URL:

https://www.bluestacks.com/

Full analysis: https://app.any.run/tasks/13979900-e786-41ce-b192-4f065ee9d609
Verdict: Malicious activity
Analysis date: April 11, 2025, 20:37:22
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
Indicators:
MD5:

65456CBF44270EEFB1245DCDE3D8C2D7

SHA1:

31C45054D2F4F88406CB5544F7A893B41A0087DE

SHA256:

AA5B4BDA25518DF0748E1576F10A5B1831D562DE9521E3861C3AD1E7244ED13E

SSDEEP:

3:N8DSLp8iZq3n:2OL9m

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • BlueStacksServices.exe (PID: 8068)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • BlueStacksInstaller_5.22.51.1038_native_ffbdd35fe736e32b16fec0c8b8045632_MDs1LDM7MTUsMTsxNSw0OzE1LDU7MTU=.exe (PID: 4892)
      • BSX-Setup-5.22.51.1038_nxt.exe (PID: 5416)
      • BlueStacksInstaller.exe (PID: 7848)
      • Bootstrapper.exe (PID: 8128)
      • BlueStacksInstaller_5.22.51.1038_native_ffbdd35fe736e32b16fec0c8b8045632_MDs1LDM7MTUsMTsxNSw0OzE1LDU7MTU=.exe (PID: 5988)
      • BlueStacksServicesSetup.exe (PID: 6208)

    • Executable content was dropped or overwritten

      • BlueStacksInstaller_5.22.51.1038_native_ffbdd35fe736e32b16fec0c8b8045632_MDs1LDM7MTUsMTsxNSw0OzE1LDU7MTU=.exe (PID: 4892)
      • BSX-Setup-5.22.51.1038_nxt.exe (PID: 5416)
      • BlueStacksInstaller_5.22.51.1038_native_ffbdd35fe736e32b16fec0c8b8045632_MDs1LDM7MTUsMTsxNSw0OzE1LDU7MTU=.exe (PID: 5988)
      • 7zr.exe (PID: 744)
      • 7zr.exe (PID: 7356)
      • BlueStacksServicesSetup.exe (PID: 6208)
      • BlueStacksServices.exe (PID: 8068)
      • BlueStacksInstaller.exe (PID: 6852)

    • The process creates files with name similar to system file names

      • BSX-Setup-5.22.51.1038_nxt.exe (PID: 5416)
      • BlueStacksInstaller_5.22.51.1038_native_ffbdd35fe736e32b16fec0c8b8045632_MDs1LDM7MTUsMTsxNSw0OzE1LDU7MTU=.exe (PID: 5988)
      • 7zr.exe (PID: 7356)
      • BlueStacksServicesSetup.exe (PID: 6208)

    • Process drops legitimate windows executable

      • BSX-Setup-5.22.51.1038_nxt.exe (PID: 5416)
      • BlueStacksInstaller_5.22.51.1038_native_ffbdd35fe736e32b16fec0c8b8045632_MDs1LDM7MTUsMTsxNSw0OzE1LDU7MTU=.exe (PID: 5988)
      • 7zr.exe (PID: 744)
      • 7zr.exe (PID: 7356)
      • BlueStacksServicesSetup.exe (PID: 6208)

    • The process drops C-runtime libraries

      • BSX-Setup-5.22.51.1038_nxt.exe (PID: 5416)
      • 7zr.exe (PID: 744)
      • 7zr.exe (PID: 7356)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • BSX-Setup-5.22.51.1038_nxt.exe (PID: 5416)
      • BlueStacksServicesSetup.exe (PID: 6208)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 1280)

    • Drops 7-zip archiver for unpacking

      • BSX-Setup-5.22.51.1038_nxt.exe (PID: 5416)
      • BlueStacksInstaller_5.22.51.1038_native_ffbdd35fe736e32b16fec0c8b8045632_MDs1LDM7MTUsMTsxNSw0OzE1LDU7MTU=.exe (PID: 5988)
      • BlueStacksServicesSetup.exe (PID: 6208)
      • 7zr.exe (PID: 7356)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 1280)
      • BlueStacksServicesSetup.exe (PID: 6208)
      • BlueStacksServices.exe (PID: 8068)
      • HD-LogCollector.exe (PID: 3748)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 1280)

    • Creates a software uninstall entry

      • BlueStacksInstaller.exe (PID: 7848)
      • BlueStacksServicesSetup.exe (PID: 6208)
      • BlueStacksInstaller.exe (PID: 6852)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • cmd.exe (PID: 684)
      • BlueStacksInstaller.exe (PID: 6852)

    • The process executes VB scripts

      • BSX-Setup-5.22.51.1038_nxt.exe (PID: 5416)

    • Searches for installed software

      • BlueStacksInstaller.exe (PID: 7848)
      • BlueStacksInstaller.exe (PID: 6852)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • cmd.exe (PID: 684)
      • BlueStacksInstaller.exe (PID: 6852)

    • Reads the date of Windows installation

      • BlueStacksInstaller.exe (PID: 7848)
      • Bootstrapper.exe (PID: 8128)

    • Drops a system driver (possible attempt to evade defenses)

      • 7zr.exe (PID: 7356)

    • Get information on the list of running processes

      • BlueStacksServicesSetup.exe (PID: 6208)
      • cmd.exe (PID: 5384)
      • cmd.exe (PID: 3012)
      • BlueStacksServices.exe (PID: 8068)
      • cmd.exe (PID: 7880)
      • cmd.exe (PID: 7264)
      • cmd.exe (PID: 7624)
      • cmd.exe (PID: 6252)
      • cmd.exe (PID: 7276)
      • cmd.exe (PID: 6112)
      • cmd.exe (PID: 7896)
      • cmd.exe (PID: 5200)
      • cmd.exe (PID: 7688)
      • cmd.exe (PID: 6384)
      • cmd.exe (PID: 4980)
      • cmd.exe (PID: 7932)
      • cmd.exe (PID: 2524)
      • cmd.exe (PID: 5452)
      • cmd.exe (PID: 3760)
      • cmd.exe (PID: 7320)
      • cmd.exe (PID: 8004)
      • cmd.exe (PID: 7328)
      • cmd.exe (PID: 6960)
      • cmd.exe (PID: 7688)
      • cmd.exe (PID: 904)
      • cmd.exe (PID: 1120)
      • cmd.exe (PID: 2108)

    • Writes binary data to a Stream object (SCRIPT)

      • cscript.exe (PID: 5232)
      • cscript.exe (PID: 7104)
      • cscript.exe (PID: 6404)
      • cscript.exe (PID: 300)
      • cscript.exe (PID: 5136)
      • cscript.exe (PID: 4988)
      • cscript.exe (PID: 7492)
      • cscript.exe (PID: 5740)
      • cscript.exe (PID: 5452)
      • cscript.exe (PID: 5676)
      • cscript.exe (PID: 444)
      • cscript.exe (PID: 6488)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • cscript.exe (PID: 7104)
      • cscript.exe (PID: 5232)
      • cscript.exe (PID: 6708)
      • cscript.exe (PID: 8120)
      • cscript.exe (PID: 6404)
      • cscript.exe (PID: 5740)
      • cscript.exe (PID: 4988)
      • cscript.exe (PID: 300)
      • cscript.exe (PID: 7492)
      • cscript.exe (PID: 5136)
      • cscript.exe (PID: 5452)
      • cscript.exe (PID: 5676)
      • cscript.exe (PID: 6488)
      • cscript.exe (PID: 444)

    • Reads data from a binary Stream object (SCRIPT)

      • cscript.exe (PID: 7104)
      • cscript.exe (PID: 6708)
      • cscript.exe (PID: 6404)
      • cscript.exe (PID: 8120)
      • cscript.exe (PID: 4988)
      • cscript.exe (PID: 5740)
      • cscript.exe (PID: 300)
      • cscript.exe (PID: 7492)
      • cscript.exe (PID: 5136)
      • cscript.exe (PID: 5232)
      • cscript.exe (PID: 6488)
      • cscript.exe (PID: 5452)
      • cscript.exe (PID: 5676)
      • cscript.exe (PID: 444)

    • Gets full path of the running script (SCRIPT)

      • cscript.exe (PID: 7104)
      • cscript.exe (PID: 5232)
      • cscript.exe (PID: 6708)
      • cscript.exe (PID: 8120)
      • cscript.exe (PID: 6404)
      • cscript.exe (PID: 5740)
      • cscript.exe (PID: 300)
      • cscript.exe (PID: 4988)
      • cscript.exe (PID: 7492)
      • cscript.exe (PID: 5136)
      • cscript.exe (PID: 5452)
      • cscript.exe (PID: 5676)
      • cscript.exe (PID: 6488)
      • cscript.exe (PID: 444)

    • Application launched itself

      • BlueStacksServices.exe (PID: 8068)

    • Connects to unusual port

      • BlueStacksServices.exe (PID: 8068)

    • Creates/Modifies COM task schedule object

      • HD-ComRegistrar.exe (PID: 5608)

    • Lists all scheduled tasks in specific format

      • schtasks.exe (PID: 6216)

    • Detected use of alternative data streams (AltDS)

      • HD-Player.exe (PID: 4056)

    • Checks for external IP

      • HD-Player.exe (PID: 4056)

    • Uses SYSTEMINFO.EXE to read the environment

      • HD-LogCollector.exe (PID: 3748)

  • INFO

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 7376)
      • msedge.exe (PID: 2384)

    • Application launched itself

      • msedge.exe (PID: 2384)
      • msedge.exe (PID: 6132)

    • Checks supported languages

      • identity_helper.exe (PID: 7996)
      • BlueStacksInstaller_5.22.51.1038_native_ffbdd35fe736e32b16fec0c8b8045632_MDs1LDM7MTUsMTsxNSw0OzE1LDU7MTU=.exe (PID: 4892)
      • identity_helper.exe (PID: 7904)
      • BlueStacksInstaller.exe (PID: 7848)
      • HD-CheckCpu.exe (PID: 7340)
      • BSX-Setup-5.22.51.1038_nxt.exe (PID: 5416)
      • BlueStacksInstaller_5.22.51.1038_native_ffbdd35fe736e32b16fec0c8b8045632_MDs1LDM7MTUsMTsxNSw0OzE1LDU7MTU=.exe (PID: 5988)
      • Bootstrapper.exe (PID: 8128)
      • BlueStacksInstaller.exe (PID: 6852)
      • 7zr.exe (PID: 744)
      • HD-ForceGPU.exe (PID: 7584)
      • HD-GLCheck.exe (PID: 1116)
      • HD-CheckCpu.exe (PID: 2140)
      • HD-GLCheck.exe (PID: 7300)
      • HD-GLCheck.exe (PID: 1760)
      • HD-GLCheck.exe (PID: 1616)
      • HD-GLCheck.exe (PID: 1324)
      • HD-GLCheck.exe (PID: 3016)
      • HD-CheckCpu.exe (PID: 4448)
      • BlueStacksServicesSetup.exe (PID: 6208)
      • BlueStacksServices.exe (PID: 8068)
      • BlueStacksServices.exe (PID: 8020)
      • BlueStacksServices.exe (PID: 7840)
      • 7zr.exe (PID: 6876)
      • 7zr.exe (PID: 7356)
      • BlueStacksServices.exe (PID: 5512)
      • 7zr.exe (PID: 7560)
      • HD-GLCheck.exe (PID: 6488)
      • HD-GLCheck.exe (PID: 7244)
      • HD-GLCheck.exe (PID: 4628)
      • HD-CheckCpu.exe (PID: 6500)
      • HD-ComRegistrar.exe (PID: 2192)
      • HD-ComRegistrar.exe (PID: 5608)
      • BstkSVC.exe (PID: 5260)
      • BstkVMMgr.exe (PID: 3096)
      • BstkSVC.exe (PID: 808)
      • BlueStacksHelper.exe (PID: 5668)
      • HD-Player.exe (PID: 4056)
      • BstkSVC.exe (PID: 6276)
      • ffmpeg.exe (PID: 7236)
      • HD-LogCollector.exe (PID: 3748)
      • ffmpeg.exe (PID: 7100)
      • ffmpeg.exe (PID: 6668)
      • ffmpeg.exe (PID: 300)
      • HD-GLCheck.exe (PID: 544)

    • Reads Environment values

      • identity_helper.exe (PID: 7996)
      • identity_helper.exe (PID: 7904)
      • BlueStacksInstaller.exe (PID: 7848)
      • BSX-Setup-5.22.51.1038_nxt.exe (PID: 5416)
      • BlueStacksInstaller.exe (PID: 6852)
      • BlueStacksServices.exe (PID: 8068)
      • BlueStacksHelper.exe (PID: 5668)
      • HD-Player.exe (PID: 4056)

    • The sample compiled with english language support

      • msedge.exe (PID: 7376)
      • msedge.exe (PID: 2384)
      • BSX-Setup-5.22.51.1038_nxt.exe (PID: 5416)
      • BlueStacksInstaller_5.22.51.1038_native_ffbdd35fe736e32b16fec0c8b8045632_MDs1LDM7MTUsMTsxNSw0OzE1LDU7MTU=.exe (PID: 5988)
      • 7zr.exe (PID: 744)
      • 7zr.exe (PID: 7356)
      • BlueStacksServicesSetup.exe (PID: 6208)

    • Manual execution by a user

      • BlueStacksInstaller_5.22.51.1038_native_ffbdd35fe736e32b16fec0c8b8045632_MDs1LDM7MTUsMTsxNSw0OzE1LDU7MTU=.exe (PID: 4892)
      • BlueStacksServicesSetup.exe (PID: 6208)
      • BlueStacksServices.exe (PID: 8068)
      • HD-Player.exe (PID: 4056)
      • BlueStacksHelper.exe (PID: 5668)

    • Autorun file from Downloads

      • msedge.exe (PID: 1280)
      • msedge.exe (PID: 2384)

    • Create files in a temporary directory

      • BlueStacksInstaller_5.22.51.1038_native_ffbdd35fe736e32b16fec0c8b8045632_MDs1LDM7MTUsMTsxNSw0OzE1LDU7MTU=.exe (PID: 4892)
      • BlueStacksInstaller.exe (PID: 7848)
      • BSX-Setup-5.22.51.1038_nxt.exe (PID: 5416)
      • BlueStacksInstaller_5.22.51.1038_native_ffbdd35fe736e32b16fec0c8b8045632_MDs1LDM7MTUsMTsxNSw0OzE1LDU7MTU=.exe (PID: 5988)
      • 7zr.exe (PID: 744)
      • BlueStacksServicesSetup.exe (PID: 6208)
      • BlueStacksServices.exe (PID: 8068)
      • reg.exe (PID: 7268)
      • HD-LogCollector.exe (PID: 3748)

    • Reads the computer name

      • identity_helper.exe (PID: 7996)
      • BlueStacksInstaller_5.22.51.1038_native_ffbdd35fe736e32b16fec0c8b8045632_MDs1LDM7MTUsMTsxNSw0OzE1LDU7MTU=.exe (PID: 4892)
      • identity_helper.exe (PID: 7904)
      • BlueStacksInstaller.exe (PID: 7848)
      • BSX-Setup-5.22.51.1038_nxt.exe (PID: 5416)
      • BlueStacksInstaller_5.22.51.1038_native_ffbdd35fe736e32b16fec0c8b8045632_MDs1LDM7MTUsMTsxNSw0OzE1LDU7MTU=.exe (PID: 5988)
      • BlueStacksInstaller.exe (PID: 6852)
      • Bootstrapper.exe (PID: 8128)
      • 7zr.exe (PID: 744)
      • HD-GLCheck.exe (PID: 7300)
      • HD-GLCheck.exe (PID: 1116)
      • HD-GLCheck.exe (PID: 3016)
      • HD-GLCheck.exe (PID: 1616)
      • HD-GLCheck.exe (PID: 1324)
      • 7zr.exe (PID: 7356)
      • BlueStacksServicesSetup.exe (PID: 6208)
      • BlueStacksServices.exe (PID: 8068)
      • BlueStacksServices.exe (PID: 8020)
      • HD-GLCheck.exe (PID: 1760)
      • BlueStacksServices.exe (PID: 7840)
      • 7zr.exe (PID: 6876)
      • 7zr.exe (PID: 7560)
      • HD-GLCheck.exe (PID: 7244)
      • HD-GLCheck.exe (PID: 6488)
      • HD-GLCheck.exe (PID: 4628)
      • HD-ComRegistrar.exe (PID: 5608)
      • BstkSVC.exe (PID: 5260)
      • HD-ComRegistrar.exe (PID: 2192)
      • BstkVMMgr.exe (PID: 3096)
      • BstkSVC.exe (PID: 808)
      • BlueStacksHelper.exe (PID: 5668)
      • HD-Player.exe (PID: 4056)
      • BstkSVC.exe (PID: 6276)
      • HD-LogCollector.exe (PID: 3748)
      • ffmpeg.exe (PID: 300)
      • HD-GLCheck.exe (PID: 544)

    • Process checks computer location settings

      • BlueStacksInstaller_5.22.51.1038_native_ffbdd35fe736e32b16fec0c8b8045632_MDs1LDM7MTUsMTsxNSw0OzE1LDU7MTU=.exe (PID: 4892)
      • BSX-Setup-5.22.51.1038_nxt.exe (PID: 5416)
      • BlueStacksInstaller.exe (PID: 7848)
      • BlueStacksInstaller_5.22.51.1038_native_ffbdd35fe736e32b16fec0c8b8045632_MDs1LDM7MTUsMTsxNSw0OzE1LDU7MTU=.exe (PID: 5988)
      • Bootstrapper.exe (PID: 8128)
      • BlueStacksServices.exe (PID: 5512)
      • BlueStacksServices.exe (PID: 8068)
      • HD-Player.exe (PID: 4056)

    • Creates files or folders in the user directory

      • BlueStacksInstaller.exe (PID: 7848)
      • BlueStacksInstaller.exe (PID: 6852)
      • BlueStacksServicesSetup.exe (PID: 6208)
      • BlueStacksServices.exe (PID: 8068)
      • BlueStacksServices.exe (PID: 7840)
      • HD-Player.exe (PID: 4056)

    • Disables trace logs

      • BlueStacksInstaller.exe (PID: 7848)
      • BlueStacksInstaller.exe (PID: 6852)
      • BlueStacksHelper.exe (PID: 5668)
      • HD-LogCollector.exe (PID: 3748)

    • Reads the software policy settings

      • BlueStacksInstaller.exe (PID: 7848)
      • slui.exe (PID: 920)
      • slui.exe (PID: 2644)
      • BlueStacksInstaller.exe (PID: 6852)
      • BlueStacksHelper.exe (PID: 5668)
      • HD-Player.exe (PID: 4056)

    • Checks proxy server information

      • BlueStacksInstaller.exe (PID: 7848)
      • BlueStacksInstaller.exe (PID: 6852)
      • slui.exe (PID: 2644)
      • BlueStacksServices.exe (PID: 8068)
      • BlueStacksHelper.exe (PID: 5668)
      • HD-LogCollector.exe (PID: 3748)
      • HD-Player.exe (PID: 4056)

    • Reads the machine GUID from the registry

      • BlueStacksInstaller.exe (PID: 7848)
      • BlueStacksInstaller.exe (PID: 6852)
      • BlueStacksServices.exe (PID: 8068)
      • BlueStacksHelper.exe (PID: 5668)
      • HD-Player.exe (PID: 4056)
      • HD-LogCollector.exe (PID: 3748)

    • Creates files in the program directory

      • BlueStacksInstaller.exe (PID: 7848)
      • BSX-Setup-5.22.51.1038_nxt.exe (PID: 5416)
      • BlueStacksInstaller.exe (PID: 6852)
      • 7zr.exe (PID: 7356)
      • 7zr.exe (PID: 6876)
      • 7zr.exe (PID: 7560)
      • HD-ComRegistrar.exe (PID: 2192)
      • BstkSVC.exe (PID: 5260)
      • BstkSVC.exe (PID: 808)
      • HD-Player.exe (PID: 4056)
      • BstkSVC.exe (PID: 6276)

    • Reads product name

      • BSX-Setup-5.22.51.1038_nxt.exe (PID: 5416)
      • BlueStacksServices.exe (PID: 8068)

    • The sample compiled with chinese language support

      • BSX-Setup-5.22.51.1038_nxt.exe (PID: 5416)
      • 7zr.exe (PID: 7356)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 5232)
      • cscript.exe (PID: 6708)
      • cscript.exe (PID: 7104)
      • cscript.exe (PID: 6404)
      • cscript.exe (PID: 8120)
      • cscript.exe (PID: 4988)
      • cscript.exe (PID: 300)
      • cscript.exe (PID: 5740)
      • cscript.exe (PID: 5136)
      • cscript.exe (PID: 7492)
      • cscript.exe (PID: 6488)
      • cscript.exe (PID: 5452)
      • cscript.exe (PID: 5676)
      • cscript.exe (PID: 444)

    • Reads CPU info

      • BlueStacksInstaller.exe (PID: 6852)
      • HD-Player.exe (PID: 4056)

    • Reads mouse settings

      • HD-Player.exe (PID: 4056)

    • Reads the time zone

      • HD-Player.exe (PID: 4056)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
412
Monitored processes
262
Malicious processes
25
Suspicious processes
2

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs sppextcomobj.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs bluestacksinstaller_5.22.51.1038_native_ffbdd35fe736e32b16fec0c8b8045632_mds1ldm7mtusmtsxnsw0oze1ldu7mtu=.exe msedge.exe no specs bluestacksinstaller.exe hd-checkcpu.exe no specs conhost.exe no specs hd-checkcpu.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs bsx-setup-5.22.51.1038_nxt.exe slui.exe msedge.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs COpenControlPanel no specs msedge.exe no specs bluestacksinstaller_5.22.51.1038_native_ffbdd35fe736e32b16fec0c8b8045632_mds1ldm7mtusmtsxnsw0oze1ldu7mtu=.exe bootstrapper.exe no specs bluestacksinstaller.exe 7zr.exe conhost.exe no specs hd-forcegpu.exe no specs conhost.exe no specs hd-glcheck.exe no specs conhost.exe no specs hd-glcheck.exe no specs conhost.exe no specs hd-glcheck.exe no specs conhost.exe no specs hd-glcheck.exe no specs conhost.exe no specs hd-glcheck.exe no specs conhost.exe no specs hd-glcheck.exe no specs conhost.exe no specs hd-checkcpu.exe no specs conhost.exe no specs 7zr.exe conhost.exe no specs bluestacksservicessetup.exe msedge.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs bluestacksservices.exe bluestacksservices.exe no specs cscript.exe no specs conhost.exe no specs cscript.exe no specs conhost.exe no specs bluestacksservices.exe cscript.exe no specs conhost.exe no specs cscript.exe no specs conhost.exe no specs cscript.exe no specs conhost.exe no specs cscript.exe no specs conhost.exe no specs bluestacksservices.exe no specs 7zr.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs tasklist.exe no specs tasklist.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs 7zr.exe no specs conhost.exe no specs conhost.exe no specs tasklist.exe no specs tasklist.exe no specs cscript.exe no specs cscript.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs tasklist.exe no specs tasklist.exe no specs cscript.exe no specs conhost.exe no specs cscript.exe no specs conhost.exe no specs cscript.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs tasklist.exe no specs tasklist.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs tasklist.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs tasklist.exe no specs tasklist.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs tasklist.exe no specs tasklist.exe no specs hd-glcheck.exe no specs conhost.exe no specs hd-glcheck.exe no specs conhost.exe no specs hd-glcheck.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs hd-checkcpu.exe no specs conhost.exe no specs hd-comregistrar.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs hd-comregistrar.exe no specs bstksvc.exe no specs bstkvmmgr.exe no specs conhost.exe no specs bstksvc.exe no specs bluestackshelper.exe hd-player.exe schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs bstksvc.exe no specs ffmpeg.exe no specs conhost.exe no specs ffmpeg.exe no specs conhost.exe no specs ffmpeg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs tasklist.exe no specs ffmpeg.exe no specs conhost.exe no specs hd-logcollector.exe reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs hd-glcheck.exe no specs conhost.exe no specs hd-hvutl.exe no specs systeminfo.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
300cscript.exe //Nologo C:\Users\admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A "HKCU\SOFTWARE\BlueStacks X"C:\Windows\System32\cscript.exe—BlueStacksServices.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
300"C:\Program Files\BlueStacks_nxt\ffmpeg.exe" -y -f lavfi -i testsrc -c:v h264_qsv C:/Users/admin/Videos/test_hardware_encoder.mp4C:\Program Files\BlueStacks_nxt\ffmpeg.exe—HD-Player.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\program files\bluestacks_nxt\ffmpeg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
444cscript.exe //Nologo C:\Users\admin\AppData\Local\Programs\bluestacks-services\resources\regedit\vbs\regList.wsf A HKLM\SOFTWARE\BlueStacks_nxtC:\Windows\System32\cscript.exe—BlueStacksServices.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
516netsh advfirewall firewall delete rule name="Cloud Game"C:\Windows\SysWOW64\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
544"C:\Program Files\BlueStacks_nxt\HD-GLCheck.exe" 2C:\Program Files\BlueStacks_nxt\HD-GLCheck.exe—HD-LogCollector.exe
User:
admin
Company:
BlueStack Systems
Integrity Level:
MEDIUM
Description:
BlueStacks GLCheck Utility
Exit code:
0
Version:
5.22.51.1038
Modules
Images
c:\program files\bluestacks_nxt\hd-glcheck.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\opengl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
616"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5476 --field-trial-handle=2360,i,11074570196404559562,16409979322589605950,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
684"C:\Windows\System32\cmd.exe" /c green.batC:\Windows\SysWOW64\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
744"C:\Users\admin\AppData\Local\Temp\7zS467EBBD3\7zr.exe" x "C:\Users\admin\AppData\Local\Temp\7zS467EBBD3\CommonInstallUtils.zip" -o"C:\Users\admin\AppData\Local\Temp\7zS467EBBD3\" -aoaC:\Users\admin\AppData\Local\Temp\7zS467EBBD3\7zr.exe
BlueStacksInstaller.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Standalone Console
Exit code:
0
Version:
23.01
Modules
Images
c:\users\admin\appdata\local\temp\7zs467ebbd3\7zr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
776\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—HD-GLCheck.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
776\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
94 747
Read events
94 546
Write events
178
Delete events
23

Modification events

(PID) Process:(2384) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2384) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2384) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2384) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(2384) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
A57A3AF41C912F00
(PID) Process:(2384) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
ECF444F41C912F00
(PID) Process:(2384) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\262988
Operation:writeName:WindowTabManagerFileMappingId
Value:
{178452EB-C517-493F-B604-D124AD0E9BB2}
(PID) Process:(2384) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\262988
Operation:writeName:WindowTabManagerFileMappingId
Value:
{0E66F088-44B6-436F-92B6-0DB5D9526FF1}
(PID) Process:(2384) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\262988
Operation:writeName:WindowTabManagerFileMappingId
Value:
{691D2AC7-A18A-462E-9A01-9E9AEC362F70}
(PID) Process:(2384) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\262988
Operation:writeName:WindowTabManagerFileMappingId
Value:
{06FB5D8F-7DF4-4511-9426-F09046BC4486}
Executable files
523
Suspicious files
884
Text files
676
Unknown types
0

Dropped files

PID
Process
Filename
Type
2384msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF10b6fd.TMP —
MD5:—
SHA256:—
2384msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
2384msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF10b6fd.TMP —
MD5:—
SHA256:—
2384msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
2384msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF10b6fd.TMP —
MD5:—
SHA256:—
2384msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
2384msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF10b70d.TMP —
MD5:—
SHA256:—
2384msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
2384msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF10b6fd.TMP —
MD5:—
SHA256:—
2384msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
33
TCP/UDP connections
157
DNS requests
132
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1240
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1240
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4996
svchost.exe
GET
206
23.50.131.72:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1744953270&P2=404&P3=2&P4=U%2bVq1jj%2bG81CZNTxg84csp1jp%2fInK08nV2bv2iKlm8tobMtu9N21Wgif4VID4lLYBCnj2jobNAkOdWeVDgFrIg%3d%3d
unknown
—
—
whitelisted
4996
svchost.exe
GET
200
23.50.131.72:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9b9f8fb4-8a65-41e4-bda3-5416858f0aeb?P1=1744953270&P2=404&P3=2&P4=fQYBRmA%2fw8cVBjUVnHZS51XvcC834QnmkTJ5qFO%2bpEdFdUsvaiarrrZB7icft4zORqEzNFYI9xcg2KoyOlF14Q%3d%3d
unknown
—
—
whitelisted
4996
svchost.exe
GET
206
23.50.131.72:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1744953270&P2=404&P3=2&P4=U%2bVq1jj%2bG81CZNTxg84csp1jp%2fInK08nV2bv2iKlm8tobMtu9N21Wgif4VID4lLYBCnj2jobNAkOdWeVDgFrIg%3d%3d
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.141:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4996
svchost.exe
GET
206
23.50.131.72:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/f0a82376-a390-4752-ab77-2cdbdcb1da8a?P1=1744953272&P2=404&P3=2&P4=XcDxZm1A8z4vxBKW5sIF5zycAO07E6RS%2fSkz%2faz3v6aVL4ZoahvdIt45evojnAqmkSGyY9vn6OEYyKXvkvkPqg%3d%3d
unknown
—
—
whitelisted
4996
svchost.exe
HEAD
200
23.50.131.72:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9b9f8fb4-8a65-41e4-bda3-5416858f0aeb?P1=1744953270&P2=404&P3=2&P4=fQYBRmA%2fw8cVBjUVnHZS51XvcC834QnmkTJ5qFO%2bpEdFdUsvaiarrrZB7icft4zORqEzNFYI9xcg2KoyOlF14Q%3d%3d
unknown
—
—
whitelisted
4996
svchost.exe
GET
206
23.50.131.72:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/f0a82376-a390-4752-ab77-2cdbdcb1da8a?P1=1744953272&P2=404&P3=2&P4=XcDxZm1A8z4vxBKW5sIF5zycAO07E6RS%2fSkz%2faz3v6aVL4ZoahvdIt45evojnAqmkSGyY9vn6OEYyKXvkvkPqg%3d%3d
unknown
—
—
whitelisted
4996
svchost.exe
GET
206
23.50.131.72:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/f0a82376-a390-4752-ab77-2cdbdcb1da8a?P1=1744953272&P2=404&P3=2&P4=XcDxZm1A8z4vxBKW5sIF5zycAO07E6RS%2fSkz%2faz3v6aVL4ZoahvdIt45evojnAqmkSGyY9vn6OEYyKXvkvkPqg%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.141:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7376
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2384
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
7376
msedge.exe
150.171.27.11:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7376
msedge.exe
13.107.246.45:443
edge-mobile-static.azureedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7376
msedge.exe
13.32.121.53:443
www.bluestacks.com
AMAZON-02
US
whitelisted
7376
msedge.exe
23.50.131.78:443
bzib.nelreports.net
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.141
  • 23.48.23.176
  • 23.48.23.164
  • 23.48.23.143
  • 23.48.23.169
  • 23.48.23.194
whitelisted
google.com
  • 142.250.185.206
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 150.171.27.11
  • 150.171.28.11
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.45
whitelisted
www.bluestacks.com
  • 13.32.121.53
  • 13.32.121.33
  • 13.32.121.127
  • 13.32.121.15
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
www.bing.com
  • 104.126.37.129
  • 104.126.37.178
  • 104.126.37.128
  • 104.126.37.179
  • 104.126.37.130
  • 104.126.37.176
  • 104.126.37.123
  • 104.126.37.186
  • 104.126.37.171
  • 2.16.241.218
  • 2.16.241.201
  • 2.16.241.205
  • 2.16.241.207
whitelisted
webapi-cloud.bluestacks.com
  • 34.120.235.88
whitelisted

Threats

PID
Process
Class
Message
7376
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
7376
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
2196
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
4056
HD-Player.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.bluestacks.com/