Overview

overview

7

Static

static

1

BlueStacks...ve.exe

windows10-2004-x64

7

Resubmissions

20/07/2026, 22:35

260720-2h4yeahz8s7

20/07/2026, 22:26

260720-2csceshy916

20/07/2026, 22:22

260720-2af7dahy6z6

Analysis

  • user interaction
    yes
  • max time kernel
    600s
  • max time network
    600s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    20/07/2026, 22:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    BlueStacksMicroInstaller_5.22.75.6322_native.exe
  • Size 1.1MB
  • Sample260720-2h4yeahz8s
  • SHA256 06cb3f619a7554dc955214e33358fb7ce6f4e734bf3020846ce5d4b7040fdf7e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Downloads MZ/PE file 1 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies Windows Firewall 2 TTPs 8 IoCs
    defense_evasion
  • Checks computer location settings 2 TTPs 11 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 31 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 24 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies registry class 13 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BlueStacksMicroInstaller_5.22.75.6322_native.exe
    "C:\Users\Admin\AppData\Local\Temp\BlueStacksMicroInstaller_5.22.75.6322_native.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1764
    • C:\Users\Admin\AppData\Local\Temp\7zS4E6AF258\BlueStacksInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS4E6AF258\BlueStacksInstaller.exe"
      2⤵
      • Downloads MZ/PE file
      • Enumerates connected drives
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3380
      • C:\Users\Admin\AppData\Local\Temp\7zS4E6AF258\HD-CheckCpu.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS4E6AF258\HD-CheckCpu.exe" --cmd checkHypervEnabled
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1328
      • C:\Users\Admin\AppData\Local\Temp\7zS4E6AF258\HD-CheckCpu.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS4E6AF258\HD-CheckCpu.exe" --cmd checkSSE4
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2768
      • C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.22.75.6322_msi5.exe
        "C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.22.75.6322_msi5.exe" -s
        3⤵
        • Checks computer location settings
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4320
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\BlueStacks X_msi5\green.vbs"
          4⤵
          • Checks computer location settings
          • Executes a VBScript file via the Windows Script Host.
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6784
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c green.bat
            5⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:6700
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall delete rule name="BlueStacksWeb"
              6⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:6648
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall delete rule name="Cloud Game"
              6⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:6568
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall add rule name="BlueStacksWeb" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X_msi5\BlueStacksWeb.exe"
              6⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:6428
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall add rule name="Cloud Game" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X_msi5\Cloud Game.exe"
              6⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:6276
      • C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksMicroInstaller_5.22.75.6322_native.exe
        "C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksMicroInstaller_5.22.75.6322_native.exe" -versionMachineID=716725d5-4cb3-485f-8626-3f8c08d8c1ca -machineID=711a3a94-cb71-4be2-b61a-21bfa1ded8c9 -pddir="C:\ProgramData\BlueStacks_msi5" -defaultImageName=Pie64 -imageToLaunch=Pie64 -isSSE4Available=1 -appToLaunch=bsx -bsxVersion=10.42.75.6311 -country=GB
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2596
        • C:\Users\Admin\AppData\Local\Temp\7zS42AC8BFA\BlueStacksInstaller.exe
          "C:\Users\Admin\AppData\Local\Temp\7zS42AC8BFA\BlueStacksInstaller.exe" -versionMachineID=716725d5-4cb3-485f-8626-3f8c08d8c1ca -machineID=711a3a94-cb71-4be2-b61a-21bfa1ded8c9 -pddir="C:\ProgramData\BlueStacks_msi5" -defaultImageName=Pie64 -imageToLaunch=Pie64 -isSSE4Available=1 -appToLaunch=bsx -bsxVersion=10.42.75.6311 -country=GB
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1628
          • C:\Users\Admin\AppData\Local\Temp\7zS42AC8BFA\HD-CheckCpu.exe
            "C:\Users\Admin\AppData\Local\Temp\7zS42AC8BFA\HD-CheckCpu.exe" --cmd checkHypervEnabled
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2588
      • C:\Program Files (x86)\BlueStacks X_msi5\MSI App Player.exe
        "C:\Program Files (x86)\BlueStacks X_msi5\MSI App Player.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies registry class
        • Modifies system certificate store
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5356
        • C:\Program Files (x86)\BlueStacks X_msi5\BlueStacksWeb.exe
          BlueStacksWeb.exe --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,NetworkServiceInProcess,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,InstalledApp,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --lang=en --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --mojo-platform-channel-handle=3808 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:9844
        • C:\Program Files (x86)\BlueStacks X_msi5\BlueStacksWeb.exe
          BlueStacksWeb.exe --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,NetworkServiceInProcess,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,InstalledApp,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --lang=en --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=3832 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:10020
        • C:\Program Files (x86)\BlueStacks X_msi5\BlueStacksWeb.exe
          BlueStacksWeb.exe --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,NetworkServiceInProcess,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,InstalledApp,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --disable-gpu-compositing --lang=en --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=5976 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:9460
        • C:\Users\Admin\AppData\Local\MSI App Player\BlueStacks-Installer_5.22.75.6322_amd64_native.exe
          "C:\Users\Admin\AppData\Local\MSI App Player\BlueStacks-Installer_5.22.75.6322_amd64_native.exe" -s -defaultImageName Nougat32 -imageToLaunch Nougat32 -skipBinaryShortcuts -appToLaunch=bsx -pddir="C:\ProgramData\BlueStacks_msi5"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:7316
          • C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Bootstrapper.exe
            "C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Bootstrapper.exe" -s -defaultImageName Nougat32 -imageToLaunch Nougat32 -skipBinaryShortcuts -appToLaunch=bsx -pddir="C:\ProgramData\BlueStacks_msi5"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:6596
            • C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\BlueStacksInstaller.exe
              "C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\BlueStacksInstaller.exe" -s -defaultImageName="Nougat32" -imageToLaunch="Nougat32" -skipBinaryShortcuts -appToLaunch="bsx" -pddir="C:\ProgramData\BlueStacks_msi5" -parentpath="C:\Users\Admin\AppData\Local\MSI App Player\BlueStacks-Installer_5.22.75.6322_amd64_native.exe"
              6⤵
              • Executes dropped EXE
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:6496
              • C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\7zr.exe
                "C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\CommonInstallUtils.zip" -o"C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\" -aoa
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:4040
              • C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\HD-ForceGPU.exe
                "C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\HD-ForceGPU.exe" 1 "C:\Program Files\BlueStacks_msi5"
                7⤵
                • Executes dropped EXE
                PID:312
              • C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\HD-GLCheck.exe
                "C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\HD-GLCheck.exe" 1 2
                7⤵
                • Executes dropped EXE
                PID:5940
              • C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\HD-GLCheck.exe
                "C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\HD-GLCheck.exe" 4 2
                7⤵
                • Executes dropped EXE
                PID:788
              • C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\HD-GLCheck.exe
                "C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\HD-GLCheck.exe" 2 2
                7⤵
                • Executes dropped EXE
                PID:6000
              • C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\HD-GLCheck.exe
                "C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\HD-GLCheck.exe" 1 1
                7⤵
                • Executes dropped EXE
                PID:2312
              • C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\HD-GLCheck.exe
                "C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\HD-GLCheck.exe" 4 1
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:6404
              • C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\HD-GLCheck.exe
                "C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\HD-GLCheck.exe" 2 1
                7⤵
                • Executes dropped EXE
                PID:5680
              • C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\HD-CheckCpu.exe
                "C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\HD-CheckCpu.exe" --cmd checkSSE4
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4268
              • C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\7zr.exe
                "C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\PF.zip" -o"C:\Program Files\BlueStacks_msi5" -aoa
                7⤵
                • Drops file in Program Files directory
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:7172
              • C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\7zr.exe
                "C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\PD.zip" -o"C:\ProgramData\BlueStacks_msi5" -aoa
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:2116
              • C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\7zr.exe
                "C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\7zr.exe" x "C:\Users\Admin\AppData\Local\MSI App Player\Nougat32_5.22.75.6322.exe" -o"C:\ProgramData\BlueStacks_msi5\Engine\Nougat32" -aoa
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:9584
              • C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\HD-GLCheck.exe
                "C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\\HD-GLCheck.exe" 2
                7⤵
                • Executes dropped EXE
                PID:9304
              • C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\HD-GLCheck.exe
                "C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\\HD-GLCheck.exe" 3
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:9288
              • C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\HD-GLCheck.exe
                "C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\\HD-GLCheck.exe" 1
                7⤵
                • Executes dropped EXE
                PID:9224
              • C:\Windows\SYSTEM32\netsh.exe
                "netsh.exe" advfirewall firewall delete rule name="BlueStacks Service"
                7⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:7120
              • C:\Windows\SYSTEM32\netsh.exe
                "netsh.exe" advfirewall firewall add rule name="BlueStacks Service" dir=in action=allow program="C:\Program Files\BlueStacks_msi5\HD-Player.exe" enable=yes
                7⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:10232
              • C:\Windows\SYSTEM32\netsh.exe
                "netsh.exe" advfirewall firewall delete rule name="BlueStacksAppplayerWeb"
                7⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:8688
              • C:\Windows\SYSTEM32\netsh.exe
                "netsh.exe" advfirewall firewall add rule name="BlueStacksAppplayerWeb" dir=in action=allow program="C:\Program Files\BlueStacks_msi5\BlueStacksAppplayerWeb.exe" enable=yes
                7⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:8588
              • C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\HD-CheckCpu.exe
                "C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\HD-CheckCpu.exe" --cmd checkSSE3
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:8516
              • C:\Windows\SYSTEM32\cmd.exe
                "cmd.exe" /c "sc.exe delete BlueStacksDrv_msi5"
                7⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:10348
                • C:\Windows\system32\sc.exe
                  sc.exe delete BlueStacksDrv_msi5
                  8⤵
                  • Launches sc.exe
                  PID:10392
              • C:\Windows\SYSTEM32\reg.exe
                "reg.exe" EXPORT HKLM\Software\BlueStacks_msi5 "C:\Users\Admin\AppData\Local\Temp\2ewzvc0h.0bb\RegHKLM.txt"
                7⤵
                  PID:10408
                • C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\7zr.exe
                  "C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\7zr.exe" a "C:\Users\Admin\AppData\Local\Temp\Installer.zip" -m0=LZMA:a=1 "C:\Users\Admin\AppData\Local\Temp\2ewzvc0h.0bb\*"
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:10476
    • C:\Program Files\BlueStacks_msi5\BstkDrv_msi5.sys
      "C:\Program Files\BlueStacks_msi5\BstkDrv_msi5.sys"
      1⤵
      • Executes dropped EXE
      PID:10324

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          2
          T1059

          Visual Basic

          1
          T1059.005

          Windows Command Shell

          1
          T1059.003

          System Services

          1
          T1569

          Service Execution

          1
          T1569.002

          Persistence

          Create or Modify System Process

          2
          T1543

          Windows Service

          2
          T1543.003

          Event Triggered Execution

          1
          T1546

          Netsh Helper DLL

          1
          T1546.007

          Privilege Escalation

          Create or Modify System Process

          2
          T1543

          Windows Service

          2
          T1543.003

          Event Triggered Execution

          1
          T1546

          Netsh Helper DLL

          1
          T1546.007

          Defense Evasion

          Impair Defenses

          2
          T1562

          Disable or Modify System Firewall

          1
          T1562.004

          Modify Registry

          1
          T1112

          Subvert Trust Controls

          1
          T1553

          Install Root Certificate

          1
          T1553.004

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          5
          T1012

          System Information Discovery

          5
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Service Stop

          1
          T1489

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          MSI App Player.exe
          • Path C:\Program Files (x86)\BlueStacks X_msi5\MSI App Player.exe
          • Size 495KB
          • SHA256 a5922756565b89b408fd327ea0dab910607e4aad8a8928709bc80f1683cefb22
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          close_disabled.svg
          • Path C:\Program Files (x86)\BlueStacks X_msi5\image\LocalAPK\close_disabled.svg
          • Size 569B
          • SHA256 8ee5aa84139b2ea5549f7272523aeb203d73954c5ccdcf6f7407bf1a3469f13e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          close_hover.svg
          • Path C:\Program Files (x86)\BlueStacks X_msi5\image\LocalAPK\close_hover.svg
          • Size 653B
          • SHA256 7b191722443d02f3716db38c73ba789fa9cb2adca7c9d2868f59d46eb3f54c52
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          close_normal.svg
          • Path C:\Program Files (x86)\BlueStacks X_msi5\image\LocalAPK\close_normal.svg
          • Size 569B
          • SHA256 92aeae68e9e0973d9e0dc575941f1cb2e24afd0574341a46b870be7384eaa537
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          close_pressed.svg
          • Path C:\Program Files (x86)\BlueStacks X_msi5\image\LocalAPK\close_pressed.svg
          • Size 653B
          • SHA256 cfa710391fdf13a97b5d5e202b535eb8367ceda61ed0589fd11f33a10408890d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          7zr.exe
          • Path C:\Program Files\BlueStacks_msi5\7zr.exe
          • Size 812KB
          • SHA256 4889c0826c633c0291264d37834363be90ee39d07fcea228494ed151386dcb16
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BlueStacksUninstaller.exe.config
          • Path C:\Program Files\BlueStacks_msi5\BlueStacksUninstaller.exe.config
          • Size 392B
          • SHA256 4b7df915d706af6459c38d75b09c5e14f951842ae0678078400f204ad1c7a7c2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          HD-ForceGPU.exe
          • Path C:\Program Files\BlueStacks_msi5\HD-ForceGPU.exe
          • Size 169KB
          • SHA256 ab29da920e9c8f560559d69093db1702fc858345a713d90e262a3712df3974cf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          HD-GLCheck.exe
          • Path C:\Program Files\BlueStacks_msi5\HD-GLCheck.exe
          • Size 218KB
          • SHA256 2b8f1ef579867e3806cd51c73b8dfb4eee1157a3d30659ddaa5d69bdc94f85f9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProductLogo.ico
          • Path C:\Program Files\BlueStacks_msi5\ProductLogo.ico
          • Size 125KB
          • SHA256 ff28fea3d0447a96798ccadf44f3da147a1a760ccab7196e722e079e5759f928
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          exit_close_click.png
          • Path C:\ProgramData\BlueStacks_msi5\Client\Assets\exit_close_click.png
          • Size 447B
          • SHA256 caa2a8fe9b282939a21b86f8f61fb0c9452222cc3409f06cbb0dcc45613aca8e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          radio_selected_hover.png
          • Path C:\ProgramData\BlueStacks_msi5\Client\Assets\radio_selected_hover.png
          • Size 577B
          • SHA256 4786cfb7c98edcf01d6b670abf19c50891d56a4de87b96a5e17be142b1af666a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          radio_unselected_hover.png
          • Path C:\ProgramData\BlueStacks_msi5\Client\Assets\radio_unselected_hover.png
          • Size 480B
          • SHA256 0ec39ed4bf89a341f1b5aea56d0e99ff5c923b9c3a6a81adeb9ff21764136f92
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          BlueStacks-Installer_5.22.75.6322.log
          • Path C:\Users\Admin\AppData\Local\Bluestacks\BlueStacks-Installer_5.22.75.6322.log
          • Size 165KB
          • SHA256 7ee506f311d2281e93580bb84b5bf80650d8ed7322358775690abca5a4aa41dc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Impression.json
          • Path C:\Users\Admin\AppData\Local\MSI App Player\LocalGames\Impression.json
          • Size 2KB
          • SHA256 5ecf560e1f423406dafb6d4807e075a45467953e137a2b20eb0d7392f9edcb5b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          log.txt
          • Path C:\Users\Admin\AppData\Local\MSI App Player\Log\log.txt
          • Size 771B
          • SHA256 0fe8f6f3ab39b577dac3468e36d81731bded76b196d5667aa38286ffb7abb729
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          log.txt
          • Path C:\Users\Admin\AppData\Local\MSI App Player\Log\log.txt
          • Size 3KB
          • SHA256 bad4156367f752f3979e03ceecb1a4160fc855b26bb1fe915bc734ac9fde39e5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          log.txt
          • Path C:\Users\Admin\AppData\Local\MSI App Player\Log\log.txt
          • Size 5KB
          • SHA256 8bd6b583d078c5d9a508a022a017b901af1f9042322395fdf30714bd4f4afd9d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CURRENT
          • Path C:\Users\Admin\AppData\Local\MSI App Player\QtWebEngine\Default\Local Storage\leveldb\CURRENT
          • Size 16B
          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
          • MD5 SHA1 SHA512
          Submit Download

          Network Persistent State
          • Path C:\Users\Admin\AppData\Local\MSI App Player\QtWebEngine\Default\Network Persistent State
          • Size 489B
          • SHA256 fa73e041cfea75ab80833b4d2758b5e623c736aae96772175ab99ec0b9020127
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Network Persistent State~RFe5f9ee9.TMP
          • Path C:\Users\Admin\AppData\Local\MSI App Player\QtWebEngine\Default\Network Persistent State~RFe5f9ee9.TMP
          • Size 59B
          • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MANIFEST-000001
          • Path C:\Users\Admin\AppData\Local\MSI App Player\QtWebEngine\Default\Session Storage\MANIFEST-000001
          • Size 41B
          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
          • MD5 SHA1 SHA512
          Submit Download

          f_000011
          • Path C:\Users\Admin\AppData\Local\MSI App Player\cache\QtWebEngine\Default\Cache\f_000011
          • Size 299KB
          • SHA256 1d58a22c0ad1a4a45e8f82953f1bf6d740f35cefeac9d8c1188c62578f355c08
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          f_000012
          • Path C:\Users\Admin\AppData\Local\MSI App Player\cache\QtWebEngine\Default\Cache\f_000012
          • Size 107KB
          • SHA256 7011dc146327b18579b20aaf342e5e0eefffa5387628dd498bad8ff3af89738e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          f_000013
          • Path C:\Users\Admin\AppData\Local\MSI App Player\cache\QtWebEngine\Default\Cache\f_000013
          • Size 98KB
          • SHA256 21ec52cf2d5be1500fa6d9ac473ab1ac60db5cdb120de7e1d4a3c8d8c03286b5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          f_000014
          • Path C:\Users\Admin\AppData\Local\MSI App Player\cache\QtWebEngine\Default\Cache\f_000014
          • Size 204KB
          • SHA256 4f671b49f8a5cac7ac84dd52862f8f9db5169be1e17c556dd8b39865f2b8d3eb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          f_000015
          • Path C:\Users\Admin\AppData\Local\MSI App Player\cache\QtWebEngine\Default\Cache\f_000015
          • Size 89KB
          • SHA256 7183592ec54c374496394e3e6cfb953afb420d9cc67e53d2ea981c3870344e0c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          com.roblox.client.tmp
          • Path C:\Users\Admin\AppData\Local\MSI App Player\cache\pcGames\com.roblox.client.tmp
          • Size 59KB
          • SHA256 92faf38f10482111d06b6f465b04ef0f2e059be3c16787c14e1cee3d67714d12
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          discord_icon_click.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS42AC8BFA\Assets\discord_icon_click.png
          • Size 512B
          • SHA256 6b126c8a7015c2274e6a2ac969e0f31ecae421e1652b446b2aafd2b03d0dc3f5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          exit_close.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS42AC8BFA\Assets\exit_close.png
          • Size 670B
          • SHA256 7aaef329ba9fa052791d1a09f127551289641ea743baba171de55faa30ec1157
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          minimize_progress.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS42AC8BFA\Assets\minimize_progress.png
          • Size 212B
          • SHA256 2f62d4e8c643051093f907058dddc78cc525147d9c4f4a0d78b4d0e5c90979f6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          checked_gray.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Assets\checked_gray.png
          • Size 659B
          • SHA256 fc88b72393b58799ad747a988b76c1b9d8ce3dbaedfd0463e74d6a33be0878b6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          checked_gray_hover.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Assets\checked_gray_hover.png
          • Size 412B
          • SHA256 d7c79677d2ef897fa0ad1efc90e916c46da29f571208f78f24505603b7165c20
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          close_red_click.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Assets\close_red_click.png
          • Size 1KB
          • SHA256 d2a45b8d92ddd7f4c6a9a21f22936fba0a2ffac101efeb98b9b14810de09fba0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          close_red_hover.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Assets\close_red_hover.png
          • Size 883B
          • SHA256 0b1d12bce748cdab6fb9550278e60eb993d74bf9ae877995c68099c3cda68a8a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          custom_click.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Assets\custom_click.png
          • Size 581B
          • SHA256 7431781037f422688265d141fec19f85bd6ffc230fef6fe7373df31015ac0994
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          custom_hover.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Assets\custom_hover.png
          • Size 444B
          • SHA256 74d0b8db319ca7408ec928c14859b0032adc6d15e4cb476cae17147a707fb137
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          error_icon.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Assets\error_icon.png
          • Size 1KB
          • SHA256 666ad4fe456216ddc06618967846ed31f81d8db5be97da6531842c0667352b89
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          error_icon_72.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Assets\error_icon_72.png
          • Size 1KB
          • SHA256 84e59d14d9433e6c3d92daeb8c443063b5e3be6c0b297f0403dbde473a05cb3f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          exit_close_hover.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Assets\exit_close_hover.png
          • Size 575B
          • SHA256 bcc053a9a087e077d58114106d29701a34f7851f4052f3157102811355d3e709
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          installer_minimize_click.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Assets\installer_minimize_click.png
          • Size 157B
          • SHA256 1b7431688c2c805c887948a5b3e6967b08e50ecac517b8536242421a77c111ee
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          installer_minimize_hover.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Assets\installer_minimize_hover.png
          • Size 154B
          • SHA256 1e0170f84a430a645449162569639a8145714516d52c6ba77c7919b788f391e8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          installer_upgrade_image_bg.jpg
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Assets\installer_upgrade_image_bg.jpg
          • Size 77KB
          • SHA256 ff0e7752f6e10a35a5c4ef661b99e3b59b7cf8c419ddca0c11dfc7860a75bd0c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          link.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Assets\link.png
          • Size 306B
          • SHA256 28c0abc6bfe7a155815104883a37a53dd783d142300471064c95eddf3cae0eaf
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          minimize_progress_hover.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Assets\minimize_progress_hover.png
          • Size 214B
          • SHA256 1a4aaa46893e2a9b011c478fbb0cd0e84c199f9f3520703189640088969ef5cd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          powered_by_bs.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Assets\powered_by_bs.png
          • Size 9KB
          • SHA256 3d2afe5236ec813d9e8063bc43eb34b88c2155784e1bce19c6a533c32767af35
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          setpath_click.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Assets\setpath_click.png
          • Size 360B
          • SHA256 9b3fb9fdf44616e2a0040ac994116919a5076e33e910581e4f6748fb4ae3123a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          setpath_hover.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Assets\setpath_hover.png
          • Size 362B
          • SHA256 5b357f522296166c37aca338f477eaf76c354f75f93f348cf2bd85a201ef7352
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          unchecked_gray.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Assets\unchecked_gray.png
          • Size 321B
          • SHA256 8355a9b447991ed53c3e1c768f397b622f9535faadb26913e4f2298cc3621c5c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          unchecked_gray_hover.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Assets\unchecked_gray_hover.png
          • Size 176B
          • SHA256 a631e26bd5b6ea19c8c65b766a056c92ba8a47e1483768dcf12b05293c9a7a0d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Bootstrapper.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Bootstrapper.exe
          • Size 148KB
          • SHA256 bb060e90a608c084367f32c30d4dc4f03651ce7e9095990ee6db6d9f74168d1f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.ar-EG.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Locales\i18n.ar-EG.txt
          • Size 27KB
          • SHA256 55e0d8d190fbbd1e94770c89a5f98146473c48eb13b5a96d9d55bfaf97cd5cc1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.ar-IL.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Locales\i18n.ar-IL.txt
          • Size 14KB
          • SHA256 65e7b0f37b5e2aa805ac8d57969804d803430186f34e9703ca9fa09ba908ef90
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.de-DE.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Locales\i18n.de-DE.txt
          • Size 23KB
          • SHA256 9ef7d5b09f834ca3695f33a7201b21956ab5f5131e25be22915d98b3cbde749a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.es-ES.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Locales\i18n.es-ES.txt
          • Size 22KB
          • SHA256 54891737aac1f39fd32dd732c69c58aca384084b8c259c2ff84a0b1a7961c736
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.fr-FR.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Locales\i18n.fr-FR.txt
          • Size 23KB
          • SHA256 e11295b0bec57604341d0ef360adca0062be6fb84370b225c605d3b26f688b56
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.id-ID.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Locales\i18n.id-ID.txt
          • Size 21KB
          • SHA256 39a2e1affc42b865e358f262e4989c16ce00ff8f636b97deca0de72f2619e2c9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.it-IT.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Locales\i18n.it-IT.txt
          • Size 22KB
          • SHA256 d39cee8e61a4de1f2345713012dc6b2d75b941b69126a68309d140063c83a54f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.ja-JP.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Locales\i18n.ja-JP.txt
          • Size 26KB
          • SHA256 2631fc51414f527a133ec724f1c3c7106628d2ff3f2bb5910f4d549405f6ed48
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.ko-KR.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Locales\i18n.ko-KR.txt
          • Size 23KB
          • SHA256 e9c7a85eded17d4313858de13d7b356bb7736e8bb649fcfb77dc224089a4ee5c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.pl-PL.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Locales\i18n.pl-PL.txt
          • Size 22KB
          • SHA256 c1d574c348ded142d37e8d18328c0b7934eae34012fec7cf91b72f69662dd26c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.pt-BR.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Locales\i18n.pt-BR.txt
          • Size 22KB
          • SHA256 c1619ea9fd1effa6550a4c3de8921066c52325f31eb1368539315218a18529ae
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.ru-RU.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Locales\i18n.ru-RU.txt
          • Size 31KB
          • SHA256 a399403971089e6b0b1e7a420b282d6a04997e8a456ccb43f3c17a05fd90552c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.th-TH.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Locales\i18n.th-TH.txt
          • Size 37KB
          • SHA256 3f6b9186892bf157f436292d68cdcb62c06296f2520832ddf4d7089b064de422
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.tr-TR.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Locales\i18n.tr-TR.txt
          • Size 22KB
          • SHA256 607cf31ff8dbfb1d807fa682c19dfdf6b8923b88d874e3f492c0eef6a15ea2d5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.vi-VN.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Locales\i18n.vi-VN.txt
          • Size 25KB
          • SHA256 430aa7fa1500bcdc8db4551baf23ba88fffafe76c203e22dd70dd06a4bf80173
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.zh-CN.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Locales\i18n.zh-CN.txt
          • Size 19KB
          • SHA256 816f0106cf95e54547ae3a81e572d5bc399a3cfda866e2fd7f2f6dda8904c3e5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.zh-TW.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zS49C436CF\Locales\i18n.zh-TW.txt
          • Size 19KB
          • SHA256 8b0076d8c9687bcbe766b3547380f0155f1555ecb8b36fde4453c60c0153e453
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          backicon.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E6AF258\Assets\backicon.png
          • Size 778B
          • SHA256 77533707194f691af85e6c990d852b949c09018378c8f9d87763b54b1c118f67
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          change_hover.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E6AF258\Assets\change_hover.png
          • Size 310B
          • SHA256 8e5847487da148ebb3ea029cc92165afd215cdc08f7122271e13eb37f94e6dc1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          close_red.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E6AF258\Assets\close_red.png
          • Size 1KB
          • SHA256 8cd75e91be69cf7cc6e6979c14b394a11fe683be7b62d5163da1073bb568b7d9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          custom.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E6AF258\Assets\custom.png
          • Size 580B
          • SHA256 8eaab641d186f93f50d2d2bbae6ac5b3c937ca30665bf916321a35c83253eca3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          discord_icon.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E6AF258\Assets\discord_icon.png
          • Size 564B
          • SHA256 c29b35c6be50f9e34f1120bd346ce01884f0c7ba1121c866d95b24e46e420b0c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          installer_bg.jpg
          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E6AF258\Assets\installer_bg.jpg
          • Size 353KB
          • SHA256 15bde105d61a562560d354614e0254dc4259000d8f610b32be8a965bf26829ca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          installer_logo.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E6AF258\Assets\installer_logo.png
          • Size 13KB
          • SHA256 1121302d4f18620499588c60e9991052665f6a4423774750880226e72ae4e0e4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          installer_minimize.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E6AF258\Assets\installer_minimize.png
          • Size 157B
          • SHA256 8e6e37b79756bfebb943d51d3571926fe4992748c4a673bbb6d78b22e87bc7f6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          loader.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E6AF258\Assets\loader.png
          • Size 279B
          • SHA256 076263cc65f9824f4f82eb6beaa594d1df90218a2ee21664cf209181557e04b1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          setpath.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E6AF258\Assets\setpath.png
          • Size 355B
          • SHA256 9ea14db4e8d39be52c9b55a39119d5f95dc331a0559d38de44fd8e72e8677718
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          BlueStacksInstaller.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E6AF258\BlueStacksInstaller.exe
          • Size 635KB
          • SHA256 00153d50951d23f2d980276f1556c9124eff4321156c4043f47124dbf5e72bde
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BlueStacksInstaller.exe.config
          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E6AF258\BlueStacksInstaller.exe.config
          • Size 324B
          • SHA256 d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          HD-CheckCpu.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E6AF258\HD-CheckCpu.exe
          • Size 200KB
          • SHA256 2e14887f3432b4a313442247fc669f891dbdad7ef1a2d371466a2afa88074a4c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          JSON.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E6AF258\JSON.dll
          • Size 411KB
          • SHA256 d2c8d26f95f55431e632c8581154db7c19547b656380e051194a9d2583dd2156
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.en-US.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E6AF258\Locales\i18n.en-US.txt
          • Size 21KB
          • SHA256 195c5ef488ba9e24a49405ffcfc3beabcf8d93d8d6740efd5e189d943fbcefaa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ThemeFile
          • Path C:\Users\Admin\AppData\Local\Temp\7zS4E6AF258\ThemeFile
          • Size 79KB
          • SHA256 87bbd881c9603d6032564b787a85a1c040fc1a2c216f25a1b0b62e26fedcdf69
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BgWorker.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nso5849.tmp\BgWorker.dll
          • Size 12KB
          • SHA256 a9e4f7ec65670d2ce375ffaf09b6d07f4cd531132ca002452287a4d540154a38
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nso5849.tmp\System.dll
          • Size 11KB
          • SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsDialogs.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nso5849.tmp\nsDialogs.dll
          • Size 9KB
          • SHA256 2bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsDui.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nso5849.tmp\nsDui.dll
          • Size 2.5MB
          • SHA256 19c542063e0db41f326ab2695422a727caacf05b9ff87b217f248c8e1d84e05e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsis7z.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nso5849.tmp\nsis7z.dll
          • Size 434KB
          • SHA256 a896a9ece055d334d431cd0f856113ab925d9ee86d2dee383c0bfbbef11a5b50
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1764-8040-0x0000000000400000-0x0000000000450000-memory.dmp
          Download

          memory/1764-7988-0x0000000000400000-0x0000000000450000-memory.dmp
          Download

          memory/3380-160-0x000000001ACA0000-0x000000001ACB0000-memory.dmp
          Download

          memory/3380-146-0x000000001CEA0000-0x000000001CED8000-memory.dmp
          Download

          memory/3380-131-0x00000000000E0000-0x0000000000182000-memory.dmp
          Download

          memory/3380-132-0x000000001ACA0000-0x000000001ACB0000-memory.dmp
          Download

          memory/3380-134-0x000000001BD60000-0x000000001BDC8000-memory.dmp
          Download

          memory/3380-161-0x000000001ACA0000-0x000000001ACB0000-memory.dmp
          Download

          memory/3380-159-0x000000001ACA0000-0x000000001ACB0000-memory.dmp
          Download

          memory/3380-138-0x000000001ACA0000-0x000000001ACB0000-memory.dmp
          Download

          memory/3380-140-0x000000001ACA0000-0x000000001ACB0000-memory.dmp
          Download

          memory/3380-142-0x000000001D100000-0x000000001D628000-memory.dmp
          Download

          memory/3380-147-0x000000001C800000-0x000000001C80E000-memory.dmp
          Download

          memory/3380-157-0x0000000020CD0000-0x0000000020CD8000-memory.dmp
          Download

          memory/5356-12646-0x0000000069170000-0x000000006918D000-memory.dmp
          Download

          memory/5356-12645-0x0000000069190000-0x00000000691A7000-memory.dmp
          Download

          memory/5356-12644-0x00000000691B0000-0x00000000691BF000-memory.dmp
          Download

          memory/5356-12643-0x00000000719F0000-0x0000000071A1F000-memory.dmp
          Download

          memory/6496-15830-0x000000001D020000-0x000000001D0A0000-memory.dmp
          Download

          memory/6496-15829-0x0000000000D20000-0x0000000000D78000-memory.dmp
          Download

          memory/6596-15828-0x000000001CBC0000-0x000000001CCAE000-memory.dmp
          Download

          memory/6596-15827-0x0000000000E30000-0x0000000000E58000-memory.dmp
          Download