File name:

BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exe

Full analysis: https://app.any.run/tasks/46f238f1-d064-4692-bf76-efbdf430dcd0
Verdict: Malicious activity
Analysis date: April 30, 2024, 18:33:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

78663342AB2F369BE4AD15B7CBD5C2ED

SHA1:

0E65FF60F14A35473E3E52401C41275742B0DF4F

SHA256:

37899C856BC1AD1F1BE77B427971EDBDA1579962F8246EDB044CC0476A8B0897

SSDEEP:

49152:6nVQhBuOT8fLPjWs4Ia9KL68NhnMuFjD1KRmqBL/F:2eT8fLjW4uS68NhnM+1SR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exe (PID: 3968)
      • BlueStacksInstaller_5.14.22.1003_native_e0175934c4a0a56f1db683585ffd1bcf.exe (PID: 2996)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exe (PID: 3968)
      • BlueStacksInstaller_5.14.22.1003_native_e0175934c4a0a56f1db683585ffd1bcf.exe (PID: 2996)

    • Reads the Internet Settings

      • BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exe (PID: 3968)
      • BlueStacksInstaller.exe (PID: 4004)
      • BlueStacksInstaller_5.14.22.1003_native_e0175934c4a0a56f1db683585ffd1bcf.exe (PID: 2996)
      • BlueStacksInstaller.exe (PID: 368)
      • BlueStacksInstaller.exe (PID: 3028)

    • Reads security settings of Internet Explorer

      • BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exe (PID: 3968)
      • BlueStacksInstaller_5.14.22.1003_native_e0175934c4a0a56f1db683585ffd1bcf.exe (PID: 2996)
      • BlueStacksInstaller.exe (PID: 3028)

    • Reads settings of System Certificates

      • BlueStacksInstaller.exe (PID: 4004)
      • BlueStacksInstaller.exe (PID: 368)
      • BlueStacksInstaller.exe (PID: 3028)

    • Application launched itself

      • BlueStacksInstaller.exe (PID: 3028)

  • INFO

    • Checks supported languages

      • BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exe (PID: 3968)
      • BlueStacksInstaller.exe (PID: 4004)
      • BlueStacksInstaller_5.14.22.1003_native_e0175934c4a0a56f1db683585ffd1bcf.exe (PID: 2996)
      • BlueStacksInstaller.exe (PID: 3028)
      • BlueStacksInstaller.exe (PID: 368)
      • HD-CheckCpu.exe (PID: 3444)
      • wmpnscfg.exe (PID: 4080)

    • Reads the computer name

      • BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exe (PID: 3968)
      • BlueStacksInstaller.exe (PID: 4004)
      • wmpnscfg.exe (PID: 4080)
      • BlueStacksInstaller.exe (PID: 3028)
      • BlueStacksInstaller_5.14.22.1003_native_e0175934c4a0a56f1db683585ffd1bcf.exe (PID: 2996)
      • BlueStacksInstaller.exe (PID: 368)

    • Create files in a temporary directory

      • BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exe (PID: 3968)
      • BlueStacksInstaller_5.14.22.1003_native_e0175934c4a0a56f1db683585ffd1bcf.exe (PID: 2996)

    • Reads the machine GUID from the registry

      • BlueStacksInstaller.exe (PID: 4004)
      • BlueStacksInstaller.exe (PID: 3028)
      • BlueStacksInstaller.exe (PID: 368)

    • Reads Environment values

      • BlueStacksInstaller.exe (PID: 4004)
      • BlueStacksInstaller.exe (PID: 3028)
      • BlueStacksInstaller.exe (PID: 368)

    • Creates files or folders in the user directory

      • BlueStacksInstaller.exe (PID: 4004)
      • BlueStacksInstaller.exe (PID: 3028)
      • BlueStacksInstaller.exe (PID: 368)

    • Reads the software policy settings

      • BlueStacksInstaller.exe (PID: 4004)
      • BlueStacksInstaller.exe (PID: 3028)
      • BlueStacksInstaller.exe (PID: 368)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 4080)

    • Drops the executable file immediately after the start

      • msedge.exe (PID: 1020)
      • msedge.exe (PID: 524)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 524)
      • msedge.exe (PID: 1020)

    • The process uses the downloaded file

      • msedge.exe (PID: 2884)
      • msedge.exe (PID: 1020)

    • Application launched itself

      • msedge.exe (PID: 1020)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:07:19 13:21:27+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 133632
InitializedDataSize: 224768
UninitializedDataSize: -
EntryPoint: 0x1a5b2
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 19.0.0.0
ProductVersionNumber: 19.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: now.gg, Inc.
FileDescription: BlueStacks Setup
FileVersion: 5
InternalName: BlueStacks Installer
LegalCopyright: Copyright (c) 2010-2021 Bluestacks from Now.gg, Inc.
OriginalFileName: BlueStacksInstaller.exe
ProductName: BlueStacks 5
ProductVersion: 5
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
67
Monitored processes
29
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start bluestacksinstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_mtsxnq==.exe bluestacksinstaller.exe wmpnscfg.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs bluestacksinstaller_5.14.22.1003_native_e0175934c4a0a56f1db683585ffd1bcf.exe bluestacksinstaller.exe bluestacksinstaller.exe hd-checkcpu.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
368"C:\Users\admin\AppData\Local\Temp\7zS4BB27190\BlueStacksInstaller.exe" "BlueStacksInstaller_5.14.22.1003_native_e0175934c4a0a56f1db683585ffd1bcf.exe"C:\Users\admin\AppData\Local\Temp\7zS4BB27190\BlueStacksInstaller.exe
BlueStacksInstaller.exe
User:
admin
Company:
now.gg, Inc.
Integrity Level:
HIGH
Description:
BlueStacks Installer
Version:
5.14.22.1003
Modules
Images
c:\users\admin\appdata\local\temp\7zs4bb27190\bluestacksinstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
524"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1388 --field-trial-handle=1312,i,17359148291922564730,10317157173174008388,131072 /prefetch:3C:\Program Files\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
660"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1256 --field-trial-handle=1312,i,17359148291922564730,10317157173174008388,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
952"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3684 --field-trial-handle=1312,i,17359148291922564730,10317157173174008388,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1020"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument https://cloud.bluestacks.com/bs3/help_articles?article=download_compatible_installer_version&oem=nxt&locale=en-US&image_name=Nougat32C:\Program Files\Microsoft\Edge\Application\msedge.exe
BlueStacksInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1060"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1620 --field-trial-handle=1312,i,17359148291922564730,10317157173174008388,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1296"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3572 --field-trial-handle=1312,i,17359148291922564730,10317157173174008388,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1332"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3732 --field-trial-handle=1312,i,17359148291922564730,10317157173174008388,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1676"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1452 --field-trial-handle=1312,i,17359148291922564730,10317157173174008388,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1796"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --first-renderer-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2200 --field-trial-handle=1312,i,17359148291922564730,10317157173174008388,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
30 755
Read events
30 576
Write events
164
Delete events
15

Modification events

(PID) Process:(3968) BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3968) BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3968) BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3968) BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(4004) BlueStacksInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BlueStacksInstaller_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4004) BlueStacksInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BlueStacksInstaller_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4004) BlueStacksInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BlueStacksInstaller_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(4004) BlueStacksInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BlueStacksInstaller_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(4004) BlueStacksInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BlueStacksInstaller_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(4004) BlueStacksInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BlueStacksInstaller_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
11
Suspicious files
31
Text files
142
Unknown types
63

Dropped files

PID
Process
Filename
Type
3968BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exeC:\Users\admin\AppData\Local\Temp\7zS08F3CD00\Assets\checked_gray.pngimage
MD5:CE144D2AAB3BF213AF693D4E18F87A59
SHA256:D8E502FAB00B0C6F06BA6ABEDE6922AB3B423FE6F2D2F56941DABC887B229AD3
3968BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exeC:\Users\admin\AppData\Local\Temp\7zS08F3CD00\Assets\checked_gray_hover.pngimage
MD5:EA22933E94C7AB813B639627F2B38286
SHA256:D7C79677D2EF897FA0AD1EFC90E916C46DA29F571208F78F24505603B7165C20
3968BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exeC:\Users\admin\AppData\Local\Temp\7zS08F3CD00\Assets\custom_hover.pngimage
MD5:F3E05F142E742E25A98D4F5AF3AE0623
SHA256:D588EF0EAA334ED8482F32E5839A7EE0D0B544D5B8D5F7720B8C57010E080424
3968BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exeC:\Users\admin\AppData\Local\Temp\7zS08F3CD00\Assets\custom.pngimage
MD5:03B17F0B1C067826B0FCC6746CCED2CB
SHA256:FBECE8BB5F4DFA55DCFBF41151B10608AF807B9477E99ACF0940954A11E68F7B
3968BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exeC:\Users\admin\AppData\Local\Temp\7zS08F3CD00\Assets\close_red.pngimage
MD5:93216B2F9D66D423B3E1311C0573332D
SHA256:D0B6D143642D356B40C47459A996131A344CADE6BB86158F1B74693426B09BFB
3968BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exeC:\Users\admin\AppData\Local\Temp\7zS08F3CD00\Assets\close_red_hover.pngimage
MD5:5CEAB43AA527BC146F9453A1586DDF03
SHA256:7C625AE4668CC03E37E4FFC478B87EACE06B49B77E71E3209F431C23D98ACDD0
3968BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exeC:\Users\admin\AppData\Local\Temp\7zS08F3CD00\Assets\installer_bg.jpgimage
MD5:3478E24BA1DD52C80A0FF0D43828B6B5
SHA256:4C7471C986E16DE0CD451BE27D4B3171E595FE2916B4B3BF7CA52DF6EC368904
3968BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exeC:\Users\admin\AppData\Local\Temp\7zS08F3CD00\Assets\installer_minimize.pngimage
MD5:38B539A1E4229738E5C196EEDB4EB225
SHA256:A064F417E3C2B8F3121A14BBDED268B2CDF635706880B7006F931DE31476BBC2
3968BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exeC:\Users\admin\AppData\Local\Temp\7zS08F3CD00\Assets\exit_close_hover.pngimage
MD5:92C2BF222D6AB81FE7A0C072BF31C107
SHA256:BCC053A9A087E077D58114106D29701A34F7851F4052F3157102811355D3E709
3968BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exeC:\Users\admin\AppData\Local\Temp\7zS08F3CD00\Assets\installer_logo.pngimage
MD5:E33432B5D6DAFB8B58F161CF38B8F177
SHA256:9F3104493216C1FA114FF935D23E3E41C7C3511792A30B10A40B507936C0D183
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
62
DNS requests
60
Threats
5

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4004
BlueStacksInstaller.exe
34.160.86.181:443
cloud.bluestacks.com
GOOGLE
US
unknown
524
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
524
msedge.exe
34.160.86.181:443
cloud.bluestacks.com
GOOGLE
US
unknown
524
msedge.exe
204.79.197.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1020
msedge.exe
239.255.255.250:1900
—
—
—
unknown
524
msedge.exe
104.16.51.111:443
support.bluestacks.com
CLOUDFLARENET
—
shared

DNS requests

Domain
IP
Reputation
cloud.bluestacks.com
  • 34.160.86.181
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
support.bluestacks.com
  • 104.16.51.111
  • 104.16.53.111
unknown
static.zdassets.com
  • 104.18.72.113
  • 104.18.70.113
whitelisted
p13.zdassets.com
  • 104.18.70.113
  • 104.18.72.113
whitelisted
use.fontawesome.com
  • 104.21.27.152
  • 172.67.142.245
whitelisted
cdn.jsdelivr.net
  • 104.16.85.20
  • 104.16.89.20
  • 104.16.86.20
  • 104.16.87.20
  • 104.16.88.20
whitelisted
theme.zdassets.com
  • 104.18.70.113
  • 104.18.72.113
whitelisted
bluestacks.zendesk.com
  • 104.16.53.111
  • 104.16.51.111
unknown

Threats

PID
Process
Class
Message
524
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
524
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
524
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
524
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
524
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
BlueStacksInstaller_5.21.150.1026_native_5a8876bfe92a39aeaaaee5b7b85e4274_MTsxNQ==.exe