Overview

overview

8

Static

static

1

URLScan

urlscan

1

http://bluestacks.com

windows10-2004-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    232s
  • max time network
    244s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    17/10/2026, 00:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    http://bluestacks.com
  • Sample261017-akpgyscc33
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Downloads MZ/PE file 3 IoCs
  • Modifies Windows Firewall 2 TTPs 4 IoCs
    defense_evasion
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 20 IoCs
  • Loads dropped DLL 64 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Discovers running processes 1 TTPs 7 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 11 IoCs
    execution
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 10 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 43 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://bluestacks.com
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4856
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffe1bb8c188,0x7ffe1bb8c194,0x7ffe1bb8c1a0
      2⤵
        PID:1360
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,2674241113948510774,4566979309907957983,524288 --field-trial-handle=2380,i,18262899906685189631,14599883814099943355,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:3
        2⤵
        • Downloads MZ/PE file
        • System Time Discovery
        PID:4632
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,11727760820927627343,16618567251150842956,262144 --field-trial-handle=2380,i,18262899906685189631,14599883814099943355,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2
        2⤵
          PID:1612
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,13035309934464262556,15402691558812743752,524288 --field-trial-handle=2380,i,18262899906685189631,14599883814099943355,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:8
          2⤵
            PID:2236
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,762479583195744885,15757131956736999781,2097152 --field-trial-handle=2380,i,18262899906685189631,14599883814099943355,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
            2⤵
              PID:4748
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,15332629506385566831,18102575797304155977,2097152 --field-trial-handle=2380,i,18262899906685189631,14599883814099943355,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
              2⤵
                PID:2932
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,9817062329478954777,4872942484227845551,2097152 --field-trial-handle=2380,i,18262899906685189631,14599883814099943355,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
                2⤵
                  PID:3880
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,15782197307391035412,6333637320884707698,2097152 --field-trial-handle=2380,i,18262899906685189631,14599883814099943355,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:2
                  2⤵
                    PID:4152
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5132,i,14111812294716800806,3067570684444326762,2097152 --field-trial-handle=2380,i,18262899906685189631,14599883814099943355,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:1
                    2⤵
                      PID:1800
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,2391194663361168752,18369711703732569732,524288 --field-trial-handle=2380,i,18262899906685189631,14599883814099943355,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
                      2⤵
                        PID:5100
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,10614525711880411812,3155305632243718495,524288 --field-trial-handle=2380,i,18262899906685189631,14599883814099943355,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
                        2⤵
                          PID:3284
                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,4352337594724394904,255897955619886157,524288 --field-trial-handle=2380,i,18262899906685189631,14599883814099943355,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
                          2⤵
                            PID:732
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,4352337594724394904,255897955619886157,524288 --field-trial-handle=2380,i,18262899906685189631,14599883814099943355,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
                            2⤵
                              PID:5088
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,5303589096635429269,9338300603880417712,524288 --field-trial-handle=2380,i,18262899906685189631,14599883814099943355,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
                              2⤵
                                PID:4180
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6416,i,10033390412656261252,16996006365492753924,2097152 --field-trial-handle=2380,i,18262899906685189631,14599883814099943355,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:1
                                2⤵
                                  PID:4312
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,9322200989977528403,16854082607555731081,524288 --field-trial-handle=2380,i,18262899906685189631,14599883814099943355,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:8
                                  2⤵
                                    PID:1628
                                  • C:\Users\Admin\Downloads\BlueStacksInstaller_5.22.285.1013_native_47e82952df6bb067f06863bf5e6aa80f_MzsxNSwwOzUsNTsxNQ==.exe
                                    "C:\Users\Admin\Downloads\BlueStacksInstaller_5.22.285.1013_native_47e82952df6bb067f06863bf5e6aa80f_MzsxNSwwOzUsNTsxNQ==.exe"
                                    2⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:2428
                                    • C:\Users\Admin\AppData\Local\Temp\7zSC79D3349\BlueStacksInstaller.exe
                                      "C:\Users\Admin\AppData\Local\Temp\7zSC79D3349\BlueStacksInstaller.exe"
                                      3⤵
                                      • Downloads MZ/PE file
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Enumerates connected drives
                                      • Reads the TCP/IP host and domain name from the registry
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      PID:5348
                                      • C:\Users\Admin\AppData\Local\Temp\7zSC79D3349\HD-CheckCpu.exe
                                        "C:\Users\Admin\AppData\Local\Temp\7zSC79D3349\HD-CheckCpu.exe" --cmd checkHypervEnabled
                                        4⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:5472
                                      • C:\Users\Admin\AppData\Local\Temp\7zSC79D3349\HD-CheckCpu.exe
                                        "C:\Users\Admin\AppData\Local\Temp\7zSC79D3349\HD-CheckCpu.exe" --cmd checkSSE4
                                        4⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:5600
                                      • C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.22.285.1013_nxt.exe
                                        "C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.22.285.1013_nxt.exe" -s
                                        4⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Drops file in Program Files directory
                                        • Reads the TCP/IP host and domain name from the registry
                                        • System Location Discovery: System Language Discovery
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        PID:5196
                                        • C:\Windows\SysWOW64\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\BlueStacks X\green.vbs"
                                          5⤵
                                          • Checks computer location settings
                                          • Executes a VBScript file via the Windows Script Host.
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:8068
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c green.bat
                                            6⤵
                                            • Executes a command shell one-liner
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:7988
                                            • C:\Windows\SysWOW64\netsh.exe
                                              netsh advfirewall firewall delete rule name="BlueStacksWeb"
                                              7⤵
                                              • Modifies Windows Firewall
                                              • Event Triggered Execution: Netsh Helper DLL
                                              • System Location Discovery: System Language Discovery
                                              PID:7948
                                            • C:\Windows\SysWOW64\netsh.exe
                                              netsh advfirewall firewall delete rule name="Cloud Game"
                                              7⤵
                                              • Modifies Windows Firewall
                                              • Event Triggered Execution: Netsh Helper DLL
                                              • System Location Discovery: System Language Discovery
                                              PID:7892
                                            • C:\Windows\SysWOW64\netsh.exe
                                              netsh advfirewall firewall add rule name="BlueStacksWeb" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\BlueStacksWeb.exe"
                                              7⤵
                                              • Modifies Windows Firewall
                                              • Event Triggered Execution: Netsh Helper DLL
                                              • System Location Discovery: System Language Discovery
                                              PID:5700
                                            • C:\Windows\SysWOW64\netsh.exe
                                              netsh advfirewall firewall add rule name="Cloud Game" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\Cloud Game.exe"
                                              7⤵
                                              • Modifies Windows Firewall
                                              • Event Triggered Execution: Netsh Helper DLL
                                              • System Location Discovery: System Language Discovery
                                              PID:2768
                                      • C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.22.285.1013_native_47e82952df6bb067f06863bf5e6aa80f_MzsxNSwwOzUsNTsxNQ==.exe
                                        "C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.22.285.1013_native_47e82952df6bb067f06863bf5e6aa80f_MzsxNSwwOzUsNTsxNQ==.exe" -versionMachineID=c49deb86-33c5-4d7d-b1f1-39091f5b0c79 -machineID=1a2fb2f1-d374-47bf-833e-98ad4c96e70d -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Pie64 -imageToLaunch=Pie64 -isSSE4Available=1 -appToLaunch=bs5 -bsxVersion=10.42.285.1001 -country=GB -isWalletFeatureEnabled -discordUrl=https://www.bluestacksplayer.com/#joinBlueStacksCommunity
                                        4⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:9132
                                        • C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Bootstrapper.exe
                                          "C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Bootstrapper.exe" -versionMachineID=c49deb86-33c5-4d7d-b1f1-39091f5b0c79 -machineID=1a2fb2f1-d374-47bf-833e-98ad4c96e70d -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Pie64 -imageToLaunch=Pie64 -isSSE4Available=1 -appToLaunch=bs5 -bsxVersion=10.42.285.1001 -country=GB -isWalletFeatureEnabled -discordUrl=https://www.bluestacksplayer.com/#joinBlueStacksCommunity
                                          5⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          PID:9768
                                          • C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\BlueStacksInstaller.exe
                                            "C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\BlueStacksInstaller.exe" -versionMachineID="c49deb86-33c5-4d7d-b1f1-39091f5b0c79" -machineID="1a2fb2f1-d374-47bf-833e-98ad4c96e70d" -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName="Pie64" -imageToLaunch="Pie64" -appToLaunch="bs5" -bsxVersion="10.42.285.1001" -country="GB" -isWalletFeatureEnabled -discordUrl="https://www.bluestacksplayer.com/#joinBlueStacksCommunity" -parentpath="C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacksInstaller_5.22.285.1013_native_47e82952df6bb067f06863bf5e6aa80f_MzsxNSwwOzUsNTsxNQ==.exe" -md5=47e82952df6bb067f06863bf5e6aa80f -app64=
                                            6⤵
                                            • Executes dropped EXE
                                            • Reads the TCP/IP host and domain name from the registry
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:9876
                                            • C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\7zr.exe
                                              "C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\CommonInstallUtils.zip" -o"C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\" -aoa
                                              7⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:6572
                                            • C:\Windows\SYSTEM32\cmd.exe
                                              "cmd.exe" /c "sc.exe delete BlueStacksDrv_nxt"
                                              7⤵
                                              • Executes a command shell one-liner
                                              PID:7020
                                              • C:\Windows\system32\sc.exe
                                                sc.exe delete BlueStacksDrv_nxt
                                                8⤵
                                                • Launches sc.exe
                                                PID:7116
                                            • C:\Windows\SYSTEM32\cmd.exe
                                              "cmd.exe" /c "C:\Windows\system32\sc.exe delete BlueStacksDrv_nxt"
                                              7⤵
                                              • Executes a command shell one-liner
                                              PID:7096
                                              • C:\Windows\system32\sc.exe
                                                C:\Windows\system32\sc.exe delete BlueStacksDrv_nxt
                                                8⤵
                                                • Launches sc.exe
                                                PID:3244
                                            • C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\HD-ForceGPU.exe
                                              "C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\HD-ForceGPU.exe" 1 "C:\Program Files\BlueStacks_nxt"
                                              7⤵
                                              • Executes dropped EXE
                                              PID:5604
                                            • C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\HD-GLCheck.exe
                                              "C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\HD-GLCheck.exe" 1 2
                                              7⤵
                                              • Executes dropped EXE
                                              PID:3512
                                            • C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\HD-GLCheck.exe
                                              "C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\HD-GLCheck.exe" 4 2
                                              7⤵
                                              • Executes dropped EXE
                                              PID:2184
                                            • C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\HD-GLCheck.exe
                                              "C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\HD-GLCheck.exe" 2 2
                                              7⤵
                                              • Executes dropped EXE
                                              PID:7216
                                            • C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\HD-GLCheck.exe
                                              "C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\HD-GLCheck.exe" 1 1
                                              7⤵
                                              • Executes dropped EXE
                                              PID:7300
                                            • C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\HD-GLCheck.exe
                                              "C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\HD-GLCheck.exe" 4 1
                                              7⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:7400
                                            • C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\HD-GLCheck.exe
                                              "C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\HD-GLCheck.exe" 2 1
                                              7⤵
                                              • Executes dropped EXE
                                              PID:7512
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.bluestacks.com/download.html
                                              7⤵
                                                PID:9664
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://www.bluestacks.com/download.html
                                                  8⤵
                                                    PID:9652
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,17279666753997525044,493752273225244079,524288 --field-trial-handle=2380,i,18262899906685189631,14599883814099943355,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:8
                                        2⤵
                                          PID:5900
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,11182765438700750885,5855497024339297308,524288 --field-trial-handle=2380,i,18262899906685189631,14599883814099943355,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:8
                                          2⤵
                                            PID:5908
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,10271181641334970718,11285039013642828651,524288 --field-trial-handle=2380,i,18262899906685189631,14599883814099943355,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:8
                                            2⤵
                                              PID:5916
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,11927110157344859009,11336741558023158229,524288 --field-trial-handle=2380,i,18262899906685189631,14599883814099943355,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:8
                                              2⤵
                                                PID:5400
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,10519827959392470741,12592502013520862223,524288 --field-trial-handle=2380,i,18262899906685189631,14599883814099943355,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
                                                2⤵
                                                  PID:8424
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5612,i,17178459656749681442,2162511294501719858,262144 --field-trial-handle=2380,i,18262899906685189631,14599883814099943355,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
                                                  2⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:8532
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4044,i,964319038911701500,5637508621331229933,524288 --field-trial-handle=2380,i,18262899906685189631,14599883814099943355,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:8
                                                  2⤵
                                                    PID:8788
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,14841869718894570159,15974038237242777369,524288 --field-trial-handle=2380,i,18262899906685189631,14599883814099943355,262144 --variations-seed-version --mojo-platform-channel-handle=1528 /prefetch:8
                                                    2⤵
                                                      PID:8772
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,9973514561618078637,3438843869238446734,524288 --field-trial-handle=2380,i,18262899906685189631,14599883814099943355,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:8
                                                      2⤵
                                                        PID:8876
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6268,i,12644141809956434513,4221472066986369154,2097152 --field-trial-handle=2380,i,18262899906685189631,14599883814099943355,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:1
                                                        2⤵
                                                          PID:9688
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6968,i,5827129417976580212,3578146953593004589,2097152 --field-trial-handle=2380,i,18262899906685189631,14599883814099943355,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
                                                          2⤵
                                                            PID:6740
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                          1⤵
                                                            PID:3740
                                                          • C:\ProgramData\BlueStacksServicesSetup.exe
                                                            "C:\ProgramData\BlueStacksServicesSetup.exe"
                                                            1⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:10072
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq BlueStacksServices.exe" | find "BlueStacksServices.exe"
                                                              2⤵
                                                              • Executes a command shell one-liner
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:10216
                                                              • C:\Windows\SysWOW64\tasklist.exe
                                                                tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq BlueStacksServices.exe"
                                                                3⤵
                                                                • Discovers running processes
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:6256
                                                              • C:\Windows\SysWOW64\find.exe
                                                                find "BlueStacksServices.exe"
                                                                3⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:6264
                                                          • C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
                                                            "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --hidden --initialLaunch
                                                            1⤵
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • Reads the TCP/IP host and domain name from the registry
                                                            • Modifies registry class
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:7568
                                                            • C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
                                                              "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1616 --field-trial-handle=1748,i,17516722774150757778,13757658423765335551,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                                                              2⤵
                                                              • Executes dropped EXE
                                                              PID:3288
                                                            • C:\Windows\system32\cscript.exe
                                                              cscript.exe
                                                              2⤵
                                                                PID:2996
                                                              • C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
                                                                "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --mojo-platform-channel-handle=1992 --field-trial-handle=1748,i,17516722774150757778,13757658423765335551,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • Reads the TCP/IP host and domain name from the registry
                                                                PID:2660
                                                              • C:\Windows\system32\cscript.exe
                                                                cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKCU\SOFTWARE\BlueStacksServices
                                                                2⤵
                                                                • Executes a VBScript file via the Windows Script Host.
                                                                • Reads the TCP/IP host and domain name from the registry
                                                                PID:8124
                                                              • C:\Windows\system32\cscript.exe
                                                                cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKCU\SOFTWARE\BlueStacksServices
                                                                2⤵
                                                                • Executes a VBScript file via the Windows Script Host.
                                                                PID:7940
                                                              • C:\Windows\system32\cscript.exe
                                                                cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regPutValue.wsf A
                                                                2⤵
                                                                • Executes a VBScript file via the Windows Script Host.
                                                                PID:2704
                                                              • C:\Windows\system32\cscript.exe
                                                                cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regPutValue.wsf A
                                                                2⤵
                                                                • Executes a VBScript file via the Windows Script Host.
                                                                PID:4360
                                                              • C:\Windows\system32\cscript.exe
                                                                cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
                                                                2⤵
                                                                • Executes a VBScript file via the Windows Script Host.
                                                                PID:7984
                                                              • C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
                                                                "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --app-user-model-id=com.bluestacks.services --app-path="C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2692 --field-trial-handle=1748,i,17516722774150757778,13757658423765335551,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
                                                                2⤵
                                                                  PID:1604
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                  2⤵
                                                                  • Executes a command shell one-liner
                                                                  PID:728
                                                                  • C:\Windows\system32\tasklist.exe
                                                                    tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                    3⤵
                                                                    • Discovers running processes
                                                                    PID:9092
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                  2⤵
                                                                  • Executes a command shell one-liner
                                                                  PID:5536
                                                                  • C:\Windows\system32\tasklist.exe
                                                                    tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                    3⤵
                                                                    • Discovers running processes
                                                                    PID:9036
                                                                • C:\Windows\system32\cscript.exe
                                                                  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
                                                                  2⤵
                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                  PID:5184
                                                                • C:\Windows\system32\cscript.exe
                                                                  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
                                                                  2⤵
                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                  PID:5124
                                                                • C:\Windows\system32\cscript.exe
                                                                  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
                                                                  2⤵
                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                  PID:2776
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                  2⤵
                                                                  • Executes a command shell one-liner
                                                                  PID:6176
                                                                  • C:\Windows\system32\tasklist.exe
                                                                    tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                    3⤵
                                                                    • Discovers running processes
                                                                    PID:9416
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                  2⤵
                                                                  • Executes a command shell one-liner
                                                                  PID:9252
                                                                  • C:\Windows\system32\tasklist.exe
                                                                    tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                    3⤵
                                                                    • Discovers running processes
                                                                    PID:9452
                                                                • C:\Windows\system32\cscript.exe
                                                                  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
                                                                  2⤵
                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                  PID:9296
                                                                • C:\Windows\system32\cscript.exe
                                                                  cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
                                                                  2⤵
                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                  PID:9236
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                  2⤵
                                                                  • Executes a command shell one-liner
                                                                  PID:6412
                                                                  • C:\Windows\system32\tasklist.exe
                                                                    tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                    3⤵
                                                                    • Discovers running processes
                                                                    PID:6452
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                  2⤵
                                                                  • Executes a command shell one-liner
                                                                  PID:6436
                                                                  • C:\Windows\system32\tasklist.exe
                                                                    tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                    3⤵
                                                                    • Discovers running processes
                                                                    PID:6704

                                                              Network

                                                                    MITRE ATT&CK Enterprise v16

                                                                    Reconnaissance

                                                                    Resource Development

                                                                    Initial Access

                                                                    Execution

                                                                    Command and Scripting Interpreter

                                                                    2
                                                                    T1059

                                                                    Visual Basic

                                                                    1
                                                                    T1059.005

                                                                    Windows Command Shell

                                                                    1
                                                                    T1059.003

                                                                    System Services

                                                                    1
                                                                    T1569

                                                                    Service Execution

                                                                    1
                                                                    T1569.002

                                                                    Persistence

                                                                    Boot or Logon Autostart Execution

                                                                    1
                                                                    T1547

                                                                    Registry Run Keys / Startup Folder

                                                                    1
                                                                    T1547.001

                                                                    Create or Modify System Process

                                                                    2
                                                                    T1543

                                                                    Windows Service

                                                                    2
                                                                    T1543.003

                                                                    Event Triggered Execution

                                                                    1
                                                                    T1546

                                                                    Netsh Helper DLL

                                                                    1
                                                                    T1546.007

                                                                    Privilege Escalation

                                                                    Boot or Logon Autostart Execution

                                                                    1
                                                                    T1547

                                                                    Registry Run Keys / Startup Folder

                                                                    1
                                                                    T1547.001

                                                                    Create or Modify System Process

                                                                    2
                                                                    T1543

                                                                    Windows Service

                                                                    2
                                                                    T1543.003

                                                                    Event Triggered Execution

                                                                    1
                                                                    T1546

                                                                    Netsh Helper DLL

                                                                    1
                                                                    T1546.007

                                                                    Defense Evasion

                                                                    Impair Defenses

                                                                    2
                                                                    T1562

                                                                    Disable or Modify System Firewall

                                                                    1
                                                                    T1562.004

                                                                    Modify Registry

                                                                    1
                                                                    T1112

                                                                    Credential Access

                                                                    Discovery

                                                                    Browser Information Discovery

                                                                    1
                                                                    T1217

                                                                    Peripheral Device Discovery

                                                                    1
                                                                    T1120

                                                                    Process Discovery

                                                                    1
                                                                    T1057

                                                                    Query Registry

                                                                    5
                                                                    T1012

                                                                    System Information Discovery

                                                                    5
                                                                    T1082

                                                                    System Location Discovery

                                                                    1
                                                                    T1614

                                                                    System Language Discovery

                                                                    1
                                                                    T1614.001

                                                                    System Network Configuration Discovery

                                                                    1
                                                                    T1016

                                                                    System Time Discovery

                                                                    1
                                                                    T1124

                                                                    Lateral Movement

                                                                    Collection

                                                                    Command and Control

                                                                    Exfiltration

                                                                    Impact

                                                                    Service Stop

                                                                    1
                                                                    T1489

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    BlueStacks X.exe
                                                                    • Path C:\Program Files (x86)\BlueStacks X\BlueStacks X.exe
                                                                    • Size 496KB
                                                                    • SHA256 f4b2703f0d875370ef4b18f8e6a49a2103782525525dccc7483fe09d50f36e74
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    green.vbs
                                                                    • Path C:\Program Files (x86)\BlueStacks X\green.vbs
                                                                    • Size 66B
                                                                    • SHA256 9aadc49b300c730ff96b3aecbd5eca60dc7d7b725b41d1c689dd58ce13421fe1
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    close_disabled.svg
                                                                    • Path C:\Program Files (x86)\BlueStacks X\image\Gallery\close_disabled.svg
                                                                    • Size 569B
                                                                    • SHA256 8ee5aa84139b2ea5549f7272523aeb203d73954c5ccdcf6f7407bf1a3469f13e
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    close_hover.svg
                                                                    • Path C:\Program Files (x86)\BlueStacks X\image\Gallery\close_hover.svg
                                                                    • Size 653B
                                                                    • SHA256 1bca2e912184b8168ee8961de68d1d839f4f9827fde6f48ab100fb61e82eff90
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    close_normal.svg
                                                                    • Path C:\Program Files (x86)\BlueStacks X\image\Gallery\close_normal.svg
                                                                    • Size 569B
                                                                    • SHA256 92aeae68e9e0973d9e0dc575941f1cb2e24afd0574341a46b870be7384eaa537
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    close_pressed.svg
                                                                    • Path C:\Program Files (x86)\BlueStacks X\image\Gallery\close_pressed.svg
                                                                    • Size 653B
                                                                    • SHA256 9585f41eb6202e89f2087266fa31852d7f41ca8cc659b907c96753fe165f937d
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    muti_on.svg
                                                                    • Path C:\Program Files (x86)\BlueStacks X\image\MyGames\muti_on.svg
                                                                    • Size 2KB
                                                                    • SHA256 27948bad2c9ed5ff966769ba028d14c90d8d2f621498ab3e2012e422eaa9203f
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    Right-hover.svg
                                                                    • Path C:\Program Files (x86)\BlueStacks X\image\NowBuxUser\Right-hover.svg
                                                                    • Size 244B
                                                                    • SHA256 16c03f5c8ae6e478fdebd40a157ba6e94a1a4caa818f3bb456804841ff7f5c13
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    close.svg
                                                                    • Path C:\Program Files (x86)\BlueStacks X\image\NowBuxUser\close.svg
                                                                    • Size 629B
                                                                    • SHA256 e8c916269f823d8c14b64c0f0533de2fc0c5339e1ec16eb3eade58e145a22801
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    nowBux.png
                                                                    • Path C:\Program Files (x86)\BlueStacks X\image\NowBuxUser\nowBux.png
                                                                    • Size 223KB
                                                                    • SHA256 cd8c5292c38bd39cec764f12cb357c7400041a35a44bedc562d051be0c61acd0
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    DefaultApp.svg
                                                                    • Path C:\Program Files (x86)\BlueStacks X\image\Search\DefaultApp.svg
                                                                    • Size 12KB
                                                                    • SHA256 ce4591b3bab0cae9fc400ede4c75ba9607c6110a80a6ed62c539335b4a63b9f1
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    CloudGame_on.svg
                                                                    • Path C:\Program Files (x86)\BlueStacks X\image\TypeIndicator\CloudGame_on.svg
                                                                    • Size 1KB
                                                                    • SHA256 adfbdae5a3f86120f4e874eb716a3f300be6e5d5708785a65800199f94a89a02
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    Setting_hover.svg
                                                                    • Path C:\Program Files (x86)\BlueStacks X\image\TypeIndicator\Setting_hover.svg
                                                                    • Size 6KB
                                                                    • SHA256 74a1c0512b601ac34e5779b1dae553b8c41a0c47913b3578797bf017f2860cb9
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    web3_on.svg
                                                                    • Path C:\Program Files (x86)\BlueStacks X\image\TypeIndicator\web3_on.svg
                                                                    • Size 3KB
                                                                    • SHA256 cbd617f8863cfe6f71a431c52cfde33757f233fcf0ef57a90c59392bd4ae16d9
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    nxt-noNetwork.svg
                                                                    • Path C:\Program Files (x86)\BlueStacks X\www\images\nxt-noNetwork.svg
                                                                    • Size 17KB
                                                                    • SHA256 e52ef44418d7fac9b198fc99f16d566f4057b426a7eef9c8db481f26f233a62c
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    0952cc3b-abd2-4368-9603-66445335fb21.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0952cc3b-abd2-4368-9603-66445335fb21.tmp
                                                                    • Size 18KB
                                                                    • SHA256 3e0c7f88b25e819340ee4bc96f11b9767cdd7ff65b0c8084e66446d2f4debe11
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    1288eea5-00e8-4db6-9705-fdae449a2957.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1288eea5-00e8-4db6-9705-fdae449a2957.tmp
                                                                    • Size 26KB
                                                                    • SHA256 3040a11b0c2355405153b2863817185e4671372d629089a06677269a7325a999
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    4f58ae84-e320-42e8-b71d-fc97e394fd02.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4f58ae84-e320-42e8-b71d-fc97e394fd02.tmp
                                                                    • Size 8KB
                                                                    • SHA256 3f2f01feb60aff86b21ff6aff19e6e2f7de2f8ad24dacbb5c17d6465f581491e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    7c97cbd1-1050-4439-9dfc-1dcc8182029d.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7c97cbd1-1050-4439-9dfc-1dcc8182029d.tmp
                                                                    • Size 18KB
                                                                    • SHA256 82a798688264c55baf90897be5684b037ba4dbbf0c0d2cc8fc29a9e1a846b5db
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    9c1dc84c-421b-4a68-b93a-0b1a1ce5ef69.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9c1dc84c-421b-4a68-b93a-0b1a1ce5ef69.tmp
                                                                    • Size 26KB
                                                                    • SHA256 c023f923e333713d2da5484af4f6c3bd34102eff4022dfa6653f51b8e278ae75
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    settings.dat
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                    • Size 280B
                                                                    • SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    01db9a08-3cc3-485b-b8b3-476536d7e642.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\01db9a08-3cc3-485b-b8b3-476536d7e642.tmp
                                                                    • Size 10KB
                                                                    • SHA256 f9d7b5dd2a89022369a8e9c4c0183c599aafe421ccd4a15debb3307c748d5963
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    23251822-3c3f-4e18-96c0-343604b99b95.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\23251822-3c3f-4e18-96c0-343604b99b95.tmp
                                                                    • Size 10KB
                                                                    • SHA256 c7d2db97d9b050c6c2a31956dbbbadabf918200011fb8a2c43d3b5e214209c9a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    55872fcb-5b12-42b6-9505-bba3b7b7ccac.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\55872fcb-5b12-42b6-9505-bba3b7b7ccac.tmp
                                                                    • Size 10KB
                                                                    • SHA256 eadcbb7fce7c1ff1472ad772d5913204a8d84bb8576d9c5bec1a116b4825a15f
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    83a8a8f2-5e05-4c78-92a7-05b6fc74a950.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\83a8a8f2-5e05-4c78-92a7-05b6fc74a950.tmp
                                                                    • Size 10KB
                                                                    • SHA256 ee4f296d2fea795275fa843c2d5189a193793ab02f9b044d6d2335286064d724
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    LOG.old
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                    • Size 334B
                                                                    • SHA256 cbd96226db3b69ecd5b4a24788e5c1fc2f53f570945084ee387d434e6b900a71
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    LOG.old
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                    • Size 334B
                                                                    • SHA256 87639047281ea2564f5e399d1b5ec0d3d2f2c9e1e559dbda9ba5c1fc737b0309
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    f_000061
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000061
                                                                    • Size 178KB
                                                                    • SHA256 a082efb929bb708780f2bf0c3f583c196e0db325bbfe59cf4784ee0afc4456d8
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    f_000063
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063
                                                                    • Size 113KB
                                                                    • SHA256 f9940d88ac0dbf49bf86bfa4959701a3a312a4aceebb6753dc251ed2c08868df
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    f_000064
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
                                                                    • Size 77KB
                                                                    • SHA256 c55544fb40d6a22b27922380bdc3786ea32a56c5b7bc7a12e8918a8edeba71af
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    f_000067
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
                                                                    • Size 186KB
                                                                    • SHA256 f9d06ad4df6d0a8071cd493d86d36d67e1d4fe94a21abd76d2f507f79dca6f4e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    temp-index
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                    • Size 3KB
                                                                    • SHA256 ea543332a03858bcce1476476c96246f3dcc02ed908c100a6a24c1a3366d3db0
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    4e3bc248-5ea5-43ed-968e-847c0b5b9fcf.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\4e3bc248-5ea5-43ed-968e-847c0b5b9fcf.tmp
                                                                    • Size 2B
                                                                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    1633f267-68b0-4d75-937a-4eb6314dbd75.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1633f267-68b0-4d75-937a-4eb6314dbd75.tmp
                                                                    • Size 6KB
                                                                    • SHA256 474bbb4e0d364549a6d90c2867860c9cbd72a1738588bd6661131af86bb75413
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    257c74e0-9369-4f4f-85f1-bac8fd0cecd2.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\257c74e0-9369-4f4f-85f1-bac8fd0cecd2.tmp
                                                                    • Size 2B
                                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    90a7a424-c31a-4622-a78c-54a2e6c0f7ac.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\90a7a424-c31a-4622-a78c-54a2e6c0f7ac.tmp
                                                                    • Size 111B
                                                                    • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    sync_diagnostic.log
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                    • Size 4KB
                                                                    • SHA256 bfae2a1605a6bf0fc0ac4a12394b9feda97ad014815635575cc8c817167a13a7
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    a4000d66-8078-40e5-8765-2028586a3d93.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a4000d66-8078-40e5-8765-2028586a3d93.tmp
                                                                    • Size 27KB
                                                                    • SHA256 99653a0ac7b9b24f5b91a0409690eedf26d51b8f12cfe66d800ed0a052fab18a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    a645cbee-0bc3-4fc0-9ea8-deb960063e57.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a645cbee-0bc3-4fc0-9ea8-deb960063e57.tmp
                                                                    • Size 70KB
                                                                    • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    b4fafb34-6be3-45af-baca-9989863272de.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b4fafb34-6be3-45af-baca-9989863272de.tmp
                                                                    • Size 6B
                                                                    • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    035c6aaf-cb35-4190-ae80-d9b024ceeca5.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\035c6aaf-cb35-4190-ae80-d9b024ceeca5.tmp
                                                                    • Size 22KB
                                                                    • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    a95ae842-b221-484a-8bae-313a1ec3ab65.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a95ae842-b221-484a-8bae-313a1ec3ab65.tmp
                                                                    • Size 21KB
                                                                    • SHA256 15be891ce64ad7e37ec119912ef010b503a98f1b7a6ae1296594d1a3ab4511ad
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    daddc94f-9613-4418-94e8-54d562e8faa7.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\daddc94f-9613-4418-94e8-54d562e8faa7.tmp
                                                                    • Size 8KB
                                                                    • SHA256 52b5fc0853e4011490f4c9eea00fe5592f4642500b1cfb72dbafbe2f0115009e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    6dc2fc90-85db-4205-bfaa-16ddd8ecb6e4.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6dc2fc90-85db-4205-bfaa-16ddd8ecb6e4.tmp
                                                                    • Size 13B
                                                                    • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                    • Size 2KB
                                                                    • SHA256 615670f8afe7ca851a4ee86205188fca259a23bce3a16f9e87c8d7d183b0e3c5
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    resources.js
                                                                    • Path C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\static\notification_manager\i18n\resources.js
                                                                    • Size 1KB
                                                                    • SHA256 68f3243bea4b7e7e8eb118607ecd22362271a64579126168a55f25f72bc0914c
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    utils.js
                                                                    • Path C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\static\notification_manager\js\utils.js
                                                                    • Size 252B
                                                                    • SHA256 1176f11d2aa2e35cf8b41bab715cfbc2c542415229a600f638ac8c9f054102f5
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    backicon.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC79D3349\Assets\backicon.png
                                                                    • Size 15KB
                                                                    • SHA256 fa64884054171515e97b78aaa1aad1ec5baa9d1daf9c682e0b3fb4a41a9cb1c1
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    change_click.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC79D3349\Assets\change_click.png
                                                                    • Size 310B
                                                                    • SHA256 8e5847487da148ebb3ea029cc92165afd215cdc08f7122271e13eb37f94e6dc1
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    close_red.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC79D3349\Assets\close_red.png
                                                                    • Size 15KB
                                                                    • SHA256 d0b6d143642d356b40c47459a996131a344cade6bb86158f1b74693426b09bfb
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    custom.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC79D3349\Assets\custom.png
                                                                    • Size 17KB
                                                                    • SHA256 fbece8bb5f4dfa55dcfbf41151b10608af807b9477e99acf0940954a11e68f7b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    discord_icon.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC79D3349\Assets\discord_icon.png
                                                                    • Size 564B
                                                                    • SHA256 c29b35c6be50f9e34f1120bd346ce01884f0c7ba1121c866d95b24e46e420b0c
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    discord_icon_hover.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC79D3349\Assets\discord_icon_hover.png
                                                                    • Size 512B
                                                                    • SHA256 6b126c8a7015c2274e6a2ac969e0f31ecae421e1652b446b2aafd2b03d0dc3f5
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    exit_close_click.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC79D3349\Assets\exit_close_click.png
                                                                    • Size 670B
                                                                    • SHA256 7aaef329ba9fa052791d1a09f127551289641ea743baba171de55faa30ec1157
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    folder.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC79D3349\Assets\folder.png
                                                                    • Size 298B
                                                                    • SHA256 7ffa875fab1be82e384022a27f3e627ab75131eb168be949cc83c03b6e291bbf
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    help_icon.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC79D3349\Assets\help_icon.png
                                                                    • Size 1KB
                                                                    • SHA256 97c7450d55ecda9017d0a9eed0049b8176e1828f3525aaf5660985ba214010cc
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    info_icon.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC79D3349\Assets\info_icon.png
                                                                    • Size 929B
                                                                    • SHA256 ee91e51aaa8356318cc75d60476d9422bf84be7d8a25e1b884aa16c3198dc764
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    installer_bg.jpg
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC79D3349\Assets\installer_bg.jpg
                                                                    • Size 78KB
                                                                    • SHA256 4c7471c986e16de0cd451be27d4b3171e595fe2916b4b3bf7ca52df6ec368904
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    installer_logo.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC79D3349\Assets\installer_logo.png
                                                                    • Size 9KB
                                                                    • SHA256 462b64f2e016d25a2a6a653ba896206129c4ac841d61a6c2fd116009606f7e1c
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    installer_minimize.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC79D3349\Assets\installer_minimize.png
                                                                    • Size 113B
                                                                    • SHA256 a064f417e3c2b8f3121a14bbded268b2cdf635706880b7006f931de31476bbc2
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    loader.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC79D3349\Assets\loader.png
                                                                    • Size 279B
                                                                    • SHA256 076263cc65f9824f4f82eb6beaa594d1df90218a2ee21664cf209181557e04b1
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    logo_text.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC79D3349\Assets\logo_text.png
                                                                    • Size 4KB
                                                                    • SHA256 66df86129129d8aa8dd3ba014eb3b3c27a36c22e4782f3dbd6a9a4bc1f4a87bc
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    minimize_progress_click.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC79D3349\Assets\minimize_progress_click.png
                                                                    • Size 212B
                                                                    • SHA256 2f62d4e8c643051093f907058dddc78cc525147d9c4f4a0d78b4d0e5c90979f6
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    setpath.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC79D3349\Assets\setpath.png
                                                                    • Size 15KB
                                                                    • SHA256 5bbb2f41f9f3a805986c3c88a639bcc22d90067d4b8de9f1e21e3cf9e5c1766b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    BlueStacksInstaller.exe
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC79D3349\BlueStacksInstaller.exe
                                                                    • Size 648KB
                                                                    • SHA256 df190c5a8c407df51dacb33d241698e730f530b1e97d492ff4554e0034cba1cb
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    BlueStacksInstaller.exe.config
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC79D3349\BlueStacksInstaller.exe.config
                                                                    • Size 324B
                                                                    • SHA256 d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    HD-CheckCpu.exe
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC79D3349\HD-CheckCpu.exe
                                                                    • Size 200KB
                                                                    • SHA256 2e14887f3432b4a313442247fc669f891dbdad7ef1a2d371466a2afa88074a4c
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    JSON.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC79D3349\JSON.dll
                                                                    • Size 411KB
                                                                    • SHA256 d2c8d26f95f55431e632c8581154db7c19547b656380e051194a9d2583dd2156
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    i18n.en-US.txt
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC79D3349\Locales\i18n.en-US.txt
                                                                    • Size 22KB
                                                                    • SHA256 8936455d79f33eb298869f1654286db493fb5b11b580ef7e8d859ce63541ba91
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    ThemeFile
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC79D3349\ThemeFile
                                                                    • Size 80KB
                                                                    • SHA256 de1a2e6b560e036da5ea6b042e29e81a5bfcf67dde89670c332fc5199e811ba6
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    checked_gray.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Assets\checked_gray.png
                                                                    • Size 538B
                                                                    • SHA256 d8e502fab00b0c6f06ba6abede6922ab3b423fe6f2d2f56941dabc887b229ad3
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    checked_gray_hover.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Assets\checked_gray_hover.png
                                                                    • Size 412B
                                                                    • SHA256 d7c79677d2ef897fa0ad1efc90e916c46da29f571208f78f24505603b7165c20
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    close_red_click.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Assets\close_red_click.png
                                                                    • Size 15KB
                                                                    • SHA256 d5a7e6fc5e92e0b29a4f65625030447f3379b4e3ac4bed051a0646a7932ce0cd
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    close_red_hover.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Assets\close_red_hover.png
                                                                    • Size 15KB
                                                                    • SHA256 7c625ae4668cc03e37e4ffc478b87eace06b49b77e71e3209f431c23d98acdd0
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    custom_click.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Assets\custom_click.png
                                                                    • Size 15KB
                                                                    • SHA256 1318e0f34a551edae1e82818fdf7de5ac627493db5b24556d919f525052d5b90
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    custom_hover.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Assets\custom_hover.png
                                                                    • Size 15KB
                                                                    • SHA256 d588ef0eaa334ed8482f32e5839a7ee0d0b544d5b8d5f7720b8c57010e080424
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    error_icon.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Assets\error_icon.png
                                                                    • Size 1KB
                                                                    • SHA256 666ad4fe456216ddc06618967846ed31f81d8db5be97da6531842c0667352b89
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    error_icon_72.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Assets\error_icon_72.png
                                                                    • Size 1KB
                                                                    • SHA256 84e59d14d9433e6c3d92daeb8c443063b5e3be6c0b297f0403dbde473a05cb3f
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    exit_close_hover.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Assets\exit_close_hover.png
                                                                    • Size 575B
                                                                    • SHA256 bcc053a9a087e077d58114106d29701a34f7851f4052f3157102811355d3e709
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    installer_minimize_click.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Assets\installer_minimize_click.png
                                                                    • Size 112B
                                                                    • SHA256 2599d6a55a8e12b1f05a6e8982d55559151a25ae3690e6637510b6283622dd95
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    installer_minimize_hover.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Assets\installer_minimize_hover.png
                                                                    • Size 112B
                                                                    • SHA256 57aae4bf49dcbb0ad6cff6263200015c89d7752dc75c2ad918bf846e1ce9646d
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    installer_upgrade_image_bg.jpg
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Assets\installer_upgrade_image_bg.jpg
                                                                    • Size 19KB
                                                                    • SHA256 b7f75233e633107d50f24ca82099225c83a832571cd2ce92901f2db3897f058b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    link.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Assets\link.png
                                                                    • Size 306B
                                                                    • SHA256 28c0abc6bfe7a155815104883a37a53dd783d142300471064c95eddf3cae0eaf
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    minimize_progress_hover.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Assets\minimize_progress_hover.png
                                                                    • Size 214B
                                                                    • SHA256 1a4aaa46893e2a9b011c478fbb0cd0e84c199f9f3520703189640088969ef5cd
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    powered_by_bs.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Assets\powered_by_bs.png
                                                                    • Size 9KB
                                                                    • SHA256 3d2afe5236ec813d9e8063bc43eb34b88c2155784e1bce19c6a533c32767af35
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    setpath_click.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Assets\setpath_click.png
                                                                    • Size 15KB
                                                                    • SHA256 c94924e95a49b175c8fc00bdc2821bb70a85b864cc193becc553b32f0024dde1
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    setpath_hover.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Assets\setpath_hover.png
                                                                    • Size 15KB
                                                                    • SHA256 2da3f9367c847e47131370dd163f611c4639287512a47f487e0025c5665830e0
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    unchecked_gray.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Assets\unchecked_gray.png
                                                                    • Size 192B
                                                                    • SHA256 671f26795b12008fbea1943143f660095f3dca5d925f67d765e2352fd7ee2396
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    unchecked_gray_hover.png
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Assets\unchecked_gray_hover.png
                                                                    • Size 176B
                                                                    • SHA256 a631e26bd5b6ea19c8c65b766a056c92ba8a47e1483768dcf12b05293c9a7a0d
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    Bootstrapper.exe
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Bootstrapper.exe
                                                                    • Size 153KB
                                                                    • SHA256 ff32be64c9eca8b3bd6fcc8f5ab45f03e5f0cd53df7458096486a32550493c83
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Bootstrapper.exe.config
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Bootstrapper.exe.config
                                                                    • Size 392B
                                                                    • SHA256 4b7df915d706af6459c38d75b09c5e14f951842ae0678078400f204ad1c7a7c2
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    i18n.ar-EG.txt
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Locales\i18n.ar-EG.txt
                                                                    • Size 28KB
                                                                    • SHA256 86d03fbd616a35ad9631e51e61aff37d6be401556e355748bd82761947be77ac
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    i18n.ar-IL.txt
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Locales\i18n.ar-IL.txt
                                                                    • Size 14KB
                                                                    • SHA256 65e7b0f37b5e2aa805ac8d57969804d803430186f34e9703ca9fa09ba908ef90
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    i18n.de-DE.txt
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Locales\i18n.de-DE.txt
                                                                    • Size 24KB
                                                                    • SHA256 f20f1a37f57065efc3fbbeeb2173f10469545256b8083210dcdbf111daf3e488
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    i18n.es-ES.txt
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Locales\i18n.es-ES.txt
                                                                    • Size 24KB
                                                                    • SHA256 6f3dd47822533fb69c5cc57f588bacb697d016ec0ea6a80c928f200621515fbd
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    i18n.fr-FR.txt
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Locales\i18n.fr-FR.txt
                                                                    • Size 25KB
                                                                    • SHA256 fb5021346992b0e6a709a8c0aea5c722954626308c26890b609c24d48a621a54
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    i18n.id-ID.txt
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Locales\i18n.id-ID.txt
                                                                    • Size 22KB
                                                                    • SHA256 8617d7a7841130cade79ac7e523c588744389e5ffa24523915540c22e94c5efb
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    i18n.it-IT.txt
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Locales\i18n.it-IT.txt
                                                                    • Size 23KB
                                                                    • SHA256 e4f9a5a6f698f85180840802079bdffad6ec5666af178e67bf111ebc7bb020ae
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    i18n.ja-JP.txt
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Locales\i18n.ja-JP.txt
                                                                    • Size 28KB
                                                                    • SHA256 018d107f61f9f460d8994a4872086049d71538dbff1290c45f3449dac237b287
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    i18n.ko-KR.txt
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Locales\i18n.ko-KR.txt
                                                                    • Size 24KB
                                                                    • SHA256 3aa1a1437140e16753e2b9e66c0a527a84d2876e4ff3dbb41408b61519ee4fb7
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    i18n.pl-PL.txt
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Locales\i18n.pl-PL.txt
                                                                    • Size 23KB
                                                                    • SHA256 4504be00bba5ec9f2e9571957f8d1841fc4b1b24c0d72e2d867c3e95b6aebcfc
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    i18n.pt-BR.txt
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Locales\i18n.pt-BR.txt
                                                                    • Size 23KB
                                                                    • SHA256 4cf3f6d289a810b766eb91846ab24dc25f21f314992b7170d351a4602f63bf3f
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    i18n.ru-RU.txt
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Locales\i18n.ru-RU.txt
                                                                    • Size 32KB
                                                                    • SHA256 71baa209ed0ec73d0e4eb84596f61e6811268b7f5c8349128b4339108f6d9336
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    i18n.th-TH.txt
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Locales\i18n.th-TH.txt
                                                                    • Size 38KB
                                                                    • SHA256 762116894a1e4078ac3a4af12db5ae4c5fd4efe99d12924ebfc75ac1e1a591cd
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    i18n.tr-TR.txt
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Locales\i18n.tr-TR.txt
                                                                    • Size 23KB
                                                                    • SHA256 ba13ebd5e876061c1a4f271ee05d119294b3aada62d2299cfec72e9f61335a57
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    i18n.vi-VN.txt
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Locales\i18n.vi-VN.txt
                                                                    • Size 26KB
                                                                    • SHA256 ab8fec72d3bbcfd62cae9237375c9762682b6366029051738a98e98f1945d548
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    i18n.zh-CN.txt
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Locales\i18n.zh-CN.txt
                                                                    • Size 20KB
                                                                    • SHA256 2af9d8fbf0f710bd689466443f5ad7af9e6eac8ea55072e8d80aded23e7b8ab3
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    i18n.zh-TW.txt
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSCA326F7B\Locales\i18n.zh-TW.txt
                                                                    • Size 20KB
                                                                    • SHA256 39332d6ddf2398f2b6b4deb88bc86c54c6ca993802ee861859ae95385da70fcd
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    installer_bg_2.jpg
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Assets\installer_bg_2.jpg
                                                                    • Size 121KB
                                                                    • SHA256 7cc477b38d05c7002621a51d04d2c2d9f943be5115abae1d8bcbd2def49de54e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    installer_bg_4.jpg
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Assets\installer_bg_4.jpg
                                                                    • Size 93KB
                                                                    • SHA256 3c947b7946c9e92318880bb5d31fb600b9d32476fade9ed0ee9c9c7c714f6a57
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    installer_bg_6.jpg
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Assets\installer_bg_6.jpg
                                                                    • Size 87KB
                                                                    • SHA256 423dba72b462e2595f608bc6e66bfe35869aa5b240791a30432b89b3ab0547ba
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    installer_bg_7.jpg
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Assets\installer_bg_7.jpg
                                                                    • Size 30KB
                                                                    • SHA256 873030e34515538dac3efb98edec519596439fa05b7aad37f6137ca954ba41a6
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    installer_bg_8.jpg
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Assets\installer_bg_8.jpg
                                                                    • Size 104KB
                                                                    • SHA256 1ab4953190aeb9e7e5c2cb7d58aa13508906d982c2a8435ba50c709cd6b597c8
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    ddd30021-0aa9-4206-9c7f-853bb424d47d.tmp.node
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ddd30021-0aa9-4206-9c7f-853bb424d47d.tmp.node
                                                                    • Size 2.2MB
                                                                    • SHA256 dadb2fc7fa9f6a8691661a90d5b1ab80f4091c1b8a5becf1959a977e8aca025a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    BgWorker.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsp9BBA.tmp\BgWorker.dll
                                                                    • Size 12KB
                                                                    • SHA256 a9e4f7ec65670d2ce375ffaf09b6d07f4cd531132ca002452287a4d540154a38
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    System.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsp9BBA.tmp\System.dll
                                                                    • Size 11KB
                                                                    • SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    nsDialogs.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsp9BBA.tmp\nsDialogs.dll
                                                                    • Size 9KB
                                                                    • SHA256 2bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    nsDui.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsp9BBA.tmp\nsDui.dll
                                                                    • Size 3.0MB
                                                                    • SHA256 4c0f2d66fe7edcbd3826ef31452abb6ad5eafbb12003e2286387cfaa5dd395cb
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    nsis7z.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsp9BBA.tmp\nsis7z.dll
                                                                    • Size 434KB
                                                                    • SHA256 a896a9ece055d334d431cd0f856113ab925d9ee86d2dee383c0bfbbef11a5b50
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Registry.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsz214C.tmp\Registry.dll
                                                                    • Size 24KB
                                                                    • SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    StdUtils.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsz214C.tmp\StdUtils.dll
                                                                    • Size 100KB
                                                                    • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    System.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsz214C.tmp\System.dll
                                                                    • Size 12KB
                                                                    • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    WinShell.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsz214C.tmp\WinShell.dll
                                                                    • Size 3KB
                                                                    • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    nsExec.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsz214C.tmp\nsExec.dll
                                                                    • Size 6KB
                                                                    • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    nsis7z.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsz214C.tmp\nsis7z.dll
                                                                    • Size 424KB
                                                                    • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    default.dic
                                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                    • Size 2B
                                                                    • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    temp-index
                                                                    • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\Code Cache\js\index-dir\temp-index
                                                                    • Size 48B
                                                                    • SHA256 c109ea7bb1333b9b596a4aa568eb076bbd067078ab7a9ff08d7d0c3b40a5e8ca
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    data_0
                                                                    • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\GPUCache\data_0
                                                                    • Size 8KB
                                                                    • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    data_1
                                                                    • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\GPUCache\data_1
                                                                    • Size 264KB
                                                                    • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    data_2
                                                                    • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\GPUCache\data_2
                                                                    • Size 8KB
                                                                    • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    data_3
                                                                    • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\GPUCache\data_3
                                                                    • Size 8KB
                                                                    • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    CURRENT
                                                                    • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\Local Storage\leveldb\CURRENT
                                                                    • Size 16B
                                                                    • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    config.json
                                                                    • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json
                                                                    • Size 57B
                                                                    • SHA256 9ab36ed2eab71a0f9265f57cda3d573c74805bdf4c6d41e7a4312eb580f4086f
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    config.json
                                                                    • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json
                                                                    • Size 1KB
                                                                    • SHA256 8abd14175be33035f62d103c282610f69d6e6585836c4e4ca926e9d3de2aa81c
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    config.json.tmp-219642934297e820
                                                                    • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json.tmp-219642934297e820
                                                                    • Size 92B
                                                                    • SHA256 d98a988bbb9cd4f371aeca9de6a18b7a2841a4e7b83e85406bcf85fbd5c9c211
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    config.json.tmp-21964295659426f9
                                                                    • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json.tmp-21964295659426f9
                                                                    • Size 119B
                                                                    • SHA256 d1cf0810eabfc70e3cc9f4182c31c0ba6bf2869e013ee33e6b20f7d4cfad8ae2
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    19916858-15b2-46d7-803e-b5f8a80404b8.tmp
                                                                    • Path C:\Users\Admin\Downloads\19916858-15b2-46d7-803e-b5f8a80404b8.tmp
                                                                    • Size 931KB
                                                                    • SHA256 48cb161fd85b862118dde6d7ab0b4b7308847b27f9941dcc9031f272ae05390a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    storage.json
                                                                    • Path C:\Windows\System32\storage.json
                                                                    • Size 5B
                                                                    • SHA256 1245552f1e44239aa0dfdc7aa0af24ac1e588d66abaee3ad10ddcb82a229f2ef
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    memory/1604-9889-0x00000198F98C0000-0x00000198F98C1000-memory.dmp
                                                                    Download

                                                                    memory/1604-9888-0x00007FFE36CF0000-0x00007FFE36CF1000-memory.dmp
                                                                    Download

                                                                    memory/5348-409-0x000000001BC50000-0x000000001BCB8000-memory.dmp
                                                                    Download

                                                                    memory/5348-419-0x000000001CE20000-0x000000001CE2E000-memory.dmp
                                                                    Download

                                                                    memory/5348-418-0x000000001CE50000-0x000000001CE88000-memory.dmp
                                                                    Download

                                                                    memory/5348-415-0x000000001D010000-0x000000001D538000-memory.dmp
                                                                    Download

                                                                    memory/5348-407-0x0000000000E10000-0x0000000000EB4000-memory.dmp
                                                                    Download

                                                                    memory/5348-433-0x000000001D670000-0x000000001D678000-memory.dmp
                                                                    Download

                                                                    memory/7568-10277-0x0000017AD40D0000-0x0000017AD41BD000-memory.dmp
                                                                    Download

                                                                    memory/9768-9422-0x0000000000360000-0x0000000000388000-memory.dmp
                                                                    Download

                                                                    memory/9768-9423-0x000000001AF90000-0x000000001B07E000-memory.dmp
                                                                    Download

                                                                    memory/9876-9839-0x000000001C140000-0x000000001C148000-memory.dmp
                                                                    Download

                                                                    memory/9876-9424-0x0000000000630000-0x000000000068A000-memory.dmp
                                                                    Download

                                                                    memory/9876-9454-0x0000000020A70000-0x0000000020AF0000-memory.dmp
                                                                    Download

                                                                    memory/9876-9840-0x000000001C180000-0x000000001C1A2000-memory.dmp
                                                                    Download