Size 564B
SHA256 c29b35c6be50f9e34f1120bd346ce01884f0c7ba1121c866d95b24e46e420b0c
MD5 9354bc445e979c2de9b9eedd9b7c8318
SHA1 8dc3e8fdcad0fcdad1fe19b0b94b676e8846affd
SHA512 ad13f6bf46dd8cb48a030e720c1c577a22b0d3dec794ae807aa482474fe6c2bead7fc63dd45983fb3ab82034d74d4f10b6d9967d4ff677d2226c6c18ee03a4d6
TLSH
T118F096F97D43D827F042101E764B64906C35F5782B32BB2E7588800C790F7B8522B6B0
MD5 SHA1 SHA512 TLSH

Submit Download

installer_bg.jpg

Path C:\Users\Admin\AppData\Local\Temp\7zSCAD01E08\Assets\installer_bg.jpg
Size 353KB
SHA256 15bde105d61a562560d354614e0254dc4259000d8f610b32be8a965bf26829ca
MD5 49875ca1499a58b4ca9abda4d34adea5
SHA1 091155113dd5cf955211fd7a932ecba32f8bf136
SHA512 08cf0ce98b4c31f5879789f9458f14526fa3483096efd5feeca0f9b477456d80eb542a1e2f5823593e6d7d4d9d106bae0a7a7f096bacb638ee6fcfc67e13623a
SSDEEP 6144:OJPWdCG7sIfZ0esuoF2rWnLAfWfOBzXExDXO8W9l7Zj8AvcY9bYzJXnuIx2aWHN3:OKHAIulF2KnxfOEDI7ZBR18XuIKtvDZJ
TLSH
T18174234ECD0D81015A19B1E5E213C0F69D07DA8DC78C72F95153EA86CFA8599DCFA88E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_logo.png

Path C:\Users\Admin\AppData\Local\Temp\7zSCAD01E08\Assets\installer_logo.png
Size 13KB
SHA256 1121302d4f18620499588c60e9991052665f6a4423774750880226e72ae4e0e4
MD5 0aa1b6e9ddac3e0a53394758357bcfad
SHA1 1fdca03b3a41f6dca2b535e83d51e5cd14df8334
SHA512 98364f5b379abd6f153c53a7f752132be9b1bae20632dfd7dfebc357fcb0c79642464ab725891b844f4b897761650fc61a1fc194641e8ce14b27830c07c1e697
SSDEEP 384:0qP0yVzAv2D/JlAYJV1J+Lt2e4OzYa6C/:0mRk2D/Jl3J8t21ar
TLSH
T1E752CF272F68E3625E362DE78CFC6E4949D8D61521F66251278EF5E6D805C3C8C009C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer_minimize.png

Path C:\Users\Admin\AppData\Local\Temp\7zSCAD01E08\Assets\installer_minimize.png
Size 157B
SHA256 8e6e37b79756bfebb943d51d3571926fe4992748c4a673bbb6d78b22e87bc7f6
MD5 857bcef475b0d4c1d669bf47a143e85e
SHA1 072746be2f79c9571ec9b7e3b702a8cdef5a2b66
SHA512 b7e236edefe3f4aceefd912f2b6cfcecee034125ff082d3bac5fdf6db57c89dc2dfb4a96897529aed8834a423529680cc0ba1c94d497eb8d9c4f450ff70cf79c
TLSH
T143C02BD307666C38CE8D616380D20798FEF713CB251D214CA172A07D31467CCE0E5356
MD5 SHA1 SHA512 TLSH

Submit Download

loader.png

Path C:\Users\Admin\AppData\Local\Temp\7zSCAD01E08\Assets\loader.png
Size 279B
SHA256 076263cc65f9824f4f82eb6beaa594d1df90218a2ee21664cf209181557e04b1
MD5 03903fd42ed2ee3cb014f0f3b410bcb4
SHA1 762a95240607fe8a304867a46bc2d677f494f5c2
SHA512 8b0e717268590e5287c07598a06d89220c5e9a33cd1c29c55f8720321f4b3efc869d20c61fcc892e13188d77f0fdc4c73a2ee6dece174bf876fcc3a6c5683857
TLSH
T17FD0EB93F339AC52F8018213C788083CD2FA26852E476E4C022A8CB60280D3E8AE018B
MD5 SHA1 SHA512 TLSH

Submit Download

setpath.png

Path C:\Users\Admin\AppData\Local\Temp\7zSCAD01E08\Assets\setpath.png
Size 355B
SHA256 9ea14db4e8d39be52c9b55a39119d5f95dc331a0559d38de44fd8e72e8677718
MD5 f4c65de79fb292fd6104eb1a160ca09b
SHA1 52173df03e93433d88b50ebcd7d3bdbc32bd4165
SHA512 db4bca2ed5582efe9ca27ec67bff59ed2a66c471dc4e4247818e3b79838b57a00cd69d92b709c3a7e0628d7c9e9508335aff877279d30741de18226f0626dced
TLSH
T1F3E0C0CF8778ED6DA4CAA4B610A36820DD7EDCDB13A4518DFA05C134597695190D57C0
MD5 SHA1 SHA512 TLSH

Submit Download

BlueStacksInstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSCAD01E08\BlueStacksInstaller.exe
Size 635KB
SHA256 00153d50951d23f2d980276f1556c9124eff4321156c4043f47124dbf5e72bde
MD5 ef65c234f0b855e6daddc67c23520fd8
SHA1 482da8bca7bda868edc46fa69eeac815b381ca28
SHA512 70e7a7bb349e96fcd8df02439c0ffa1a6e2743c9114b923654a8426e5db6ab9411486b34b3613fe363e96824f592bb3348be8b45d1c34b53151f34c6e230703b
SSDEEP 6144:bU3vCX04ua6suY6KyHczZPGWVqy2p3PnSnrquzShIo5pWfeDP:bgCXUa6suQ8yvVi3PSnrUIpe7
TLSH
T1EFD43A4017F8C988F1FF4BB56DF204208B7AB8669EA3C21E41A15C4D5EB2BC59C61B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlueStacksInstaller.exe.config

Path C:\Users\Admin\AppData\Local\Temp\7zSCAD01E08\BlueStacksInstaller.exe.config
Size 324B
SHA256 d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb
MD5 1b456d88546e29f4f007cd0bf1025703
SHA1 e5c444fcfe5baf2ef71c1813afc3f2c1100cab86
SHA512 c545e416c841b8786e4589fc9ca2b732b16cdd759813ec03f558332f2436f165ec1ad2fbc65012b5709fa19ff1e8396639c17bfad150cabeb51328a39ea556e6
TLSH
T1C9E0C21941D8FD2B5D734B13A3128852EFB0A2A391A4544CF0EE7F830F3308A6697332
MD5 SHA1 SHA512 TLSH

Submit Download

HD-CheckCpu.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSCAD01E08\HD-CheckCpu.exe
Size 200KB
SHA256 2e14887f3432b4a313442247fc669f891dbdad7ef1a2d371466a2afa88074a4c
MD5 81234fd9895897b8d1f5e6772a1b38d0
SHA1 80b2fec4a85ed90c4db2f09b63bd8f37038db0d3
SHA512 4c924d6524dc2c7d834bfc1a0d98b21753a7bf1e94b1c2c6650f755e6f265512d3a963bc7bc745351f79f547add57c37e29ba9270707edbf62b60df3a541bc16
SSDEEP 3072:KjDeWjpu716WoCYv8NBa3eSx8LHGYwj6V4NL1q7HOAg0FujFfnk601hWNxK:opcoCYv8Xa3eSqL8j/3AOpNq
TLSH
T1FA147C10B4C18433D9B715314DF8DAB99A3DB8110B2559EB73D80B7E4F346E3BA31A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JSON.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSCAD01E08\JSON.dll
Size 411KB
SHA256 d2c8d26f95f55431e632c8581154db7c19547b656380e051194a9d2583dd2156
MD5 f5fd966e29f5c359f78cb61a571d1be4
SHA1 a55e7ed593b4bc7a77586da0f1223cfd9d51a233
SHA512 d99e6fe250bb106257f86135938635f6e7ad689b2c11a96bb274f4c4c5e9a85cfacba40122dbc953f77b5d33d886c6af30bff821f10945e15b21a24b66f6c8be
SSDEEP 6144:GmyZXnmtWrnngnnnKnanlywwwBwwA5wwwwswww+wwwGwwwbwwwLwwwwwwwwwnwwd:GmIWtWrnngnnnKnanxNYhX
TLSH
T11F947250D8535838CA244778BA7396B02DF9EC718A07E6716B207EE7F13BA20ED75532
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i18n.en-US.txt

Path C:\Users\Admin\AppData\Local\Temp\7zSCAD01E08\Locales\i18n.en-US.txt
Size 21KB
SHA256 195c5ef488ba9e24a49405ffcfc3beabcf8d93d8d6740efd5e189d943fbcefaa
MD5 fe19404280b985603d19c373d1be4f7d
SHA1 989b590aa2606dcff6935bd9fe931a34c5035070
SHA512 a20c8ef304f1e2a78e8eb87e87d5f259a36cfa73b564af7c65e160892ac5985769e63d50808a8001cc960d5e9f7dbcbe0399563d148d125624fd1f879b2b9ded
SSDEEP 384:aBvGq6rKPsL/ds89JplYTWfUvcABRGjV+qXOJtUmEIpNnU6+FKvtCFV30Y4TWEah:aBvGqaKPsL/ds893l+WfacWRGjV+qXO2
TLSH
T19FA22C8FD777136CAAD1011A94E93542A517B35B33693A11BCACC03B1B5790E133EADE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThemeFile

Path C:\Users\Admin\AppData\Local\Temp\7zSCAD01E08\ThemeFile
Size 79KB
SHA256 87bbd881c9603d6032564b787a85a1c040fc1a2c216f25a1b0b62e26fedcdf69
MD5 51e4b1a661b3e96697b54899cb2317de
SHA1 1cacf6e055023cd2cd7100e2537a6d2dee7d9a84
SHA512 55dbe855478a32ba78f15b0611847f609279fe262a7940c024a09378d58e1b84397038847aad03cd113ab5d1e4026fb323fb07d3024e0470f40eefa18949e7d3
SSDEEP 1536:Vy0cbtQ4Bt5A+pDdOlCaVqlt1ck8nTLsP8fPmaE32fO5GBQ/MPVn8Oep3xu+Pchw:FcOZC
TLSH
T187837B9DEADD3C39323F52AEB6361063C847301B7952896ABA1F11215FBC89F3417B25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1296-165-0x0000000010000000-0x0000000010003000-memory.dmp

Download

memory/5112-148-0x0000000020BE0000-0x0000000020BEE000-memory.dmp

Download

memory/5112-147-0x0000000020C10000-0x0000000020C48000-memory.dmp

Download

memory/5112-143-0x000000001E460000-0x000000001E988000-memory.dmp

Download

memory/5112-142-0x000000001B6A0000-0x000000001B6B0000-memory.dmp

Download

memory/5112-140-0x000000001B6A0000-0x000000001B6B0000-memory.dmp

Download

memory/5112-135-0x000000001B6A0000-0x000000001B6B0000-memory.dmp

Download

memory/5112-134-0x000000001B6B0000-0x000000001B718000-memory.dmp

Download

memory/5112-132-0x000000001B6A0000-0x000000001B6B0000-memory.dmp

Download

memory/5112-158-0x000000001DA40000-0x000000001DA48000-memory.dmp

Download

memory/5112-131-0x0000000000A90000-0x0000000000B32000-memory.dmp

Download

memory/5112-160-0x000000001B6A0000-0x000000001B6B0000-memory.dmp

Download