Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '2b83800acab30455d26ab8c9dca5e280' = '"%TEMP%\bluestacks.exe" ..'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '2b83800acab30455d26ab8c9dca5e280' = '"%TEMP%\bluestacks.exe" ..'
- %HOMEPATH%\Start Menu\Programs\Startup\2b83800acab30455d26ab8c9dca5e280.exe
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\bluestacks.exe' = '%TEMP%\bluestacks.exe:*:Enabled:bluestacks.exe'
- '%TEMP%\7zS2.tmp\BlueStacks-ThinInstaller_0.9.4.4078.exe'
- '%TEMP%\bluestacks.exe'
- '%TEMP%\7zS2.tmp\BlueStacks-ThinInstaller_0.9.4.4078.exe' install:WindowsForms10.Window.8.app.0.33c0d9d
- '%TEMP%\FUD.exe'
- '%TEMP%\BlueStacksImstaller.exe'
- '%TEMP%\7zS2.tmp\MicroInstallerNative.exe'
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%TEMP%\bluestacks.exe" "bluestacks.exe" ENABLE
- %TEMP%\Cab1B.tmp
- %TEMP%\Cab1D.tmp
- <LS_APPDATA>\Bluestacks\Logs\BlueStacksUsers.log
- %TEMP%\Cab19.tmp
- %TEMP%\Cab1F.tmp
- %TEMP%\Cab25.tmp
- %TEMP%\Cab27.tmp
- %TEMP%\Cab21.tmp
- %TEMP%\Cab23.tmp
- %TEMP%\Cab17.tmp
- %TEMP%\Cab9.tmp
- %TEMP%\CabB.tmp
- %TEMP%\Cab5.tmp
- %TEMP%\Cab7.tmp
- %TEMP%\CabD.tmp
- %TEMP%\Cab13.tmp
- %TEMP%\Cab15.tmp
- %TEMP%\CabF.tmp
- %TEMP%\Cab11.tmp
- %ALLUSERSPROFILE%\Application Data\BlueStacksSetup\Images\SetupImage6.jpg
- %ALLUSERSPROFILE%\Application Data\BlueStacksSetup\Images\SetupImage7.jpg
- %ALLUSERSPROFILE%\Application Data\BlueStacksSetup\Images\SetupImage4.jpg
- %ALLUSERSPROFILE%\Application Data\BlueStacksSetup\Images\SetupImage5.jpg
- %ALLUSERSPROFILE%\Application Data\BlueStacksSetup\Images\SetupImage8.jpg
- %ALLUSERSPROFILE%\Application Data\BlueStacksSetup\Images\SetupImage11.jpg
- %ALLUSERSPROFILE%\Application Data\BlueStacksSetup\Images\SetupImage12.jpg
- %ALLUSERSPROFILE%\Application Data\BlueStacksSetup\Images\SetupImage9.jpg
- %ALLUSERSPROFILE%\Application Data\BlueStacksSetup\Images\SetupImage10.jpg
- %ALLUSERSPROFILE%\Application Data\BlueStacksSetup\Images\SetupImage3.jpg
- %TEMP%\Cab2D.tmp
- %TEMP%\Cab2F.tmp
- %TEMP%\Cab29.tmp
- %TEMP%\Cab2B.tmp
- %ALLUSERSPROFILE%\Application Data\BlueStacksSetup\Images\bg.jpg
- %ALLUSERSPROFILE%\Application Data\BlueStacksSetup\Images\SetupImage1.jpg
- %ALLUSERSPROFILE%\Application Data\BlueStacksSetup\Images\SetupImage2.jpg
- %ALLUSERSPROFILE%\Application Data\BlueStacksSetup\Images\HomeScreen.jpg
- %ALLUSERSPROFILE%\Application Data\BlueStacksSetup\Images\ThankYouImage.jpg
- %TEMP%\Cab3.tmp
- %TEMP%\7zS2.tmp\ThininstallerStrings_fr-CA.txt
- %TEMP%\7zS2.tmp\ThininstallerStrings_fr-CH.txt
- %TEMP%\7zS2.tmp\ThininstallerStrings_fi-FI.txt
- %TEMP%\7zS2.tmp\ThininstallerStrings_fr-BE.txt
- %TEMP%\7zS2.tmp\ThininstallerStrings_fr-FR.txt
- %TEMP%\7zS2.tmp\ThininstallerStrings_it-IT.txt
- %TEMP%\7zS2.tmp\ThininstallerStrings_ja-JP.txt
- %TEMP%\7zS2.tmp\ThininstallerStrings_in-ID.txt
- %TEMP%\7zS2.tmp\ThininstallerStrings_it-CH.txt
- %TEMP%\7zS2.tmp\ThininstallerStrings_es-US.txt
- %TEMP%\7zS2.tmp\ThininstallerStrings_ar-EG.txt
- %TEMP%\7zS2.tmp\ThininstallerStrings_ar-IL.txt
- %TEMP%\FUD.exe
- %TEMP%\BlueStacksImstaller.exe
- %TEMP%\7zS2.tmp\ThininstallerStrings_da-DK.txt
- %TEMP%\7zS2.tmp\ThininstallerStrings_en-US.txt
- %TEMP%\7zS2.tmp\ThininstallerStrings_es-ES.txt
- %TEMP%\7zS2.tmp\ThininstallerStrings_de-AT.txt
- %TEMP%\7zS2.tmp\ThininstallerStrings_de-LI.txt
- %TEMP%\7zS2.tmp\MicroInstallerNative.exe
- %TEMP%\7zS2.tmp\HD-Logger-Native.dll
- %TEMP%\7zS2.tmp\BlueStacks-ThinInstaller_0.9.4.4078.exe.config
- %TEMP%\7zS2.tmp\BlueStacks-ThinInstaller_0.9.4.4078.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %TEMP%\bluestacks.exe
- %TEMP%\7zS2.tmp\ThininstallerStrings_zh-CN.txt
- %TEMP%\7zS2.tmp\ThininstallerStrings_pt-BR.txt
- %TEMP%\7zS2.tmp\ThininstallerStrings_pt-PT.txt
- %TEMP%\7zS2.tmp\ThininstallerStrings_ko-KR.txt
- %TEMP%\7zS2.tmp\ThininstallerStrings_nb-NO.txt
- %TEMP%\7zS2.tmp\ThininstallerStrings_ru-RU.txt
- %TEMP%\7zS2.tmp\ThininstallerStrings_tr-TR.txt
- %TEMP%\7zS2.tmp\ThininstallerStrings_vi-VN.txt
- %TEMP%\7zS2.tmp\ThininstallerStrings_sv-SE.txt
- %TEMP%\7zS2.tmp\ThininstallerStrings_th-TH.txt
- %TEMP%\Cab23.tmp
- %TEMP%\Cab25.tmp
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
- %TEMP%\Cab1D.tmp
- %TEMP%\Cab1F.tmp
- %TEMP%\Cab21.tmp
- %TEMP%\Cab2B.tmp
- %TEMP%\Cab2D.tmp
- %TEMP%\Cab2F.tmp
- %TEMP%\Cab27.tmp
- %TEMP%\Cab29.tmp
- <SYSTEM32>\PerfStringBackup.TMP
- %TEMP%\Cab1B.tmp
- %TEMP%\Cab9.tmp
- %TEMP%\CabB.tmp
- %TEMP%\CabD.tmp
- %TEMP%\Cab3.tmp
- %TEMP%\Cab5.tmp
- %TEMP%\Cab7.tmp
- %TEMP%\Cab15.tmp
- %TEMP%\Cab17.tmp
- %TEMP%\Cab19.tmp
- %TEMP%\CabF.tmp
- %TEMP%\Cab11.tmp
- %TEMP%\Cab13.tmp
- 'www.bl#######s-cloud.appspot.com':80
- 'www.go#####analytics.com':443
- 'do#####i1.no-ip.info':1177
- 'wp#d':80
- 'www.download.windowsupdate.com':80
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
- wp#d/wpad.dat
- DNS ASK www.bl#######s-cloud.appspot.com
- DNS ASK www.go#####analytics.com
- DNS ASK do#####i1.no-ip.info
- DNS ASK wp#d
- DNS ASK www.download.windowsupdate.com
- ClassName: 'WindowsForms10.Window.8.app.0.33c0d9d' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''