File name:

BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exe

Full analysis: https://app.any.run/tasks/46f238f1-d064-4692-bf76-efbdf430dcd0
Verdict: Malicious activity
Analysis date: April 30, 2024, 18:33:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

78663342AB2F369BE4AD15B7CBD5C2ED

SHA1:

0E65FF60F14A35473E3E52401C41275742B0DF4F

SHA256:

37899C856BC1AD1F1BE77B427971EDBDA1579962F8246EDB044CC0476A8B0897

SSDEEP:

49152:6nVQhBuOT8fLPjWs4Ia9KL68NhnMuFjD1KRmqBL/F:2eT8fLjW4uS68NhnM+1SR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exe (PID: 3968)
      • BlueStacksInstaller_5.14.22.1003_native_e0175934c4a0a56f1db683585ffd1bcf.exe (PID: 2996)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exe (PID: 3968)
      • BlueStacksInstaller_5.14.22.1003_native_e0175934c4a0a56f1db683585ffd1bcf.exe (PID: 2996)

    • Reads the Internet Settings

      • BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exe (PID: 3968)
      • BlueStacksInstaller.exe (PID: 4004)
      • BlueStacksInstaller_5.14.22.1003_native_e0175934c4a0a56f1db683585ffd1bcf.exe (PID: 2996)
      • BlueStacksInstaller.exe (PID: 3028)
      • BlueStacksInstaller.exe (PID: 368)

    • Reads security settings of Internet Explorer

      • BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exe (PID: 3968)
      • BlueStacksInstaller_5.14.22.1003_native_e0175934c4a0a56f1db683585ffd1bcf.exe (PID: 2996)
      • BlueStacksInstaller.exe (PID: 3028)

    • Reads settings of System Certificates

      • BlueStacksInstaller.exe (PID: 4004)
      • BlueStacksInstaller.exe (PID: 3028)
      • BlueStacksInstaller.exe (PID: 368)

    • Application launched itself

      • BlueStacksInstaller.exe (PID: 3028)

  • INFO

    • Create files in a temporary directory

      • BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exe (PID: 3968)
      • BlueStacksInstaller_5.14.22.1003_native_e0175934c4a0a56f1db683585ffd1bcf.exe (PID: 2996)

    • Checks supported languages

      • BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exe (PID: 3968)
      • BlueStacksInstaller.exe (PID: 4004)
      • wmpnscfg.exe (PID: 4080)
      • BlueStacksInstaller.exe (PID: 3028)
      • BlueStacksInstaller_5.14.22.1003_native_e0175934c4a0a56f1db683585ffd1bcf.exe (PID: 2996)
      • BlueStacksInstaller.exe (PID: 368)
      • HD-CheckCpu.exe (PID: 3444)

    • Reads the computer name

      • BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exe (PID: 3968)
      • BlueStacksInstaller.exe (PID: 4004)
      • wmpnscfg.exe (PID: 4080)
      • BlueStacksInstaller_5.14.22.1003_native_e0175934c4a0a56f1db683585ffd1bcf.exe (PID: 2996)
      • BlueStacksInstaller.exe (PID: 368)
      • BlueStacksInstaller.exe (PID: 3028)

    • Reads the machine GUID from the registry

      • BlueStacksInstaller.exe (PID: 4004)
      • BlueStacksInstaller.exe (PID: 368)
      • BlueStacksInstaller.exe (PID: 3028)

    • Creates files or folders in the user directory

      • BlueStacksInstaller.exe (PID: 4004)
      • BlueStacksInstaller.exe (PID: 3028)
      • BlueStacksInstaller.exe (PID: 368)

    • Reads Environment values

      • BlueStacksInstaller.exe (PID: 4004)
      • BlueStacksInstaller.exe (PID: 368)
      • BlueStacksInstaller.exe (PID: 3028)

    • Reads the software policy settings

      • BlueStacksInstaller.exe (PID: 4004)
      • BlueStacksInstaller.exe (PID: 3028)
      • BlueStacksInstaller.exe (PID: 368)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 4080)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 1020)
      • msedge.exe (PID: 524)

    • Application launched itself

      • msedge.exe (PID: 1020)

    • Drops the executable file immediately after the start

      • msedge.exe (PID: 524)
      • msedge.exe (PID: 1020)

    • The process uses the downloaded file

      • msedge.exe (PID: 2884)
      • msedge.exe (PID: 1020)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:07:19 13:21:27+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 133632
InitializedDataSize: 224768
UninitializedDataSize: -
EntryPoint: 0x1a5b2
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 19.0.0.0
ProductVersionNumber: 19.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: now.gg, Inc.
FileDescription: BlueStacks Setup
FileVersion: 5
InternalName: BlueStacks Installer
LegalCopyright: Copyright (c) 2010-2021 Bluestacks from Now.gg, Inc.
OriginalFileName: BlueStacksInstaller.exe
ProductName: BlueStacks 5
ProductVersion: 5
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
67
Monitored processes
29
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start bluestacksinstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_mtsxnq==.exe bluestacksinstaller.exe wmpnscfg.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs bluestacksinstaller_5.14.22.1003_native_e0175934c4a0a56f1db683585ffd1bcf.exe bluestacksinstaller.exe bluestacksinstaller.exe hd-checkcpu.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
368"C:\Users\admin\AppData\Local\Temp\7zS4BB27190\BlueStacksInstaller.exe" "BlueStacksInstaller_5.14.22.1003_native_e0175934c4a0a56f1db683585ffd1bcf.exe"C:\Users\admin\AppData\Local\Temp\7zS4BB27190\BlueStacksInstaller.exe
BlueStacksInstaller.exe
User:
admin
Company:
now.gg, Inc.
Integrity Level:
HIGH
Description:
BlueStacks Installer
Version:
5.14.22.1003
Modules
Images
c:\users\admin\appdata\local\temp\7zs4bb27190\bluestacksinstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
524"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1388 --field-trial-handle=1312,i,17359148291922564730,10317157173174008388,131072 /prefetch:3C:\Program Files\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
660"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1256 --field-trial-handle=1312,i,17359148291922564730,10317157173174008388,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
952"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3684 --field-trial-handle=1312,i,17359148291922564730,10317157173174008388,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1020"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument https://cloud.bluestacks.com/bs3/help_articles?article=download_compatible_installer_version&oem=nxt&locale=en-US&image_name=Nougat32C:\Program Files\Microsoft\Edge\Application\msedge.exe
BlueStacksInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1060"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1620 --field-trial-handle=1312,i,17359148291922564730,10317157173174008388,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1296"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3572 --field-trial-handle=1312,i,17359148291922564730,10317157173174008388,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1332"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3732 --field-trial-handle=1312,i,17359148291922564730,10317157173174008388,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1676"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1452 --field-trial-handle=1312,i,17359148291922564730,10317157173174008388,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1796"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --first-renderer-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2200 --field-trial-handle=1312,i,17359148291922564730,10317157173174008388,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
30 755
Read events
30 576
Write events
164
Delete events
15

Modification events

(PID) Process:(3968) BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3968) BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3968) BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3968) BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(4004) BlueStacksInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BlueStacksInstaller_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4004) BlueStacksInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BlueStacksInstaller_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4004) BlueStacksInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BlueStacksInstaller_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(4004) BlueStacksInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BlueStacksInstaller_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(4004) BlueStacksInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BlueStacksInstaller_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(4004) BlueStacksInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BlueStacksInstaller_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
11
Suspicious files
31
Text files
142
Unknown types
63

Dropped files

PID
Process
Filename
Type
3968BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exeC:\Users\admin\AppData\Local\Temp\7zS08F3CD00\Assets\checked_gray_hover.pngimage
MD5:EA22933E94C7AB813B639627F2B38286
SHA256:D7C79677D2EF897FA0AD1EFC90E916C46DA29F571208F78F24505603B7165C20
3968BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exeC:\Users\admin\AppData\Local\Temp\7zS08F3CD00\Assets\error_icon_72.pngimage
MD5:4AAF83D2B3FD56AD806708E60474DF39
SHA256:84E59D14D9433E6C3D92DAEB8C443063B5E3BE6C0B297F0403DBDE473A05CB3F
3968BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exeC:\Users\admin\AppData\Local\Temp\7zS08F3CD00\Assets\custom_hover.pngimage
MD5:F3E05F142E742E25A98D4F5AF3AE0623
SHA256:D588EF0EAA334ED8482F32E5839A7EE0D0B544D5B8D5F7720B8C57010E080424
3968BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exeC:\Users\admin\AppData\Local\Temp\7zS08F3CD00\Assets\backicon.pngimage
MD5:7FF5DC8270B5FA7EF6C4A1420BD67A7F
SHA256:FA64884054171515E97B78AAA1AAD1EC5BAA9D1DAF9C682E0B3FB4A41A9CB1C1
3968BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exeC:\Users\admin\AppData\Local\Temp\7zS08F3CD00\Assets\exit_close_click.pngimage
MD5:26EB04B9E0105A7B121EA9C6601BBF2A
SHA256:7AAEF329BA9FA052791D1A09F127551289641EA743BABA171DE55FAA30EC1157
3968BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exeC:\Users\admin\AppData\Local\Temp\7zS08F3CD00\Assets\error_icon.pngimage
MD5:DAB2C4538A83422B5DEAE0E0DE9B7A30
SHA256:666AD4FE456216DDC06618967846ED31F81D8DB5BE97DA6531842C0667352B89
3968BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exeC:\Users\admin\AppData\Local\Temp\7zS08F3CD00\Assets\close_red_click.pngimage
MD5:6DB7460B73A6641C7621D0A6203A0A90
SHA256:D5A7E6FC5E92E0B29A4F65625030447F3379B4E3AC4BED051A0646A7932CE0CD
3968BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exeC:\Users\admin\AppData\Local\Temp\7zS08F3CD00\Assets\custom_click.pngimage
MD5:CED07C9DB242115400E159D9A02BB7B7
SHA256:1318E0F34A551EDAE1E82818FDF7DE5AC627493DB5B24556D919F525052D5B90
3968BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exeC:\Users\admin\AppData\Local\Temp\7zS08F3CD00\Assets\custom.pngimage
MD5:03B17F0B1C067826B0FCC6746CCED2CB
SHA256:FBECE8BB5F4DFA55DCFBF41151B10608AF807B9477E99ACF0940954A11E68F7B
3968BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exeC:\Users\admin\AppData\Local\Temp\7zS08F3CD00\Assets\exit_close_hover.pngimage
MD5:92C2BF222D6AB81FE7A0C072BF31C107
SHA256:BCC053A9A087E077D58114106D29701A34F7851F4052F3157102811355D3E709
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
62
DNS requests
60
Threats
5

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4004
BlueStacksInstaller.exe
34.160.86.181:443
cloud.bluestacks.com
GOOGLE
US
unknown
524
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
524
msedge.exe
34.160.86.181:443
cloud.bluestacks.com
GOOGLE
US
unknown
524
msedge.exe
204.79.197.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1020
msedge.exe
239.255.255.250:1900
—
—
—
unknown
524
msedge.exe
104.16.51.111:443
support.bluestacks.com
CLOUDFLARENET
—
shared

DNS requests

Domain
IP
Reputation
cloud.bluestacks.com
  • 34.160.86.181
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
support.bluestacks.com
  • 104.16.51.111
  • 104.16.53.111
unknown
static.zdassets.com
  • 104.18.72.113
  • 104.18.70.113
whitelisted
p13.zdassets.com
  • 104.18.70.113
  • 104.18.72.113
whitelisted
use.fontawesome.com
  • 104.21.27.152
  • 172.67.142.245
whitelisted
cdn.jsdelivr.net
  • 104.16.85.20
  • 104.16.89.20
  • 104.16.86.20
  • 104.16.87.20
  • 104.16.88.20
whitelisted
theme.zdassets.com
  • 104.18.70.113
  • 104.18.72.113
whitelisted
bluestacks.zendesk.com
  • 104.16.53.111
  • 104.16.51.111
unknown

Threats

PID
Process
Class
Message
524
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
524
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
524
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
524
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
524
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exe