File name:

BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exe

Full analysis: https://app.any.run/tasks/4837adcb-7572-4e78-8112-9d77c50af5d2
Verdict: Malicious activity
Analysis date: April 24, 2024, 09:29:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
bluestacks
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

5C25341E8ECFD88A50B7566115751C1F

SHA1:

6FBF9E7067A6259226A6E892C710693BBC374B86

SHA256:

7A1C0D1727A6A168A0D1F8D9EFC93EFA42F1A71B6F6162C964E25DA208EA1C1C

SSDEEP:

49152:HnVQhBuOT8fiPjWs4Ia9KL6py1DzDn/sBYa0DvmGOQKEAUAMy:1eT8f0jW4uS6Ah/UCa0DVOQPAUAd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exe (PID: 668)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exe (PID: 668)

    • Reads the Internet Settings

      • BlueStacksInstaller.exe (PID: 392)
      • BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exe (PID: 668)

    • Reads security settings of Internet Explorer

      • BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exe (PID: 668)

    • Reads settings of System Certificates

      • BlueStacksInstaller.exe (PID: 392)

  • INFO

    • Reads the machine GUID from the registry

      • BlueStacksInstaller.exe (PID: 392)

    • Reads Environment values

      • BlueStacksInstaller.exe (PID: 392)

    • Creates files or folders in the user directory

      • BlueStacksInstaller.exe (PID: 392)

    • Checks supported languages

      • BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exe (PID: 668)
      • BlueStacksInstaller.exe (PID: 392)

    • Reads the software policy settings

      • BlueStacksInstaller.exe (PID: 392)

    • Application launched itself

      • msedge.exe (PID: 2360)

    • Create files in a temporary directory

      • BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exe (PID: 668)

    • Reads the computer name

      • BlueStacksInstaller.exe (PID: 392)
      • BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exe (PID: 668)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:07:19 13:21:27+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 133632
InitializedDataSize: 224768
UninitializedDataSize: -
EntryPoint: 0x1a5b2
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 19.0.0.0
ProductVersionNumber: 19.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: now.gg, Inc.
FileDescription: BlueStacks Setup
FileVersion: 5
InternalName: BlueStacks Installer
LegalCopyright: Copyright (c) 2010-2021 Bluestacks from Now.gg, Inc.
OriginalFileName: BlueStacksInstaller.exe
ProductName: BlueStacks 5
ProductVersion: 5
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
19
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start bluestacksinstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_mzsxnswwozusmtsxnsw0oze1.exe bluestacksinstaller.exe msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
392"C:\Users\admin\AppData\Local\Temp\7zSC923E1EB\BlueStacksInstaller.exe" C:\Users\admin\AppData\Local\Temp\7zSC923E1EB\BlueStacksInstaller.exe
BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exe
User:
admin
Company:
now.gg, Inc.
Integrity Level:
MEDIUM
Description:
BlueStacks Installer
Exit code:
7
Version:
5.21.150.1025
Modules
Images
c:\users\admin\appdata\local\temp\7zsc923e1eb\bluestacksinstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
584"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1640 --field-trial-handle=1328,i,3902471627144998814,16651127086926540605,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
668"C:\Users\admin\AppData\Local\Temp\BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exe" C:\Users\admin\AppData\Local\Temp\BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exe
explorer.exe
User:
admin
Company:
now.gg, Inc.
Integrity Level:
MEDIUM
Description:
BlueStacks Setup
Exit code:
7
Version:
5.0
Modules
Images
c:\users\admin\appdata\local\temp\bluestacksinstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_mzsxnswwozusmtsxnsw0oze1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
712"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4156 --field-trial-handle=1328,i,3902471627144998814,16651127086926540605,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1056"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3668 --field-trial-handle=1328,i,3902471627144998814,16651127086926540605,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1432"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3824 --field-trial-handle=1328,i,3902471627144998814,16651127086926540605,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1792"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4164 --field-trial-handle=1328,i,3902471627144998814,16651127086926540605,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2044"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1532 --field-trial-handle=1328,i,3902471627144998814,16651127086926540605,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2360"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument https://cloud.bluestacks.com/bs3/help_articles?article=download_compatible_installer_version&oem=nxt&locale=en-US&image_name=Nougat32C:\Program Files\Microsoft\Edge\Application\msedge.exe
BlueStacksInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2416"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd8,0x6177f598,0x6177f5a8,0x6177f5b4C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
10 048
Read events
9 984
Write events
60
Delete events
4

Modification events

(PID) Process:(668) BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(668) BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(668) BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(668) BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(392) BlueStacksInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BlueStacksInstaller_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(392) BlueStacksInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BlueStacksInstaller_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(392) BlueStacksInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BlueStacksInstaller_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(392) BlueStacksInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BlueStacksInstaller_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(392) BlueStacksInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BlueStacksInstaller_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(392) BlueStacksInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BlueStacksInstaller_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
3
Suspicious files
66
Text files
97
Unknown types
4

Dropped files

PID
Process
Filename
Type
668BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exeC:\Users\admin\AppData\Local\Temp\7zSC923E1EB\Assets\close_red.pngimage
MD5:93216B2F9D66D423B3E1311C0573332D
SHA256:D0B6D143642D356B40C47459A996131A344CADE6BB86158F1B74693426B09BFB
668BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exeC:\Users\admin\AppData\Local\Temp\7zSC923E1EB\Assets\error_icon.pngimage
MD5:DAB2C4538A83422B5DEAE0E0DE9B7A30
SHA256:666AD4FE456216DDC06618967846ED31F81D8DB5BE97DA6531842C0667352B89
668BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exeC:\Users\admin\AppData\Local\Temp\7zSC923E1EB\Assets\custom_hover.pngimage
MD5:F3E05F142E742E25A98D4F5AF3AE0623
SHA256:D588EF0EAA334ED8482F32E5839A7EE0D0B544D5B8D5F7720B8C57010E080424
668BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exeC:\Users\admin\AppData\Local\Temp\7zSC923E1EB\Assets\custom_click.pngimage
MD5:CED07C9DB242115400E159D9A02BB7B7
SHA256:1318E0F34A551EDAE1E82818FDF7DE5AC627493DB5B24556D919F525052D5B90
668BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exeC:\Users\admin\AppData\Local\Temp\7zSC923E1EB\Assets\close_red_click.pngimage
MD5:6DB7460B73A6641C7621D0A6203A0A90
SHA256:D5A7E6FC5E92E0B29A4F65625030447F3379B4E3AC4BED051A0646A7932CE0CD
668BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exeC:\Users\admin\AppData\Local\Temp\7zSC923E1EB\Assets\custom.pngimage
MD5:03B17F0B1C067826B0FCC6746CCED2CB
SHA256:FBECE8BB5F4DFA55DCFBF41151B10608AF807B9477E99ACF0940954A11E68F7B
668BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exeC:\Users\admin\AppData\Local\Temp\7zSC923E1EB\Assets\exit_close.pngimage
MD5:26EB04B9E0105A7B121EA9C6601BBF2A
SHA256:7AAEF329BA9FA052791D1A09F127551289641EA743BABA171DE55FAA30EC1157
668BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exeC:\Users\admin\AppData\Local\Temp\7zSC923E1EB\Assets\error_icon_72.pngimage
MD5:4AAF83D2B3FD56AD806708E60474DF39
SHA256:84E59D14D9433E6C3D92DAEB8C443063B5E3BE6C0B297F0403DBDE473A05CB3F
668BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exeC:\Users\admin\AppData\Local\Temp\7zSC923E1EB\Assets\installer_logo.pngimage
MD5:E33432B5D6DAFB8B58F161CF38B8F177
SHA256:9F3104493216C1FA114FF935D23E3E41C7C3511792A30B10A40B507936C0D183
668BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exeC:\Users\admin\AppData\Local\Temp\7zSC923E1EB\Assets\exit_close_click.pngimage
MD5:26EB04B9E0105A7B121EA9C6601BBF2A
SHA256:7AAEF329BA9FA052791D1A09F127551289641EA743BABA171DE55FAA30EC1157
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
56
DNS requests
55
Threats
5

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
392
BlueStacksInstaller.exe
34.160.86.181:443
cloud.bluestacks.com
GOOGLE
US
unknown
2360
msedge.exe
239.255.255.250:1900
—
—
—
unknown
3844
msedge.exe
131.253.33.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3844
msedge.exe
34.160.86.181:443
cloud.bluestacks.com
GOOGLE
US
unknown
3844
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3844
msedge.exe
104.16.53.111:443
bluestacks.zendesk.com
CLOUDFLARENET
—
shared
3844
msedge.exe
104.18.70.113:443
static.zdassets.com
CLOUDFLARENET
—
unknown

DNS requests

Domain
IP
Reputation
cloud.bluestacks.com
  • 34.160.86.181
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 131.253.33.239
  • 13.107.22.239
whitelisted
support.bluestacks.com
  • 104.16.86.20
  • 104.16.89.20
  • 104.16.88.20
  • 104.16.85.20
  • 104.16.87.20
unknown
static.zdassets.com
  • 104.18.70.113
  • 104.18.72.113
whitelisted
p13.zdassets.com
  • 104.18.70.113
  • 104.18.72.113
whitelisted
use.fontawesome.com
  • 172.67.142.245
  • 104.21.27.152
whitelisted
cdn.jsdelivr.net
  • —
unknown
theme.zdassets.com
  • 104.18.72.113
  • 104.18.70.113
whitelisted
bluestacks.zendesk.com
  • 104.16.53.111
  • 104.16.51.111
unknown

Threats

PID
Process
Class
Message
3844
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
3844
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
3844
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
3844
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
3844
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
BlueStacksInstaller_5.21.150.1025_native_7e4c8f7fad53eff1df1b0052afc5dab0_MzsxNSwwOzUsMTsxNSw0OzE1.exe