Overview

overview

6

Static

static

1

BlueStacks...==.exe

windows11-21h2-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    299s
  • max time network
    299s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    10/09/2026, 02:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    BlueStacksInstaller_5.22.262.1001_native_41c0737b8446c75de49dcd8b9cb6a45f_MzsxNSwwOzUsNTsxNQ==.exe
  • Size 931KB
  • Sample260910-c272qseg53
  • SHA256 a2f304ad0eb4bd356eaa50f70a3b4fd5036ac79fdbe9041be248f24695c35b9b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Downloads MZ/PE file 1 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies Windows Firewall 2 TTPs 4 IoCs
    defense_evasion
  • Discovers running processes 1 TTPs 64 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 15 IoCs
    execution
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 20 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BlueStacksInstaller_5.22.262.1001_native_41c0737b8446c75de49dcd8b9cb6a45f_MzsxNSwwOzUsNTsxNQ==.exe
    "C:\Users\Admin\AppData\Local\Temp\BlueStacksInstaller_5.22.262.1001_native_41c0737b8446c75de49dcd8b9cb6a45f_MzsxNSwwOzUsNTsxNQ==.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:404
    • C:\Users\Admin\AppData\Local\Temp\7zS491338C8\BlueStacksInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS491338C8\BlueStacksInstaller.exe"
      2⤵
      • Downloads MZ/PE file
      • Enumerates connected drives
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2748
      • C:\Users\Admin\AppData\Local\Temp\7zS491338C8\HD-CheckCpu.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS491338C8\HD-CheckCpu.exe" --cmd checkHypervEnabled
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:644
      • C:\Users\Admin\AppData\Local\Temp\7zS491338C8\HD-CheckCpu.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS491338C8\HD-CheckCpu.exe" --cmd checkSSE4
        3⤵
        • Executes dropped EXE
        PID:4448
      • C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.22.262.1001_nxt.exe
        "C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.22.262.1001_nxt.exe" -s
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1960
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\BlueStacks X\green.vbs"
          4⤵
          • Executes a VBScript file via the Windows Script Host.
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3924
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c green.bat
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3520
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall delete rule name="BlueStacksWeb"
              6⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:1004
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall delete rule name="Cloud Game"
              6⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:5328
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall add rule name="BlueStacksWeb" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\BlueStacksWeb.exe"
              6⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:5360
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall add rule name="Cloud Game" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\Cloud Game.exe"
              6⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:5648
      • C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.22.262.1001_native_41c0737b8446c75de49dcd8b9cb6a45f_MzsxNSwwOzUsNTsxNQ==.exe
        "C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.22.262.1001_native_41c0737b8446c75de49dcd8b9cb6a45f_MzsxNSwwOzUsNTsxNQ==.exe" -versionMachineID=0d6f7aaa-e958-487d-9792-a8f50d2dd241 -machineID=1e72c7a2-2bf0-41fb-99a7-3e50e5820e12 -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Pie64 -imageToLaunch=Pie64 -isSSE4Available=1 -appToLaunch=bs5 -bsxVersion=10.42.262.1001 -country=GB -isWalletFeatureEnabled -discordUrl=https://discord.gg/UnXV7taVs4
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5772
        • C:\Users\Admin\AppData\Local\Temp\7zSC86CC2A9\BlueStacksInstaller.exe
          "C:\Users\Admin\AppData\Local\Temp\7zSC86CC2A9\BlueStacksInstaller.exe" -versionMachineID=0d6f7aaa-e958-487d-9792-a8f50d2dd241 -machineID=1e72c7a2-2bf0-41fb-99a7-3e50e5820e12 -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Pie64 -imageToLaunch=Pie64 -isSSE4Available=1 -appToLaunch=bs5 -bsxVersion=10.42.262.1001 -country=GB -isWalletFeatureEnabled -discordUrl=https://discord.gg/UnXV7taVs4
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3752
          • C:\Users\Admin\AppData\Local\Temp\7zSC86CC2A9\HD-CheckCpu.exe
            "C:\Users\Admin\AppData\Local\Temp\7zSC86CC2A9\HD-CheckCpu.exe" --cmd checkHypervEnabled
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2440
  • C:\ProgramData\BlueStacksServicesSetup.exe
    "C:\ProgramData\BlueStacksServicesSetup.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4980
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq BlueStacksServices.exe" | find "BlueStacksServices.exe"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3056
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq BlueStacksServices.exe"
        3⤵
        • Discovers running processes
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3128
      • C:\Windows\SysWOW64\find.exe
        find "BlueStacksServices.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4884
  • C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
    "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --hidden --initialLaunch
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Executes dropped EXE
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:7184
    • C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
      "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1468 --field-trial-handle=1708,i,795139251020118873,13310514128104573879,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
      • Executes dropped EXE
      PID:7332
    • C:\Windows\system32\cscript.exe
      cscript.exe
      2⤵
        PID:7348
      • C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
        "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --mojo-platform-channel-handle=1944 --field-trial-handle=1708,i,795139251020118873,13310514128104573879,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        2⤵
        • Executes dropped EXE
        PID:7440
      • C:\Windows\system32\cscript.exe
        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKCU\SOFTWARE\BlueStacksServices
        2⤵
        • Executes a VBScript file via the Windows Script Host.
        PID:7492
      • C:\Windows\system32\cscript.exe
        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKCU\SOFTWARE\BlueStacksServices
        2⤵
        • Executes a VBScript file via the Windows Script Host.
        PID:7660
      • C:\Windows\system32\cscript.exe
        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regPutValue.wsf A
        2⤵
        • Executes a VBScript file via the Windows Script Host.
        PID:7736
      • C:\Windows\system32\cscript.exe
        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regPutValue.wsf A
        2⤵
        • Executes a VBScript file via the Windows Script Host.
        PID:7860
      • C:\Windows\system32\cscript.exe
        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
        2⤵
        • Executes a VBScript file via the Windows Script Host.
        PID:8036
      • C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
        "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --app-user-model-id=com.bluestacks.services --app-path="C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2600 --field-trial-handle=1708,i,795139251020118873,13310514128104573879,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
        2⤵
        • Executes dropped EXE
        PID:8124
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5224
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq HD-Player.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2844
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5356
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq BlueStacks X.exe"
          3⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:4852
      • C:\Windows\system32\cscript.exe
        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
        2⤵
        • Executes a VBScript file via the Windows Script Host.
        PID:3988
      • C:\Windows\system32\cscript.exe
        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
        2⤵
        • Executes a VBScript file via the Windows Script Host.
        PID:1228
      • C:\Windows\system32\cscript.exe
        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
        2⤵
        • Executes a VBScript file via the Windows Script Host.
        PID:3740
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5520
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq HD-Player.exe"
          3⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:5900
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4428
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq BlueStacks X.exe"
          3⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:5924
      • C:\Windows\system32\cscript.exe
        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
        2⤵
        • Executes a VBScript file via the Windows Script Host.
        PID:5892
      • C:\Windows\system32\cscript.exe
        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
        2⤵
        • Executes a VBScript file via the Windows Script Host.
        PID:5972
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:792
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq BlueStacks X.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2860
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4156
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq HD-Player.exe"
          3⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:1720
      • C:\Windows\system32\cscript.exe
        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
        2⤵
        • Executes a VBScript file via the Windows Script Host.
        PID:4688
      • C:\Windows\system32\cscript.exe
        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
        2⤵
        • Executes a VBScript file via the Windows Script Host.
        PID:4248
      • C:\Windows\system32\cscript.exe
        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
        2⤵
        • Executes a VBScript file via the Windows Script Host.
        PID:2956
      • C:\Windows\system32\cscript.exe
        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
        2⤵
        • Executes a VBScript file via the Windows Script Host.
        PID:1576
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:6228
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq HD-Player.exe"
          3⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:6308
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:6304
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq BlueStacks X.exe"
          3⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:6400
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:6512
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq HD-Player.exe"
          3⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:6556
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:6540
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq BlueStacks X.exe"
          3⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:6584
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:6608
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq HD-Player.exe"
          3⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:6792
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:6744
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq BlueStacks X.exe"
          3⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:6820
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:6876
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq HD-Player.exe"
          3⤵
          • Discovers running processes
          PID:6920
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:6948
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq BlueStacks X.exe"
          3⤵
          • Discovers running processes
          PID:7000
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
        2⤵
        • Executes a command shell one-liner
        PID:7064
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq HD-Player.exe"
          3⤵
            PID:7112
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
          2⤵
            PID:7140
            • C:\Windows\system32\tasklist.exe
              tasklist /FI "IMAGENAME eq BlueStacks X.exe"
              3⤵
              • Discovers running processes
              PID:2312
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
            2⤵
            • Executes a command shell one-liner
            PID:4252
            • C:\Windows\system32\tasklist.exe
              tasklist /FI "IMAGENAME eq HD-Player.exe"
              3⤵
              • Discovers running processes
              PID:5000
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
            2⤵
            • Executes a command shell one-liner
            PID:3192
            • C:\Windows\system32\tasklist.exe
              tasklist /FI "IMAGENAME eq BlueStacks X.exe"
              3⤵
              • Discovers running processes
              PID:3016
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
            2⤵
              PID:4636
              • C:\Windows\system32\tasklist.exe
                tasklist /FI "IMAGENAME eq HD-Player.exe"
                3⤵
                • Discovers running processes
                PID:5116
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
              2⤵
              • Executes a command shell one-liner
              PID:864
              • C:\Windows\system32\tasklist.exe
                tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                3⤵
                • Discovers running processes
                PID:7268
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
              2⤵
              • Executes a command shell one-liner
              PID:7348
              • C:\Windows\system32\tasklist.exe
                tasklist /FI "IMAGENAME eq HD-Player.exe"
                3⤵
                • Discovers running processes
                PID:4244
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
              2⤵
              • Executes a command shell one-liner
              PID:7624
              • C:\Windows\system32\tasklist.exe
                tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                3⤵
                  PID:7516
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                2⤵
                • Executes a command shell one-liner
                PID:7716
                • C:\Windows\system32\tasklist.exe
                  tasklist /FI "IMAGENAME eq HD-Player.exe"
                  3⤵
                    PID:7840
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                  2⤵
                  • Executes a command shell one-liner
                  PID:7756
                  • C:\Windows\system32\tasklist.exe
                    tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                    3⤵
                    • Discovers running processes
                    PID:7628
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                  2⤵
                  • Executes a command shell one-liner
                  PID:7944
                  • C:\Windows\system32\tasklist.exe
                    tasklist /FI "IMAGENAME eq HD-Player.exe"
                    3⤵
                    • Discovers running processes
                    PID:7908
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                  2⤵
                  • Executes a command shell one-liner
                  PID:8008
                  • C:\Windows\system32\tasklist.exe
                    tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                    3⤵
                    • Discovers running processes
                    PID:7980
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                  2⤵
                  • Executes a command shell one-liner
                  PID:8108
                  • C:\Windows\system32\tasklist.exe
                    tasklist /FI "IMAGENAME eq HD-Player.exe"
                    3⤵
                    • Discovers running processes
                    PID:8172
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                  2⤵
                  • Executes a command shell one-liner
                  PID:3368
                  • C:\Windows\system32\tasklist.exe
                    tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                    3⤵
                    • Discovers running processes
                    PID:2136
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                  2⤵
                  • Executes a command shell one-liner
                  PID:5084
                  • C:\Windows\system32\tasklist.exe
                    tasklist /FI "IMAGENAME eq HD-Player.exe"
                    3⤵
                    • Discovers running processes
                    PID:5260
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                  2⤵
                    PID:3776
                    • C:\Windows\system32\tasklist.exe
                      tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                      3⤵
                      • Discovers running processes
                      PID:5284
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                    2⤵
                    • Executes a command shell one-liner
                    PID:5128
                    • C:\Windows\system32\tasklist.exe
                      tasklist /FI "IMAGENAME eq HD-Player.exe"
                      3⤵
                      • Discovers running processes
                      PID:4072
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                    2⤵
                    • Executes a command shell one-liner
                    PID:3804
                    • C:\Windows\system32\tasklist.exe
                      tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                      3⤵
                        PID:2508
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                      2⤵
                      • Executes a command shell one-liner
                      PID:4876
                      • C:\Windows\system32\tasklist.exe
                        tasklist /FI "IMAGENAME eq HD-Player.exe"
                        3⤵
                        • Discovers running processes
                        PID:2272
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                      2⤵
                      • Executes a command shell one-liner
                      PID:4812
                      • C:\Windows\system32\tasklist.exe
                        tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                        3⤵
                        • Discovers running processes
                        PID:5452
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                      2⤵
                      • Executes a command shell one-liner
                      PID:4784
                      • C:\Windows\system32\tasklist.exe
                        tasklist /FI "IMAGENAME eq HD-Player.exe"
                        3⤵
                        • Discovers running processes
                        PID:1768
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                      2⤵
                        PID:5808
                        • C:\Windows\system32\tasklist.exe
                          tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                          3⤵
                          • Discovers running processes
                          PID:2076
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                        2⤵
                        • Executes a command shell one-liner
                        PID:5916
                        • C:\Windows\system32\tasklist.exe
                          tasklist /FI "IMAGENAME eq HD-Player.exe"
                          3⤵
                          • Discovers running processes
                          PID:3428
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                        2⤵
                        • Executes a command shell one-liner
                        PID:468
                        • C:\Windows\system32\tasklist.exe
                          tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                          3⤵
                          • Discovers running processes
                          PID:5948
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                        2⤵
                        • Executes a command shell one-liner
                        PID:5852
                        • C:\Windows\system32\tasklist.exe
                          tasklist /FI "IMAGENAME eq HD-Player.exe"
                          3⤵
                            PID:3588
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                          2⤵
                          • Executes a command shell one-liner
                          PID:6012
                          • C:\Windows\system32\tasklist.exe
                            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                            3⤵
                              PID:6028
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                            2⤵
                            • Executes a command shell one-liner
                            PID:5940
                            • C:\Windows\system32\tasklist.exe
                              tasklist /FI "IMAGENAME eq HD-Player.exe"
                              3⤵
                              • Discovers running processes
                              PID:5376
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                            2⤵
                              PID:4500
                              • C:\Windows\system32\tasklist.exe
                                tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                3⤵
                                • Discovers running processes
                                PID:788
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                              2⤵
                              • Executes a command shell one-liner
                              PID:2648
                              • C:\Windows\system32\tasklist.exe
                                tasklist /FI "IMAGENAME eq HD-Player.exe"
                                3⤵
                                  PID:6068
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                2⤵
                                • Executes a command shell one-liner
                                PID:2860
                                • C:\Windows\system32\tasklist.exe
                                  tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                  3⤵
                                  • Discovers running processes
                                  PID:5792
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                2⤵
                                • Executes a command shell one-liner
                                PID:3456
                                • C:\Windows\system32\tasklist.exe
                                  tasklist /FI "IMAGENAME eq HD-Player.exe"
                                  3⤵
                                  • Discovers running processes
                                  PID:668
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                2⤵
                                • Executes a command shell one-liner
                                PID:2344
                                • C:\Windows\system32\tasklist.exe
                                  tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                  3⤵
                                  • Discovers running processes
                                  PID:6164
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                2⤵
                                • Executes a command shell one-liner
                                PID:4144
                                • C:\Windows\system32\tasklist.exe
                                  tasklist /FI "IMAGENAME eq HD-Player.exe"
                                  3⤵
                                  • Discovers running processes
                                  PID:6360
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                2⤵
                                • Executes a command shell one-liner
                                PID:6344
                                • C:\Windows\system32\tasklist.exe
                                  tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                  3⤵
                                  • Discovers running processes
                                  PID:6224
                              • C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
                                "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3408 --field-trial-handle=1708,i,795139251020118873,13310514128104573879,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                                2⤵
                                • Executes dropped EXE
                                • Suspicious behavior: EnumeratesProcesses
                                PID:6424
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                2⤵
                                • Executes a command shell one-liner
                                PID:6456
                                • C:\Windows\system32\tasklist.exe
                                  tasklist /FI "IMAGENAME eq HD-Player.exe"
                                  3⤵
                                  • Discovers running processes
                                  PID:6480
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                2⤵
                                • Executes a command shell one-liner
                                PID:6544
                                • C:\Windows\system32\tasklist.exe
                                  tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                  3⤵
                                  • Discovers running processes
                                  PID:6532
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                2⤵
                                • Executes a command shell one-liner
                                PID:6664
                                • C:\Windows\system32\tasklist.exe
                                  tasklist /FI "IMAGENAME eq HD-Player.exe"
                                  3⤵
                                  • Discovers running processes
                                  PID:6680
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                2⤵
                                • Executes a command shell one-liner
                                PID:6840
                                • C:\Windows\system32\tasklist.exe
                                  tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                  3⤵
                                  • Discovers running processes
                                  PID:6792
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                2⤵
                                • Executes a command shell one-liner
                                PID:6776
                                • C:\Windows\system32\tasklist.exe
                                  tasklist /FI "IMAGENAME eq HD-Player.exe"
                                  3⤵
                                  • Discovers running processes
                                  PID:4620
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                2⤵
                                • Executes a command shell one-liner
                                PID:6888
                                • C:\Windows\system32\tasklist.exe
                                  tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                  3⤵
                                  • Discovers running processes
                                  PID:6900
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                2⤵
                                  PID:7020
                                  • C:\Windows\system32\tasklist.exe
                                    tasklist /FI "IMAGENAME eq HD-Player.exe"
                                    3⤵
                                    • Discovers running processes
                                    PID:6956
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                  2⤵
                                  • Executes a command shell one-liner
                                  PID:7076
                                  • C:\Windows\system32\tasklist.exe
                                    tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                    3⤵
                                    • Discovers running processes
                                    PID:7068
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                  2⤵
                                  • Executes a command shell one-liner
                                  PID:4412
                                  • C:\Windows\system32\tasklist.exe
                                    tasklist /FI "IMAGENAME eq HD-Player.exe"
                                    3⤵
                                      PID:7164
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                    2⤵
                                    • Executes a command shell one-liner
                                    PID:8032
                                    • C:\Windows\system32\tasklist.exe
                                      tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                      3⤵
                                      • Discovers running processes
                                      PID:5660
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                    2⤵
                                    • Executes a command shell one-liner
                                    PID:1344
                                    • C:\Windows\system32\tasklist.exe
                                      tasklist /FI "IMAGENAME eq HD-Player.exe"
                                      3⤵
                                      • Discovers running processes
                                      PID:5016
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                    2⤵
                                    • Executes a command shell one-liner
                                    PID:4168
                                    • C:\Windows\system32\tasklist.exe
                                      tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                      3⤵
                                        PID:2904
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                      2⤵
                                      • Executes a command shell one-liner
                                      PID:2940
                                      • C:\Windows\system32\tasklist.exe
                                        tasklist /FI "IMAGENAME eq HD-Player.exe"
                                        3⤵
                                        • Discovers running processes
                                        PID:7360
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                      2⤵
                                      • Executes a command shell one-liner
                                      PID:7256
                                      • C:\Windows\system32\tasklist.exe
                                        tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                        3⤵
                                        • Discovers running processes
                                        PID:5140
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                      2⤵
                                      • Executes a command shell one-liner
                                      PID:5780
                                      • C:\Windows\system32\tasklist.exe
                                        tasklist /FI "IMAGENAME eq HD-Player.exe"
                                        3⤵
                                        • Discovers running processes
                                        PID:7464
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                      2⤵
                                      • Executes a command shell one-liner
                                      PID:3264
                                      • C:\Windows\system32\tasklist.exe
                                        tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                        3⤵
                                        • Discovers running processes
                                        PID:7728
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                      2⤵
                                      • Executes a command shell one-liner
                                      PID:7576
                                      • C:\Windows\system32\tasklist.exe
                                        tasklist /FI "IMAGENAME eq HD-Player.exe"
                                        3⤵
                                        • Discovers running processes
                                        PID:1832
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                      2⤵
                                      • Executes a command shell one-liner
                                      PID:2356
                                      • C:\Windows\system32\tasklist.exe
                                        tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                        3⤵
                                        • Discovers running processes
                                        PID:5484
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                      2⤵
                                        PID:7788
                                        • C:\Windows\system32\tasklist.exe
                                          tasklist /FI "IMAGENAME eq HD-Player.exe"
                                          3⤵
                                          • Discovers running processes
                                          PID:7668
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                        2⤵
                                          PID:7856
                                          • C:\Windows\system32\tasklist.exe
                                            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                            3⤵
                                            • Discovers running processes
                                            PID:7764
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                          2⤵
                                          • Executes a command shell one-liner
                                          PID:7864
                                          • C:\Windows\system32\tasklist.exe
                                            tasklist /FI "IMAGENAME eq HD-Player.exe"
                                            3⤵
                                              PID:7876
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                            2⤵
                                            • Executes a command shell one-liner
                                            PID:7904
                                            • C:\Windows\system32\tasklist.exe
                                              tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                              3⤵
                                              • Discovers running processes
                                              PID:7980
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                            2⤵
                                              PID:1492
                                              • C:\Windows\system32\tasklist.exe
                                                tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                3⤵
                                                • Discovers running processes
                                                PID:8140
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                              2⤵
                                                PID:2120
                                                • C:\Windows\system32\tasklist.exe
                                                  tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                  3⤵
                                                  • Discovers running processes
                                                  PID:8180
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                2⤵
                                                • Executes a command shell one-liner
                                                PID:6624
                                                • C:\Windows\system32\tasklist.exe
                                                  tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                  3⤵
                                                    PID:5220
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                  2⤵
                                                  • Executes a command shell one-liner
                                                  PID:2108
                                                  • C:\Windows\system32\tasklist.exe
                                                    tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                    3⤵
                                                    • Discovers running processes
                                                    PID:2208
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                  2⤵
                                                    PID:3480
                                                    • C:\Windows\system32\tasklist.exe
                                                      tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                      3⤵
                                                      • Discovers running processes
                                                      PID:5164
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                    2⤵
                                                    • Executes a command shell one-liner
                                                    PID:4920
                                                    • C:\Windows\system32\tasklist.exe
                                                      tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                      3⤵
                                                      • Discovers running processes
                                                      PID:8036

                                                Network

                                                      MITRE ATT&CK Enterprise v16

                                                      Reconnaissance

                                                      Resource Development

                                                      Initial Access

                                                      Execution

                                                      Command and Scripting Interpreter

                                                      2
                                                      T1059

                                                      Visual Basic

                                                      1
                                                      T1059.005

                                                      Windows Command Shell

                                                      1
                                                      T1059.003

                                                      Persistence

                                                      Boot or Logon Autostart Execution

                                                      1
                                                      T1547

                                                      Registry Run Keys / Startup Folder

                                                      1
                                                      T1547.001

                                                      Create or Modify System Process

                                                      1
                                                      T1543

                                                      Windows Service

                                                      1
                                                      T1543.003

                                                      Event Triggered Execution

                                                      1
                                                      T1546

                                                      Netsh Helper DLL

                                                      1
                                                      T1546.007

                                                      Privilege Escalation

                                                      Boot or Logon Autostart Execution

                                                      1
                                                      T1547

                                                      Registry Run Keys / Startup Folder

                                                      1
                                                      T1547.001

                                                      Create or Modify System Process

                                                      1
                                                      T1543

                                                      Windows Service

                                                      1
                                                      T1543.003

                                                      Event Triggered Execution

                                                      1
                                                      T1546

                                                      Netsh Helper DLL

                                                      1
                                                      T1546.007

                                                      Defense Evasion

                                                      Impair Defenses

                                                      1
                                                      T1562

                                                      Disable or Modify System Firewall

                                                      1
                                                      T1562.004

                                                      Modify Registry

                                                      1
                                                      T1112

                                                      Credential Access

                                                      Discovery

                                                      Peripheral Device Discovery

                                                      1
                                                      T1120

                                                      Process Discovery

                                                      1
                                                      T1057

                                                      Query Registry

                                                      2
                                                      T1012

                                                      System Information Discovery

                                                      2
                                                      T1082

                                                      System Location Discovery

                                                      1
                                                      T1614

                                                      System Language Discovery

                                                      1
                                                      T1614.001

                                                      Lateral Movement

                                                      Collection

                                                      Command and Control

                                                      Exfiltration

                                                      Impact

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      close_disabled.svg
                                                      • Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_disabled.svg
                                                      • Size 569B
                                                      • SHA256 8ee5aa84139b2ea5549f7272523aeb203d73954c5ccdcf6f7407bf1a3469f13e
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      close_hover.svg
                                                      • Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_hover.svg
                                                      • Size 653B
                                                      • SHA256 1bca2e912184b8168ee8961de68d1d839f4f9827fde6f48ab100fb61e82eff90
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      close_normal.svg
                                                      • Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_normal.svg
                                                      • Size 569B
                                                      • SHA256 92aeae68e9e0973d9e0dc575941f1cb2e24afd0574341a46b870be7384eaa537
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      close_pressed.svg
                                                      • Path C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_pressed.svg
                                                      • Size 653B
                                                      • SHA256 9585f41eb6202e89f2087266fa31852d7f41ca8cc659b907c96753fe165f937d
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      backicon.png
                                                      • Path C:\Users\Admin\AppData\Local\Temp\7zS491338C8\Assets\backicon.png
                                                      • Size 15KB
                                                      • SHA256 fa64884054171515e97b78aaa1aad1ec5baa9d1daf9c682e0b3fb4a41a9cb1c1
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      change_hover.png
                                                      • Path C:\Users\Admin\AppData\Local\Temp\7zS491338C8\Assets\change_hover.png
                                                      • Size 310B
                                                      • SHA256 8e5847487da148ebb3ea029cc92165afd215cdc08f7122271e13eb37f94e6dc1
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      close_red.png
                                                      • Path C:\Users\Admin\AppData\Local\Temp\7zS491338C8\Assets\close_red.png
                                                      • Size 15KB
                                                      • SHA256 d0b6d143642d356b40c47459a996131a344cade6bb86158f1b74693426b09bfb
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      custom.png
                                                      • Path C:\Users\Admin\AppData\Local\Temp\7zS491338C8\Assets\custom.png
                                                      • Size 17KB
                                                      • SHA256 fbece8bb5f4dfa55dcfbf41151b10608af807b9477e99acf0940954a11e68f7b
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      discord_icon.png
                                                      • Path C:\Users\Admin\AppData\Local\Temp\7zS491338C8\Assets\discord_icon.png
                                                      • Size 564B
                                                      • SHA256 c29b35c6be50f9e34f1120bd346ce01884f0c7ba1121c866d95b24e46e420b0c
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      folder.png
                                                      • Path C:\Users\Admin\AppData\Local\Temp\7zS491338C8\Assets\folder.png
                                                      • Size 298B
                                                      • SHA256 7ffa875fab1be82e384022a27f3e627ab75131eb168be949cc83c03b6e291bbf
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      help_icon.png
                                                      • Path C:\Users\Admin\AppData\Local\Temp\7zS491338C8\Assets\help_icon.png
                                                      • Size 1KB
                                                      • SHA256 97c7450d55ecda9017d0a9eed0049b8176e1828f3525aaf5660985ba214010cc
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      info_icon.png
                                                      • Path C:\Users\Admin\AppData\Local\Temp\7zS491338C8\Assets\info_icon.png
                                                      • Size 929B
                                                      • SHA256 ee91e51aaa8356318cc75d60476d9422bf84be7d8a25e1b884aa16c3198dc764
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      installer_bg.jpg
                                                      • Path C:\Users\Admin\AppData\Local\Temp\7zS491338C8\Assets\installer_bg.jpg
                                                      • Size 78KB
                                                      • SHA256 4c7471c986e16de0cd451be27d4b3171e595fe2916b4b3bf7ca52df6ec368904
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      installer_logo.png
                                                      • Path C:\Users\Admin\AppData\Local\Temp\7zS491338C8\Assets\installer_logo.png
                                                      • Size 9KB
                                                      • SHA256 462b64f2e016d25a2a6a653ba896206129c4ac841d61a6c2fd116009606f7e1c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      installer_minimize.png
                                                      • Path C:\Users\Admin\AppData\Local\Temp\7zS491338C8\Assets\installer_minimize.png
                                                      • Size 113B
                                                      • SHA256 a064f417e3c2b8f3121a14bbded268b2cdf635706880b7006f931de31476bbc2
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      loader.png
                                                      • Path C:\Users\Admin\AppData\Local\Temp\7zS491338C8\Assets\loader.png
                                                      • Size 279B
                                                      • SHA256 076263cc65f9824f4f82eb6beaa594d1df90218a2ee21664cf209181557e04b1
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      logo_text.png
                                                      • Path C:\Users\Admin\AppData\Local\Temp\7zS491338C8\Assets\logo_text.png
                                                      • Size 4KB
                                                      • SHA256 66df86129129d8aa8dd3ba014eb3b3c27a36c22e4782f3dbd6a9a4bc1f4a87bc
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      setpath.png
                                                      • Path C:\Users\Admin\AppData\Local\Temp\7zS491338C8\Assets\setpath.png
                                                      • Size 15KB
                                                      • SHA256 5bbb2f41f9f3a805986c3c88a639bcc22d90067d4b8de9f1e21e3cf9e5c1766b
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      BlueStacksInstaller.exe
                                                      • Path C:\Users\Admin\AppData\Local\Temp\7zS491338C8\BlueStacksInstaller.exe
                                                      • Size 648KB
                                                      • SHA256 312813d83cab91da8ea31ea7cc92a1401299c0a29d8e164a937b28d63baf4cbb
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      BlueStacksInstaller.exe.config
                                                      • Path C:\Users\Admin\AppData\Local\Temp\7zS491338C8\BlueStacksInstaller.exe.config
                                                      • Size 324B
                                                      • SHA256 d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      HD-CheckCpu.exe
                                                      • Path C:\Users\Admin\AppData\Local\Temp\7zS491338C8\HD-CheckCpu.exe
                                                      • Size 200KB
                                                      • SHA256 2e14887f3432b4a313442247fc669f891dbdad7ef1a2d371466a2afa88074a4c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      JSON.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\7zS491338C8\JSON.dll
                                                      • Size 411KB
                                                      • SHA256 d2c8d26f95f55431e632c8581154db7c19547b656380e051194a9d2583dd2156
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      i18n.en-US.txt
                                                      • Path C:\Users\Admin\AppData\Local\Temp\7zS491338C8\Locales\i18n.en-US.txt
                                                      • Size 22KB
                                                      • SHA256 8936455d79f33eb298869f1654286db493fb5b11b580ef7e8d859ce63541ba91
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      ThemeFile
                                                      • Path C:\Users\Admin\AppData\Local\Temp\7zS491338C8\ThemeFile
                                                      • Size 80KB
                                                      • SHA256 de1a2e6b560e036da5ea6b042e29e81a5bfcf67dde89670c332fc5199e811ba6
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      discord_icon_click.png
                                                      • Path C:\Users\Admin\AppData\Local\Temp\7zSC86CC2A9\Assets\discord_icon_click.png
                                                      • Size 512B
                                                      • SHA256 6b126c8a7015c2274e6a2ac969e0f31ecae421e1652b446b2aafd2b03d0dc3f5
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      exit_close.png
                                                      • Path C:\Users\Admin\AppData\Local\Temp\7zSC86CC2A9\Assets\exit_close.png
                                                      • Size 670B
                                                      • SHA256 7aaef329ba9fa052791d1a09f127551289641ea743baba171de55faa30ec1157
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      minimize_progress.png
                                                      • Path C:\Users\Admin\AppData\Local\Temp\7zSC86CC2A9\Assets\minimize_progress.png
                                                      • Size 212B
                                                      • SHA256 2f62d4e8c643051093f907058dddc78cc525147d9c4f4a0d78b4d0e5c90979f6
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      installer_bg_1.jpg
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Assets\installer_bg_1.jpg
                                                      • Size 30KB
                                                      • SHA256 873030e34515538dac3efb98edec519596439fa05b7aad37f6137ca954ba41a6
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      installer_bg_2.jpg
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Assets\installer_bg_2.jpg
                                                      • Size 121KB
                                                      • SHA256 7cc477b38d05c7002621a51d04d2c2d9f943be5115abae1d8bcbd2def49de54e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      installer_bg_4.jpg
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Assets\installer_bg_4.jpg
                                                      • Size 93KB
                                                      • SHA256 3c947b7946c9e92318880bb5d31fb600b9d32476fade9ed0ee9c9c7c714f6a57
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      installer_bg_6.jpg
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Assets\installer_bg_6.jpg
                                                      • Size 87KB
                                                      • SHA256 423dba72b462e2595f608bc6e66bfe35869aa5b240791a30432b89b3ab0547ba
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      installer_bg_8.jpg
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Assets\installer_bg_8.jpg
                                                      • Size 104KB
                                                      • SHA256 1ab4953190aeb9e7e5c2cb7d58aa13508906d982c2a8435ba50c709cd6b597c8
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      BgWorker.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\nscC8BB.tmp\BgWorker.dll
                                                      • Size 12KB
                                                      • SHA256 a9e4f7ec65670d2ce375ffaf09b6d07f4cd531132ca002452287a4d540154a38
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      System.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\nscC8BB.tmp\System.dll
                                                      • Size 11KB
                                                      • SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      nsDialogs.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\nscC8BB.tmp\nsDialogs.dll
                                                      • Size 9KB
                                                      • SHA256 2bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      nsDui.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\nscC8BB.tmp\nsDui.dll
                                                      • Size 3.0MB
                                                      • SHA256 fe8784637b656ba878c276b8075e043fab04719fe07a37ac2c1d16088c244af7
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      nsis7z.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\nscC8BB.tmp\nsis7z.dll
                                                      • Size 434KB
                                                      • SHA256 a896a9ece055d334d431cd0f856113ab925d9ee86d2dee383c0bfbbef11a5b50
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Registry.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\nsd14F2.tmp\Registry.dll
                                                      • Size 24KB
                                                      • SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      StdUtils.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\nsd14F2.tmp\StdUtils.dll
                                                      • Size 100KB
                                                      • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      WinShell.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\nsd14F2.tmp\WinShell.dll
                                                      • Size 3KB
                                                      • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      default.dic
                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                      • Size 2B
                                                      • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      Network Persistent State
                                                      • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\Network\Network Persistent State
                                                      • Size 766B
                                                      • SHA256 552c7e00eba5c9a39cdf47bbb7adc6e9f946b86d6327cc1a95d06d8184c5d8da
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      Network Persistent State~RFe5b46c9.TMP
                                                      • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\Network\Network Persistent State~RFe5b46c9.TMP
                                                      • Size 59B
                                                      • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      config.json
                                                      • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json
                                                      • Size 119B
                                                      • SHA256 4a502654529c0cb836e5c63308977d8ca9458101b95a55d99a6ffacea83ad954
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      config.json
                                                      • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json
                                                      • Size 1KB
                                                      • SHA256 7f0bf97e0b6d34214f4994d50de091cfeb0addbc503e655c76480d476b0b534c
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      config.json
                                                      • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json
                                                      • Size 57B
                                                      • SHA256 4e0828a1f6d0b668dd486362de5755142bc1a90769890eb9f299f64cc4fa749f
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      config.json.tmp-9007917038a623a4
                                                      • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json.tmp-9007917038a623a4
                                                      • Size 92B
                                                      • SHA256 d2885d090b383f53e8d81422edd508f9270d51b0938b54d540da97f38ae65e2f
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      memory/404-8990-0x0000000000400000-0x000000000045D000-memory.dmp
                                                      Download

                                                      memory/2748-142-0x000000001CC90000-0x000000001CCA0000-memory.dmp
                                                      Download

                                                      memory/2748-155-0x0000000020A70000-0x0000000020A7E000-memory.dmp
                                                      Download

                                                      memory/2748-151-0x000000001E010000-0x000000001E538000-memory.dmp
                                                      Download

                                                      memory/2748-149-0x000000001CC90000-0x000000001CCA0000-memory.dmp
                                                      Download

                                                      memory/2748-148-0x000000001CC90000-0x000000001CCA0000-memory.dmp
                                                      Download

                                                      memory/2748-144-0x0000000002A30000-0x0000000002A98000-memory.dmp
                                                      Download

                                                      memory/2748-3559-0x000000001CC90000-0x000000001CCA0000-memory.dmp
                                                      Download

                                                      memory/2748-3560-0x000000001CC90000-0x000000001CCA0000-memory.dmp
                                                      Download

                                                      memory/2748-141-0x0000000000790000-0x0000000000834000-memory.dmp
                                                      Download

                                                      memory/2748-170-0x00000000029C0000-0x00000000029C8000-memory.dmp
                                                      Download

                                                      memory/2748-2145-0x000000001CC90000-0x000000001CCA0000-memory.dmp
                                                      Download

                                                      memory/2748-154-0x00000000218E0000-0x0000000021918000-memory.dmp
                                                      Download

                                                      memory/6424-9599-0x0000024095670000-0x0000024095671000-memory.dmp
                                                      Download

                                                      memory/6424-9601-0x0000024095670000-0x0000024095671000-memory.dmp
                                                      Download

                                                      memory/6424-9600-0x0000024095670000-0x0000024095671000-memory.dmp
                                                      Download

                                                      memory/6424-9611-0x0000024095670000-0x0000024095671000-memory.dmp
                                                      Download

                                                      memory/6424-9610-0x0000024095670000-0x0000024095671000-memory.dmp
                                                      Download

                                                      memory/6424-9609-0x0000024095670000-0x0000024095671000-memory.dmp
                                                      Download

                                                      memory/6424-9608-0x0000024095670000-0x0000024095671000-memory.dmp
                                                      Download

                                                      memory/6424-9606-0x0000024095670000-0x0000024095671000-memory.dmp
                                                      Download

                                                      memory/6424-9607-0x0000024095670000-0x0000024095671000-memory.dmp
                                                      Download

                                                      memory/6424-9605-0x0000024095670000-0x0000024095671000-memory.dmp
                                                      Download

                                                      memory/8124-9387-0x00007FFF3B580000-0x00007FFF3B581000-memory.dmp
                                                      Download

                                                      memory/8124-9388-0x00007FFF3AEA0000-0x00007FFF3AEA1000-memory.dmp
                                                      Download