File name:

BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exe

Full analysis: https://app.any.run/tasks/4837adcb-7572-4e78-8112-9d77c50af5d2
Verdict: Malicious activity
Analysis date: April 24, 2024, 09:29:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
bluestacks
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

5C25341E8ECFD88A50B7566115751C1F

SHA1:

6FBF9E7067A6259226A6E892C710693BBC374B86

SHA256:

7A1C0D1727A6A168A0D1F8D9EFC93EFA42F1A71B6F6162C964E25DA208EA1C1C

SSDEEP:

49152:HnVQhBuOT8fiPjWs4Ia9KL6py1DzDn/sBYa0DvmGOQKEAUAMy:1eT8f0jW4uS6Ah/UCa0DVOQPAUAd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exe (PID: 668)

  • SUSPICIOUS

    • Reads the Internet Settings

      • BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exe (PID: 668)
      • BlueStacksInstaller.exe (PID: 392)

    • Reads settings of System Certificates

      • BlueStacksInstaller.exe (PID: 392)

    • Executable content was dropped or overwritten

      • BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exe (PID: 668)

    • Reads security settings of Internet Explorer

      • BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exe (PID: 668)

  • INFO

    • Checks supported languages

      • BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exe (PID: 668)
      • BlueStacksInstaller.exe (PID: 392)

    • Reads the computer name

      • BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exe (PID: 668)
      • BlueStacksInstaller.exe (PID: 392)

    • Reads Environment values

      • BlueStacksInstaller.exe (PID: 392)

    • Create files in a temporary directory

      • BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exe (PID: 668)

    • Creates files or folders in the user directory

      • BlueStacksInstaller.exe (PID: 392)

    • Reads the machine GUID from the registry

      • BlueStacksInstaller.exe (PID: 392)

    • Reads the software policy settings

      • BlueStacksInstaller.exe (PID: 392)

    • Application launched itself

      • msedge.exe (PID: 2360)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:07:19 13:21:27+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 133632
InitializedDataSize: 224768
UninitializedDataSize: -
EntryPoint: 0x1a5b2
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 19.0.0.0
ProductVersionNumber: 19.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: now.gg, Inc.
FileDescription: BlueStacks Setup
FileVersion: 5
InternalName: BlueStacks Installer
LegalCopyright: Copyright (c) 2010-2021 Bluestacks from Now.gg, Inc.
OriginalFileName: BlueStacksInstaller.exe
ProductName: BlueStacks 5
ProductVersion: 5
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
19
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start bluestacksinstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_mzsxnswwozusmtsxnsw0oze1.exe bluestacksinstaller.exe msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
392"C:\Users\admin\AppData\Local\Temp\7zSC923E1EB\BlueStacksInstaller.exe" C:\Users\admin\AppData\Local\Temp\7zSC923E1EB\BlueStacksInstaller.exe
BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exe
User:
admin
Company:
now.gg, Inc.
Integrity Level:
MEDIUM
Description:
BlueStacks Installer
Exit code:
7
Version:
5.21.150.1025
Modules
Images
c:\users\admin\appdata\local\temp\7zsc923e1eb\bluestacksinstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
584"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1640 --field-trial-handle=1328,i,3902471627144998814,16651127086926540605,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
668"C:\Users\admin\AppData\Local\Temp\BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exe" C:\Users\admin\AppData\Local\Temp\BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exe
explorer.exe
User:
admin
Company:
now.gg, Inc.
Integrity Level:
MEDIUM
Description:
BlueStacks Setup
Exit code:
7
Version:
5.0
Modules
Images
c:\users\admin\appdata\local\temp\bluestacksinstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_mzsxnswwozusmtsxnsw0oze1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
712"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4156 --field-trial-handle=1328,i,3902471627144998814,16651127086926540605,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1056"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3668 --field-trial-handle=1328,i,3902471627144998814,16651127086926540605,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1432"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3824 --field-trial-handle=1328,i,3902471627144998814,16651127086926540605,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1792"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4164 --field-trial-handle=1328,i,3902471627144998814,16651127086926540605,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2044"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1532 --field-trial-handle=1328,i,3902471627144998814,16651127086926540605,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2360"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument https://cloud.bluestacks.com/bs3/help_articles?article=download_compatible_installer_version&oem=nxt&locale=en-US&image_name=Nougat32C:\Program Files\Microsoft\Edge\Application\msedge.exe
BlueStacksInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2416"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd8,0x6177f598,0x6177f5a8,0x6177f5b4C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
10 048
Read events
9 984
Write events
60
Delete events
4

Modification events

(PID) Process:(668) BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(668) BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(668) BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(668) BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(392) BlueStacksInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BlueStacksInstaller_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(392) BlueStacksInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BlueStacksInstaller_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(392) BlueStacksInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BlueStacksInstaller_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(392) BlueStacksInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BlueStacksInstaller_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(392) BlueStacksInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BlueStacksInstaller_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(392) BlueStacksInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BlueStacksInstaller_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
3
Suspicious files
66
Text files
97
Unknown types
4

Dropped files

PID
Process
Filename
Type
668BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exeC:\Users\admin\AppData\Local\Temp\7zSC923E1EB\Assets\exit_close.pngimage
MD5:26EB04B9E0105A7B121EA9C6601BBF2A
SHA256:7AAEF329BA9FA052791D1A09F127551289641EA743BABA171DE55FAA30EC1157
668BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exeC:\Users\admin\AppData\Local\Temp\7zSC923E1EB\Assets\exit_close_click.pngimage
MD5:26EB04B9E0105A7B121EA9C6601BBF2A
SHA256:7AAEF329BA9FA052791D1A09F127551289641EA743BABA171DE55FAA30EC1157
668BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exeC:\Users\admin\AppData\Local\Temp\7zSC923E1EB\Assets\backicon.pngimage
MD5:7FF5DC8270B5FA7EF6C4A1420BD67A7F
SHA256:FA64884054171515E97B78AAA1AAD1EC5BAA9D1DAF9C682E0B3FB4A41A9CB1C1
668BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exeC:\Users\admin\AppData\Local\Temp\7zSC923E1EB\Assets\exit_close_hover.pngimage
MD5:92C2BF222D6AB81FE7A0C072BF31C107
SHA256:BCC053A9A087E077D58114106D29701A34F7851F4052F3157102811355D3E709
668BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exeC:\Users\admin\AppData\Local\Temp\7zSC923E1EB\Assets\error_icon.pngimage
MD5:DAB2C4538A83422B5DEAE0E0DE9B7A30
SHA256:666AD4FE456216DDC06618967846ED31F81D8DB5BE97DA6531842C0667352B89
668BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exeC:\Users\admin\AppData\Local\Temp\7zSC923E1EB\Assets\custom_click.pngimage
MD5:CED07C9DB242115400E159D9A02BB7B7
SHA256:1318E0F34A551EDAE1E82818FDF7DE5AC627493DB5B24556D919F525052D5B90
668BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exeC:\Users\admin\AppData\Local\Temp\7zSC923E1EB\Assets\custom.pngimage
MD5:03B17F0B1C067826B0FCC6746CCED2CB
SHA256:FBECE8BB5F4DFA55DCFBF41151B10608AF807B9477E99ACF0940954A11E68F7B
668BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exeC:\Users\admin\AppData\Local\Temp\7zSC923E1EB\Assets\installer_bg.jpgimage
MD5:3478E24BA1DD52C80A0FF0D43828B6B5
SHA256:4C7471C986E16DE0CD451BE27D4B3171E595FE2916B4B3BF7CA52DF6EC368904
668BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exeC:\Users\admin\AppData\Local\Temp\7zSC923E1EB\Assets\installer_minimize.pngimage
MD5:38B539A1E4229738E5C196EEDB4EB225
SHA256:A064F417E3C2B8F3121A14BBDED268B2CDF635706880B7006F931DE31476BBC2
668BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exeC:\Users\admin\AppData\Local\Temp\7zSC923E1EB\Assets\installer_minimize_click.pngimage
MD5:08FC39A69FA17E0F529915919CEA1633
SHA256:2599D6A55A8E12B1F05A6E8982D55559151A25AE3690E6637510B6283622DD95
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
56
DNS requests
55
Threats
5

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
392
BlueStacksInstaller.exe
34.160.86.181:443
cloud.bluestacks.com
GOOGLE
US
unknown
2360
msedge.exe
239.255.255.250:1900
—
—
—
unknown
3844
msedge.exe
131.253.33.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3844
msedge.exe
34.160.86.181:443
cloud.bluestacks.com
GOOGLE
US
unknown
3844
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3844
msedge.exe
104.16.53.111:443
bluestacks.zendesk.com
CLOUDFLARENET
—
shared
3844
msedge.exe
104.18.70.113:443
static.zdassets.com
CLOUDFLARENET
—
unknown

DNS requests

Domain
IP
Reputation
cloud.bluestacks.com
  • 34.160.86.181
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 131.253.33.239
  • 13.107.22.239
whitelisted
support.bluestacks.com
  • 104.16.86.20
  • 104.16.89.20
  • 104.16.88.20
  • 104.16.85.20
  • 104.16.87.20
unknown
static.zdassets.com
  • 104.18.70.113
  • 104.18.72.113
whitelisted
p13.zdassets.com
  • 104.18.70.113
  • 104.18.72.113
whitelisted
use.fontawesome.com
  • 172.67.142.245
  • 104.21.27.152
whitelisted
cdn.jsdelivr.net
  • —
unknown
theme.zdassets.com
  • 104.18.72.113
  • 104.18.70.113
whitelisted
bluestacks.zendesk.com
  • 104.16.53.111
  • 104.16.51.111
unknown

Threats

PID
Process
Class
Message
3844
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
3844
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
3844
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
3844
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
3844
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exe