Overview

overview

10

Static

static

10

BlueStacks...30.exe

windows10-2004-x64

10

BlueStacks...30.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    146s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/10/2026, 18:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    BlueStacks_5.22.130.exe
  • Size 3.4MB
  • Sample261027-wx2tpse19v
  • SHA256 2c617a8f47076ddb46f41e94d8590e12c1b4e162809bba254b77ed490dc980cc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionumbralpersistenceprivilege_escalationstealer

Malware Config

Extracted

Family

  • umbral

Version

  • v1.3

C2

  • https://discord.com/api/webhooks/1561470753034076181/eZq3sAdK4om_Vxgk3ZYK2g2W7singS26zkpWZzs8QaPymMuWnjEsjXz5Wlc8AFG-yMto

Signatures

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral
  • Detects Umbral payload 4 IoCs
  • Downloads MZ/PE file 1 IoCs
  • Modifies Windows Firewall 2 TTPs 4 IoCs
    defense_evasion
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Drops file in Program Files directory 64 IoCs
  • Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

    Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 13 IoCs
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BlueStacks_5.22.130.exe
    "C:\Users\Admin\AppData\Local\Temp\BlueStacks_5.22.130.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:620
    • C:\Users\Admin\AppData\Local\Temp\MasonDrop\BlueStacks_5.22.130 (1).exe
      "C:\Users\Admin\AppData\Local\Temp\MasonDrop\BlueStacks_5.22.130 (1).exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5412
      • C:\Users\Admin\AppData\Local\Temp\7zS425A2A88\BlueStacksInstaller.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS425A2A88\BlueStacksInstaller.exe"
        3⤵
        • Downloads MZ/PE file
        • Executes dropped EXE
        • Enumerates connected drives
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3568
        • C:\Users\Admin\AppData\Local\Temp\7zS425A2A88\HD-CheckCpu.exe
          "C:\Users\Admin\AppData\Local\Temp\7zS425A2A88\HD-CheckCpu.exe" --cmd checkHypervEnabled
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3344
        • C:\Users\Admin\AppData\Local\Temp\7zS425A2A88\HD-CheckCpu.exe
          "C:\Users\Admin\AppData\Local\Temp\7zS425A2A88\HD-CheckCpu.exe" --cmd checkSSE4
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5932
        • C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.22.130.1019_nxt.exe
          "C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.22.130.1019_nxt.exe" -s
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3872
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\BlueStacks X\green.vbs"
            5⤵
            • Checks computer location settings
            • Executes a VBScript file via the Windows Script Host.
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:7640
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c green.bat
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:7748
              • C:\Windows\SysWOW64\netsh.exe
                netsh advfirewall firewall delete rule name="BlueStacksWeb"
                7⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:7800
              • C:\Windows\SysWOW64\netsh.exe
                netsh advfirewall firewall delete rule name="Cloud Game"
                7⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:7928
              • C:\Windows\SysWOW64\netsh.exe
                netsh advfirewall firewall add rule name="BlueStacksWeb" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\BlueStacksWeb.exe"
                7⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:8036
              • C:\Windows\SysWOW64\netsh.exe
                netsh advfirewall firewall add rule name="Cloud Game" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\Cloud Game.exe"
                7⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:8080
        • C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacks_5.22.130 (1).exe
          "C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacks_5.22.130 (1).exe" -versionMachineID=e5655d64-d80e-48a8-a23c-b939c5f020cd -machineID=e3016003-b26b-4b04-a257-da21124145ce -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Pie64 -imageToLaunch=Pie64 -isSSE4Available=1 -appToLaunch=bs5 -bsxVersion=10.42.130.1001 -country=GB -isWalletFeatureEnabled -discordUrl=https://discord.gg/UnXV7taVs4
          4⤵
            PID:8700
      • C:\Users\Admin\AppData\Roaming\Discord.exe
        "C:\Users\Admin\AppData\Roaming\Discord.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4432
      • C:\Users\Admin\AppData\Local\Temp\2568.exe
        "C:\Users\Admin\AppData\Local\Temp\2568.exe"
        2⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4500
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" csproduct get uuid
          3⤵
          • Queries system WMI classes for hardware identifiers
          • Reads the TCP/IP host and domain name from the registry
          • Suspicious use of AdjustPrivilegeToken
          PID:4656

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          2
          T1059

          Visual Basic

          1
          T1059.005

          Windows Command Shell

          1
          T1059.003

          Windows Management Instrumentation

          1
          T1047

          Persistence

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Netsh Helper DLL

          1
          T1546.007

          Privilege Escalation

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Netsh Helper DLL

          1
          T1546.007

          Defense Evasion

          Impair Defenses

          1
          T1562

          Disable or Modify System Firewall

          1
          T1562.004

          Credential Access

          Discovery

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          3
          T1012

          System Information Discovery

          4
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          BlueStacks X.exe
          • Path C:\Program Files (x86)\BlueStacks X\BlueStacks X.exe
          • Size 496KB
          • SHA256 dda581d94a5dd6eb4c1087ecaaf29effcd861ffebcff18f976c550946527faa9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          green.vbs
          • Path C:\Program Files (x86)\BlueStacks X\green.vbs
          • Size 66B
          • SHA256 9aadc49b300c730ff96b3aecbd5eca60dc7d7b725b41d1c689dd58ce13421fe1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          close_disabled.svg
          • Path C:\Program Files (x86)\BlueStacks X\image\Gallery\close_disabled.svg
          • Size 569B
          • SHA256 8ee5aa84139b2ea5549f7272523aeb203d73954c5ccdcf6f7407bf1a3469f13e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          close_hover.svg
          • Path C:\Program Files (x86)\BlueStacks X\image\Gallery\close_hover.svg
          • Size 653B
          • SHA256 1bca2e912184b8168ee8961de68d1d839f4f9827fde6f48ab100fb61e82eff90
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          close_normal.svg
          • Path C:\Program Files (x86)\BlueStacks X\image\Gallery\close_normal.svg
          • Size 569B
          • SHA256 92aeae68e9e0973d9e0dc575941f1cb2e24afd0574341a46b870be7384eaa537
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          close_pressed.svg
          • Path C:\Program Files (x86)\BlueStacks X\image\Gallery\close_pressed.svg
          • Size 653B
          • SHA256 9585f41eb6202e89f2087266fa31852d7f41ca8cc659b907c96753fe165f937d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          muti_on.svg
          • Path C:\Program Files (x86)\BlueStacks X\image\MyGames\muti_on.svg
          • Size 2KB
          • SHA256 27948bad2c9ed5ff966769ba028d14c90d8d2f621498ab3e2012e422eaa9203f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Right-hover.svg
          • Path C:\Program Files (x86)\BlueStacks X\image\NowBuxUser\Right-hover.svg
          • Size 244B
          • SHA256 16c03f5c8ae6e478fdebd40a157ba6e94a1a4caa818f3bb456804841ff7f5c13
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          close.svg
          • Path C:\Program Files (x86)\BlueStacks X\image\NowBuxUser\close.svg
          • Size 629B
          • SHA256 e8c916269f823d8c14b64c0f0533de2fc0c5339e1ec16eb3eade58e145a22801
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          nowBux.png
          • Path C:\Program Files (x86)\BlueStacks X\image\NowBuxUser\nowBux.png
          • Size 223KB
          • SHA256 cd8c5292c38bd39cec764f12cb357c7400041a35a44bedc562d051be0c61acd0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DefaultApp.svg
          • Path C:\Program Files (x86)\BlueStacks X\image\Search\DefaultApp.svg
          • Size 12KB
          • SHA256 ce4591b3bab0cae9fc400ede4c75ba9607c6110a80a6ed62c539335b4a63b9f1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CloudGame_on.svg
          • Path C:\Program Files (x86)\BlueStacks X\image\TypeIndicator\CloudGame_on.svg
          • Size 1KB
          • SHA256 adfbdae5a3f86120f4e874eb716a3f300be6e5d5708785a65800199f94a89a02
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Setting_hover.svg
          • Path C:\Program Files (x86)\BlueStacks X\image\TypeIndicator\Setting_hover.svg
          • Size 6KB
          • SHA256 74a1c0512b601ac34e5779b1dae553b8c41a0c47913b3578797bf017f2860cb9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          web3_on.svg
          • Path C:\Program Files (x86)\BlueStacks X\image\TypeIndicator\web3_on.svg
          • Size 3KB
          • SHA256 cbd617f8863cfe6f71a431c52cfde33757f233fcf0ef57a90c59392bd4ae16d9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          nxt-noNetwork.svg
          • Path C:\Program Files (x86)\BlueStacks X\www\images\nxt-noNetwork.svg
          • Size 17KB
          • SHA256 e52ef44418d7fac9b198fc99f16d566f4057b426a7eef9c8db481f26f233a62c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2568.exe
          • Path C:\Users\Admin\AppData\Local\Temp\2568.exe
          • Size 229KB
          • SHA256 14eb5f61fcdb395d1791ebae815ae4d3c84339af0dafb5b23b2d66ac745d52f8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          backicon.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS425A2A88\Assets\backicon.png
          • Size 15KB
          • SHA256 fa64884054171515e97b78aaa1aad1ec5baa9d1daf9c682e0b3fb4a41a9cb1c1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          change_click.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS425A2A88\Assets\change_click.png
          • Size 310B
          • SHA256 8e5847487da148ebb3ea029cc92165afd215cdc08f7122271e13eb37f94e6dc1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          close_red.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS425A2A88\Assets\close_red.png
          • Size 15KB
          • SHA256 d0b6d143642d356b40c47459a996131a344cade6bb86158f1b74693426b09bfb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          close_red_click.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS425A2A88\Assets\close_red_click.png
          • Size 15KB
          • SHA256 d5a7e6fc5e92e0b29a4f65625030447f3379b4e3ac4bed051a0646a7932ce0cd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          close_red_hover.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS425A2A88\Assets\close_red_hover.png
          • Size 15KB
          • SHA256 7c625ae4668cc03e37e4ffc478b87eace06b49b77e71e3209f431c23d98acdd0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          custom.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS425A2A88\Assets\custom.png
          • Size 17KB
          • SHA256 fbece8bb5f4dfa55dcfbf41151b10608af807b9477e99acf0940954a11e68f7b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          discord_icon.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS425A2A88\Assets\discord_icon.png
          • Size 564B
          • SHA256 c29b35c6be50f9e34f1120bd346ce01884f0c7ba1121c866d95b24e46e420b0c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          discord_icon_hover.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS425A2A88\Assets\discord_icon_hover.png
          • Size 512B
          • SHA256 6b126c8a7015c2274e6a2ac969e0f31ecae421e1652b446b2aafd2b03d0dc3f5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          exit_close_click.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS425A2A88\Assets\exit_close_click.png
          • Size 670B
          • SHA256 7aaef329ba9fa052791d1a09f127551289641ea743baba171de55faa30ec1157
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          folder.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS425A2A88\Assets\folder.png
          • Size 298B
          • SHA256 7ffa875fab1be82e384022a27f3e627ab75131eb168be949cc83c03b6e291bbf
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          help_icon.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS425A2A88\Assets\help_icon.png
          • Size 1KB
          • SHA256 97c7450d55ecda9017d0a9eed0049b8176e1828f3525aaf5660985ba214010cc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          info_icon.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS425A2A88\Assets\info_icon.png
          • Size 929B
          • SHA256 ee91e51aaa8356318cc75d60476d9422bf84be7d8a25e1b884aa16c3198dc764
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          installer_bg.jpg
          • Path C:\Users\Admin\AppData\Local\Temp\7zS425A2A88\Assets\installer_bg.jpg
          • Size 78KB
          • SHA256 4c7471c986e16de0cd451be27d4b3171e595fe2916b4b3bf7ca52df6ec368904
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          installer_logo.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS425A2A88\Assets\installer_logo.png
          • Size 9KB
          • SHA256 462b64f2e016d25a2a6a653ba896206129c4ac841d61a6c2fd116009606f7e1c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          installer_minimize.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS425A2A88\Assets\installer_minimize.png
          • Size 113B
          • SHA256 a064f417e3c2b8f3121a14bbded268b2cdf635706880b7006f931de31476bbc2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          loader.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS425A2A88\Assets\loader.png
          • Size 279B
          • SHA256 076263cc65f9824f4f82eb6beaa594d1df90218a2ee21664cf209181557e04b1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          logo_text.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS425A2A88\Assets\logo_text.png
          • Size 4KB
          • SHA256 66df86129129d8aa8dd3ba014eb3b3c27a36c22e4782f3dbd6a9a4bc1f4a87bc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          minimize_progress_click.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS425A2A88\Assets\minimize_progress_click.png
          • Size 212B
          • SHA256 2f62d4e8c643051093f907058dddc78cc525147d9c4f4a0d78b4d0e5c90979f6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          setpath.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS425A2A88\Assets\setpath.png
          • Size 15KB
          • SHA256 5bbb2f41f9f3a805986c3c88a639bcc22d90067d4b8de9f1e21e3cf9e5c1766b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BlueStacksInstaller.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7zS425A2A88\BlueStacksInstaller.exe
          • Size 642KB
          • SHA256 314db9f6f47a876f02e5cc65119b68a64384c5c88a3539e4e6ba11a15a11b2dd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BlueStacksInstaller.exe.config
          • Path C:\Users\Admin\AppData\Local\Temp\7zS425A2A88\BlueStacksInstaller.exe.config
          • Size 324B
          • SHA256 d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          HD-CheckCpu.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7zS425A2A88\HD-CheckCpu.exe
          • Size 200KB
          • SHA256 2e14887f3432b4a313442247fc669f891dbdad7ef1a2d371466a2afa88074a4c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          JSON.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7zS425A2A88\JSON.dll
          • Size 411KB
          • SHA256 d2c8d26f95f55431e632c8581154db7c19547b656380e051194a9d2583dd2156
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.en-US.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zS425A2A88\Locales\i18n.en-US.txt
          • Size 21KB
          • SHA256 945cbd36495c301dcf1cad837a4147479077974bce2790a3cb3961c9c71f22e2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ThemeFile
          • Path C:\Users\Admin\AppData\Local\Temp\7zS425A2A88\ThemeFile
          • Size 80KB
          • SHA256 de1a2e6b560e036da5ea6b042e29e81a5bfcf67dde89670c332fc5199e811ba6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          checked_gray.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Assets\checked_gray.png
          • Size 538B
          • SHA256 d8e502fab00b0c6f06ba6abede6922ab3b423fe6f2d2f56941dabc887b229ad3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          checked_gray_hover.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Assets\checked_gray_hover.png
          • Size 412B
          • SHA256 d7c79677d2ef897fa0ad1efc90e916c46da29f571208f78f24505603b7165c20
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          custom_click.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Assets\custom_click.png
          • Size 15KB
          • SHA256 1318e0f34a551edae1e82818fdf7de5ac627493db5b24556d919f525052d5b90
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          custom_hover.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Assets\custom_hover.png
          • Size 15KB
          • SHA256 d588ef0eaa334ed8482f32e5839a7ee0d0b544d5b8d5f7720b8c57010e080424
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          error_icon.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Assets\error_icon.png
          • Size 1KB
          • SHA256 666ad4fe456216ddc06618967846ed31f81d8db5be97da6531842c0667352b89
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          error_icon_72.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Assets\error_icon_72.png
          • Size 1KB
          • SHA256 84e59d14d9433e6c3d92daeb8c443063b5e3be6c0b297f0403dbde473a05cb3f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          exit_close_hover.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Assets\exit_close_hover.png
          • Size 575B
          • SHA256 bcc053a9a087e077d58114106d29701a34f7851f4052f3157102811355d3e709
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          installer_minimize_click.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Assets\installer_minimize_click.png
          • Size 112B
          • SHA256 2599d6a55a8e12b1f05a6e8982d55559151a25ae3690e6637510b6283622dd95
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          installer_minimize_hover.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Assets\installer_minimize_hover.png
          • Size 112B
          • SHA256 57aae4bf49dcbb0ad6cff6263200015c89d7752dc75c2ad918bf846e1ce9646d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          installer_upgrade_image_bg.jpg
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Assets\installer_upgrade_image_bg.jpg
          • Size 19KB
          • SHA256 b7f75233e633107d50f24ca82099225c83a832571cd2ce92901f2db3897f058b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          link.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Assets\link.png
          • Size 306B
          • SHA256 28c0abc6bfe7a155815104883a37a53dd783d142300471064c95eddf3cae0eaf
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          minimize_progress_hover.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Assets\minimize_progress_hover.png
          • Size 214B
          • SHA256 1a4aaa46893e2a9b011c478fbb0cd0e84c199f9f3520703189640088969ef5cd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          powered_by_bs.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Assets\powered_by_bs.png
          • Size 9KB
          • SHA256 3d2afe5236ec813d9e8063bc43eb34b88c2155784e1bce19c6a533c32767af35
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          setpath_click.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Assets\setpath_click.png
          • Size 15KB
          • SHA256 c94924e95a49b175c8fc00bdc2821bb70a85b864cc193becc553b32f0024dde1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          setpath_hover.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Assets\setpath_hover.png
          • Size 15KB
          • SHA256 2da3f9367c847e47131370dd163f611c4639287512a47f487e0025c5665830e0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unchecked_gray.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Assets\unchecked_gray.png
          • Size 192B
          • SHA256 671f26795b12008fbea1943143f660095f3dca5d925f67d765e2352fd7ee2396
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          unchecked_gray_hover.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Assets\unchecked_gray_hover.png
          • Size 176B
          • SHA256 a631e26bd5b6ea19c8c65b766a056c92ba8a47e1483768dcf12b05293c9a7a0d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Bootstrapper.exe.config
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Bootstrapper.exe.config
          • Size 392B
          • SHA256 4b7df915d706af6459c38d75b09c5e14f951842ae0678078400f204ad1c7a7c2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          i18n.ar-EG.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Locales\i18n.ar-EG.txt
          • Size 28KB
          • SHA256 6686465cb54bb125f41c0e378c843a14c4504115b94cd94aeab3290fc02c1498
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.ar-IL.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Locales\i18n.ar-IL.txt
          • Size 14KB
          • SHA256 65e7b0f37b5e2aa805ac8d57969804d803430186f34e9703ca9fa09ba908ef90
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.de-DE.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Locales\i18n.de-DE.txt
          • Size 24KB
          • SHA256 e829dca27a11d357d67234b858d22969fbc39103e3bce8f6a887e7ab41183303
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.es-ES.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Locales\i18n.es-ES.txt
          • Size 23KB
          • SHA256 f63122ace78900fa73d94ad2e1cdf230116e7d8d9c39872142b126e839b78165
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.fr-FR.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Locales\i18n.fr-FR.txt
          • Size 24KB
          • SHA256 47239ca5bd5578436784c12728242f36e2e47e12ce08816a222f358b9ba0eb00
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.id-ID.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Locales\i18n.id-ID.txt
          • Size 22KB
          • SHA256 73abcf287d8494fe1b15d0f55df3820f92e31779b0998b91254289c3e0c6c7f2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.it-IT.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Locales\i18n.it-IT.txt
          • Size 23KB
          • SHA256 57860d69389b1d5155314cbf1e270a7c61a35f170a04ce550df785e38899f1ff
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.ja-JP.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Locales\i18n.ja-JP.txt
          • Size 27KB
          • SHA256 0f9815626f26cfb4a90aaa4471e30191f0edcc2130322145c1eff636c5537dd3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.ko-KR.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Locales\i18n.ko-KR.txt
          • Size 24KB
          • SHA256 85f4ea4e1e923b798adaeef29729dabab8367582c10c8efc41965b3482ec9e6f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.pl-PL.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Locales\i18n.pl-PL.txt
          • Size 23KB
          • SHA256 0da7567e1ec905767d53f71b0d2d13f66be67e645f5edfc54fe413e96beb7714
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.pt-BR.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Locales\i18n.pt-BR.txt
          • Size 23KB
          • SHA256 3fb5b9611acd0332ec94e23dc60637fad134cfff39f5b401b8cbc576d7fe6953
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.ru-RU.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Locales\i18n.ru-RU.txt
          • Size 32KB
          • SHA256 bac2ce43ff30124440a2bae2fb2187f785d4e0287ad1a10839261a03ffccc9fd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.th-TH.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Locales\i18n.th-TH.txt
          • Size 37KB
          • SHA256 b723648c0d747e7557daaa52941e9718862d1edb8f96aa85f4b28395a1dfa870
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.tr-TR.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Locales\i18n.tr-TR.txt
          • Size 23KB
          • SHA256 1374bd6fe30a6149256c87805e70f3509dacaa7a0642badc5be037fbf732f6cf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.vi-VN.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Locales\i18n.vi-VN.txt
          • Size 26KB
          • SHA256 2d0875082c04453666df118b7b2204a43706e9d6ce4db78666da2c5b11be1671
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.zh-CN.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Locales\i18n.zh-CN.txt
          • Size 19KB
          • SHA256 91b5f5dfbc4eeccb59e37af2caa8658ac36f25d3baaf0df783e62e26fb0281a7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.zh-TW.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zSCF13F68B\Locales\i18n.zh-TW.txt
          • Size 20KB
          • SHA256 a50ce58912dc63a21099a7e1caaa43388b1dd105a1dd40bc2565754f50896726
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          installer_bg_2.jpg
          • Path C:\Users\Admin\AppData\Local\Temp\Assets\installer_bg_2.jpg
          • Size 121KB
          • SHA256 7cc477b38d05c7002621a51d04d2c2d9f943be5115abae1d8bcbd2def49de54e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          installer_bg_7.jpg
          • Path C:\Users\Admin\AppData\Local\Temp\Assets\installer_bg_7.jpg
          • Size 30KB
          • SHA256 873030e34515538dac3efb98edec519596439fa05b7aad37f6137ca954ba41a6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BlueStacks_5.22.130 (1).exe
          • Path C:\Users\Admin\AppData\Local\Temp\MasonDrop\BlueStacks_5.22.130 (1).exe
          • Size 927KB
          • SHA256 801895b346e936c1a7958135c285bab8d337e2d908e7d7b2fca4e3c39a786ed7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BgWorker.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nss3119.tmp\BgWorker.dll
          • Size 12KB
          • SHA256 a9e4f7ec65670d2ce375ffaf09b6d07f4cd531132ca002452287a4d540154a38
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nss3119.tmp\System.dll
          • Size 11KB
          • SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsDialogs.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nss3119.tmp\nsDialogs.dll
          • Size 9KB
          • SHA256 2bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsDui.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nss3119.tmp\nsDui.dll
          • Size 3.0MB
          • SHA256 d3385f17160ff8383c0585ce273eeb4a58d45b79791ac867243495948c86b277
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsis7z.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nss3119.tmp\nsis7z.dll
          • Size 434KB
          • SHA256 a896a9ece055d334d431cd0f856113ab925d9ee86d2dee383c0bfbbef11a5b50
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Discord.exe
          • Path C:\Users\Admin\AppData\Roaming\Discord.exe
          • Size 2.2MB
          • SHA256 78df229ddc6f50297a3f9808b5e8e6472181e6aeb880efc4f35326e4ce7edcf6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/620-190-0x00007FF6EF540000-0x00007FF6EF556000-memory.dmp
          Download

          memory/620-4038-0x00007FF6EF540000-0x00007FF6EF556000-memory.dmp
          Download

          memory/3568-160-0x000000001E680000-0x000000001EBA8000-memory.dmp
          Download

          memory/3568-154-0x000000001B950000-0x000000001B9B8000-memory.dmp
          Download

          memory/3568-164-0x000000001DBE0000-0x000000001DBEE000-memory.dmp
          Download

          memory/3568-152-0x0000000000D80000-0x0000000000E24000-memory.dmp
          Download

          memory/3568-163-0x000000001DC10000-0x000000001DC48000-memory.dmp
          Download

          memory/3568-178-0x0000000022230000-0x0000000022238000-memory.dmp
          Download

          memory/4432-4026-0x000002C2F2B50000-0x000002C2F2D12000-memory.dmp
          Download

          memory/4432-4025-0x000002C2D82D0000-0x000002C2D8510000-memory.dmp
          Download

          memory/4500-4035-0x000001D49D5C0000-0x000001D49D600000-memory.dmp
          Download