File scan report
Verdict Safe
Is Blue
No antivirus engine detected the signed Now.gg installer, while broad prevalence and two signer-matched prior samples outweigh unconfirmed sandbox heuristics.
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 70 flagged
- Flagged 0
- No detection 70
- No result 4
- Code signing Now.gg, INC
- Test run Completed
- First seen 1mo ago
Chapter 02
Why we think so
5 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
All 70 antivirus engines that checked it were non-detecting, including 17 major antivirus engines, and the installer carries a verified Now.gg signature.
The sample received no malicious or suspicious detections from 74 antivirus engines, with all 17 major participants reporting no detection. Its verified Now.gg signature, 3,199 submissions from 2,560 sources, and two signer-matched prior installer samples support a legitimate commercial distribution pattern. One completed sandbox run produced no malicious verdict, and none of the ten inspected files it created was identified as malicious. Host-reputation coverage was incomplete because only one host was inspected despite several observed IP and URL contacts. On balance, the independent reputation, prevalence, signing, and similarity evidence substantially outweighs the unconfirmed behavioral heuristics.
What We Detected
No malicious or suspicious result was reported by any of the 74 antivirus engines. It is also broadly distributed, with 3,199 submissions from 2,560 sources, while two prior BlueStacksInstaller.exe samples sharing both the import-table fingerprint and signer received favorable assessments.
Threat Behavior
These are notable indicators, but the sandbox did not issue a malicious verdict and the saved evidence does not establish an injection method, credential theft, or destructive action. Ten files it created were inspected without a malicious child finding, although their individual verdicts remain unknown. Several IP contacts and one URL were observed, but only one host received a saved reputation check, so a complete network-reputation result is unavailable.
What To Do Now
Use the installer only if it came directly from the official BlueStacks or Now.gg release channel, and verify that Windows still reports the Now.gg signature as valid. Keep security software enabled and avoid running copies obtained through advertisements, mirrors, or unsolicited links.
Where this verdict could be wrong4 caveats
- One of our behaviour rules fired on T1055, and one of our behaviour rules associated activity with the Windows password store; these runtime indicators warrant caution despite the absence of a malicious sandbox verdict.
- One of our behaviour rules reported direct connections to multiple IP addresses, while the cross-check of 1 host provides incomplete reputation coverage for the observed contacts.
- 2 earlier files from this signer were seen and this signer is not auto-trusted from its history, so the verified Now.gg signature has only a short local history.
- The 10 files it created have unknown individual verdicts even though no dropped file is known to be malicious.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/70 engines reported a malicious or suspicious detection.
- The code signature for Now.gg is verified.
- The file has 3,199 submissions from 2,560 sources.
- Two signer-matched import-table fingerprint samples previously received safe verdicts.
- Sandbox evidence mapped activity to process injection.
- Direct-IP network traffic was observed.
- Host-reputation coverage was incomplete for the observed contacts.
- The local Now.gg signer history contains only two prior samples.
- Ten files it created lack individual verdicts.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 25sandbox rule tags
- 7spawned processes
- 8network contacts
- 33filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
25MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1033· Reads user info
- T1055· Process injection
- T1057· Lists programs
- T1059· Runs commands
- T1070· Covers its tracks
- T1071· Application protocol
- T1074
- T1082· System recon
- T1083· Scans your files
- T1105· Network file transfer
- T1106
- T1112
- T1129· Loads modules
- T1222
- T1485
- T1486· File encryption
- T1497· Sandbox evasion
- T1543· Service install
- T1547· Auto-start
- T1562· Disables security
- T1564.003· Hides artifacts
- T1568
- T1573
- T1574· Execution hijack
Observed activity
Processes started
7Programs the file ran, with their command lines.
1cea3bcca0e342_MzsxNQ___VHJhaWxzIG9mIENvbGQgU3RlZWw6Tlc_.exe"C:\Users\<USER>\Desktop\1cea3bcca0e342_MzsxNQ___VHJhaWxzIG9mIENvbGQgU3RlZWw6Tlc_.exe"BlueStacksInstaller.exe"C:\Users\<USER>\AppData\Local\Temp\7zS467A59F0\BlueStacksInstaller.exe"BlueStacksInstaller.exeC:\Users\<USER>\AppData\Local\Temp\7zS815F3114\BlueStacksInstaller.exeHD-CheckCpu.exeC:\Users\<USER>\AppData\Local\Temp\7zS815F3114\HD-CheckCpu.exe --cmd checkHypervEnabledBlueStacksInstaller.exeC:\Users\<USER>\AppData\Local\Temp\7zS4690DBC3\BlueStacksInstaller.exeHD-CheckCpu.exeC:\Users\<USER>\AppData\Local\Temp\7zS4690DBC3\HD-CheckCpu.exe --cmd checkHypervEnabled
Show all 7 entries for processes started
1cea3bcca0e342_MzsxNQ==_VHJhaWxzIG9mIENvbGQgU3RlZWw6Tlc=.exe"C:\Users\user\Desktop\1cea3bcca0e342_MzsxNQ==_VHJhaWxzIG9mIENvbGQgU3RlZWw6Tlc=.exe"
Network contacts
88 hosts, listed as 7 addresses, 1 link. Links show the host and path only.
- IP address
34.160.86.181 - IP address
23.218.218.18 - IP address
23.11.32.159 - IP address
23.53.11.240 - IP address
23.54.127.41 - IP address
162.159.142.9
Show all 8 entries for network contacts
- IP address
199.232.214.172 - URL
https://cloud.bluestacks.com/api/getcountryforip
Files
30Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\7zS467A59F0\Assets - Written
C:\Users\<USER>\AppData\Local\Temp\7zS467A59F0\Locales - Written
C:\Users\<USER>\AppData\Local\Temp\7zS467A59F0\OpenClaw - Written
C:\Users\<USER>\AppData\Local\Temp\7zS467A59F0\Assets\backicon.png - Written
C:\Users\<USER>\AppData\Local\Temp\7zS467A59F0\Assets\change.png - Written
C:\Users\<USER>\AppData\Local\Temp\7zS467A59F0\Assets\change_click.png
Show all 30 entries for files
- Written
C:\Users\<USER>\AppData\Local\Temp\7zS467A59F0\Assets\change_hover.png - Written
C:\Users\<USER>\AppData\Local\Temp\7zS467A59F0\Assets\checked_gray.png - Written
C:\Users\<USER>\AppData\Local\Temp\7zS467A59F0\Assets\checked_gray_hover.png - Written
C:\Users\<USER>\AppData\Local\Temp\7zS467A59F0\Assets\close_red_click.png - Written
C:\Users\<USER>\AppData\Local\Temp\7zS467A59F0\Assets\close_red_hover.png - Written
C:\Users\<USER>\AppData\Local\Temp\7zS467A59F0\Assets\custom.png - Written
C:\Users\<USER>\AppData\Local\Temp\7zS467A59F0\Assets\custom_click.png - Written
C:\Users\<USER>\AppData\Local\Temp\7zS467A59F0\Assets\custom_hover.png - Written
C:\Users\<USER>\AppData\Local\Temp\7zS467A59F0\Assets\discord_icon.png - Deleted
C:\Users\<USER>\AppData\Local\Temp\7zS467A59F0\Assets\backicon.png - Deleted
C:\Users\<USER>\AppData\Local\Temp\7zS467A59F0\Assets\change.png - Deleted
C:\Users\<USER>\AppData\Local\Temp\7zS467A59F0\Assets\change_click.png - Deleted
C:\Users\<USER>\AppData\Local\Temp\7zS467A59F0\Assets\change_hover.png - Deleted
C:\Users\<USER>\AppData\Local\Temp\7zS467A59F0\Assets\checked_gray.png - Deleted
C:\Users\<USER>\AppData\Local\Temp\7zS467A59F0\Assets\checked_gray_hover.png - Deleted
C:\Users\<USER>\AppData\Local\Temp\7zS467A59F0\Assets\close_red.png - Deleted
C:\Users\<USER>\AppData\Local\Temp\7zS467A59F0\Assets\close_red_click.png - Deleted
C:\Users\<USER>\AppData\Local\Temp\7zS467A59F0\Assets\close_red_hover.png - Deleted
C:\Users\<USER>\AppData\Local\Temp\7zS467A59F0\Assets\custom.png - Deleted
C:\Users\<USER>\AppData\Local\Temp\7zS467A59F0\Assets\custom_click.png - Deleted
C:\Users\<USER>\AppData\Local\Temp\7zS467A59F0\Assets\custom_hover.png - Deleted
C:\Users\<USER>\AppData\Local\Temp\7zS467A59F0\Assets\discord_icon.png - Deleted
C:\Users\<USER>\AppData\Local\Temp\7zS467A59F0\Assets\discord_icon_click.png - Deleted
C:\Users\<USER>\AppData\Local\Temp\7zS467A59F0\Assets\discord_icon_hover.png
Mutexes
3Named locks a program uses so only one copy runs; malware families often reuse them.
Local\WERReportingForProcess1020Global\70a398c8-7aa7-4ca8-b9f2-248d2505fe83Global\BlueStacks_MicroInstaller_Locknxt
Sandbox background — not the file
10The analysis machine's own processes and connections, recorded in every run.
- VM process
WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1020 -s 1916 - VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc - VM process
lsass.exeC:\Windows\system32\lsass.exe
Show all 10 entries for sandbox background — not the file
- VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost - VM host
8.8.8.8 - VM host
162.159.36.2
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- abe3ee8bd8aef53d4f9b…e8b1faNot checkedno saved verdict
- 5f97cf2518d3c61f536e…ebd924Not checkedno saved verdict
- fa64884054171515e97b…9cb1c1Not checkedno saved verdict
- 8e5847487da148ebb3ea…4e6dc1Not checkedno saved verdict
- d8e502fab00b0c6f06ba…229ad3Not checkedno saved verdict
- d7c79677d2ef897fa0ad…165c20Not checkedno saved verdict
- d0b6d143642d356b40c4…b09bfbNot checkedno saved verdict
- d5a7e6fc5e92e0b29a4f…2ce0cdNot checkedno saved verdict
- 7c625ae4668cc03e37e4…8acdd0Not checkedno saved verdict
- fbece8bb5f4dfa55dcfb…e68f7bNot checkedno saved verdict
Chapter 04
Technical details
None of the 70 antivirus engines that checked it flag it; signed by Now.gg, INC.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 17, 2026, 1:35 PM UTC
- SHA-256
267737b6425f3a473e11b6051f2a95ddab5f8f6d2e6aebd2ff9033fd31d5c145- SHA-1
eee25a5f0545fbb708ccbca093ee00e408523660- MD5
d0df19ad5d5cc93d5397f13dea2ea5fc
About this file
BlueStacksInstaller.exe is a Win32 EXE file of 953.8 kB.
- Type and size
- Win32 EXE · 953.8 kB
- Signer
- Now.gg, INCValid code signature.
- First seen
- Sep 10, 2026On VirusTotal.
- Submitted by
- 2,560 distinct sources
- Packer
- None detected
- Entropy
- 8.00 of 8
First scanned Updated
Antivirus consensus
0 of 70 engines flagged this file
4 of the 74 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust16 engines0flagged
View all 74 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely uploaded, but first seen within the last six months. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is BlueStacksInstaller.exe safe?
What is BlueStacksInstaller.exe?
How many antivirus engines detected BlueStacksInstaller.exe?
Is BlueStacksInstaller.exe digitally signed?
What is the SHA-256 hash of BlueStacksInstaller.exe?
Is it safe to run BlueStacksInstaller.exe?
How up to date is this analysis of BlueStacksInstaller.exe?
Community
Member reviews and reports for this exact file hash.