Overview

overview

7

Static

static

1

BlueStacks...==.exe

windows10-2004-x64

7

BlueStacks...==.exe

windows11-ltsc_2024-x64

4

Analysis

  • user interaction
    yes
  • max time kernel
    317s
  • max time network
    344s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    29/10/2026, 21:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    BlueStacks10Installer_10.42.286.1001_native_bbcc85dde8190665020356732762a089_MzsxNSwwOzUsNTsxNQ==_UmV0cm8gQm93bA==.exe
  • Size 931KB
  • Sample261029-1bcd5ss1ft
  • SHA256 02428ec0ec943a18f274db658e2476d751d6802703aacd3ab48eaee6fd4a4ca6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Downloads MZ/PE file 2 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Modifies Windows Firewall 2 TTPs 4 IoCs
    defense_evasion
  • Checks computer location settings 2 TTPs 15 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Discovers running processes 1 TTPs 57 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 15 IoCs
    execution
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 43 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 62 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 48 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 23 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 43 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 14 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BlueStacks10Installer_10.42.286.1001_native_bbcc85dde8190665020356732762a089_MzsxNSwwOzUsNTsxNQ==_UmV0cm8gQm93bA==.exe
    "C:\Users\Admin\AppData\Local\Temp\BlueStacks10Installer_10.42.286.1001_native_bbcc85dde8190665020356732762a089_MzsxNSwwOzUsNTsxNQ==_UmV0cm8gQm93bA==.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4968
    • C:\Users\Admin\AppData\Local\Temp\7zS863C77E8\BlueStacksInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS863C77E8\BlueStacksInstaller.exe"
      2⤵
      • Downloads MZ/PE file
      • Enumerates connected drives
      • Checks computer location settings
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3060
      • C:\Users\Admin\AppData\Local\Temp\7zS863C77E8\HD-CheckCpu.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS863C77E8\HD-CheckCpu.exe" --cmd checkHypervEnabled
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1044
      • C:\Users\Admin\AppData\Local\Temp\7zS863C77E8\HD-CheckCpu.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS863C77E8\HD-CheckCpu.exe" --cmd checkSSE4
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1260
      • C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.22.286.1003_nxt.exe
        "C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.22.286.1003_nxt.exe" -s
        3⤵
        • Checks computer location settings
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:728
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\BlueStacks X\green.vbs"
          4⤵
          • Checks computer location settings
          • Executes a VBScript file via the Windows Script Host.
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:9080
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c green.bat
            5⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:9124
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall delete rule name="BlueStacksWeb"
              6⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:2060
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall delete rule name="Cloud Game"
              6⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:1824
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall add rule name="BlueStacksWeb" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\BlueStacksWeb.exe"
              6⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:8012
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall add rule name="Cloud Game" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\Cloud Game.exe"
              6⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:8052
      • C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacks10Installer_10.42.286.1001_native_bbcc85dde8190665020356732762a089_MzsxNSwwOzUsNTsxNQ==_UmV0cm8gQm93bA==.exe
        "C:\Users\Admin\AppData\Local\BlueStacksSetup\BlueStacks10Installer_10.42.286.1001_native_bbcc85dde8190665020356732762a089_MzsxNSwwOzUsNTsxNQ==_UmV0cm8gQm93bA==.exe" -versionMachineID=6bb319c0-8e71-4291-81ec-f8d95cd3577d -machineID=ef34c1c1-3004-4225-b255-ff8951ad2f08 -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Pie64 -imageToLaunch=Pie64 -isSSE4Available=1 -appToLaunch=bsx -bsxVersion=10.42.286.1001 -country=GB -isWalletFeatureEnabled -discordUrl=https://discord.gg/UnXV7taVs4
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:7420
        • C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\BlueStacksInstaller.exe
          "C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\BlueStacksInstaller.exe" -versionMachineID=6bb319c0-8e71-4291-81ec-f8d95cd3577d -machineID=ef34c1c1-3004-4225-b255-ff8951ad2f08 -pddir="C:\ProgramData\BlueStacks_nxt" -defaultImageName=Pie64 -imageToLaunch=Pie64 -isSSE4Available=1 -appToLaunch=bsx -bsxVersion=10.42.286.1001 -country=GB -isWalletFeatureEnabled -discordUrl=https://discord.gg/UnXV7taVs4
          4⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1044
          • C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\HD-CheckCpu.exe
            "C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\HD-CheckCpu.exe" --cmd checkHypervEnabled
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5044
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/UnXV7taVs4
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:632
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://discord.gg/UnXV7taVs4
          4⤵
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies registry class
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1136
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffbac36c188,0x7ffbac36c194,0x7ffbac36c1a0
            5⤵
              PID:6692
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,6342307963283253383,7033423951011149781,524288 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
              5⤵
              • Downloads MZ/PE file
              • System Time Discovery
              PID:8576
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,9442091396589567637,283459041091758957,262144 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
              5⤵
                PID:8568
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,5135821211987394703,4268239088767712660,524288 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
                5⤵
                  PID:8524
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,1351172386321918538,7727973604371802802,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
                  5⤵
                    PID:8276
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,6620426050817005562,8057994295824461479,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
                    5⤵
                      PID:8284
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,6974730771837663313,13169356131821366867,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:1
                      5⤵
                        PID:2968
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,2770250042042484423,9829175866201510844,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:2
                        5⤵
                          PID:380
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,2941417622987674139,3835861039637545876,524288 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
                          5⤵
                            PID:4168
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,6376640709123658322,2438449127025874691,524288 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
                            5⤵
                              PID:7876
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5320,i,8130777843964362345,15885385406763352536,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
                              5⤵
                                PID:464
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,16197354004809859906,14553266778611916560,524288 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:8
                                5⤵
                                  PID:3036
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,9786707876444016509,6217852363457311030,524288 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
                                  5⤵
                                    PID:3004
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,12650959485252854754,18392833573494865009,524288 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
                                    5⤵
                                    • Modifies registry class
                                    PID:9172
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,17700701978769050365,11994482029446644427,524288 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
                                    5⤵
                                      PID:2088
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,6031360129703481007,5098269941050993042,524288 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
                                      5⤵
                                        PID:8860
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,6031360129703481007,5098269941050993042,524288 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
                                        5⤵
                                          PID:6756
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,11862014690224044488,2149782497157781894,524288 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:8
                                          5⤵
                                            PID:8832
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,3609580190911096364,9093767269188029053,524288 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:8
                                            5⤵
                                              PID:8332
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,14847682789616772061,17032960227960965345,524288 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:8
                                              5⤵
                                                PID:4720
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,17708300426019561,11269307653304179072,524288 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
                                                5⤵
                                                  PID:7452
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,8050815652219331063,6778653393889847766,524288 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:8
                                                  5⤵
                                                    PID:4060
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,16914281488588263061,10424568089413581140,524288 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:8
                                                    5⤵
                                                      PID:7368
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7296,i,8869010758195546531,9289910414159232149,524288 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:8
                                                      5⤵
                                                        PID:1856
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,2603435613070615024,9212616171891006009,524288 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:8
                                                        5⤵
                                                          PID:7564
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2864,i,2202274347898140487,9422961729837031335,524288 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:8
                                                          5⤵
                                                            PID:8764
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,3027635410476549323,12837823154590987143,524288 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:8
                                                            5⤵
                                                              PID:5724
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7192,i,2018724240060337266,8264006300182055174,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:1
                                                              5⤵
                                                                PID:8452
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=4680,i,11937672365792989915,15811509474379862405,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
                                                                5⤵
                                                                  PID:7412
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7152,i,16509062285674447878,642169251966200959,524288 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:8
                                                                  5⤵
                                                                    PID:1624
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7032,i,6766543988163168916,9815517051847262103,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:1
                                                                    5⤵
                                                                      PID:5600
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7368,i,17099696134650989064,8482813041376864340,524288 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:8
                                                                      5⤵
                                                                        PID:6448
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7580,i,2903409271594054204,14105658254513916400,524288 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=7628 /prefetch:8
                                                                        5⤵
                                                                          PID:5436
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7784,i,15258039741583885629,12411103321267949305,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=7456 /prefetch:1
                                                                          5⤵
                                                                            PID:5168
                                                                          • C:\Users\Admin\Downloads\BlueStacksInstaller_5.22.286.1003_native_4d871e0bb6401a13bfb288c55cee27ae_MzsxNSwwOzUsNTsxNQ==.exe
                                                                            "C:\Users\Admin\Downloads\BlueStacksInstaller_5.22.286.1003_native_4d871e0bb6401a13bfb288c55cee27ae_MzsxNSwwOzUsNTsxNQ==.exe"
                                                                            5⤵
                                                                            • Checks computer location settings
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:6964
                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS43B3249C\BlueStacksInstaller.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\7zS43B3249C\BlueStacksInstaller.exe"
                                                                              6⤵
                                                                              • Executes dropped EXE
                                                                              • Reads the TCP/IP host and domain name from the registry
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:4804
                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS43B3249C\HD-CheckCpu.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\7zS43B3249C\HD-CheckCpu.exe" --cmd checkHypervEnabled
                                                                                7⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:2092
                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS43B3249C\HD-CheckCpu.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\7zS43B3249C\HD-CheckCpu.exe" --cmd checkSSE4
                                                                                7⤵
                                                                                • Executes dropped EXE
                                                                                PID:2976
                                                                          • C:\Users\Admin\Downloads\BlueStacksInstaller_5.22.286.1003_native_4d871e0bb6401a13bfb288c55cee27ae_MzsxNSwwOzUsNTsxNQ==.exe
                                                                            "C:\Users\Admin\Downloads\BlueStacksInstaller_5.22.286.1003_native_4d871e0bb6401a13bfb288c55cee27ae_MzsxNSwwOzUsNTsxNQ==.exe"
                                                                            5⤵
                                                                            • Checks computer location settings
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:5132
                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSC04DFEBC\BlueStacksInstaller.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\7zSC04DFEBC\BlueStacksInstaller.exe"
                                                                              6⤵
                                                                              • Executes dropped EXE
                                                                              • Reads the TCP/IP host and domain name from the registry
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:6304
                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC04DFEBC\HD-CheckCpu.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\7zSC04DFEBC\HD-CheckCpu.exe" --cmd checkHypervEnabled
                                                                                7⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:8388
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7764,i,1435345223114170551,16658620687473183651,262144 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
                                                                            5⤵
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:6588
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7740,i,2540691367725351337,15849897256353469932,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:1
                                                                            5⤵
                                                                              PID:3864
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7756,i,3930100509584849054,2968718676497835511,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=7752 /prefetch:1
                                                                              5⤵
                                                                                PID:3496
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7844,i,9970786901805895511,16776528405465958734,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=7860 /prefetch:1
                                                                                5⤵
                                                                                  PID:5220
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8000,i,9975287323060655375,2012982664254537653,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=8016 /prefetch:1
                                                                                  5⤵
                                                                                    PID:9012
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8136,i,3107762694492420771,14395104330146940162,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=8164 /prefetch:1
                                                                                    5⤵
                                                                                      PID:8780
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8300,i,7170959023521712128,16600763849896545696,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=8316 /prefetch:1
                                                                                      5⤵
                                                                                        PID:7132
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8464,i,1800664852442608043,12059551882746405673,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=8468 /prefetch:1
                                                                                        5⤵
                                                                                          PID:8584
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8612,i,15573381160689088381,17508410246124519983,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=8484 /prefetch:1
                                                                                          5⤵
                                                                                            PID:7820
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8772,i,8254343709024068608,5628753390030095643,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=8788 /prefetch:1
                                                                                            5⤵
                                                                                              PID:7316
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8892,i,9517144245512963477,4384059501010044786,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=8908 /prefetch:1
                                                                                              5⤵
                                                                                                PID:2484
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7560,i,5855869422806439737,11783361280680860499,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=7980 /prefetch:1
                                                                                                5⤵
                                                                                                  PID:6996
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=9160,i,4575445422002913465,418574592217025834,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=8580 /prefetch:1
                                                                                                  5⤵
                                                                                                    PID:3104
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=9232,i,8810595698848886615,13166661028993326889,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:1
                                                                                                    5⤵
                                                                                                      PID:3408
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=9292,i,8289102215383923593,5169993909186547479,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
                                                                                                      5⤵
                                                                                                        PID:6744
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=9312,i,7721557713694395911,1837842598098968539,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=8656 /prefetch:1
                                                                                                        5⤵
                                                                                                          PID:7656
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=9328,i,8045442212799803550,716161810632331858,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=8648 /prefetch:1
                                                                                                          5⤵
                                                                                                            PID:2916
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=9372,i,4768574898274700637,15726696488755671004,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=8736 /prefetch:1
                                                                                                            5⤵
                                                                                                              PID:7728
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=7264,i,10128514006814638815,7071734965893554972,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=8696 /prefetch:1
                                                                                                              5⤵
                                                                                                                PID:3256
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=9400,i,10047560255302433618,1199427287895134627,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=8688 /prefetch:1
                                                                                                                5⤵
                                                                                                                  PID:6492
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8604,i,16579918453754884069,16529656141106929883,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=8668 /prefetch:1
                                                                                                                  5⤵
                                                                                                                    PID:7836
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=5232,i,10113228567131618566,11241940965219453405,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=9688 /prefetch:1
                                                                                                                    5⤵
                                                                                                                      PID:7868
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=9264,i,10808893057541427501,12644170999514402705,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=8728 /prefetch:1
                                                                                                                      5⤵
                                                                                                                        PID:3284
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=6224,i,13724242369767855411,12849137762562347156,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
                                                                                                                        5⤵
                                                                                                                          PID:8020
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=9244,i,17650657796631609958,13323920640371466183,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=7260 /prefetch:1
                                                                                                                          5⤵
                                                                                                                            PID:7240
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=9220,i,17155737285594411844,15644646852863308692,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=9324 /prefetch:1
                                                                                                                            5⤵
                                                                                                                              PID:7432
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=9432,i,14163727167818681149,15788126264072462383,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:1
                                                                                                                              5⤵
                                                                                                                                PID:8156
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=9452,i,13602253312811544517,17160566764040111042,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=9636 /prefetch:1
                                                                                                                                5⤵
                                                                                                                                  PID:8008
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=9472,i,12443920705619937012,8340583553351604856,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=9592 /prefetch:1
                                                                                                                                  5⤵
                                                                                                                                    PID:6764
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=9492,i,4485564229369099559,10048856827231666214,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=9832 /prefetch:1
                                                                                                                                    5⤵
                                                                                                                                      PID:6408
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=9512,i,14974427716649134253,661637208206273065,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=9836 /prefetch:1
                                                                                                                                      5⤵
                                                                                                                                        PID:2520
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=9532,i,2226366822757522178,6114600222014306254,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=9848 /prefetch:1
                                                                                                                                        5⤵
                                                                                                                                          PID:6756
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=9552,i,414687824934897875,4242000304304856013,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=9860 /prefetch:1
                                                                                                                                          5⤵
                                                                                                                                            PID:2912
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=10248,i,7747001633450889793,9177912982973808990,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=9804 /prefetch:1
                                                                                                                                            5⤵
                                                                                                                                              PID:4704
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,12981943105498515281,16902367305532228155,524288 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=9912 /prefetch:8
                                                                                                                                              5⤵
                                                                                                                                                PID:3148
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=3644,i,3280000865799724638,852668765045106685,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
                                                                                                                                                5⤵
                                                                                                                                                  PID:5740
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,10147544163999585722,2623335439573958452,524288 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
                                                                                                                                                  5⤵
                                                                                                                                                    PID:8080
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4600,i,9596524262364366341,15777031062075965345,524288 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=7372 /prefetch:8
                                                                                                                                                    5⤵
                                                                                                                                                      PID:6748
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12124,i,15684176809937395977,14794138621619822810,524288 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=11568 /prefetch:8
                                                                                                                                                      5⤵
                                                                                                                                                        PID:4600
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=12204,i,12859822686762787173,7800510204694282725,2097152 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=9916 /prefetch:1
                                                                                                                                                        5⤵
                                                                                                                                                          PID:8160
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12088,i,14597926864760176437,10322131209852149084,524288 --field-trial-handle=2284,i,6742054544674203544,7348365895950891726,262144 --variations-seed-version --mojo-platform-channel-handle=12064 /prefetch:8
                                                                                                                                                          5⤵
                                                                                                                                                            PID:5500
                                                                                                                                                  • C:\ProgramData\BlueStacksServicesSetup.exe
                                                                                                                                                    "C:\ProgramData\BlueStacksServicesSetup.exe"
                                                                                                                                                    1⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                    PID:4648
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq BlueStacksServices.exe" | find "BlueStacksServices.exe"
                                                                                                                                                      2⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                      PID:4368
                                                                                                                                                      • C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                                        tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq BlueStacksServices.exe"
                                                                                                                                                        3⤵
                                                                                                                                                        • Discovers running processes
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        PID:4768
                                                                                                                                                      • C:\Windows\SysWOW64\find.exe
                                                                                                                                                        find "BlueStacksServices.exe"
                                                                                                                                                        3⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:3036
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --hidden --initialLaunch
                                                                                                                                                    1⤵
                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                    • Checks computer location settings
                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                    • Modifies registry class
                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                    PID:6372
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1676,i,7632414279625316541,18201846156142937897,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                                                                                                                                                      2⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:1124
                                                                                                                                                    • C:\Windows\system32\cscript.exe
                                                                                                                                                      cscript.exe
                                                                                                                                                      2⤵
                                                                                                                                                        PID:3500
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --mojo-platform-channel-handle=2012 --field-trial-handle=1676,i,7632414279625316541,18201846156142937897,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
                                                                                                                                                        2⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                        PID:2640
                                                                                                                                                      • C:\Windows\system32\cscript.exe
                                                                                                                                                        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKCU\SOFTWARE\BlueStacksServices
                                                                                                                                                        2⤵
                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                        PID:6240
                                                                                                                                                      • C:\Windows\system32\cscript.exe
                                                                                                                                                        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKCU\SOFTWARE\BlueStacksServices
                                                                                                                                                        2⤵
                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                        PID:1776
                                                                                                                                                      • C:\Windows\system32\cscript.exe
                                                                                                                                                        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regPutValue.wsf A
                                                                                                                                                        2⤵
                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                        PID:6640
                                                                                                                                                      • C:\Windows\system32\cscript.exe
                                                                                                                                                        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regPutValue.wsf A
                                                                                                                                                        2⤵
                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                        PID:5024
                                                                                                                                                      • C:\Windows\system32\cscript.exe
                                                                                                                                                        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
                                                                                                                                                        2⤵
                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                        PID:8892
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --app-user-model-id=com.bluestacks.services --app-path="C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2672 --field-trial-handle=1676,i,7632414279625316541,18201846156142937897,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
                                                                                                                                                        2⤵
                                                                                                                                                        • Checks computer location settings
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:7956
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                        2⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                        PID:2176
                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                          tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                          3⤵
                                                                                                                                                          • Discovers running processes
                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                          PID:2908
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                        2⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                        PID:812
                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                          tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                          3⤵
                                                                                                                                                          • Discovers running processes
                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                          PID:4376
                                                                                                                                                      • C:\Windows\system32\cscript.exe
                                                                                                                                                        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
                                                                                                                                                        2⤵
                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                        PID:3536
                                                                                                                                                      • C:\Windows\system32\cscript.exe
                                                                                                                                                        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
                                                                                                                                                        2⤵
                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                        PID:4284
                                                                                                                                                      • C:\Windows\system32\cscript.exe
                                                                                                                                                        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
                                                                                                                                                        2⤵
                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                        PID:7560
                                                                                                                                                      • C:\Windows\system32\cscript.exe
                                                                                                                                                        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
                                                                                                                                                        2⤵
                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                        PID:1472
                                                                                                                                                      • C:\Windows\system32\cscript.exe
                                                                                                                                                        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
                                                                                                                                                        2⤵
                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                        PID:8100
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                        2⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:624
                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                          tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                          3⤵
                                                                                                                                                          • Discovers running processes
                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                          PID:4928
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                        2⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:1100
                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                          tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                          3⤵
                                                                                                                                                          • Discovers running processes
                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                          PID:6916
                                                                                                                                                      • C:\Windows\system32\cscript.exe
                                                                                                                                                        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
                                                                                                                                                        2⤵
                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                        PID:5880
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                        2⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:5956
                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                          tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                          3⤵
                                                                                                                                                          • Discovers running processes
                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                          PID:7568
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                        2⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:3672
                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                          tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                          3⤵
                                                                                                                                                          • Discovers running processes
                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                          PID:8812
                                                                                                                                                      • C:\Windows\system32\cscript.exe
                                                                                                                                                        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
                                                                                                                                                        2⤵
                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                        PID:7780
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                        2⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:7648
                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                          tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                          3⤵
                                                                                                                                                          • Discovers running processes
                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                          PID:6492
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                        2⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:2364
                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                          tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                          3⤵
                                                                                                                                                          • Discovers running processes
                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                          PID:3800
                                                                                                                                                      • C:\Windows\system32\cscript.exe
                                                                                                                                                        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"
                                                                                                                                                        2⤵
                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                        PID:2852
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                        2⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:756
                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                          tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                          3⤵
                                                                                                                                                          • Discovers running processes
                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                          PID:4484
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                        2⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:4168
                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                          tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                          3⤵
                                                                                                                                                          • Discovers running processes
                                                                                                                                                          PID:5580
                                                                                                                                                      • C:\Windows\system32\cscript.exe
                                                                                                                                                        cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxt
                                                                                                                                                        2⤵
                                                                                                                                                        • Executes a VBScript file via the Windows Script Host.
                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                        PID:7516
                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                          3⤵
                                                                                                                                                            PID:8100
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:6340
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:212
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:5844
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:2540
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:8596
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:6792
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:8476
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:8176
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:9116
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:5864
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:6308
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:7664
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:2576
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:7216
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:4004
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:4680
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:4408
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:3400
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:4108
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:7868
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:4272
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:5200
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:8132
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:816
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:6084
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:3960
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:2240
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:948
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:6768
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:8584
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:8664
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:8612
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:7684
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:5004
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:4996
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:2996
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:4928
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:5496
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:3200
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:6852
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\bluestacks-services\BlueStacksServices.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\bluestacks-services" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3416 --field-trial-handle=1676,i,7632414279625316541,18201846156142937897,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                          PID:368
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:3252
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:3816
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:4024
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:1864
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:6496
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:6368
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:3220
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:8260
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:5600
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:6024
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:2012
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:4652
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:5060
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:8740
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:3984
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:8004
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:2888
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:6680
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:4672
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:6512
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:8776
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:7980
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:7040
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:5820
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:676
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:824
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:2996
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:9200
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:1816
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:1552
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:8252
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:5268
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:5812
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:4540
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:5724
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:7764
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:1520
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:5788
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:3760
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:8672
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:2580
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:7152
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:5708
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:8856
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:1260
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:1180
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:4064
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:4312
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq HD-Player.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:5196
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq HD-Player.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:1676
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq BlueStacks X.exe""
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:7368
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            tasklist /FI "IMAGENAME eq BlueStacks X.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Discovers running processes
                                                                                                                                                            PID:3244
                                                                                                                                                      • C:\Program Files (x86)\BlueStacks X\BlueStacks X.exe
                                                                                                                                                        "C:\Program Files (x86)\BlueStacks X\BlueStacks X.exe" BlueStacksX:{} -fle=com.newstargames.retrobowl
                                                                                                                                                        1⤵
                                                                                                                                                        • Checks computer location settings
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                        • Modifies registry class
                                                                                                                                                        • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                        PID:9000
                                                                                                                                                        • C:\Program Files (x86)\BlueStacks X\BlueStacksWeb.exe
                                                                                                                                                          BlueStacksWeb.exe --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,NetworkServiceInProcess,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,InstalledApp,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --lang=en --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --mojo-platform-channel-handle=4832 /prefetch:1
                                                                                                                                                          2⤵
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                          PID:5744
                                                                                                                                                        • C:\Users\Admin\AppData\Local\BlueStacks X\BlueStacks-Installer_5.22.286.1003_amd64_native.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\BlueStacks X\BlueStacks-Installer_5.22.286.1003_amd64_native.exe" -s -defaultImageName Pie64 -imageToLaunch Pie64 -appToLaunch=bsx
                                                                                                                                                          2⤵
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:7864
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS8BECC00C\Bootstrapper.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zS8BECC00C\Bootstrapper.exe" -s -defaultImageName Pie64 -imageToLaunch Pie64 -appToLaunch=bsx
                                                                                                                                                            3⤵
                                                                                                                                                            • Checks computer location settings
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                            PID:4560
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS8BECC00C\BlueStacksInstaller.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zS8BECC00C\BlueStacksInstaller.exe" -s -defaultImageName="Pie64" -imageToLaunch="Pie64" -appToLaunch="bsx" -parentpath="C:\Users\Admin\AppData\Local\BlueStacks X\BlueStacks-Installer_5.22.286.1003_amd64_native.exe"
                                                                                                                                                              4⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                              PID:3976
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS8BECC00C\7zr.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zS8BECC00C\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\7zS8BECC00C\CommonInstallUtils.zip" -o"C:\Users\Admin\AppData\Local\Temp\7zS8BECC00C\" -aoa
                                                                                                                                                                5⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:5132
                                                                                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                "cmd.exe" /c "sc.exe delete BlueStacksDrv_nxt"
                                                                                                                                                                5⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                PID:6364
                                                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                                                  sc.exe delete BlueStacksDrv_nxt
                                                                                                                                                                  6⤵
                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                  PID:2584
                                                                                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                "cmd.exe" /c "C:\Windows\system32\sc.exe delete BlueStacksDrv_nxt"
                                                                                                                                                                5⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                PID:5772
                                                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                                                  C:\Windows\system32\sc.exe delete BlueStacksDrv_nxt
                                                                                                                                                                  6⤵
                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                  PID:4528
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS8BECC00C\HD-ForceGPU.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zS8BECC00C\HD-ForceGPU.exe" 1 "C:\Program Files\BlueStacks_nxt"
                                                                                                                                                                5⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:3180
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS8BECC00C\HD-GLCheck.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zS8BECC00C\HD-GLCheck.exe" 1 2
                                                                                                                                                                5⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:4420
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS8BECC00C\HD-GLCheck.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zS8BECC00C\HD-GLCheck.exe" 4 2
                                                                                                                                                                5⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:6560
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS8BECC00C\HD-GLCheck.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zS8BECC00C\HD-GLCheck.exe" 2 2
                                                                                                                                                                5⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:644
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS8BECC00C\HD-GLCheck.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zS8BECC00C\HD-GLCheck.exe" 1 1
                                                                                                                                                                5⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:4696
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS8BECC00C\HD-GLCheck.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zS8BECC00C\HD-GLCheck.exe" 4 1
                                                                                                                                                                5⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                PID:6280
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS8BECC00C\HD-GLCheck.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zS8BECC00C\HD-GLCheck.exe" 2 1
                                                                                                                                                                5⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:3592
                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.bluestacks.com/download.html
                                                                                                                                                                5⤵
                                                                                                                                                                  PID:5588
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://www.bluestacks.com/download.html
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:7856
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cloud.bluestacks.com/bs3/help_articles?article=bsx_engine_install_instruction&launcher_version=10.42.286.1001
                                                                                                                                                              2⤵
                                                                                                                                                                PID:8824
                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://cloud.bluestacks.com/bs3/help_articles?article=bsx_engine_install_instruction&launcher_version=10.42.286.1001
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:4736
                                                                                                                                                                • C:\Users\Admin\AppData\Local\BlueStacks X\BlueStacks-Installer_5.22.286.1003_amd64_native.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\BlueStacks X\BlueStacks-Installer_5.22.286.1003_amd64_native.exe" -s -defaultImageName Pie64 -imageToLaunch Pie64 -appToLaunch=bsx
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:4480
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS081A551D\Bootstrapper.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zS081A551D\Bootstrapper.exe" -s -defaultImageName Pie64 -imageToLaunch Pie64 -appToLaunch=bsx
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                    PID:8688
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS081A551D\BlueStacksInstaller.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zS081A551D\BlueStacksInstaller.exe" -s -defaultImageName="Pie64" -imageToLaunch="Pie64" -appToLaunch="bsx" -parentpath="C:\Users\Admin\AppData\Local\BlueStacks X\BlueStacks-Installer_5.22.286.1003_amd64_native.exe"
                                                                                                                                                                      4⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                      PID:1312
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS081A551D\7zr.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7zS081A551D\7zr.exe" x "C:\Users\Admin\AppData\Local\Temp\7zS081A551D\CommonInstallUtils.zip" -o"C:\Users\Admin\AppData\Local\Temp\7zS081A551D\" -aoa
                                                                                                                                                                        5⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:8212
                                                                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                        "cmd.exe" /c "sc.exe delete BlueStacksDrv_nxt"
                                                                                                                                                                        5⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        PID:5064
                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                          sc.exe delete BlueStacksDrv_nxt
                                                                                                                                                                          6⤵
                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                          PID:2976
                                                                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                        "cmd.exe" /c "C:\Windows\system32\sc.exe delete BlueStacksDrv_nxt"
                                                                                                                                                                        5⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        PID:4320
                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:4652
                                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                                            C:\Windows\system32\sc.exe delete BlueStacksDrv_nxt
                                                                                                                                                                            6⤵
                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                            PID:7544
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS081A551D\HD-ForceGPU.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zS081A551D\HD-ForceGPU.exe" 1 "C:\Program Files\BlueStacks_nxt"
                                                                                                                                                                          5⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:8120
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS081A551D\HD-GLCheck.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zS081A551D\HD-GLCheck.exe" 1 2
                                                                                                                                                                          5⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:4424
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS081A551D\HD-GLCheck.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zS081A551D\HD-GLCheck.exe" 4 2
                                                                                                                                                                          5⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:7116
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS081A551D\HD-GLCheck.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zS081A551D\HD-GLCheck.exe" 2 2
                                                                                                                                                                          5⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:7356
                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:3816
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS081A551D\HD-GLCheck.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zS081A551D\HD-GLCheck.exe" 1 1
                                                                                                                                                                            5⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:1864
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS081A551D\HD-GLCheck.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zS081A551D\HD-GLCheck.exe" 4 1
                                                                                                                                                                            5⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                            PID:6864
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS081A551D\HD-GLCheck.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zS081A551D\HD-GLCheck.exe" 2 1
                                                                                                                                                                            5⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:6468
                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cloud.bluestacks.com/bs3/help_articles?article=update_graphics_card_drivers&oem=nxt&locale=en-US&image_name=Pie64
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:3272
                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://cloud.bluestacks.com/bs3/help_articles?article=update_graphics_card_drivers&oem=nxt&locale=en-US&image_name=Pie64
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:9144
                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:8260

                                                                                                                                                                        Network

                                                                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                                                                              Reconnaissance

                                                                                                                                                                              Resource Development

                                                                                                                                                                              Initial Access

                                                                                                                                                                              Execution

                                                                                                                                                                              Command and Scripting Interpreter

                                                                                                                                                                              2
                                                                                                                                                                              T1059

                                                                                                                                                                              Visual Basic

                                                                                                                                                                              1
                                                                                                                                                                              T1059.005

                                                                                                                                                                              Windows Command Shell

                                                                                                                                                                              1
                                                                                                                                                                              T1059.003

                                                                                                                                                                              System Services

                                                                                                                                                                              1
                                                                                                                                                                              T1569

                                                                                                                                                                              Service Execution

                                                                                                                                                                              1
                                                                                                                                                                              T1569.002

                                                                                                                                                                              Persistence

                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                              1
                                                                                                                                                                              T1547

                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                              1
                                                                                                                                                                              T1547.001

                                                                                                                                                                              Create or Modify System Process

                                                                                                                                                                              2
                                                                                                                                                                              T1543

                                                                                                                                                                              Windows Service

                                                                                                                                                                              2
                                                                                                                                                                              T1543.003

                                                                                                                                                                              Event Triggered Execution

                                                                                                                                                                              1
                                                                                                                                                                              T1546

                                                                                                                                                                              Netsh Helper DLL

                                                                                                                                                                              1
                                                                                                                                                                              T1546.007

                                                                                                                                                                              Privilege Escalation

                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                              1
                                                                                                                                                                              T1547

                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                              1
                                                                                                                                                                              T1547.001

                                                                                                                                                                              Create or Modify System Process

                                                                                                                                                                              2
                                                                                                                                                                              T1543

                                                                                                                                                                              Windows Service

                                                                                                                                                                              2
                                                                                                                                                                              T1543.003

                                                                                                                                                                              Event Triggered Execution

                                                                                                                                                                              1
                                                                                                                                                                              T1546

                                                                                                                                                                              Netsh Helper DLL

                                                                                                                                                                              1
                                                                                                                                                                              T1546.007

                                                                                                                                                                              Defense Evasion

                                                                                                                                                                              Impair Defenses

                                                                                                                                                                              2
                                                                                                                                                                              T1562

                                                                                                                                                                              Disable or Modify System Firewall

                                                                                                                                                                              1
                                                                                                                                                                              T1562.004

                                                                                                                                                                              Modify Registry

                                                                                                                                                                              1
                                                                                                                                                                              T1112

                                                                                                                                                                              Credential Access

                                                                                                                                                                              Credentials from Password Stores

                                                                                                                                                                              1
                                                                                                                                                                              T1555

                                                                                                                                                                              Credentials from Web Browsers

                                                                                                                                                                              1
                                                                                                                                                                              T1555.003

                                                                                                                                                                              Unsecured Credentials

                                                                                                                                                                              1
                                                                                                                                                                              T1552

                                                                                                                                                                              Credentials In Files

                                                                                                                                                                              1
                                                                                                                                                                              T1552.001

                                                                                                                                                                              Discovery

                                                                                                                                                                              Browser Information Discovery

                                                                                                                                                                              1
                                                                                                                                                                              T1217

                                                                                                                                                                              Peripheral Device Discovery

                                                                                                                                                                              1
                                                                                                                                                                              T1120

                                                                                                                                                                              Process Discovery

                                                                                                                                                                              1
                                                                                                                                                                              T1057

                                                                                                                                                                              Query Registry

                                                                                                                                                                              5
                                                                                                                                                                              T1012

                                                                                                                                                                              System Information Discovery

                                                                                                                                                                              5
                                                                                                                                                                              T1082

                                                                                                                                                                              System Location Discovery

                                                                                                                                                                              1
                                                                                                                                                                              T1614

                                                                                                                                                                              System Language Discovery

                                                                                                                                                                              1
                                                                                                                                                                              T1614.001

                                                                                                                                                                              System Network Configuration Discovery

                                                                                                                                                                              2
                                                                                                                                                                              T1016

                                                                                                                                                                              Internet Connection Discovery

                                                                                                                                                                              1
                                                                                                                                                                              T1016.001

                                                                                                                                                                              System Time Discovery

                                                                                                                                                                              1
                                                                                                                                                                              T1124

                                                                                                                                                                              Lateral Movement

                                                                                                                                                                              Collection

                                                                                                                                                                              Data from Local System

                                                                                                                                                                              1
                                                                                                                                                                              T1005

                                                                                                                                                                              Command and Control

                                                                                                                                                                              Web Service

                                                                                                                                                                              1
                                                                                                                                                                              T1102

                                                                                                                                                                              Exfiltration

                                                                                                                                                                              Impact

                                                                                                                                                                              Service Stop

                                                                                                                                                                              1
                                                                                                                                                                              T1489

                                                                                                                                                                              Replay Monitor

                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                              Downloads

                                                                                                                                                                              BlueStacks X.exe
                                                                                                                                                                              • Path C:\Program Files (x86)\BlueStacks X\BlueStacks X.exe
                                                                                                                                                                              • Size 496KB
                                                                                                                                                                              • SHA256 61cc70ab2f34684f5c4c792285e4d12ca788339be0743eb30cad3ab157c5fff1
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              green.vbs
                                                                                                                                                                              • Path C:\Program Files (x86)\BlueStacks X\green.vbs
                                                                                                                                                                              • Size 66B
                                                                                                                                                                              • SHA256 9aadc49b300c730ff96b3aecbd5eca60dc7d7b725b41d1c689dd58ce13421fe1
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              close_disabled.svg
                                                                                                                                                                              • Path C:\Program Files (x86)\BlueStacks X\image\Gallery\close_disabled.svg
                                                                                                                                                                              • Size 569B
                                                                                                                                                                              • SHA256 8ee5aa84139b2ea5549f7272523aeb203d73954c5ccdcf6f7407bf1a3469f13e
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              close_hover.svg
                                                                                                                                                                              • Path C:\Program Files (x86)\BlueStacks X\image\Gallery\close_hover.svg
                                                                                                                                                                              • Size 653B
                                                                                                                                                                              • SHA256 1bca2e912184b8168ee8961de68d1d839f4f9827fde6f48ab100fb61e82eff90
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              close_normal.svg
                                                                                                                                                                              • Path C:\Program Files (x86)\BlueStacks X\image\Gallery\close_normal.svg
                                                                                                                                                                              • Size 569B
                                                                                                                                                                              • SHA256 92aeae68e9e0973d9e0dc575941f1cb2e24afd0574341a46b870be7384eaa537
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              close_pressed.svg
                                                                                                                                                                              • Path C:\Program Files (x86)\BlueStacks X\image\Gallery\close_pressed.svg
                                                                                                                                                                              • Size 653B
                                                                                                                                                                              • SHA256 9585f41eb6202e89f2087266fa31852d7f41ca8cc659b907c96753fe165f937d
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              muti_on.svg
                                                                                                                                                                              • Path C:\Program Files (x86)\BlueStacks X\image\MyGames\muti_on.svg
                                                                                                                                                                              • Size 2KB
                                                                                                                                                                              • SHA256 27948bad2c9ed5ff966769ba028d14c90d8d2f621498ab3e2012e422eaa9203f
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              Right-hover.svg
                                                                                                                                                                              • Path C:\Program Files (x86)\BlueStacks X\image\NowBuxUser\Right-hover.svg
                                                                                                                                                                              • Size 244B
                                                                                                                                                                              • SHA256 16c03f5c8ae6e478fdebd40a157ba6e94a1a4caa818f3bb456804841ff7f5c13
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              close.svg
                                                                                                                                                                              • Path C:\Program Files (x86)\BlueStacks X\image\NowBuxUser\close.svg
                                                                                                                                                                              • Size 629B
                                                                                                                                                                              • SHA256 e8c916269f823d8c14b64c0f0533de2fc0c5339e1ec16eb3eade58e145a22801
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              nowBux.png
                                                                                                                                                                              • Path C:\Program Files (x86)\BlueStacks X\image\NowBuxUser\nowBux.png
                                                                                                                                                                              • Size 223KB
                                                                                                                                                                              • SHA256 cd8c5292c38bd39cec764f12cb357c7400041a35a44bedc562d051be0c61acd0
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              DefaultApp.svg
                                                                                                                                                                              • Path C:\Program Files (x86)\BlueStacks X\image\Search\DefaultApp.svg
                                                                                                                                                                              • Size 12KB
                                                                                                                                                                              • SHA256 ce4591b3bab0cae9fc400ede4c75ba9607c6110a80a6ed62c539335b4a63b9f1
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              CloudGame_on.svg
                                                                                                                                                                              • Path C:\Program Files (x86)\BlueStacks X\image\TypeIndicator\CloudGame_on.svg
                                                                                                                                                                              • Size 1KB
                                                                                                                                                                              • SHA256 adfbdae5a3f86120f4e874eb716a3f300be6e5d5708785a65800199f94a89a02
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              Setting_hover.svg
                                                                                                                                                                              • Path C:\Program Files (x86)\BlueStacks X\image\TypeIndicator\Setting_hover.svg
                                                                                                                                                                              • Size 6KB
                                                                                                                                                                              • SHA256 74a1c0512b601ac34e5779b1dae553b8c41a0c47913b3578797bf017f2860cb9
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              web3_on.svg
                                                                                                                                                                              • Path C:\Program Files (x86)\BlueStacks X\image\TypeIndicator\web3_on.svg
                                                                                                                                                                              • Size 3KB
                                                                                                                                                                              • SHA256 cbd617f8863cfe6f71a431c52cfde33757f233fcf0ef57a90c59392bd4ae16d9
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              nxt-noNetwork.svg
                                                                                                                                                                              • Path C:\Program Files (x86)\BlueStacks X\www\images\nxt-noNetwork.svg
                                                                                                                                                                              • Size 17KB
                                                                                                                                                                              • SHA256 e52ef44418d7fac9b198fc99f16d566f4057b426a7eef9c8db481f26f233a62c
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              protocols.json
                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping1136_372484672\protocols.json
                                                                                                                                                                              • Size 3KB
                                                                                                                                                                              • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              nav_config.json
                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping1136_452900712\nav_config.json
                                                                                                                                                                              • Size 2KB
                                                                                                                                                                              • SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              2481adf9811df54babaec4f07c31dfe2-VGh1LCAyMiBPY3QgMjAyNiAwOTowNDoxNCBHTVQ=
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\Banner\2481adf9811df54babaec4f07c31dfe2-VGh1LCAyMiBPY3QgMjAyNiAwOTowNDoxNCBHTVQ=
                                                                                                                                                                              • Size 176KB
                                                                                                                                                                              • SHA256 5b05feb74e9e89f9fc58874db29482efe9f5c923d120fd87dd9f054514f95311
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              34937e9cc5b6459f4975d4b7b7a868f7-V2VkLCAxNCBKdW4gMjAyMyAxODoyOTowMyBHTVQ=
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\Banner\34937e9cc5b6459f4975d4b7b7a868f7-V2VkLCAxNCBKdW4gMjAyMyAxODoyOTowMyBHTVQ=
                                                                                                                                                                              • Size 3.5MB
                                                                                                                                                                              • SHA256 b1010b86dc26b93b286da2e3db490647f41af4a4d63999cd44baa1f6386ea170
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              713553eba8525efc441c46be4e46adc7-TW9uLCAwOSBGZWIgMjAyNiAwOTo0NjoxNiBHTVQ=
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\Banner\713553eba8525efc441c46be4e46adc7-TW9uLCAwOSBGZWIgMjAyNiAwOTo0NjoxNiBHTVQ=
                                                                                                                                                                              • Size 218KB
                                                                                                                                                                              • SHA256 f1be401a79e71c111190fed1132a89d10f8a29a7ce5b609f741702c2b2b12372
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              7b6a58f8ddb5c3c3fcebe25eaa1b07d4-V2VkLCAyMCBNYXkgMjAyNiAxMToxNzowNSBHTVQ=
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\Banner\7b6a58f8ddb5c3c3fcebe25eaa1b07d4-V2VkLCAyMCBNYXkgMjAyNiAxMToxNzowNSBHTVQ=
                                                                                                                                                                              • Size 649KB
                                                                                                                                                                              • SHA256 8d0abc6ba5a3676f9f42cf09d4c6051032047f721146804aeaa290e0967a0d9b
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              96db5aa261f36e33334b5afe288830aa-VHVlLCAxNyBNYXIgMjAyNiAwOToyMDo1OSBHTVQ=
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\Banner\96db5aa261f36e33334b5afe288830aa-VHVlLCAxNyBNYXIgMjAyNiAwOToyMDo1OSBHTVQ=
                                                                                                                                                                              • Size 583KB
                                                                                                                                                                              • SHA256 c1a06dc2b9d731153df5b4fed54ff100cb3136117dd1746bbc288d961a943bee
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              a9124641505d76531fefd54fcc40047f-TW9uLCAxOSBPY3QgMjAyNiAwNTozOTowNSBHTVQ=
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\Banner\a9124641505d76531fefd54fcc40047f-TW9uLCAxOSBPY3QgMjAyNiAwNTozOTowNSBHTVQ=
                                                                                                                                                                              • Size 605KB
                                                                                                                                                                              • SHA256 81da1b402b34f0a979d5276588e91391431a5465d002a932e21d11ad186a77ed
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              e5ae25ca0d7fdbe758e83f786d4df27c-V2VkLCAxNSBKYW4gMjAyNSAxMjo0NDo1MCBHTVQ=
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\Banner\e5ae25ca0d7fdbe758e83f786d4df27c-V2VkLCAxNSBKYW4gMjAyNSAxMjo0NDo1MCBHTVQ=
                                                                                                                                                                              • Size 50KB
                                                                                                                                                                              • SHA256 87891522ebf96a253b14c2d1e6f3afdd51b1fec1a8bb96231dd9d31d0ef6d93a
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              e97e9174eba8813e0e10de89d706b17b-VGh1LCAyNCBTZXAgMjAyNiAwNzozMzo0OCBHTVQ=
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\Banner\e97e9174eba8813e0e10de89d706b17b-VGh1LCAyNCBTZXAgMjAyNiAwNzozMzo0OCBHTVQ=
                                                                                                                                                                              • Size 178KB
                                                                                                                                                                              • SHA256 df45a16f5a2a623bc6756d9b2da03f30202d8bf2c838df025bae8e1a0cf10eb6
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              f84f4020cdc27e0979b136933d9b813b-V2VkLCAxNCBKdW4gMjAyMyAxODoyOToxMiBHTVQ=
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\Banner\f84f4020cdc27e0979b136933d9b813b-V2VkLCAxNCBKdW4gMjAyMyAxODoyOToxMiBHTVQ=
                                                                                                                                                                              • Size 22KB
                                                                                                                                                                              • SHA256 03de1c2bd3651a8d3494ab3ab30ae43a78dad75be483fc2c5d7f8daae29d3d82
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              GrmConfig.json
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\Grm\GrmConfig.json
                                                                                                                                                                              • Size 3.4MB
                                                                                                                                                                              • SHA256 ebdef86ec69ae2bdf32eefb34f57ea83b9eac044dd1dede95f2e0fb69bfdcd47
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              Impression.json
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\LocalGames\Impression.json
                                                                                                                                                                              • Size 4B
                                                                                                                                                                              • SHA256 3fbbd4c6d76130399b0c79cdf41758669224a91e05b7b216953f0c9728750865
                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                              Submit Download

                                                                                                                                                                              log.txt
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\Log\log.txt
                                                                                                                                                                              • Size 3KB
                                                                                                                                                                              • SHA256 a4c2aced24e35026e9c875e47b5441053ed8de8ed4661bf41a99f56d8ce6330f
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              log.txt
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\Log\log.txt
                                                                                                                                                                              • Size 6KB
                                                                                                                                                                              • SHA256 cee90dc03b6044d0c3ec1dcd3effc50367c92053a23a506b216a392f86dcc8be
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              log.txt
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\Log\log.txt
                                                                                                                                                                              • Size 772B
                                                                                                                                                                              • SHA256 def2d7c6effb81405442c6211f51eef8e8ebd981d0a1c66c7f79c473ddeaf3bf
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              log.txt
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\Log\log.txt
                                                                                                                                                                              • Size 1KB
                                                                                                                                                                              • SHA256 960821f2f27aa8795e9329d30d0ab6ba758033b2a5574d657a96040e7a6386ba
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              039abde2-891d-4a65-9133-182f2736f291.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\QtWebEngine\Default\039abde2-891d-4a65-9133-182f2736f291.tmp
                                                                                                                                                                              • Size 59B
                                                                                                                                                                              • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              30f3c15d-6e86-4e02-9580-e908bdf8bda5.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\QtWebEngine\Default\30f3c15d-6e86-4e02-9580-e908bdf8bda5.tmp
                                                                                                                                                                              • Size 364B
                                                                                                                                                                              • SHA256 51d17a0eac26d56b895e664597c748bfdcedfc18e306f9623ed3baa30e8a5429
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              6326b02c-f446-4185-a084-3728f70b449d.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\QtWebEngine\Default\6326b02c-f446-4185-a084-3728f70b449d.tmp
                                                                                                                                                                              • Size 364B
                                                                                                                                                                              • SHA256 7b2efb4eaeaa23308677119ac674b8c03f8806fc45dba6e074deb31d9ec5c509
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              906ce5a0-2aa2-43d3-b104-929db58a9376.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\QtWebEngine\Default\906ce5a0-2aa2-43d3-b104-929db58a9376.tmp
                                                                                                                                                                              • Size 531B
                                                                                                                                                                              • SHA256 36e0f60966881488eab3bc4d0afc3c9d56b0993568582bec6508bf9e62127df2
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              937ba6c7-c246-4adf-85c4-f59241ea99d9.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\QtWebEngine\Default\937ba6c7-c246-4adf-85c4-f59241ea99d9.tmp
                                                                                                                                                                              • Size 364B
                                                                                                                                                                              • SHA256 bcc7883c9c722d90afc7f5e84b49535b669e249d6d8f2054fe2032c1d590cc89
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              9bc30f9c-9fd8-4251-98c8-daa50a202c96.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\QtWebEngine\Default\9bc30f9c-9fd8-4251-98c8-daa50a202c96.tmp
                                                                                                                                                                              • Size 364B
                                                                                                                                                                              • SHA256 d09a2516cbc8b48342ae7e7e098de1214863f82a029e3dc7f79ceabe5688f660
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              data_0
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\QtWebEngine\Default\GPUCache\data_0
                                                                                                                                                                              • Size 8KB
                                                                                                                                                                              • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                              Submit Download

                                                                                                                                                                              data_1
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\QtWebEngine\Default\GPUCache\data_1
                                                                                                                                                                              • Size 264KB
                                                                                                                                                                              • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                              Submit Download

                                                                                                                                                                              data_2
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\QtWebEngine\Default\GPUCache\data_2
                                                                                                                                                                              • Size 8KB
                                                                                                                                                                              • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                              Submit Download

                                                                                                                                                                              data_3
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\QtWebEngine\Default\GPUCache\data_3
                                                                                                                                                                              • Size 8KB
                                                                                                                                                                              • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                              Submit Download

                                                                                                                                                                              MANIFEST-000001
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\QtWebEngine\Default\Platform Notifications\MANIFEST-000001
                                                                                                                                                                              • Size 41B
                                                                                                                                                                              • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                              Submit Download

                                                                                                                                                                              TransportSecurity
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\QtWebEngine\Default\TransportSecurity
                                                                                                                                                                              • Size 364B
                                                                                                                                                                              • SHA256 18a91af32b2828315278b8ba17be0cde8a1a026470a34291f592f7c0af99ae7d
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              bb5cec25-8891-4774-bb3b-36e71c284209.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\QtWebEngine\Default\bb5cec25-8891-4774-bb3b-36e71c284209.tmp
                                                                                                                                                                              • Size 348B
                                                                                                                                                                              • SHA256 37205be1fc564ca1c87990de757e5115d294afec45035b3f5c45988e5db23633
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              fb125206-bf69-4d02-aee2-bf9fc741388f.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\QtWebEngine\Default\fb125206-bf69-4d02-aee2-bf9fc741388f.tmp
                                                                                                                                                                              • Size 519B
                                                                                                                                                                              • SHA256 2da7f33482f3d6bb425ad113feb7da57c8cb8b7322a13f2833f7c9388974fd09
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              com.LinaGames.RetroShooter
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\icons\com.LinaGames.RetroShooter
                                                                                                                                                                              • Size 162KB
                                                                                                                                                                              • SHA256 fe1d4e69f1ba45b5f349d311db937c308bc328f5f4a1f3ef183ebb29b1f97dc0
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              com.YoStarEN.Arknights
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\icons\com.YoStarEN.Arknights
                                                                                                                                                                              • Size 171KB
                                                                                                                                                                              • SHA256 54c63ed243bbaf8df09aac11c9c8ad08dfc85c6cab9557b9c7f534501ea319cf
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              com.YsoCorp.RetroBattle
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\icons\com.YsoCorp.RetroBattle
                                                                                                                                                                              • Size 110KB
                                                                                                                                                                              • SHA256 43ed02df0d041f175b2dd7bae75c9f3ac954e8ce914c067a5242bca1ddf611c4
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              com.chgames.gba64
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\icons\com.chgames.gba64
                                                                                                                                                                              • Size 21KB
                                                                                                                                                                              • SHA256 4eb106aebf9fbad03059422f723476a9385b7a5d9b751701c0318ae2643a2d78
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              com.gba.emulator.gameboyadvance.games
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\icons\com.gba.emulator.gameboyadvance.games
                                                                                                                                                                              • Size 68KB
                                                                                                                                                                              • SHA256 44196af67892d3cf4f75467a79c42b580a92a9fc6554c6fa1066a94fcee07426
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              com.igames.retro
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\icons\com.igames.retro
                                                                                                                                                                              • Size 34KB
                                                                                                                                                                              • SHA256 f8df5ab38788f575c37f224ed1e4a8199676b5ebc11959a35b917f98c4c63051
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              com.igg.android.doomsdaylastsurvivors
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\icons\com.igg.android.doomsdaylastsurvivors
                                                                                                                                                                              • Size 32KB
                                                                                                                                                                              • SHA256 27df12851a384b5461db7d833c8379711ace3ee79c0b7df6acbff6f1dad2b92e
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              com.igg.android.lordsmobile
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\icons\com.igg.android.lordsmobile
                                                                                                                                                                              • Size 155KB
                                                                                                                                                                              • SHA256 5cd46c93f09a0da62e8fed264403b564645445b2ad47f2c104af92a520133a13
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              com.maf.moneyhero
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\icons\com.maf.moneyhero
                                                                                                                                                                              • Size 117KB
                                                                                                                                                                              • SHA256 e7a715c24b0a232142d3c1d56b3c67955f588f19f0b85da0cd008a0262e84aeb
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              com.netease.retrorampage
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\icons\com.netease.retrorampage
                                                                                                                                                                              • Size 257KB
                                                                                                                                                                              • SHA256 b53b733d9e6ccfe57cac5c1ab32375993a75fcccdd6f37ff02d7e27a4efeaada
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              com.newstargames.retrobowl
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\icons\com.newstargames.retrobowl
                                                                                                                                                                              • Size 3KB
                                                                                                                                                                              • SHA256 3ce2ac557ddd9ee53877fb149ea4abb4369c3b940f1478ce819aff8f406be4e9
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              com.newstargames.retrobowlcollege
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\icons\com.newstargames.retrobowlcollege
                                                                                                                                                                              • Size 4KB
                                                                                                                                                                              • SHA256 f3ee3d9e5220b2ba923b466cbe2d0577c666a2ee67239b06a4e5da2db99f7db0
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              com.newstargames.retroslamtennis
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\icons\com.newstargames.retroslamtennis
                                                                                                                                                                              • Size 10KB
                                                                                                                                                                              • SHA256 5e33bab6a8892788e70ff04a48e1423a6845026e1171b747bfebdc813c20d952
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              com.pixonic.wwr
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\icons\com.pixonic.wwr
                                                                                                                                                                              • Size 153KB
                                                                                                                                                                              • SHA256 2bf188d37da4f3c9e458dbae45500a71e4d9d8826bd09c1810d0d4cc50d1761a
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              com.retro90s.emulatorgames
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\icons\com.retro90s.emulatorgames
                                                                                                                                                                              • Size 61KB
                                                                                                                                                                              • SHA256 2e455962a4368846dd348bd5a4215f741b54a1d67a8599813ed68547318a9dd7
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              com.sjkim.retroxel2
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\icons\com.sjkim.retroxel2
                                                                                                                                                                              • Size 60KB
                                                                                                                                                                              • SHA256 19fb47e2dd5e990b73c60264f05c8cbe2f01f2047335676df2c8a0fc5ca23ac4
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              com.yoozoo.jgame.us
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\icons\com.yoozoo.jgame.us
                                                                                                                                                                              • Size 178KB
                                                                                                                                                                              • SHA256 0e36cf4455c518ca0d801ecb6dcd90bbe22d0b4e7085bb2b857e773556f1d731
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              spacebeads.jocmania
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\icons\spacebeads.jocmania
                                                                                                                                                                              • Size 101KB
                                                                                                                                                                              • SHA256 6361bb79c3d4a29ef43cb3751c181d399cb125ca923159455f736bee3ea47e83
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              com.droidhang.ad
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\pcGames\com.droidhang.ad
                                                                                                                                                                              • Size 106KB
                                                                                                                                                                              • SHA256 288742f1a52477412a4f26dc0ad60c69eed7dac7a0276fadce55177491eb126b
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              com.farlightgames.pgame.gp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\pcGames\com.farlightgames.pgame.gp
                                                                                                                                                                              • Size 545KB
                                                                                                                                                                              • SHA256 e335db4fbdbdfe4b7dfcc7e1f1b8192009a271a41aaa90a02cb502e8e232a43d
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              com.farlightgames.samo.gp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\pcGames\com.farlightgames.samo.gp
                                                                                                                                                                              • Size 720KB
                                                                                                                                                                              • SHA256 2580f117970a12e1d97d25d74187af56fa3bda688f6ad099cda1edb2d6677abb
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              com.funplus.st.region
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\pcGames\com.funplus.st.region
                                                                                                                                                                              • Size 123KB
                                                                                                                                                                              • SHA256 76052b46211664c836891e36296c71760cfdfd6b0255cfd5e551463dfa8eec2e
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              com.gof.global
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\pcGames\com.gof.global
                                                                                                                                                                              • Size 137KB
                                                                                                                                                                              • SHA256 e11200fd1e556018ba4e173031ef8154692fb77fc86becb33ae15a803905d81a
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              com.iskslowtest.mislen
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\pcGames\com.iskslowtest.mislen
                                                                                                                                                                              • Size 140KB
                                                                                                                                                                              • SHA256 c5866f051414db85a6317966e30160d773dec21bc40e2583ec5e97388f1f622b
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              com.megoogames.loot
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\pcGames\com.megoogames.loot
                                                                                                                                                                              • Size 453KB
                                                                                                                                                                              • SHA256 e30aa05e5b9f2db745bcfabbe68a0209e6bfeaeade2a0c7c04f299497e4170ad
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              com.netease.idv.googleplay
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\pcGames\com.netease.idv.googleplay
                                                                                                                                                                              • Size 61KB
                                                                                                                                                                              • SHA256 f508656234583f57c1be53b7cf91338b01cfeb4903b6771a3c602b35abfed911
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              com.nexon.ma
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\pcGames\com.nexon.ma
                                                                                                                                                                              • Size 85KB
                                                                                                                                                                              • SHA256 59d4f363886664f0f61655ea9161d6c5ada51fe12661531eeb9a71fdedcfb45e
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              com.plarium.raidlegends
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\pcGames\com.plarium.raidlegends
                                                                                                                                                                              • Size 59KB
                                                                                                                                                                              • SHA256 1741f3880b0da542cb0c089a7e53de696926d68b8f09f8b9d1c8fe565a469d99
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              com.zjcs.android.us
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\pcGames\com.zjcs.android.us
                                                                                                                                                                              • Size 117KB
                                                                                                                                                                              • SHA256 6feb8bdde3888adb84fc004d2b22850683d9abdc1ff3d012b5e9453ef24153d7
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              global.thedream.and.rox
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\pcGames\global.thedream.and.rox
                                                                                                                                                                              • Size 122KB
                                                                                                                                                                              • SHA256 a81c6a9edfa40898d7007f0bf1e00bbf568c9052cb3f189d6c6bf4bef181fd15
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              days.ini
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\cache\promote\days.ini
                                                                                                                                                                              • Size 69B
                                                                                                                                                                              • SHA256 e7e36ba7902898a47e5874639efefd3ca24075638554118b9c71539e02394a4b
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              config.ini
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\BlueStacks X\config.ini
                                                                                                                                                                              • Size 40B
                                                                                                                                                                              • SHA256 d6ed522d394e0bb910c6a6e64d753b7fd278c32a9d325377867c225df2bfe7dc
                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                              Submit Download

                                                                                                                                                                              BlueStacks-Installer_5.22.286.1003.log
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Bluestacks\BlueStacks-Installer_5.22.286.1003.log
                                                                                                                                                                              • Size 137KB
                                                                                                                                                                              • SHA256 ae2c08f00660cfac6e4da5eecbf10a265d0e2a2259dccb1790dd88192b7d7543
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              21ed67b5-074c-42b8-baf2-067e561930fe.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\21ed67b5-074c-42b8-baf2-067e561930fe.tmp
                                                                                                                                                                              • Size 28KB
                                                                                                                                                                              • SHA256 9d16090ef6e5b99f217cee2e3e5fe7540712179b9ac3256aeb46ce26d18037d9
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              3bf6da61-8101-4991-9436-5e5eb34b11be.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3bf6da61-8101-4991-9436-5e5eb34b11be.tmp
                                                                                                                                                                              • Size 392B
                                                                                                                                                                              • SHA256 fe434e6de44363da295469e4be7d16a9822e1ed915846a9a118302be9ae3cafc
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              625913fe-49e3-4f2a-bf3c-a58d350bfd1f.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\625913fe-49e3-4f2a-bf3c-a58d350bfd1f.tmp
                                                                                                                                                                              • Size 18KB
                                                                                                                                                                              • SHA256 aac4d37450f26b90951cfa2da352bff8b8b0b106339a8a1cfb0a9156de770791
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              6fb906ca-0a46-4f08-87bd-d75876dfff55.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6fb906ca-0a46-4f08-87bd-d75876dfff55.tmp
                                                                                                                                                                              • Size 8KB
                                                                                                                                                                              • SHA256 16a17e0f343f622e38afd4791e3463646e882384a72da39128cf61dbc5c84771
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              cce7d119-0ddf-4359-8885-4559da4219d4.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\cce7d119-0ddf-4359-8885-4559da4219d4.tmp
                                                                                                                                                                              • Size 105KB
                                                                                                                                                                              • SHA256 2ef96264d2b79f2f32ba7c3f4d8bc3a7cd12206153f6218f7bbe1251f2de650f
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              manifest.json
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
                                                                                                                                                                              • Size 135B
                                                                                                                                                                              • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              settings.dat
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                              • Size 280B
                                                                                                                                                                              • SHA256 0e364ae2365b95ee5142a1a0abe3ee5065b85c554bc5cb9fcb1f31bcd0a1af4e
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              settings.dat
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                              • Size 280B
                                                                                                                                                                              • SHA256 27f6aa5d39c98b4843eaed7972cf93d10e75e08f497afafa54ccf4057f6d52c9
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              2a42c786-f07f-4eff-b818-f99ad0836980.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2a42c786-f07f-4eff-b818-f99ad0836980.tmp
                                                                                                                                                                              • Size 9KB
                                                                                                                                                                              • SHA256 96b1af25ee4d8a7c00d5254adb49652092966053ad315868822411502bb127ba
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              361cb1ea-5105-4498-b27f-d49248aa4731.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\361cb1ea-5105-4498-b27f-d49248aa4731.tmp
                                                                                                                                                                              • Size 19KB
                                                                                                                                                                              • SHA256 e4d5feaffa4985daefbe4aa331ba2332c2bc01b7f98e322b43d07d669230b5b3
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              392d55d7-7c6d-438f-9a05-d8569a8c1016.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\392d55d7-7c6d-438f-9a05-d8569a8c1016.tmp
                                                                                                                                                                              • Size 10KB
                                                                                                                                                                              • SHA256 d0c0b25add1e3b82d0342232bc9c7f1616f1233657a2c4e4d9baee56e0e5e625
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              8c9b1e86-3b0b-462c-af4d-83ef2cf9cefd.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8c9b1e86-3b0b-462c-af4d-83ef2cf9cefd.tmp
                                                                                                                                                                              • Size 19KB
                                                                                                                                                                              • SHA256 8ef7df3b7b652af837036934b33fdb6091c6a15df5fc2f9907b9e8b7c10d51f5
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              LOG.old
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                                                                              • Size 334B
                                                                                                                                                                              • SHA256 bc854e793e1f9c5e099883bc4a07e25f0566139737470226e70d9305512afded
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              f_00008b
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
                                                                                                                                                                              • Size 81KB
                                                                                                                                                                              • SHA256 ad7fc6722efdb7625f6e6c565c317d8a3baef7fa10ff1317866cc05b7d0109d6
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              f_00009a
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009a
                                                                                                                                                                              • Size 20KB
                                                                                                                                                                              • SHA256 62fff4b0730e00fc63de6b96fe142def57847c99cb463d474be55df05ee5429c
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              f_00009b
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009b
                                                                                                                                                                              • Size 26KB
                                                                                                                                                                              • SHA256 f2a907cdf7fdbb78a9b471788cacb886ecafff6cdf9bb1c97c86c721fa3edbb3
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              f_00009c
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
                                                                                                                                                                              • Size 17KB
                                                                                                                                                                              • SHA256 94970fda4784d43d3fa1c7a0b3550db94a014542c67e8dae61e8fe6cd4640ee2
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              f_00009d
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
                                                                                                                                                                              • Size 26KB
                                                                                                                                                                              • SHA256 9cf5b9def85cae11a2b26312a6a275b47794234677d1a90bba300c6fb775b5df
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              f_00009e
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
                                                                                                                                                                              • Size 127KB
                                                                                                                                                                              • SHA256 28ede68469dd63617234463a868cdaf4c7978ada9f78453c4621926130a89999
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              f_0000a0
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a0
                                                                                                                                                                              • Size 36KB
                                                                                                                                                                              • SHA256 f317af3e0aa116d172eadaac4c75b42074505d9a8cf3e7c0ebc62cdffd46e745
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              f_0000a1
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a1
                                                                                                                                                                              • Size 167KB
                                                                                                                                                                              • SHA256 80edb21e409f3437535c6f565b261e5981f23a02cffd5a191e36a20d45336777
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              f_0000a2
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a2
                                                                                                                                                                              • Size 174KB
                                                                                                                                                                              • SHA256 eb2ce8286cfe623df3593a226e94247c5c1f5460245a33b054ba39f3e039db7a
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              f_0000a4
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a4
                                                                                                                                                                              • Size 67KB
                                                                                                                                                                              • SHA256 67ca1abd107c1c587489a06adc41ed3221a1b77048be449a076a5e93c93d2b98
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              f_0000a7
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a7
                                                                                                                                                                              • Size 70KB
                                                                                                                                                                              • SHA256 ac1a655367b02648fe8217ee11d1b272786605b78989ff614cb0beab5f6f547c
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              f_0000aa
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000aa
                                                                                                                                                                              • Size 100KB
                                                                                                                                                                              • SHA256 06051e3068cb630b5952ad162efecb37a76f3e43d2873b4017e76030b0f43144
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              f_0000ac
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ac
                                                                                                                                                                              • Size 28KB
                                                                                                                                                                              • SHA256 197fa91485271f01b3d6ac5b2651cf87ff8eacff0ecbc49210f4f7a98048897a
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              temp-index
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                                                                                              • Size 9KB
                                                                                                                                                                              • SHA256 e1a0b6cab2452a74d97afaaa881f1725fae58d593c872c6b8a79b097765a7398
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              temp-index
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                                                                                              • Size 11KB
                                                                                                                                                                              • SHA256 c256bd2cb2fee97ed32c5d8dc6a3032e27631cc1ea27f382da2b3b118bff7426
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              the-real-index
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                              • Size 2KB
                                                                                                                                                                              • SHA256 a2e87c3875a86ec7ba9fc51d470a4581f3467bfb22aba3b53d8c86fc64a8bcc4
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              755172f1-8046-4f58-a5c6-03fd9ae45be7.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\755172f1-8046-4f58-a5c6-03fd9ae45be7.tmp
                                                                                                                                                                              • Size 2B
                                                                                                                                                                              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                              Submit Download

                                                                                                                                                                              dasherSettingSchema.json
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
                                                                                                                                                                              • Size 854B
                                                                                                                                                                              • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              734d6fd3-5dc1-4f8f-bef4-a85c09098642.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\734d6fd3-5dc1-4f8f-bef4-a85c09098642.tmp
                                                                                                                                                                              • Size 2B
                                                                                                                                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                              Submit Download

                                                                                                                                                                              a7d1efc1-d69f-4a90-b7a8-79bb9114265a.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a7d1efc1-d69f-4a90-b7a8-79bb9114265a.tmp
                                                                                                                                                                              • Size 111B
                                                                                                                                                                              • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              cfb9bee2-ecbf-4f9e-a334-7a03381d18e6.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cfb9bee2-ecbf-4f9e-a334-7a03381d18e6.tmp
                                                                                                                                                                              • Size 2KB
                                                                                                                                                                              • SHA256 6c138a93b0a9c885187a0cadaa6376f2a5a114578b73ea378311a00cb30c60ed
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              ff5b2c8b-4e04-425f-a60e-8447ab5c3de3.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ff5b2c8b-4e04-425f-a60e-8447ab5c3de3.tmp
                                                                                                                                                                              • Size 26KB
                                                                                                                                                                              • SHA256 a83a2796f6e33a3f7ee84a1498fb26264d34b20ea889e626929639bedaf41116
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              index
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\7882274f-c1ac-45d7-bc07-f7abdf87c8ec\index
                                                                                                                                                                              • Size 24B
                                                                                                                                                                              • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                              Submit Download

                                                                                                                                                                              index.txt
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
                                                                                                                                                                              • Size 138B
                                                                                                                                                                              • SHA256 1b19e9704ef982ce1a4988cc71c4f1362bf01f3866caf98b79620e85629d49d5
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              index.txt.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
                                                                                                                                                                              • Size 233B
                                                                                                                                                                              • SHA256 756c29a792c1f7650c2365fa6c7351f718b2ac3187d0ec60873fbc5ca5b20450
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              index.txt.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
                                                                                                                                                                              • Size 226B
                                                                                                                                                                              • SHA256 623e08a6f3f278fa267c95724afa3a410b9c8685ead8c76867829831f0e87efd
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              sync_diagnostic.log
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                                              • Size 5KB
                                                                                                                                                                              • SHA256 39ce3e2c6b46b86b5b81bfd2a042276b5cf26895cb71fdb41b0519395e1627ef
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              abb66f7a-e43b-40b4-b102-ccbff0e36424.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\abb66f7a-e43b-40b4-b102-ccbff0e36424.tmp
                                                                                                                                                                              • Size 11KB
                                                                                                                                                                              • SHA256 48cb8e8e5eed15eb4d10c575848ffa388ad8a2d39a1386fa982b7e1ce0661e8b
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              af137f38-8e74-4b8a-a518-885546279cf2.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\af137f38-8e74-4b8a-a518-885546279cf2.tmp
                                                                                                                                                                              • Size 6B
                                                                                                                                                                              • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                              Submit Download

                                                                                                                                                                              bca3ac6c-bfa2-4994-826e-a95d4e5bc9f3.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bca3ac6c-bfa2-4994-826e-a95d4e5bc9f3.tmp
                                                                                                                                                                              • Size 70KB
                                                                                                                                                                              • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              c3e1ff6b-9378-4636-9334-b15b5a815143.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c3e1ff6b-9378-4636-9334-b15b5a815143.tmp
                                                                                                                                                                              • Size 15KB
                                                                                                                                                                              • SHA256 b0ca8a9c681cbcafc488d0f52822487f2d793176090c2c98ba1748ea68e1a9dc
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              d394f97b-08f0-4092-a3e1-336a2e5d93e0.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d394f97b-08f0-4092-a3e1-336a2e5d93e0.tmp
                                                                                                                                                                              • Size 29KB
                                                                                                                                                                              • SHA256 7a3f7e05ced1ee73e97d7b7bf77ff408553b836090a9f4ab3e9277b6dbd2e04d
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              OperationConfig
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                                                                                                              • Size 3KB
                                                                                                                                                                              • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              dc27d013-c59d-43a3-83c8-89bf4bc00015.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\dc27d013-c59d-43a3-83c8-89bf4bc00015.tmp
                                                                                                                                                                              • Size 22KB
                                                                                                                                                                              • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              manifest.json
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
                                                                                                                                                                              • Size 43B
                                                                                                                                                                              • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                              Submit Download

                                                                                                                                                                              RevisitationBloomfilter
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                              • Size 392B
                                                                                                                                                                              • SHA256 003082e6c959c9a34c925d6c547c68b6f8624a8879cde95b0435e67b6462b0f7
                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                              Submit Download

                                                                                                                                                                              manifest.json
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\manifest.json
                                                                                                                                                                              • Size 160B
                                                                                                                                                                              • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              aa537047-b391-4965-b1d3-ff183e069bf6.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\aa537047-b391-4965-b1d3-ff183e069bf6.tmp
                                                                                                                                                                              • Size 28KB
                                                                                                                                                                              • SHA256 bd5a1c7144ea6998bc1c3cb938216ad31b8992d63e26c7fb6d4c299c64bdc4a2
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              ace21fdf-bc8b-4b06-ad68-2d0225e59cb8.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ace21fdf-bc8b-4b06-ad68-2d0225e59cb8.tmp
                                                                                                                                                                              • Size 8KB
                                                                                                                                                                              • SHA256 2d4e8fe71ba5a914a0bae242841aeeac4d8eb69eaefa848a36bd1ee377a08252
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              c2bbec28-38a4-44f7-b42b-5827d261aa79.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c2bbec28-38a4-44f7-b42b-5827d261aa79.tmp
                                                                                                                                                                              • Size 18KB
                                                                                                                                                                              • SHA256 2f60eb59fe64e4a553da80c4db42095c30e74db81cbc0d81c137f954763581c8
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              95ae80b0-c66d-40f9-a8b2-068ee74e8d5c.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\95ae80b0-c66d-40f9-a8b2-068ee74e8d5c.tmp
                                                                                                                                                                              • Size 252B
                                                                                                                                                                              • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              d5d97240-57f1-4335-8b2f-eb4befc7d13a.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\d5d97240-57f1-4335-8b2f-eb4befc7d13a.tmp
                                                                                                                                                                              • Size 132B
                                                                                                                                                                              • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              d1d5b9f1-a958-4f6b-9845-c51a49212293.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d1d5b9f1-a958-4f6b-9845-c51a49212293.tmp
                                                                                                                                                                              • Size 392B
                                                                                                                                                                              • SHA256 89b7f0e100216c54515d876c3dc2e365cb4e8c00a1fb1f467ff794273a6f6a4f
                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                              Submit Download

                                                                                                                                                                              ed27d623-0bc8-4134-a2e7-f96544f349a6.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ed27d623-0bc8-4134-a2e7-f96544f349a6.tmp
                                                                                                                                                                              • Size 28KB
                                                                                                                                                                              • SHA256 6de2b9152d330d1ca8b4b43da420320b3feded8a4246408194b80ab9683dcace
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              26c20720-3e41-4140-872d-17b2fe95f408.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\26c20720-3e41-4140-872d-17b2fe95f408.tmp
                                                                                                                                                                              • Size 13B
                                                                                                                                                                              • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                              Submit Download

                                                                                                                                                                              f28f63b4-4562-4ec3-ab3d-9e491067122c.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f28f63b4-4562-4ec3-ab3d-9e491067122c.tmp
                                                                                                                                                                              • Size 18KB
                                                                                                                                                                              • SHA256 66fdc8432198ef5a3a8106dcf37dcb5ea3eda4746a28ac1581074c7de046b5eb
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                                                                                              • Size 2KB
                                                                                                                                                                              • SHA256 7f69fcf4902b9594aa276918b0d2eeae4bb2f9b6b8a8a420c0567ef2e9de26b4
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              resources.js
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\static\notification_manager\i18n\resources.js
                                                                                                                                                                              • Size 1KB
                                                                                                                                                                              • SHA256 68f3243bea4b7e7e8eb118607ecd22362271a64579126168a55f25f72bc0914c
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              utils.js
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Programs\bluestacks-services\resources\static\notification_manager\js\utils.js
                                                                                                                                                                              • Size 252B
                                                                                                                                                                              • SHA256 1176f11d2aa2e35cf8b41bab715cfbc2c542415229a600f638ac8c9f054102f5
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              013767f4-57af-4047-9ae3-9c60879f6a7d.tmp.node
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\013767f4-57af-4047-9ae3-9c60879f6a7d.tmp.node
                                                                                                                                                                              • Size 2.2MB
                                                                                                                                                                              • SHA256 dadb2fc7fa9f6a8691661a90d5b1ab80f4091c1b8a5becf1959a977e8aca025a
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              35e18671-2951-4a19-bfab-fadea225d019.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\35e18671-2951-4a19-bfab-fadea225d019.tmp
                                                                                                                                                                              • Size 158KB
                                                                                                                                                                              • SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              7zr.exe
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\7zr.exe
                                                                                                                                                                              • Size 1.3MB
                                                                                                                                                                              • SHA256 9f30c03c3ba88154e069b2e9cf320448192351272ae265bcc3009784dd9f7503
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              BlueStacks.ico
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\Assets\BlueStacks.ico
                                                                                                                                                                              • Size 131KB
                                                                                                                                                                              • SHA256 3803045963af064936d7071c178de8e40854968b3d3f9171c57a182c869f3697
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              BlueStacksInstaller.exe
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\BlueStacksInstaller.exe
                                                                                                                                                                              • Size 345KB
                                                                                                                                                                              • SHA256 324037862e2f7239f9838839d9275ca1cd742b9838b25984afe9c11bc2910ae9
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              BstkTypeLib.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\BstkTypeLib.dll
                                                                                                                                                                              • Size 458KB
                                                                                                                                                                              • SHA256 4fd5e376c94bcd978f478dbac7985d24f2606694b1be8087a52bfa610dfe6d88
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              CPUID.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\CPUID.dll
                                                                                                                                                                              • Size 37KB
                                                                                                                                                                              • SHA256 e7147c3e38950fe7e7ed2d37e5eacd6dd90046c9553fa81e2f2abe604635f79b
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              CommonInstallUtils.zip
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\CommonInstallUtils.zip
                                                                                                                                                                              • Size 10.0MB
                                                                                                                                                                              • SHA256 c3d80ba0563fe18990ea4a647d8e7956340d245bda24bfe855b3b2470e8395ff
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              Dependencies.7z
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\Dependencies.7z
                                                                                                                                                                              • Size 375KB
                                                                                                                                                                              • SHA256 9b005b39ea526d7e706014c3cd0f77a79901975e5d5ea4efa67f30f133fdb8f7
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              HD-Astcdecoder.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\HD-Astcdecoder.dll
                                                                                                                                                                              • Size 99KB
                                                                                                                                                                              • SHA256 64dfa776ff0e956c734988c69f83a64959aa78db45930620aeb7ee87f701b482
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              HD-Bridge-Native.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\HD-Bridge-Native.dll
                                                                                                                                                                              • Size 878KB
                                                                                                                                                                              • SHA256 ca79e63419cd013f4d8ab8833231f3e9651b151bd398b8861662c56164936ff4
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              HD-Common.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\HD-Common.dll
                                                                                                                                                                              • Size 940KB
                                                                                                                                                                              • SHA256 2f6974a0fdc5d231ee0038f93db7fb4744b8def0d94480c1aef0112826c54b65
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              HD-ForceGPU.exe
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\HD-ForceGPU.exe
                                                                                                                                                                              • Size 169KB
                                                                                                                                                                              • SHA256 58acc9a51a5d4cdb32ea40941b5af5ff1bf031df93ed29a768536df5dce56055
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              HD-GLCheck.exe
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\HD-GLCheck.exe
                                                                                                                                                                              • Size 224KB
                                                                                                                                                                              • SHA256 8d22c775dd84ad403323548ae5295545c1b5d9e1e7f018728386b322fa42e1b9
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              HD-Opengl-Native.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\HD-Opengl-Native.dll
                                                                                                                                                                              • Size 5.9MB
                                                                                                                                                                              • SHA256 dbf7f1afb619746e130f6b0006eea33dd3e3d8c8e2158a7e2bd6df7f8ee96a6f
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              Microsoft.WindowsAPICodePack.Shell.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\Microsoft.WindowsAPICodePack.Shell.dll
                                                                                                                                                                              • Size 540KB
                                                                                                                                                                              • SHA256 fc803c2594af11313f146594ac9670a7ecd5c87e8d57c1490fd274a087ee6c9a
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              Microsoft.WindowsAPICodePack.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\Microsoft.WindowsAPICodePack.dll
                                                                                                                                                                              • Size 121KB
                                                                                                                                                                              • SHA256 8edca4ac4a24b6aa62d0f9e766e5d6e7826bda893d001880079b0c9b2741e967
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              Newtonsoft.Json.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\Newtonsoft.Json.dll
                                                                                                                                                                              • Size 496KB
                                                                                                                                                                              • SHA256 31a1195802b17ca9a3986c82faeed0ec9fe0b7c1aac4cb7b549375e2c219ce69
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              PD.zip
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\PD.zip
                                                                                                                                                                              • Size 557KB
                                                                                                                                                                              • SHA256 23c3080cbe88165f042524f90b7f2a85732f013c0bf43c93642d5ac1100fdb0e
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              SPIRV-Tools-shared.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\SPIRV-Tools-shared.dll
                                                                                                                                                                              • Size 1.5MB
                                                                                                                                                                              • SHA256 7fe09abd82d0e2e9f548cd59d35d745f1eb930d2b972609977c54770dbe97a68
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              concrt140.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\concrt140.dll
                                                                                                                                                                              • Size 310KB
                                                                                                                                                                              • SHA256 39b2df43ab2bc455aa1f46a33440d0880e9bc781c4e03c6081251b56e543f608
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              d3dcompiler_47.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\d3dcompiler_47.dll
                                                                                                                                                                              • Size 4.0MB
                                                                                                                                                                              • SHA256 bef3c125122bb459434bb02e763454cc21454257a78e63ceabfb5b347d46efd2
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              glslang-default-resource-limits.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\glslang-default-resource-limits.dll
                                                                                                                                                                              • Size 48KB
                                                                                                                                                                              • SHA256 5c4ad7c71ba8426eed3789b14c15e13da7a56696a687df7d7fe805390daec71b
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              glslang.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\glslang.dll
                                                                                                                                                                              • Size 4.5MB
                                                                                                                                                                              • SHA256 f9fcb9c8fba665b47ba31141ada89ee462181766e77f5e06cffc72b53586971d
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              libEGL.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\libEGL.dll
                                                                                                                                                                              • Size 29KB
                                                                                                                                                                              • SHA256 5e287e7e884504b524dc4610bebe79e013f0bc6f87fe788dd1f5562b70a6dd65
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              libGLESv2.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\libGLESv2.dll
                                                                                                                                                                              • Size 3.2MB
                                                                                                                                                                              • SHA256 5b0acf994cd091c5c07d707219a33de7d5d9ce2038bf93644a7c3d8d64de48d5
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              libOpenglRender.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\libOpenglRender.dll
                                                                                                                                                                              • Size 12.2MB
                                                                                                                                                                              • SHA256 2252218cf1b9e5fd5c2088bbbadcde73f4bbe4f822c029a912bb69f18d9e662c
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              msvcp140.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\msvcp140.dll
                                                                                                                                                                              • Size 554KB
                                                                                                                                                                              • SHA256 75872c426555ac8af55b5a7f6d4aea8831af74353b22612850a2bfc40e3b67e1
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              msvcp140_1.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\msvcp140_1.dll
                                                                                                                                                                              • Size 24KB
                                                                                                                                                                              • SHA256 9d6a0264a41ef8b3e758cfcced8ab3270c76211b75af6981c991b50cb00f2a85
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              msvcp140_2.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\msvcp140_2.dll
                                                                                                                                                                              • Size 182KB
                                                                                                                                                                              • SHA256 299d080f793e721d9d18a928c0cd137540b07053979ae19026892372cbe89a88
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              msvcp140_atomic_wait.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\msvcp140_atomic_wait.dll
                                                                                                                                                                              • Size 56KB
                                                                                                                                                                              • SHA256 ae430f3b65c5fc88643b30a344289bfda29811279379c1537cec19983c0938ae
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              msvcp140_codecvt_ids.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\msvcp140_codecvt_ids.dll
                                                                                                                                                                              • Size 21KB
                                                                                                                                                                              • SHA256 9f05310a2330ee37b2f814c1d6ef40be553cc5bfd3f301b84dc221160f687f87
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              oem.cfg
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\oem.cfg
                                                                                                                                                                              • Size 445B
                                                                                                                                                                              • SHA256 0d111e0260b3c11e1dae2b5328bcfd2d1fb21f15f5b49064bd07e272a8bb0822
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              spirv-cross-c-shared.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\spirv-cross-c-shared.dll
                                                                                                                                                                              • Size 1.9MB
                                                                                                                                                                              • SHA256 a5bdb02798646f0c7f2807ccd949be306bb7c3e322a645ef8db28715ecb4465e
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              vccorlib140.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\vccorlib140.dll
                                                                                                                                                                              • Size 328KB
                                                                                                                                                                              • SHA256 9d9011986ff7eb7c709a81bf47af19ab6fa82d03e84d1389bb74a1e41ba9b93a
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              vcredist_msvc2019_x64.exe
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\vcredist_msvc2019_x64.exe
                                                                                                                                                                              • Size 14.4MB
                                                                                                                                                                              • SHA256 40ea2955391c9eae3e35619c4c24b5aaf3d17aeaa6d09424ee9672aa9372aeed
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              vcruntime140.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\vcruntime140.dll
                                                                                                                                                                              • Size 96KB
                                                                                                                                                                              • SHA256 270ba17bf89cc2eb6e6ce536eb78e4614ab5499f653ab7e07fe9e3d33bf3b6e3
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              vcruntime140_1.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS081A551D\vcruntime140_1.dll
                                                                                                                                                                              • Size 37KB
                                                                                                                                                                              • SHA256 f3754fc6ec87bcf84e05f3287b5de7bd305a30a0e1db7d478cb6353600682784
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              backicon.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS863C77E8\Assets\backicon.png
                                                                                                                                                                              • Size 15KB
                                                                                                                                                                              • SHA256 fa64884054171515e97b78aaa1aad1ec5baa9d1daf9c682e0b3fb4a41a9cb1c1
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              change_click.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS863C77E8\Assets\change_click.png
                                                                                                                                                                              • Size 310B
                                                                                                                                                                              • SHA256 8e5847487da148ebb3ea029cc92165afd215cdc08f7122271e13eb37f94e6dc1
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              close_red.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS863C77E8\Assets\close_red.png
                                                                                                                                                                              • Size 15KB
                                                                                                                                                                              • SHA256 d0b6d143642d356b40c47459a996131a344cade6bb86158f1b74693426b09bfb
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              custom.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS863C77E8\Assets\custom.png
                                                                                                                                                                              • Size 17KB
                                                                                                                                                                              • SHA256 fbece8bb5f4dfa55dcfbf41151b10608af807b9477e99acf0940954a11e68f7b
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              discord_icon.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS863C77E8\Assets\discord_icon.png
                                                                                                                                                                              • Size 564B
                                                                                                                                                                              • SHA256 c29b35c6be50f9e34f1120bd346ce01884f0c7ba1121c866d95b24e46e420b0c
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              discord_icon_hover.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS863C77E8\Assets\discord_icon_hover.png
                                                                                                                                                                              • Size 512B
                                                                                                                                                                              • SHA256 6b126c8a7015c2274e6a2ac969e0f31ecae421e1652b446b2aafd2b03d0dc3f5
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              exit_close_click.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS863C77E8\Assets\exit_close_click.png
                                                                                                                                                                              • Size 670B
                                                                                                                                                                              • SHA256 7aaef329ba9fa052791d1a09f127551289641ea743baba171de55faa30ec1157
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              folder.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS863C77E8\Assets\folder.png
                                                                                                                                                                              • Size 298B
                                                                                                                                                                              • SHA256 7ffa875fab1be82e384022a27f3e627ab75131eb168be949cc83c03b6e291bbf
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              help_icon.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS863C77E8\Assets\help_icon.png
                                                                                                                                                                              • Size 1KB
                                                                                                                                                                              • SHA256 97c7450d55ecda9017d0a9eed0049b8176e1828f3525aaf5660985ba214010cc
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              info_icon.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS863C77E8\Assets\info_icon.png
                                                                                                                                                                              • Size 929B
                                                                                                                                                                              • SHA256 ee91e51aaa8356318cc75d60476d9422bf84be7d8a25e1b884aa16c3198dc764
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              installer_bg.jpg
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS863C77E8\Assets\installer_bg.jpg
                                                                                                                                                                              • Size 78KB
                                                                                                                                                                              • SHA256 4c7471c986e16de0cd451be27d4b3171e595fe2916b4b3bf7ca52df6ec368904
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              installer_logo.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS863C77E8\Assets\installer_logo.png
                                                                                                                                                                              • Size 9KB
                                                                                                                                                                              • SHA256 462b64f2e016d25a2a6a653ba896206129c4ac841d61a6c2fd116009606f7e1c
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              installer_minimize.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS863C77E8\Assets\installer_minimize.png
                                                                                                                                                                              • Size 113B
                                                                                                                                                                              • SHA256 a064f417e3c2b8f3121a14bbded268b2cdf635706880b7006f931de31476bbc2
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              loader.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS863C77E8\Assets\loader.png
                                                                                                                                                                              • Size 279B
                                                                                                                                                                              • SHA256 076263cc65f9824f4f82eb6beaa594d1df90218a2ee21664cf209181557e04b1
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              logo_text.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS863C77E8\Assets\logo_text.png
                                                                                                                                                                              • Size 4KB
                                                                                                                                                                              • SHA256 66df86129129d8aa8dd3ba014eb3b3c27a36c22e4782f3dbd6a9a4bc1f4a87bc
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              minimize_progress_click.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS863C77E8\Assets\minimize_progress_click.png
                                                                                                                                                                              • Size 212B
                                                                                                                                                                              • SHA256 2f62d4e8c643051093f907058dddc78cc525147d9c4f4a0d78b4d0e5c90979f6
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              setpath.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS863C77E8\Assets\setpath.png
                                                                                                                                                                              • Size 15KB
                                                                                                                                                                              • SHA256 5bbb2f41f9f3a805986c3c88a639bcc22d90067d4b8de9f1e21e3cf9e5c1766b
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              BlueStacksInstaller.exe
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS863C77E8\BlueStacksInstaller.exe
                                                                                                                                                                              • Size 648KB
                                                                                                                                                                              • SHA256 db742649fa6a55f166850686532dd74c36bee7b186b118ac03508fed757ff4ef
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              BlueStacksInstaller.exe.config
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS863C77E8\BlueStacksInstaller.exe.config
                                                                                                                                                                              • Size 324B
                                                                                                                                                                              • SHA256 d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              HD-CheckCpu.exe
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS863C77E8\HD-CheckCpu.exe
                                                                                                                                                                              • Size 200KB
                                                                                                                                                                              • SHA256 2e14887f3432b4a313442247fc669f891dbdad7ef1a2d371466a2afa88074a4c
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              JSON.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS863C77E8\JSON.dll
                                                                                                                                                                              • Size 411KB
                                                                                                                                                                              • SHA256 d2c8d26f95f55431e632c8581154db7c19547b656380e051194a9d2583dd2156
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              i18n.en-US.txt
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS863C77E8\Locales\i18n.en-US.txt
                                                                                                                                                                              • Size 22KB
                                                                                                                                                                              • SHA256 8936455d79f33eb298869f1654286db493fb5b11b580ef7e8d859ce63541ba91
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              ThemeFile
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS863C77E8\ThemeFile
                                                                                                                                                                              • Size 80KB
                                                                                                                                                                              • SHA256 de1a2e6b560e036da5ea6b042e29e81a5bfcf67dde89670c332fc5199e811ba6
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              Bootstrapper.exe
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS8BECC00C\Bootstrapper.exe
                                                                                                                                                                              • Size 153KB
                                                                                                                                                                              • SHA256 a1cb16ed18dd90a84077e623cf0e5326e74d7f7b22c77a8a05faa7429520a3d8
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              Bootstrapper.exe.config
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS8BECC00C\Bootstrapper.exe.config
                                                                                                                                                                              • Size 392B
                                                                                                                                                                              • SHA256 4b7df915d706af6459c38d75b09c5e14f951842ae0678078400f204ad1c7a7c2
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              checked_gray.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Assets\checked_gray.png
                                                                                                                                                                              • Size 538B
                                                                                                                                                                              • SHA256 d8e502fab00b0c6f06ba6abede6922ab3b423fe6f2d2f56941dabc887b229ad3
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              checked_gray_hover.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Assets\checked_gray_hover.png
                                                                                                                                                                              • Size 412B
                                                                                                                                                                              • SHA256 d7c79677d2ef897fa0ad1efc90e916c46da29f571208f78f24505603b7165c20
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              close_red_click.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Assets\close_red_click.png
                                                                                                                                                                              • Size 15KB
                                                                                                                                                                              • SHA256 d5a7e6fc5e92e0b29a4f65625030447f3379b4e3ac4bed051a0646a7932ce0cd
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              close_red_hover.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Assets\close_red_hover.png
                                                                                                                                                                              • Size 15KB
                                                                                                                                                                              • SHA256 7c625ae4668cc03e37e4ffc478b87eace06b49b77e71e3209f431c23d98acdd0
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              custom_click.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Assets\custom_click.png
                                                                                                                                                                              • Size 15KB
                                                                                                                                                                              • SHA256 1318e0f34a551edae1e82818fdf7de5ac627493db5b24556d919f525052d5b90
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              custom_hover.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Assets\custom_hover.png
                                                                                                                                                                              • Size 15KB
                                                                                                                                                                              • SHA256 d588ef0eaa334ed8482f32e5839a7ee0d0b544d5b8d5f7720b8c57010e080424
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              error_icon.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Assets\error_icon.png
                                                                                                                                                                              • Size 1KB
                                                                                                                                                                              • SHA256 666ad4fe456216ddc06618967846ed31f81d8db5be97da6531842c0667352b89
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              error_icon_72.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Assets\error_icon_72.png
                                                                                                                                                                              • Size 1KB
                                                                                                                                                                              • SHA256 84e59d14d9433e6c3d92daeb8c443063b5e3be6c0b297f0403dbde473a05cb3f
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              exit_close_hover.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Assets\exit_close_hover.png
                                                                                                                                                                              • Size 575B
                                                                                                                                                                              • SHA256 bcc053a9a087e077d58114106d29701a34f7851f4052f3157102811355d3e709
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              installer_minimize_click.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Assets\installer_minimize_click.png
                                                                                                                                                                              • Size 112B
                                                                                                                                                                              • SHA256 2599d6a55a8e12b1f05a6e8982d55559151a25ae3690e6637510b6283622dd95
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              installer_minimize_hover.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Assets\installer_minimize_hover.png
                                                                                                                                                                              • Size 112B
                                                                                                                                                                              • SHA256 57aae4bf49dcbb0ad6cff6263200015c89d7752dc75c2ad918bf846e1ce9646d
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              installer_upgrade_image_bg.jpg
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Assets\installer_upgrade_image_bg.jpg
                                                                                                                                                                              • Size 19KB
                                                                                                                                                                              • SHA256 b7f75233e633107d50f24ca82099225c83a832571cd2ce92901f2db3897f058b
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              link.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Assets\link.png
                                                                                                                                                                              • Size 306B
                                                                                                                                                                              • SHA256 28c0abc6bfe7a155815104883a37a53dd783d142300471064c95eddf3cae0eaf
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              minimize_progress_hover.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Assets\minimize_progress_hover.png
                                                                                                                                                                              • Size 214B
                                                                                                                                                                              • SHA256 1a4aaa46893e2a9b011c478fbb0cd0e84c199f9f3520703189640088969ef5cd
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              powered_by_bs.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Assets\powered_by_bs.png
                                                                                                                                                                              • Size 9KB
                                                                                                                                                                              • SHA256 3d2afe5236ec813d9e8063bc43eb34b88c2155784e1bce19c6a533c32767af35
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              setpath_click.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Assets\setpath_click.png
                                                                                                                                                                              • Size 15KB
                                                                                                                                                                              • SHA256 c94924e95a49b175c8fc00bdc2821bb70a85b864cc193becc553b32f0024dde1
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              setpath_hover.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Assets\setpath_hover.png
                                                                                                                                                                              • Size 15KB
                                                                                                                                                                              • SHA256 2da3f9367c847e47131370dd163f611c4639287512a47f487e0025c5665830e0
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              unchecked_gray.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Assets\unchecked_gray.png
                                                                                                                                                                              • Size 192B
                                                                                                                                                                              • SHA256 671f26795b12008fbea1943143f660095f3dca5d925f67d765e2352fd7ee2396
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              unchecked_gray_hover.png
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Assets\unchecked_gray_hover.png
                                                                                                                                                                              • Size 176B
                                                                                                                                                                              • SHA256 a631e26bd5b6ea19c8c65b766a056c92ba8a47e1483768dcf12b05293c9a7a0d
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              i18n.ar-EG.txt
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Locales\i18n.ar-EG.txt
                                                                                                                                                                              • Size 28KB
                                                                                                                                                                              • SHA256 86d03fbd616a35ad9631e51e61aff37d6be401556e355748bd82761947be77ac
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              i18n.ar-IL.txt
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Locales\i18n.ar-IL.txt
                                                                                                                                                                              • Size 14KB
                                                                                                                                                                              • SHA256 65e7b0f37b5e2aa805ac8d57969804d803430186f34e9703ca9fa09ba908ef90
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              i18n.de-DE.txt
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Locales\i18n.de-DE.txt
                                                                                                                                                                              • Size 24KB
                                                                                                                                                                              • SHA256 f20f1a37f57065efc3fbbeeb2173f10469545256b8083210dcdbf111daf3e488
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              i18n.es-ES.txt
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Locales\i18n.es-ES.txt
                                                                                                                                                                              • Size 24KB
                                                                                                                                                                              • SHA256 6f3dd47822533fb69c5cc57f588bacb697d016ec0ea6a80c928f200621515fbd
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              i18n.fr-FR.txt
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Locales\i18n.fr-FR.txt
                                                                                                                                                                              • Size 25KB
                                                                                                                                                                              • SHA256 fb5021346992b0e6a709a8c0aea5c722954626308c26890b609c24d48a621a54
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              i18n.id-ID.txt
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Locales\i18n.id-ID.txt
                                                                                                                                                                              • Size 22KB
                                                                                                                                                                              • SHA256 8617d7a7841130cade79ac7e523c588744389e5ffa24523915540c22e94c5efb
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              i18n.it-IT.txt
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Locales\i18n.it-IT.txt
                                                                                                                                                                              • Size 23KB
                                                                                                                                                                              • SHA256 e4f9a5a6f698f85180840802079bdffad6ec5666af178e67bf111ebc7bb020ae
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              i18n.ja-JP.txt
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Locales\i18n.ja-JP.txt
                                                                                                                                                                              • Size 28KB
                                                                                                                                                                              • SHA256 018d107f61f9f460d8994a4872086049d71538dbff1290c45f3449dac237b287
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              i18n.ko-KR.txt
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Locales\i18n.ko-KR.txt
                                                                                                                                                                              • Size 24KB
                                                                                                                                                                              • SHA256 3aa1a1437140e16753e2b9e66c0a527a84d2876e4ff3dbb41408b61519ee4fb7
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              i18n.pl-PL.txt
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Locales\i18n.pl-PL.txt
                                                                                                                                                                              • Size 23KB
                                                                                                                                                                              • SHA256 4504be00bba5ec9f2e9571957f8d1841fc4b1b24c0d72e2d867c3e95b6aebcfc
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              i18n.pt-BR.txt
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Locales\i18n.pt-BR.txt
                                                                                                                                                                              • Size 23KB
                                                                                                                                                                              • SHA256 4cf3f6d289a810b766eb91846ab24dc25f21f314992b7170d351a4602f63bf3f
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              i18n.ru-RU.txt
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Locales\i18n.ru-RU.txt
                                                                                                                                                                              • Size 32KB
                                                                                                                                                                              • SHA256 71baa209ed0ec73d0e4eb84596f61e6811268b7f5c8349128b4339108f6d9336
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              i18n.th-TH.txt
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Locales\i18n.th-TH.txt
                                                                                                                                                                              • Size 38KB
                                                                                                                                                                              • SHA256 762116894a1e4078ac3a4af12db5ae4c5fd4efe99d12924ebfc75ac1e1a591cd
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              i18n.tr-TR.txt
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Locales\i18n.tr-TR.txt
                                                                                                                                                                              • Size 23KB
                                                                                                                                                                              • SHA256 ba13ebd5e876061c1a4f271ee05d119294b3aada62d2299cfec72e9f61335a57
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              i18n.vi-VN.txt
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Locales\i18n.vi-VN.txt
                                                                                                                                                                              • Size 26KB
                                                                                                                                                                              • SHA256 ab8fec72d3bbcfd62cae9237375c9762682b6366029051738a98e98f1945d548
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              i18n.zh-CN.txt
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Locales\i18n.zh-CN.txt
                                                                                                                                                                              • Size 20KB
                                                                                                                                                                              • SHA256 2af9d8fbf0f710bd689466443f5ad7af9e6eac8ea55072e8d80aded23e7b8ab3
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              i18n.zh-TW.txt
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\Locales\i18n.zh-TW.txt
                                                                                                                                                                              • Size 20KB
                                                                                                                                                                              • SHA256 39332d6ddf2398f2b6b4deb88bc86c54c6ca993802ee861859ae95385da70fcd
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              upgrade.sh
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7zSCFC623AA\OpenClaw\upgrade.sh
                                                                                                                                                                              • Size 62B
                                                                                                                                                                              • SHA256 d2f463c1e5b37e50617a6fddcd991fb9e32694e652dcb51bfe2ec1a431ced8d0
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              90026d5d-f673-4d0d-b589-d90298f43543.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\90026d5d-f673-4d0d-b589-d90298f43543.tmp
                                                                                                                                                                              • Size 1B
                                                                                                                                                                              • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                              Submit Download

                                                                                                                                                                              installer_bg_7.jpg
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Assets\installer_bg_7.jpg
                                                                                                                                                                              • Size 30KB
                                                                                                                                                                              • SHA256 873030e34515538dac3efb98edec519596439fa05b7aad37f6137ca954ba41a6
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              BgWorker.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\nsb45DA.tmp\BgWorker.dll
                                                                                                                                                                              • Size 12KB
                                                                                                                                                                              • SHA256 a9e4f7ec65670d2ce375ffaf09b6d07f4cd531132ca002452287a4d540154a38
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              System.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\nsb45DA.tmp\System.dll
                                                                                                                                                                              • Size 11KB
                                                                                                                                                                              • SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              nsDialogs.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\nsb45DA.tmp\nsDialogs.dll
                                                                                                                                                                              • Size 9KB
                                                                                                                                                                              • SHA256 2bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              nsDui.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\nsb45DA.tmp\nsDui.dll
                                                                                                                                                                              • Size 3.0MB
                                                                                                                                                                              • SHA256 3942ec628ed66b83c03904efe69112d56637b991a2d2ba23fdb431f06628022a
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              nsis7z.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\nsb45DA.tmp\nsis7z.dll
                                                                                                                                                                              • Size 434KB
                                                                                                                                                                              • SHA256 a896a9ece055d334d431cd0f856113ab925d9ee86d2dee383c0bfbbef11a5b50
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              Registry.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\nswF6E5.tmp\Registry.dll
                                                                                                                                                                              • Size 24KB
                                                                                                                                                                              • SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              StdUtils.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\nswF6E5.tmp\StdUtils.dll
                                                                                                                                                                              • Size 100KB
                                                                                                                                                                              • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              System.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\nswF6E5.tmp\System.dll
                                                                                                                                                                              • Size 12KB
                                                                                                                                                                              • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              WinShell.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\nswF6E5.tmp\WinShell.dll
                                                                                                                                                                              • Size 3KB
                                                                                                                                                                              • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              nsExec.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\nswF6E5.tmp\nsExec.dll
                                                                                                                                                                              • Size 6KB
                                                                                                                                                                              • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              nsis7z.dll
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\nswF6E5.tmp\nsis7z.dll
                                                                                                                                                                              • Size 424KB
                                                                                                                                                                              • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              messages.json
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1136_296025783\CRX_INSTALL\_locales\en_CA\messages.json
                                                                                                                                                                              • Size 711B
                                                                                                                                                                              • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              2f794bb1-df70-4601-bccd-d06526dc7a54.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1136_845419789\2f794bb1-df70-4601-bccd-d06526dc7a54.tmp
                                                                                                                                                                              • Size 10KB
                                                                                                                                                                              • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              verified_contents.json
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1136_845419789\CRX_INSTALL\_metadata\verified_contents.json
                                                                                                                                                                              • Size 1KB
                                                                                                                                                                              • SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              content.js
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1136_845419789\CRX_INSTALL\content.js
                                                                                                                                                                              • Size 9KB
                                                                                                                                                                              • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              manifest.json
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1136_845419789\CRX_INSTALL\manifest.json
                                                                                                                                                                              • Size 962B
                                                                                                                                                                              • SHA256 5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              default.dic
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                                                                                                                              • Size 2B
                                                                                                                                                                              • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                              Submit Download

                                                                                                                                                                              temp-index
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\Code Cache\wasm\index-dir\temp-index
                                                                                                                                                                              • Size 48B
                                                                                                                                                                              • SHA256 63e58b3ed6a0c47327fac923c39def3ba1b500bf516ea96c3a78415458a022a2
                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                              Submit Download

                                                                                                                                                                              CURRENT
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\Local Storage\leveldb\CURRENT
                                                                                                                                                                              • Size 16B
                                                                                                                                                                              • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                              Submit Download

                                                                                                                                                                              9fce1d86-ba58-4cc2-b511-96a6b81de29a.tmp
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\Network\9fce1d86-ba58-4cc2-b511-96a6b81de29a.tmp
                                                                                                                                                                              • Size 766B
                                                                                                                                                                              • SHA256 1b28153b001270027fd220caa4ff1a86e8246f1e61a2055569400255533ca296
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              config.json
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json
                                                                                                                                                                              • Size 57B
                                                                                                                                                                              • SHA256 4c2b98b20fb9855cc72182802cbb52304769133a4f064ee9156cb6bab85bbd1e
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              config.json.tmp-3309453086a9c2d4
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json.tmp-3309453086a9c2d4
                                                                                                                                                                              • Size 92B
                                                                                                                                                                              • SHA256 005d98463ddcfa00954a5da65ac24d5fa4f86780d55d408643f65a104e0e74fa
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              config.json.tmp-33094532118a30eb
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json.tmp-33094532118a30eb
                                                                                                                                                                              • Size 119B
                                                                                                                                                                              • SHA256 a96a6bf5b11ec17c1244736da4edd1692ff955bf542a1075f7d0d2ba560d61c9
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              config.json.tmp-3309455999dba229
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json.tmp-3309455999dba229
                                                                                                                                                                              • Size 1KB
                                                                                                                                                                              • SHA256 1f4e680cd864796f9439556483ebb1656762e7b20231ea5447303ab65846ff95
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              config.json.tmp-33095098720daf4c
                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\bluestacks-services\config.json.tmp-33095098720daf4c
                                                                                                                                                                              • Size 2KB
                                                                                                                                                                              • SHA256 358adb550e35ce810cd95a755273d84d7979111300539ecd72426b1267661ea5
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              283b05c0-8543-4174-b613-ce463c4460e8.tmp
                                                                                                                                                                              • Path C:\Users\Admin\Downloads\283b05c0-8543-4174-b613-ce463c4460e8.tmp
                                                                                                                                                                              • Size 96KB
                                                                                                                                                                              • SHA256 62d3bfd6b4f22973be6b1307f43b5c5cfa22dad0da14871cba5aa4ea07bca2ae
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              BlueStacksInstaller_5.22.286.1003_native_4d871e0bb6401a13bfb288c55cee27ae_MzsxNSwwOzUsNTsxNQ==.exe.crdownload
                                                                                                                                                                              • Path C:\Users\Admin\Downloads\BlueStacksInstaller_5.22.286.1003_native_4d871e0bb6401a13bfb288c55cee27ae_MzsxNSwwOzUsNTsxNQ==.exe.crdownload
                                                                                                                                                                              • Size 931KB
                                                                                                                                                                              • SHA256 02428ec0ec943a18f274db658e2476d751d6802703aacd3ab48eaee6fd4a4ca6
                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              storage.json
                                                                                                                                                                              • Path C:\Windows\System32\storage.json
                                                                                                                                                                              • Size 51B
                                                                                                                                                                              • SHA256 3cb23b535845ddd6fd6160dbb5fb6b14096161d3e632e0dc424a788875c85094
                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                              Submit Download

                                                                                                                                                                              memory/368-12418-0x0000023BF4970000-0x0000023BF4971000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/368-12429-0x0000023BF4970000-0x0000023BF4971000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/368-12428-0x0000023BF4970000-0x0000023BF4971000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/368-12420-0x0000023BF4970000-0x0000023BF4971000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/368-12430-0x0000023BF4970000-0x0000023BF4971000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/368-12419-0x0000023BF4970000-0x0000023BF4971000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/368-12427-0x0000023BF4970000-0x0000023BF4971000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/368-12426-0x0000023BF4970000-0x0000023BF4971000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/368-12425-0x0000023BF4970000-0x0000023BF4971000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/368-12424-0x0000023BF4970000-0x0000023BF4971000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/3060-155-0x000000001EB30000-0x000000001EB3E000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/3060-148-0x000000001DB00000-0x000000001DB10000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/3060-144-0x0000000002740000-0x00000000027A8000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/3060-154-0x000000001F2E0000-0x000000001F318000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/3060-173-0x000000001DB00000-0x000000001DB10000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/3060-142-0x000000001DB00000-0x000000001DB10000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/3060-141-0x00000000005B0000-0x0000000000654000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/3060-151-0x000000001ED70000-0x000000001F298000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/3060-169-0x00000000027C0000-0x00000000027C8000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/3976-12163-0x0000000021BE0000-0x0000000021C02000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/3976-12098-0x0000000000510000-0x000000000056A000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/3976-12162-0x0000000021720000-0x0000000021728000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/3976-12099-0x000000001CD50000-0x000000001CDD0000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4560-12097-0x000000001C960000-0x000000001CA4E000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4560-12096-0x0000000000740000-0x0000000000768000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4968-9424-0x0000000000400000-0x000000000045D000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/4968-9099-0x0000000000400000-0x000000000045D000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/7956-11174-0x000001DB08B70000-0x000001DB08BA0000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/7956-9451-0x00007FFBD8730000-0x00007FFBD8731000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/7956-9450-0x00007FFBD8B20000-0x00007FFBD8B21000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/9000-11480-0x0000000072110000-0x000000007213F000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/9000-11095-0x00000000671C0000-0x00000000672C0000-memory.dmp
                                                                                                                                                                              Download

                                                                                                                                                                              memory/9000-11094-0x0000000072110000-0x000000007213F000-memory.dmp
                                                                                                                                                                              Download