3bc3990b5045257ae2ee56efaca48b547acabf5749b361c229fa2b0204922255

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
108s
max time network
119s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/08/2026, 19:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BsgLauncher.15.0.0.4574.exe
Size 146.3MB
Sample260806-xrt3caydnd
SHA256 3bc3990b5045257ae2ee56efaca48b547acabf5749b361c229fa2b0204922255
MD5 6532e6e048a69d23cc62f1310e797f25
SHA1 abb90f6a816f1433963ea4c7758fc72a4188dc88
SHA512 42946e136de43ad68d5f55b2a42af92a7c7860fad527f3ad40468ec456ef7005b16688f4f049c4039ebaf76c4aed1c014cf7305b2de79f714df64d4a10bd22d2
SSDEEP 3145728:xIhEvvrt2qBaKkOvwE5Jt8RuCkPl/bb2AgiP4lzPien8PB:xVvzthq1GlvgG4lLNn8PB
TLSH
T1EB78337BA25CB13EEF5F0E3901769A4085BB71A5E5AE4C2E0BD48A1DCF275203D33261
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery installer persistence ransomware

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00} = "\"C:\\ProgramData\\Package Cache\\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00} = "\"C:\\ProgramData\\Package Cache\\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4600	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Network Service Discovery 1 TTPs 11 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4116	BsgLauncher.exe
5640	BsgLauncher.exe
1412	BsgLauncher.exe
1636	BsgLauncher.exe
1080	BsgLauncher.exe
1504	BsgLauncher.exe
3296	BsgLauncher.exe
5732	BsgLauncher.exe
832	BsgLauncher.exe
4868	BsgLauncher.exe
5088	BsgLauncher.exe

Drops file in System32 directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 23 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DFB6052BF6274191FB.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF69B880E41DC05644.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e592c59.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI384E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3241.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3417.tmp	msiexec.exe
File created	C:\Windows\Installer\e592c59.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{AECD4ED0-8A3B-41E9-92D1-6BEE0374CCAF}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3A24.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEB9C47DD745F63F7.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{61B44572-8722-4DAF-8ACF-8E742D30BCC5}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE39D9AF1311B3909.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF13883D7B646CAAEB.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF24CBADDF3F210607.TMP	msiexec.exe
File created	C:\Windows\Installer\e592c6e.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC53C08D2EC707F37.TMP	msiexec.exe
File created	C:\Windows\Installer\e592c46.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e592c46.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e592c58.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF24DB055B5EE24DC.TMP	msiexec.exe

Executes dropped EXE 20 IoCs

pid	Process
5864	BsgLauncher.15.0.0.4574.tmp
888	vc_redist.x64.exe
3176	vc_redist.x64.exe
2196	VC_redist.x64.exe
3628	VC_redist.x64.exe
2920	VC_redist.x64.exe
844	VC_redist.x64.exe
5752	VC_redist.x64.exe
4760	BsgLauncher.exe
3296	BsgLauncher.exe
1504	BsgLauncher.exe
5640	BsgLauncher.exe
5732	BsgLauncher.exe
832	BsgLauncher.exe
4868	BsgLauncher.exe
1412	BsgLauncher.exe
1636	BsgLauncher.exe
1080	BsgLauncher.exe
5088	BsgLauncher.exe
4116	BsgLauncher.exe

Loads dropped DLL 64 IoCs

pid	Process
3176	vc_redist.x64.exe
1072	VC_redist.x64.exe
844	VC_redist.x64.exe
4760	BsgLauncher.exe
4760	BsgLauncher.exe
4760	BsgLauncher.exe
4760	BsgLauncher.exe
4760	BsgLauncher.exe
4760	BsgLauncher.exe
4760	BsgLauncher.exe
4760	BsgLauncher.exe
4760	BsgLauncher.exe
5640	BsgLauncher.exe
5640	BsgLauncher.exe
5640	BsgLauncher.exe
5640	BsgLauncher.exe
5640	BsgLauncher.exe
5640	BsgLauncher.exe
5640	BsgLauncher.exe
5640	BsgLauncher.exe
3296	BsgLauncher.exe
3296	BsgLauncher.exe
3296	BsgLauncher.exe
3296	BsgLauncher.exe
3296	BsgLauncher.exe
3296	BsgLauncher.exe
3296	BsgLauncher.exe
3296	BsgLauncher.exe
5640	BsgLauncher.exe
5640	BsgLauncher.exe
5640	BsgLauncher.exe
5640	BsgLauncher.exe
3296	BsgLauncher.exe
3296	BsgLauncher.exe
3296	BsgLauncher.exe
3296	BsgLauncher.exe
3296	BsgLauncher.exe
4760	BsgLauncher.exe
5640	BsgLauncher.exe
1504	BsgLauncher.exe
1504	BsgLauncher.exe
1504	BsgLauncher.exe
1504	BsgLauncher.exe
1504	BsgLauncher.exe
1504	BsgLauncher.exe
1504	BsgLauncher.exe
1504	BsgLauncher.exe
3296	BsgLauncher.exe
3296	BsgLauncher.exe
3296	BsgLauncher.exe
3296	BsgLauncher.exe
1504	BsgLauncher.exe
1504	BsgLauncher.exe
1504	BsgLauncher.exe
1504	BsgLauncher.exe
1504	BsgLauncher.exe
5732	BsgLauncher.exe
5732	BsgLauncher.exe
5732	BsgLauncher.exe
5732	BsgLauncher.exe
5732	BsgLauncher.exe
5732	BsgLauncher.exe
5732	BsgLauncher.exe
5732	BsgLauncher.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BsgLauncher.15.0.0.4574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BsgLauncher.15.0.0.4574.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/2520-1-0x0000000000400000-0x00000000004E4000-memory.dmp	innosetup
behavioral1/memory/2520-11-0x0000000000400000-0x00000000004E4000-memory.dmp	innosetup
behavioral1/memory/2520-1779-0x0000000000400000-0x00000000004E4000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009849ce13e51016660000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009849ce130000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809009849ce13000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a9849ce13000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d9849ce13000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	BsgLauncher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	BsgLauncher.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	BsgLauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	BsgLauncher.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	BsgLauncher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	BsgLauncher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	BsgLauncher.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305169255110393"	BsgLauncher.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	BsgLauncher.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\27544B162278FAD4A8FCE847D203CB5C\Provider	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Version = "14.50.35719"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\ = "{AECD4ED0-8A3B-41E9-92D1-6BEE0374CCAF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0DE4DCEAB3A89E14291DB6EE3047CCFA\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0DE4DCEAB3A89E14291DB6EE3047CCFA\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\27544B162278FAD4A8FCE847D203CB5C\Servicing_Key	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0DE4DCEAB3A89E14291DB6EE3047CCFA\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0DE4DCEAB3A89E14291DB6EE3047CCFA\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27544B162278FAD4A8FCE847D203CB5C\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27544B162278FAD4A8FCE847D203CB5C\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27544B162278FAD4A8FCE847D203CB5C\SourceList\Media\1 = ";"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0DE4DCEAB3A89E14291DB6EE3047CCFA\SourceList\PackageName = "vc_runtimeAdditional_x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.50.35719"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27544B162278FAD4A8FCE847D203CB5C\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27544B162278FAD4A8FCE847D203CB5C\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53\27544B162278FAD4A8FCE847D203CB5C	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27544B162278FAD4A8FCE847D203CB5C\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0DE4DCEAB3A89E14291DB6EE3047CCFA\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0DE4DCEAB3A89E14291DB6EE3047CCFA	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\27544B162278FAD4A8FCE847D203CB5C	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27544B162278FAD4A8FCE847D203CB5C\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0DE4DCEAB3A89E14291DB6EE3047CCFA\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.50,bundle	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27544B162278FAD4A8FCE847D203CB5C\ProductName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.50.35719"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27544B162278FAD4A8FCE847D203CB5C\PackageCode = "475FC1A657ACA7B48AAADCFA729BDE01"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27544B162278FAD4A8FCE847D203CB5C\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0DE4DCEAB3A89E14291DB6EE3047CCFA\AdvertiseFlags = "388"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27544B162278FAD4A8FCE847D203CB5C\Version = "238193543"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0DE4DCEAB3A89E14291DB6EE3047CCFA\PackageCode = "3E495A2D16316AD4F9919561BAD80BFC"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1\0DE4DCEAB3A89E14291DB6EE3047CCFA	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0DE4DCEAB3A89E14291DB6EE3047CCFA\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0DE4DCEAB3A89E14291DB6EE3047CCFA\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{AECD4ED0-8A3B-41E9-92D1-6BEE0374CCAF}v14.50.35719\\packages\\vcRuntimeAdditional_amd64\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	BsgLauncher.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Version = "14.50.35719"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0DE4DCEAB3A89E14291DB6EE3047CCFA\VC_Runtime_Additional	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.50,bundle\Dependents	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0DE4DCEAB3A89E14291DB6EE3047CCFA\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\ = "{61B44572-8722-4DAF-8ACF-8E742D30BCC5}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27544B162278FAD4A8FCE847D203CB5C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27544B162278FAD4A8FCE847D203CB5C\SourceList\PackageName = "vc_runtimeMinimum_x64.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0DE4DCEAB3A89E14291DB6EE3047CCFA\Version = "238193543"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0DE4DCEAB3A89E14291DB6EE3047CCFA\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0DE4DCEAB3A89E14291DB6EE3047CCFA\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0DE4DCEAB3A89E14291DB6EE3047CCFA\Clients = 3a0000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Media	msiexec.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
5864	BsgLauncher.15.0.0.4574.tmp
5864	BsgLauncher.15.0.0.4574.tmp
4600	msiexec.exe
4600	msiexec.exe
4600	msiexec.exe
4600	msiexec.exe
4600	msiexec.exe
4600	msiexec.exe
4600	msiexec.exe
4600	msiexec.exe
4760	BsgLauncher.exe
4760	BsgLauncher.exe
3296	BsgLauncher.exe
3296	BsgLauncher.exe
5640	BsgLauncher.exe
5640	BsgLauncher.exe
1504	BsgLauncher.exe
1504	BsgLauncher.exe
5732	BsgLauncher.exe
5732	BsgLauncher.exe
832	BsgLauncher.exe
832	BsgLauncher.exe
4868	BsgLauncher.exe
4868	BsgLauncher.exe
1412	BsgLauncher.exe
1412	BsgLauncher.exe
1636	BsgLauncher.exe
1636	BsgLauncher.exe
1080	BsgLauncher.exe
1080	BsgLauncher.exe
5088	BsgLauncher.exe
5088	BsgLauncher.exe
4116	BsgLauncher.exe
4116	BsgLauncher.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	3344	vssvc.exe
Token: SeRestorePrivilege	3344	vssvc.exe
Token: SeAuditPrivilege	3344	vssvc.exe
Token: SeShutdownPrivilege	2196	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	2196	VC_redist.x64.exe
Token: SeSecurityPrivilege	4600	msiexec.exe
Token: SeCreateTokenPrivilege	2196	VC_redist.x64.exe
Token: SeAssignPrimaryTokenPrivilege	2196	VC_redist.x64.exe
Token: SeLockMemoryPrivilege	2196	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	2196	VC_redist.x64.exe
Token: SeMachineAccountPrivilege	2196	VC_redist.x64.exe
Token: SeTcbPrivilege	2196	VC_redist.x64.exe
Token: SeSecurityPrivilege	2196	VC_redist.x64.exe
Token: SeTakeOwnershipPrivilege	2196	VC_redist.x64.exe
Token: SeLoadDriverPrivilege	2196	VC_redist.x64.exe
Token: SeSystemProfilePrivilege	2196	VC_redist.x64.exe
Token: SeSystemtimePrivilege	2196	VC_redist.x64.exe
Token: SeProfSingleProcessPrivilege	2196	VC_redist.x64.exe
Token: SeIncBasePriorityPrivilege	2196	VC_redist.x64.exe
Token: SeCreatePagefilePrivilege	2196	VC_redist.x64.exe
Token: SeCreatePermanentPrivilege	2196	VC_redist.x64.exe
Token: SeBackupPrivilege	2196	VC_redist.x64.exe
Token: SeRestorePrivilege	2196	VC_redist.x64.exe
Token: SeShutdownPrivilege	2196	VC_redist.x64.exe
Token: SeDebugPrivilege	2196	VC_redist.x64.exe
Token: SeAuditPrivilege	2196	VC_redist.x64.exe
Token: SeSystemEnvironmentPrivilege	2196	VC_redist.x64.exe
Token: SeChangeNotifyPrivilege	2196	VC_redist.x64.exe
Token: SeRemoteShutdownPrivilege	2196	VC_redist.x64.exe
Token: SeUndockPrivilege	2196	VC_redist.x64.exe
Token: SeSyncAgentPrivilege	2196	VC_redist.x64.exe
Token: SeEnableDelegationPrivilege	2196	VC_redist.x64.exe
Token: SeManageVolumePrivilege	2196	VC_redist.x64.exe
Token: SeImpersonatePrivilege	2196	VC_redist.x64.exe
Token: SeCreateGlobalPrivilege	2196	VC_redist.x64.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5864	BsgLauncher.15.0.0.4574.tmp
3176	vc_redist.x64.exe
844	VC_redist.x64.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 5864	2520	BsgLauncher.15.0.0.4574.exe	81
PID 5864 wrote to memory of 888	5864	BsgLauncher.15.0.0.4574.tmp	82
PID 888 wrote to memory of 3176	888	vc_redist.x64.exe	84
PID 3176 wrote to memory of 2196	3176	vc_redist.x64.exe	85
PID 3628 wrote to memory of 2920	3628	VC_redist.x64.exe	95
PID 2920 wrote to memory of 844	2920	VC_redist.x64.exe	96
PID 2196 wrote to memory of 3388	2196	VC_redist.x64.exe	97
PID 3388 wrote to memory of 1072	3388	VC_redist.x64.exe	98
PID 1072 wrote to memory of 1912	1072	VC_redist.x64.exe	99
PID 844 wrote to memory of 5752	844	VC_redist.x64.exe	100
PID 4760 wrote to memory of 3296	4760	BsgLauncher.exe	103
PID 4760 wrote to memory of 1504	4760	BsgLauncher.exe	104
PID 4760 wrote to memory of 5640	4760	BsgLauncher.exe	105
PID 4760 wrote to memory of 5732	4760	BsgLauncher.exe	107
PID 4760 wrote to memory of 4868	4760	BsgLauncher.exe	108
PID 4760 wrote to memory of 832	4760	BsgLauncher.exe	109
PID 4760 wrote to memory of 1412	4760	BsgLauncher.exe	110
PID 4760 wrote to memory of 1636	4760	BsgLauncher.exe	112
PID 4760 wrote to memory of 1080	4760	BsgLauncher.exe	113
PID 4760 wrote to memory of 5088	4760	BsgLauncher.exe	114
PID 4760 wrote to memory of 4116	4760	BsgLauncher.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\BsgLauncher.15.0.0.4574.exe
"C:\Users\Admin\AppData\Local\Temp\BsgLauncher.15.0.0.4574.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Users\Admin\AppData\Local\Temp\is-E8IPF.tmp\BsgLauncher.15.0.0.4574.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-E8IPF.tmp\BsgLauncher.15.0.0.4574.tmp" /SL5="$6011A,152437337,878592,C:\Users\Admin\AppData\Local\Temp\BsgLauncher.15.0.0.4574.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5864
- - C:\Users\Admin\AppData\Local\Temp\is-5O756.tmp\vc_redist.x64.exe
    "C:\Users\Admin\AppData\Local\Temp\is-5O756.tmp\vc_redist.x64.exe" /install /passive /norestart
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:888
  - - C:\Windows\Temp\{C17D3756-DC49-4DC7-A249-F71C7D0F581F}\.cr\vc_redist.x64.exe
      "C:\Windows\Temp\{C17D3756-DC49-4DC7-A249-F71C7D0F581F}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-5O756.tmp\vc_redist.x64.exe" -burn.filehandle.attached=624 -burn.filehandle.self=632 /install /passive /norestart
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3176
    - - C:\Windows\Temp\{AC3E8CBE-C2CE-4CFD-9831-6941A6F34549}\.be\VC_redist.x64.exe
        
        "C:\Windows\Temp\{AC3E8CBE-C2CE-4CFD-9831-6941A6F34549}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{2F04059C-53AB-4315-88E8-2BFAC8D81C78} {7DC2D00A-CA9D-4405-A7B7-CE33547BC349} 3176
        5⤵
        Adds Run key to start application
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2196
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00} -burn.filehandle.self=1112 -burn.embedded BurnPipe.{FB935AC4-7368-47C0-A3B2-0AFF17C52795} {54BCAA80-2311-453A-B4F9-BA495CED8E25} 2196
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3388
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=600 -burn.filehandle.self=616 -uninstall -quiet -burn.related.upgrade -burn.ancestors={91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00} -burn.filehandle.self=1112 -burn.embedded BurnPipe.{FB935AC4-7368-47C0-A3B2-0AFF17C52795} {54BCAA80-2311-453A-B4F9-BA495CED8E25} 2196
        7⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1072
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{8B800835-8993-44D8-B42C-039D66EC27F2} {684D6533-2C0E-4015-8886-3EA00D6C97AB} 1072
        8⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1912

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3344

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:1164

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4600

C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3628
- C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe
  "C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260807003753.log" /install
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260807003753.log" /install
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:844
  - - C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{96F13AB6-1395-4E9D-88AC-5675ACEAE804} {D547D433-760C-4CCF-A194-7BFA91AB7187} 844
      4⤵
      Adds Run key to start application
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5752

C:\Battlestate Games\BsgLauncher\BsgLauncher.exe
"C:\Battlestate Games\BsgLauncher\BsgLauncher.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Battlestate Games\BsgLauncher\BsgLauncher.exe
  "C:\Battlestate Games\BsgLauncher\BsgLauncher.exe" --type=gpu-process --no-sandbox --user-agent=BsgLauncher/15.0.0.4574 --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Battlestate Games\BsgLauncher\CefCache" --cefsharpexitsub --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=2840,i,4338543409522843573,4942163768502097046,262144 --field-trial-handle=3112,i,11300583990308830019,8044622882675100250,262144 --disable-features=EnableHangWatcher,GlicActorUi,LensOverlay --variations-seed-version --trace-process-track-uuid=3190708988185955192 --enable-logging=handle --log-file=3228 --mojo-platform-channel-handle=3108 /prefetch:2 --host-process-id=4760 --custom-scheme=local|19
  2⤵
  - Network Service Discovery
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3296
- C:\Battlestate Games\BsgLauncher\BsgLauncher.exe
  "C:\Battlestate Games\BsgLauncher\BsgLauncher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --ignore-certificate-errors --user-agent=BsgLauncher/15.0.0.4574 --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Battlestate Games\BsgLauncher\CefCache" --cefsharpexitsub --metrics-shmem-handle=3164,i,10656612616988818439,8318423836690574074,524288 --field-trial-handle=3112,i,11300583990308830019,8044622882675100250,262144 --disable-features=EnableHangWatcher,GlicActorUi,LensOverlay --variations-seed-version --trace-process-track-uuid=3190708989122997041 --enable-logging=handle --log-file=3272 --mojo-platform-channel-handle=3264 /prefetch:11 --host-process-id=4760 --custom-scheme=local|19
  2⤵
  - Network Service Discovery
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1504
- C:\Battlestate Games\BsgLauncher\BsgLauncher.exe
  "C:\Battlestate Games\BsgLauncher\BsgLauncher.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --ignore-certificate-errors --ignore-certificate-errors --user-agent=BsgLauncher/15.0.0.4574 --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Battlestate Games\BsgLauncher\CefCache" --cefsharpexitsub --metrics-shmem-handle=3432,i,16927495746370419145,18170996797876001578,524288 --field-trial-handle=3112,i,11300583990308830019,8044622882675100250,262144 --disable-features=EnableHangWatcher,GlicActorUi,LensOverlay --variations-seed-version --trace-process-track-uuid=3190708990060038890 --enable-logging=handle --log-file=3440 --mojo-platform-channel-handle=3304 /prefetch:13 --host-process-id=4760 --custom-scheme=local|19
  2⤵
  - Network Service Discovery
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:5640
- C:\Battlestate Games\BsgLauncher\BsgLauncher.exe
  "C:\Battlestate Games\BsgLauncher\BsgLauncher.exe" --type=gpu-process --no-sandbox --user-agent=BsgLauncher/15.0.0.4574 --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Battlestate Games\BsgLauncher\CefCache" --cefsharpexitsub --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --metrics-shmem-handle=4048,i,13934187480795499896,15910863876862193201,262144 --field-trial-handle=3112,i,11300583990308830019,8044622882675100250,262144 --disable-features=EnableHangWatcher,GlicActorUi,LensOverlay --variations-seed-version --trace-process-track-uuid=3190708991934122588 --enable-logging=handle --log-file=2132 --mojo-platform-channel-handle=4724 /prefetch:2 --host-process-id=4760 --custom-scheme=local|19
  2⤵
  - Network Service Discovery
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:5732
- C:\Battlestate Games\BsgLauncher\BsgLauncher.exe
  "C:\Battlestate Games\BsgLauncher\BsgLauncher.exe" --type=renderer --user-agent=BsgLauncher/15.0.0.4574 --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Battlestate Games\BsgLauncher\CefCache" --cefsharpexitsub --no-sandbox --disable-back-forward-cache --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=5256,i,5878647001859523644,7499050808276866146,2097152 --field-trial-handle=3112,i,11300583990308830019,8044622882675100250,262144 --disable-features=EnableHangWatcher,GlicActorUi,LensOverlay --variations-seed-version --trace-process-track-uuid=3190708992871164437 --enable-logging=handle --log-file=5292 --mojo-platform-channel-handle=5288 --host-process-id=4760 --custom-scheme=local|19 /prefetch:1
  2⤵
  - Network Service Discovery
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4868
- C:\Battlestate Games\BsgLauncher\BsgLauncher.exe
  "C:\Battlestate Games\BsgLauncher\BsgLauncher.exe" --type=renderer --user-agent=BsgLauncher/15.0.0.4574 --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Battlestate Games\BsgLauncher\CefCache" --cefsharpexitsub --no-sandbox --disable-back-forward-cache --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=5264,i,834220405333782999,8814989719633366360,2097152 --field-trial-handle=3112,i,11300583990308830019,8044622882675100250,262144 --disable-features=EnableHangWatcher,GlicActorUi,LensOverlay --variations-seed-version --trace-process-track-uuid=3190708990997080739 --enable-logging=handle --log-file=5304 --mojo-platform-channel-handle=5296 --host-process-id=4760 --custom-scheme=local|19 /prefetch:1
  2⤵
  - Network Service Discovery
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:832
- C:\Battlestate Games\BsgLauncher\BsgLauncher.exe
  "C:\Battlestate Games\BsgLauncher\BsgLauncher.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --ignore-certificate-errors --user-agent=BsgLauncher/15.0.0.4574 --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Battlestate Games\BsgLauncher\CefCache" --cefsharpexitsub --metrics-shmem-handle=6416,i,6219803699002517727,7384319395511016742,524288 --field-trial-handle=3112,i,11300583990308830019,8044622882675100250,262144 --disable-features=EnableHangWatcher,GlicActorUi,LensOverlay --variations-seed-version --trace-process-track-uuid=3190708993808206286 --enable-logging=handle --log-file=6452 --mojo-platform-channel-handle=6392 /prefetch:14 --host-process-id=4760 --custom-scheme=local|19
  2⤵
  - Network Service Discovery
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1412
- C:\Battlestate Games\BsgLauncher\BsgLauncher.exe
  "C:\Battlestate Games\BsgLauncher\BsgLauncher.exe" --type=renderer --user-agent=BsgLauncher/15.0.0.4574 --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Battlestate Games\BsgLauncher\CefCache" --cefsharpexitsub --no-sandbox --disable-back-forward-cache --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=7012,i,14279996149703565857,5618026616313731980,2097152 --field-trial-handle=3112,i,11300583990308830019,8044622882675100250,262144 --disable-features=EnableHangWatcher,GlicActorUi,LensOverlay --variations-seed-version --trace-process-track-uuid=3190708994745248135 --enable-logging=handle --log-file=6904 --mojo-platform-channel-handle=6900 --host-process-id=4760 --custom-scheme=local|19 /prefetch:1
  2⤵
  - Network Service Discovery
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1636
- C:\Battlestate Games\BsgLauncher\BsgLauncher.exe
  "C:\Battlestate Games\BsgLauncher\BsgLauncher.exe" --type=renderer --user-agent=BsgLauncher/15.0.0.4574 --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Battlestate Games\BsgLauncher\CefCache" --cefsharpexitsub --no-sandbox --disable-back-forward-cache --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=7112,i,18438715050026606663,8933335001804571453,2097152 --field-trial-handle=3112,i,11300583990308830019,8044622882675100250,262144 --disable-features=EnableHangWatcher,GlicActorUi,LensOverlay --variations-seed-version --trace-process-track-uuid=3190708995682289984 --enable-logging=handle --log-file=7132 --mojo-platform-channel-handle=7128 --host-process-id=4760 --custom-scheme=local|19 /prefetch:1
  2⤵
  - Network Service Discovery
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1080
- C:\Battlestate Games\BsgLauncher\BsgLauncher.exe
  "C:\Battlestate Games\BsgLauncher\BsgLauncher.exe" --type=renderer --user-agent=BsgLauncher/15.0.0.4574 --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Battlestate Games\BsgLauncher\CefCache" --cefsharpexitsub --no-sandbox --disable-back-forward-cache --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=7216,i,5324389457390190725,2034416086433172136,2097152 --field-trial-handle=3112,i,11300583990308830019,8044622882675100250,262144 --disable-features=EnableHangWatcher,GlicActorUi,LensOverlay --variations-seed-version --trace-process-track-uuid=3190708996619331833 --enable-logging=handle --log-file=6624 --mojo-platform-channel-handle=7252 --host-process-id=4760 --custom-scheme=local|19 /prefetch:1
  2⤵
  - Network Service Discovery
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5088
- C:\Battlestate Games\BsgLauncher\BsgLauncher.exe
  "C:\Battlestate Games\BsgLauncher\BsgLauncher.exe" --type=renderer --user-agent=BsgLauncher/15.0.0.4574 --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Battlestate Games\BsgLauncher\CefCache" --cefsharpexitsub --no-sandbox --disable-back-forward-cache --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=7136,i,5412547332401253136,4218119601903984121,2097152 --field-trial-handle=3112,i,11300583990308830019,8044622882675100250,262144 --disable-features=EnableHangWatcher,GlicActorUi,LensOverlay --variations-seed-version --trace-process-track-uuid=3190708997556373682 --enable-logging=handle --log-file=7224 --mojo-platform-channel-handle=7108 --host-process-id=4760 --custom-scheme=local|19 /prefetch:1
  2⤵
  - Network Service Discovery
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BsgLauncher.exe

Path C:\Battlestate Games\BsgLauncher\BsgLauncher.exe
Size 1.2MB
SHA256 e80cbc70fce3be6ad467dbd06aa4736a8bdc5dc3faefa75c66fa7fdce9c9634d
MD5 4d2e94b6786f85ab9035472acd63783a
SHA1 8b8291e1610f1145a67e569e85ee1cee0b275d9b
SHA512 df2240a3cd29b2104556a6b6cc137b8b1c4bb0cd018ca02bbcd308f4fc58c89f9c2d667698f6060577371abbe048dcd96f4dd4b45e589336efc446e715fb1abc
SSDEEP 12288:Z39R2PjWMYCmt/SZxoRJTYhWdry1FPAsM+JbyMsmi9CpLfu5/3FYGALXSTj9Mybi:Z9R2ACI7rAosjbyMsLNl3FYGvMyPTiKm
TLSH
T153454905BB98DA62CD7E827AE162552483B0CCD7AE4AF78F5758F0DC7CBA3102D8511B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BsgLauncher.exe.config

Path C:\Battlestate Games\BsgLauncher\BsgLauncher.exe.config
Size 2KB
SHA256 adab43bd359b73143994550381be80e7a2cd9accde26ba5820ff74b121cfe822
MD5 157c7422a39ab4aead67a5006d0bcd88
SHA1 afb2c8971e7f4fb6c243ffff6ce4f99c57d85cec
SHA512 cf23ad82993a158afe8c9dcc8db686d1fea41df7af36533a55570be2996971653e73368b68e9b59e646a291ccb55900ae5dcf4e2f489f332d8046105a21f792a
TLSH
T1F1412021A1C8AFE44B7249E13E6F6428CB7D03B7294C058DB0EE6E478F35A5A1607177
MD5 SHA1 SHA512 TLSH

Submit Download

CefSharp.Core.Runtime.dll

Path C:\Battlestate Games\BsgLauncher\CefSharp.Core.Runtime.dll
Size 1.2MB
SHA256 f00ccdd2dcf1914b75ed7c44dc8650f80742d9d3db171d43ad26fdd5bf3a99e9
MD5 188a9c3cd0254ac23380f1bd9eb35486
SHA1 878afb9ce56a14f0ae42f8283e3640be746f7230
SHA512 9ac9eb981196982d156cfda122a6358c0ff763da084b524d776ac580421ae0962709be5420586cbc857a03107927968d24dd7992dc02b354de6a134a4f8be75a
SSDEEP 24576:Jv98ew0NMAouoyFIOpiTieSiecbggIqc8TNWxXNkjngPaTgeWYyyx2NOb/LMrKs:t99zAKFIOpiTieSiecbggIqc8TNWxXN9
TLSH
T107457D2A22461866D1EFE23F807347A6C7B3B512A3A1E3CF955183551F6B7C4C63E31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CefSharp.Core.dll

Path C:\Battlestate Games\BsgLauncher\CefSharp.Core.dll
Size 1.0MB
SHA256 0cfb46c5f47c692f8db5f79f0cd3b498978c0c9704d70655997e39c6b78f2836
MD5 1e27c3177d9e1ff66a39d42e0211ebcb
SHA1 4326761142001666db02ddd2db467057f98fd41d
SHA512 5ff0a18b996fa4a52ffae69395b05503c07342bc54e275ff7ca06192956a8cb0f5382398b271b30bd521e2267a92d113c1734bf13d22ffaf43347ca8e3ca0d0e
SSDEEP 12288:0VoLr+gV7tRxChgPWqGZ7o381lZWs5ZCDMPXqEutqHZM0K5BUKEv:qu7QJZSolB5Igf7aqm0K5BUKO
TLSH
T1A83596393BE4872EE6AB0D71DF205225CF70DD863227E3A58AB0D4F96C4D7105A1D9B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CefSharp.Wpf.dll

Path C:\Battlestate Games\BsgLauncher\CefSharp.Wpf.dll
Size 149KB
SHA256 eb5ae78b014d1f39ac00de74262399238bcc6ace4f9135f3390d4c22d887fef0
MD5 66f848f6c7d8fa3ffff49b9155c2753c
SHA1 eb75e5d3ff3f455353206c64afbbfb5d77a323f3
SHA512 0c6faeb9ecdc82b719e5460f1a5c0563957ea28ec070899144cafe465819f5eb8132e0f649e0e6913f0bf5f9e0971b9c8692ce4ecef3dab63f7d701f497aebb0
SSDEEP 3072:yseG72u3PYeGEXCI4BycgTlOuCq3bRB0a6VdagvIgJ6emGxwjuiKE6J:TCXUXCI4ByDTliqv0aaagvIBnKE6
TLSH
T176E36B1613AC8FB3E6EF4B3AA46051028B71D787F80ED7E95D80A5BA35E735059043AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CefSharp.dll

Path C:\Battlestate Games\BsgLauncher\CefSharp.dll
Size 288KB
SHA256 32c9b99b3a49be9109912319ece0dbc573b5429ccb5e30fa0a6f37c677432601
MD5 8a1de539563447ff141ae8bdc21941a2
SHA1 302822c6ac11d9688dacac096840d17a7b23c27b
SHA512 8b5b7bf002896b21d645f3116988008c0e8304b3020b57befacabf04c44913b1f2af3dea009656faf48f6498f9520cc05e5bf6a367e39667ed989bc0a14803c8
SSDEEP 6144:mKFXJtmI3XjHCrK6ya1BzBqolTM5xfx8A+pmjCVuKER:oMYdyaMzx8UDKER
TLSH
T1D9544B1123BC927AD5FE8B39F8B1181A0A3FF90AB431D75D0D09665D2BA3B449C52B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetZip.dll

Path C:\Battlestate Games\BsgLauncher\DotNetZip.dll
Size 459KB
SHA256 1cf9a36668c88f870ed050a73103dc425a0582c24935308163c97e85434af309
MD5 6183fe9ea6e923ac4b714367deceb0ac
SHA1 d9b68de664c1da716b91a7938dd58a19ca6e5631
SHA512 c736e0bd323c289dba55b3cb2b5ee6477613981542720f6813afcb2b087b5a1a264f813adf555ce40f0509d3f7b16ccc8a2588e1890f543aeeea06d052434113
SSDEEP 6144:SuCITwatNH6B1vHTSpbIeCHz927IWYgGtSV41kJDsTDD3sAJe6dwxLV/zRKEK:g/aOaIdHo72S4csfsqe6qfzRKEK
TLSH
T144A4AE0027EC4B5BE1EF5B79D0B6A591C7B1B562693EDB8F6C4025EE2C23380D9117A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DryIoc.dll

Path C:\Battlestate Games\BsgLauncher\DryIoc.dll
Size 565KB
SHA256 ef37f974e45eca937ad425f1c764d8df8996ff34e5b13fe68484b19ef5d03699
MD5 7f984594091457c6174b51b32edf543f
SHA1 987924ba36a2bfc8d69abc76ccbfc0b32911d899
SHA512 6714ccc4c2c433d0e23f980ffd07bd9de7a911eb41a0d8ce4b439e39ebc73dedf2fa950a01769f15183871775021c5d2740cf999b6849e846e220833faae8bdb
SSDEEP 12288:1tKvCt0reiDBTZszay59yp2UI2FgsjiKeKEE:1KDBTZszz2FgsjiKF
TLSH
T147C47D0123EC5627C9FFE777643125261AB1E833B46BE78F6598A4F42C617989E013E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EOSSDK-Shipping.dll

Path C:\Battlestate Games\BsgLauncher\EOSSDK-Shipping.dll
Size 18.2MB
SHA256 0eec2f7f47c4a991010caf3d5240d41237a1fa25967d3f711cad34e30534179f
MD5 7a6ec2b6d6d677c41f853642de931025
SHA1 2224e9c4bbb13f232b5c6d46d00694bf94f10c8d
SHA512 1ae582f75d3a556cba6a4a1c9773f21f5f5ffb8c83593712dd6b8122481a8ad67cd199b5f865530c5138a0ed7a0cb1818274a6c51088d6b41d0568eb30dcdbcc
SSDEEP 98304:QjwYNp3E8tMti+Ui+HmIAzTRZrclZMsMye8k+qCjFNbyR0tgImlFTLYSG8OWYV8Q:Y4tzKmtzUlmsMye8ksxN+0ExLT2WYqQ
TLSH
T16717394272F40094D4BAC2BD8E27D916EB71398A1B35E6CF06A0859A1F77FF459BE310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.DependencyInjection.Abstractions.dll

Path C:\Battlestate Games\BsgLauncher\Microsoft.Extensions.DependencyInjection.Abstractions.dll
Size 43KB
SHA256 200aba7859ecfb045d43a8e2bf9abce4c929507364b7714388f59affe708fb06
MD5 7a9b8793552ce40160a6d273b22f807e
SHA1 1c302ea0a44f517b97af19252140ec710d5d3bfb
SHA512 7d5ea03d5815a6f5705875fe6c2d2179c6ee5468d6b19423f04c8982e64226e656bfd7ccaf7a5756c7046d2e6d2c3504190ba642e02bc197d48dad9320fd6bd5
SSDEEP 768:gQnUmCQ0dQ8d2TN7uxgoXvM4s8w0woFY9SP8:MmC3dQ88Tk+8vM2fBO9I8
TLSH
T198135B55ABFCC357DAFE1AB0693281659E39F6CE3512D70B1988C0A819A3FCCD241772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.Abstractions.dll

Path C:\Battlestate Games\BsgLauncher\Microsoft.Extensions.Logging.Abstractions.dll
Size 51KB
SHA256 ce8a3129430b92e206d59720adff91ebae0af7c8a808ba81b2ecf9ce680260e1
MD5 1237591a98cea80b03eaa68dbbcb2176
SHA1 5761dfe8070d1e273c20bf6ce50eb46a8780e065
SHA512 1446308e87aaf15ac1b3f79d8f4620b2172fb4c5f34059df75fae0ab244015cae6ac46faa86a0ab91b71d51bf91476dc407f473016ed0b71526ff6e446bbda07
SSDEEP 1536:cpl8B+QlLqS+hEKKKKKsfQ88888foDLPz:cpl8EQl5UL
TLSH
T18D333B4563EC5663CBFF49B5A47891029B37C2A67403C75738DCA1382C6BFC84A91A7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Options.DataAnnotations.dll

Path C:\Battlestate Games\BsgLauncher\Microsoft.Extensions.Options.DataAnnotations.dll
Size 15KB
SHA256 fb4627fdc2434f97dd2e88cd64d517015b8ac42d72a120e042d97a01b4598b7d
MD5 6b0ac1b6560ca52d3508d62fe1dc642e
SHA1 dd00964c2a0988de6d1f5f7428e5d0b548270e53
SHA512 8fe77c0d9799464c24ab5cf5c14aa4ef822dded32b30d2354c10d1325cd37378f0d022153be526522a65cf752a5acbbaac7661d73876c586d4f6353ac0bf8819
SSDEEP 384:6Vzzae1A1920xI7zDEW7KqW9dHRN7QoBClGsKV8:6V4G4fTV8
TLSH
T1B7723A818BAC8213DCFB2AB0A6A5D6027C3DD3C758209529054EE55D0C63BC2DB76B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Options.dll

Path C:\Battlestate Games\BsgLauncher\Microsoft.Extensions.Options.dll
Size 53KB
SHA256 c4673c6000602e76844bad63feecbe42d88fc72639b1fd64d2acde48955be970
MD5 3ddea0033ead23660b51921146dda017
SHA1 5708c44aa5326da0a69072a9b0e48715112a4bdd
SHA512 d57e25a2412f2685770e3fd1d6650ee433ed28d337221941841eb9589dbf3868a27efb0d488f960f75785e60357cd2914b0eece1da62aa9ffe77219340c03576
SSDEEP 768:h/P8hAZUWHrOTqmJj6kdMyDP63GbMnPvbFGOw:h8Lbqmp6kKyr63GbMnJGOw
TLSH
T1E9436D01DB988613D9BF4672F92860226E35C3963027FB3F56ECF5981C7B7608A60736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Battlestate Games\BsgLauncher\Newtonsoft.Json.dll
Size 659KB
SHA256 3598cccad5b535fea6f93662107a4183bfd6167bf1d0f80260436093edc2e3af
MD5 4df6c8781e70c3a4912b5be796e6d337
SHA1 cbc510520fcd85dbc1c82b02e82040702aca9b79
SHA512 964d9813e4d11e1e603e0a9627885c52034b088d0b0dfa5ac0043c27df204e621a2a654445f440ae318e15b1c5fea5c469da9e6a7350a787fef9edf6f0418e5c
SSDEEP 12288:rktg1lrjC8rjICqbwNjR4xq7iiX19K7Df/SoOKQrIB+jfP:rggD7PIEjR4xq7iiXTK7D3So9AIB+jn
TLSH
T177E4395133F89E1AE1DFA774B4708A2943F2F40AE2BAE74F5A45A5F92C937504C047A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Serilog.Formatting.Compact.dll

Path C:\Battlestate Games\BsgLauncher\Serilog.Formatting.Compact.dll
Size 8KB
SHA256 2d7dec266c5436f58ab620db4e3b5c83e550e7f76caff26eae8186b14b52cdd6
MD5 fdb7ad01c66a0c96174300167fadd249
SHA1 38b9971de844165f164e37e2d234d16f6022636c
SHA512 13df8a0ec363dc3a8f80114c64869db6f1233ae250df1bf48260cf62588065200d5a920f7d16d41faac4ddd4b9edd4d3383d1bbdb1849d120a145175d3a74d4a
SSDEEP 192:qWXD5XkXCbi5gYcKczH9MhTitYTnqztOmQz:qw9XSCi5glNzdM1yYTnqztOmQz
TLSH
T10402E946F3EC871BE4BB0B34F96512401731BA969D62E76E2C9818DB1C67A0D0F21B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Serilog.Sinks.Console.dll

Path C:\Battlestate Games\BsgLauncher\Serilog.Sinks.Console.dll
Size 31KB
SHA256 ded3b57b64eca479f2a659a244e4c403ebfb83a9a9b30ced893c145e77affd29
MD5 c48bf7030e583e273e94e2d32b752a83
SHA1 51666bcec96f529b1a28b72db54cc7fcdf68441d
SHA512 475e61bbb4484f468548dd7590d1d0bcc19912b322eacf2960b32c2c3ff1084231ddf8e689735e385a1f43e9912f79a028eae136c7dc8e130f2d3dd1eaf1f004
SSDEEP 384:obd/GivDfRbUqX+pMA84UfYN7hzWrJ7HFjA7Avraq9E6ZAlJrKanrLCyaz/JllAt:kx+pe4L10ajxHJl7u4WHjW
TLSH
T198E24BCEBBC85717E1E6867CE8D11AD00330693E6453F7394CCEAE5A69637481718B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Serilog.Sinks.File.dll

Path C:\Battlestate Games\BsgLauncher\Serilog.Sinks.File.dll
Size 27KB
SHA256 6d8d84c9c14201674d9a309f51e952cf148ad33cdb66507d9677ebf1b1e4432b
MD5 4c2b0737d9a73da09172d3c210b0265d
SHA1 a35a98ec72154cc1d112f46bd177a7f043dbcd46
SHA512 c605bef0a7caa12b0d7c47564c3a214ea1db40f901dfdc4c5b35bf73610a5d9030b67e495b409a79c76ad5ec6ef9962cd56c050c51883a3151d34931a8361aa8
SSDEEP 384:rdK36THowuUITpqSRiIrSI1KQrgwc6LdSpARCHdDQBLJRI+qMalKVeFje+WUMuUk:rdG9LUgZRiIVJrgwDmHdD2JRr6VUqX
TLSH
T139C20705A7ED421BE6FE1FB8E9B025511731F9B2E833EB4D15CC645E1C26B148E10BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Serilog.Sinks.PeriodicBatching.dll

Path C:\Battlestate Games\BsgLauncher\Serilog.Sinks.PeriodicBatching.dll
Size 15KB
SHA256 a6dba346014537e83f0e89e5fef607670c3417e0fcef4c9b3d5a054a051a8256
MD5 31aa4d2a3d3c644085523a624a899a1c
SHA1 30f63a962d5ba6ef40940b28079e2900cff40aed
SHA512 d3cd1d80ce680e62e15a449a854db1ff5b4a3199476abbb9b40d5d9aa83d42faca014513647740cfe2a2a260debe74459925ad63bc0647b11d05efaaabf53454
SSDEEP 384:QjpKVVNfMWMfoMaH7bNiRR5EDnY205RNkfdLSipO/F3p1vHBsWHi:Q0V5+9OpYkfkD
TLSH
T16862F95253BD422FECFE1E788A7502150376B90BA832E76F586C68ED2CAB7410E1475B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Serilog.Sinks.Seq.dll

Path C:\Battlestate Games\BsgLauncher\Serilog.Sinks.Seq.dll
Size 32KB
SHA256 f97ab8d74c11ed6f35aaf617b80208548c39f3a650614d1d3ad730ed83e76f50
MD5 5d0a096e0b0f26b8b4a58df9d7601e04
SHA1 2a27d637ef25b02f6e7a228c666da70009c5ec9f
SHA512 a818a733a00bfee724b3d4d54cc2eab0a4f1c7cd597199ed71d3f23123f58df8e48e47a422104b085a7a42fae2d27c32d6234d296cefcda8fbbabff7591238a5
SSDEEP 384:MxIF0vBrKSE0293YKXhm7b1dah444nU+ifCiprD0jFempBJXgoRxtKEMGV2NLeSL:XFU20IYQhmbjifrpMJNFB2USseMUMk
TLSH
T1A9E22B8563ED4207E6EE2F7CD9B299420971FA97F463E70E1C8DA0EA1C97B4148143B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Serilog.dll

Path C:\Battlestate Games\BsgLauncher\Serilog.dll
Size 123KB
SHA256 7a26a473af5eb7a00196e275c86d773f36e1d4caef566f97f1df7e07e20b1670
MD5 0aa45a8a1cd24cd2b589e4aad925f35d
SHA1 0dc29954c4c2ffea4c33af0e56ce84158849b81e
SHA512 7a865b16633c09bdecda34fdf15c62db4f04f2fb8db0abf57563aea51de67daf9eca0c08f053f551937a0c3c7987a53de2454ecb13139a193291633df7262981
SSDEEP 3072:XfwtSQoXux2ogH8I/eXXXXXPXXXXXHXXXXXTaXXXXX14N0QXVsABFkNfM+HFukRb:PwtSQoXux2M3XXXXXPXXXXXHXXXXX2Xh
TLSH
T15BC35C26A3FC4AA1D3EE1671A47506404B71F99B3567EF4E3F5C35F92C123084A28BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Steam.Sdk.Abstractions.dll

Path C:\Battlestate Games\BsgLauncher\Steam.Sdk.Abstractions.dll
Size 40KB
SHA256 0510db14713a01d6e784bb2b0fc3fda0dbb99f37d085ea99b8513792a40496ff
MD5 e8969bbcf0f59d2f5527732b963380b2
SHA1 dd76cfc164ee802cdd021e23ee92e5f9a3a90c04
SHA512 d2b3dfd1ce5e73f01e8cb18b1bdbf8d93ac070abfdf3dd159b23c15c20328c04ede3f8c6b2e80bb6776c4c640db7cceeaffa727a92a0d3087fe5bb2942138946
SSDEEP 768:Na350XoyJaBGN9ACButB0dr/YDWHsLcbbLEuQEh8c:0JLyJ6e9YMr/YDxLcbKEic
TLSH
T17F136C07F7542573DE5A46F3B8E61E1B1530E24AAA038FBF9441B5DCAC627C0271A27B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Steam.Sdk.dll

Path C:\Battlestate Games\BsgLauncher\Steam.Sdk.dll
Size 57KB
SHA256 fd981e8b5acf1900216e04bbe8c37fc6dc8338bf30947a9edeae548f9ba2c8c9
MD5 9cb41a3928b8558ea3d59e3b32e25107
SHA1 ae75bbc9428f961fa5cfc383dc5ad8bc07e799fb
SHA512 04393bf241e42dcdb989071e22aa6f289cfa42601630564b8c5046c5db7c0dc1ae1fed44bf8075c7ed176727ec20418c7a07b30ccaa4807a5580f82e906136bc
SSDEEP 768:lXdKy+W6gFA3UymRrJOpMMyRPTsZyhybF5IqFxDVqEFJ7cq/Te5+rT1UQO1O8b3L:2yymWTeCBU99z6KEKm7k
TLSH
T11943F81263E412B5C6B5CA30D8F94F4BB6B1F0DB24239F4E1392607A9856BC12E717F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.Tasks.Extensions.dll

Path C:\Battlestate Games\BsgLauncher\System.Threading.Tasks.Extensions.dll
Size 27KB
SHA256 692c324c02a922f890aaf5948c54ec9758f5ab7019b8e8ab169c106ddd3231f4
MD5 d3a5f69c93863517c2671dffeef2d39e
SHA1 c74b937a718f4dc9960bd8e105ff522f43edc59d
SHA512 3ea0e0cd4e8e9e561fb9987e53babda3f375f6e42f05e853d1da3176fa61673c5911ca2eb0d2a37242cef11706bddb94f72c3107a270210fa3adaa17d11a17d1
SSDEEP 384:87PVBSE/ug1TQb05JCw0p8CUQefpaQKwhARcUGWSHXWEWYA6VFHRN7yhoJR9znZ2:2PV0iug18Y+b5gU6RWFClyO9znQx
TLSH
T1A1C29E6183A85113DF6F4E76E2A9D91B5F70B346A902F7391EECF2D80C5338A8631235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tools.ResourceInjector.dll

Path C:\Battlestate Games\BsgLauncher\Tools.ResourceInjector.dll
Size 21KB
SHA256 15fbd08771ef8eed5d9262bf6c1628691fbab149b1b46b436d386ff44c37309f
MD5 187fef52df44b24b3457ce68c85f231b
SHA1 9f3443890f3002b663db48398b037cffc9b1df22
SHA512 72989e338eafe2572b27f631cdd201dda7a370288adf6f33e05593aefc3f36858be5b641fa04f265e77cd8ff1aad1ac33cfd477bc6ed0476f2572d2060b3d811
SSDEEP 192:pSO7gHNgJg28v0tGTJXYRISRpX0Fb+NZOk5i9pPIKfhig1R7JNix++Xa21Rd4H/Z:AOHu2mGR31MpwK3yx7bLEuQEXdEHqMR
TLSH
T105A27D4B7B305123DFA78E74B4E18A131EB0F261AD13CE6F0869C18AAC97791572027F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Battlestate Games\BsgLauncher\chrome_elf.dll
Size 1.7MB
SHA256 9d0511734fb6bb10eeaa43b0e1817cab5adcbe53a6452be44319e1fa92c27bd4
MD5 09b2ea2c56c23d365625a4225440d04a
SHA1 1f28ec03939dfd7307c9aa48fa4a19e0b0c4da8c
SHA512 41cd2f41628d76ae4011bd803a4fed4e8c0bb339d3a326cf96c81600e1d711c1f4d8169e3a112bdf8bcd3289088861966bc3be17cce57643a78ca997bbb99c50
SSDEEP 24576:il2OhpVdIN4xAjnqAN88FaPmsUacR3dQ8F3p9uZrUJSQTuQq73uVGZcLKp:iljZIixVANPvFZwJCSQTuOVAR
TLSH
T1D5857B13F29901E8C05DD179875B9233AA62BC450B35B6DF0A90B7962E7BFE4673D320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Battlestate Games\BsgLauncher\icudtl.dat
Size 10.3MB
SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
MD5 5bfd3eefca4b5ef2d1a869396390a7de
SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
TLSH
T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-5430U.tmp

Path C:\Battlestate Games\BsgLauncher\locales\is-5430U.tmp
Size 18B
SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
MD5 65f69bd2d8b6458d3ecf77d84d70dc1c
SHA1 679bdfb03cbaa594ace5af4340a061ddc514309d
SHA512 39f2728a1898bc9406516fa737c58c349e3bd7f779276a2f6679b3e3f0db43f956e03ad25e5d9bf4b07b19909febcc6c0560f71ab4f4fa6b5dd1f021ef742c60
MD5 SHA1 SHA512

Submit Download

e592c4b.rbs

Path C:\Config.Msi\e592c4b.rbs
Size 19KB
SHA256 6742ba2488dfea78999e76932a8be82ab0741a188168aee9f717d5effea1e2de
MD5 8dbc57d19c240e9b5e4853c9edae27a9
SHA1 5358e2da97e95b8bb5ccbb62983592508cd9e46e
SHA512 9988b74f5a2c34fc0b1d1cf46d9b9a4bcaef5a78cb0ba18982cb2c7463ca98a5a4ebbd269c8fff1362883eb6e87233d3fb89b266999dd6c1993fee3ba36da8de
SSDEEP 192:YPRo1kR815dXcFUADIc1f+W+y4+ogP7X7:YPRo6R8TeC81f/cYX7
TLSH
T1AE920C426A80C9D2D8766B30CD635B653B76DBD5A350838F50DC90308F93BCA2F9D69D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e592c57.rbs

Path C:\Config.Msi\e592c57.rbs
Size 19KB
SHA256 db0cc3167e7e6dc1c1bd9d727c0cb1ba575e6f6c63c4f881a27372288dcabc5f
MD5 a847438eeb364f8733d48d44b18904c6
SHA1 9aa0e615b06cebf7ae65475d27211793f944fb15
SHA512 3bf697671aad543b4861e0301443111649294aed22301c11b9f6782dc30795d48ba971bd56ed9ebcb156096c1f46a8cf97d2937fbe3f01f1bbf40286f09c3b09
SSDEEP 192:t9DAoBHRq+M3NinQv7ClstgCOCG2/dUI//dUgY3ETLNfHOpM:txAoBHRqF3NinQv7Wy/d//d/5
TLSH
T1A292EC416A40C2A3DDA63B70DD571B193BB6D3D9D792434B42CC80748E837CA6FDE68A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e592c5e.rbs

Path C:\Config.Msi\e592c5e.rbs
Size 21KB
SHA256 33770f32f192e9a9a426d7557ab85c6d91573a86eed6bc575abefb6204b5d05a
MD5 934edce910920f8acbd265bd23d64656
SHA1 69a424322700c2a99f2095de2154f6dca7b28a14
SHA512 af9de32c9c5410276ce87a1850b7f55f03b6da8dc54e2de7faf5ab2650ccad44e5cf3ed1af0378cc585d83841dbebaec8de3b6ef43193124e90847db1b599b92
SSDEEP 384:tgRcGR1nAKxNAUhUC7xJjrMNYPzIbSfsggfGmBybynxkP:tUNJAKhkmz
TLSH
T1FAA20D03768099E3C86227B1DD671BA93B73D7D99350434B10ECD1388F633C76E5AA9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e592c6d.rbs

Path C:\Config.Msi\e592c6d.rbs
Size 21KB
SHA256 05e83c87712a522c120e38edb2876645bc0bb655da4468626f1524cdcfdc8368
MD5 85a13cbbfb6830677e8b21cb2f3548c3
SHA1 83fb5156f8b352dce832b745538aac315b6826d8
SHA512 a78d81301e93599d1d3d6336d1f96188823600fbc47c86d9d8ca1e8fe4266be18000acb89333d42bb72c9cc6fa6d2c4ea56cafe82e6e79209c276ea1e6301488
SSDEEP 384:tT6tFYQxkA+pAv9jH4ryInsalckU72eC64ZjwDaD+KY2sLV:tT6tFYQxkA+pAv9jayIRZ8OqKYXLV
TLSH
T1D8A2EC017A00D292E4AB2B30CD971B2477B6C2D99361D78B80CDD1748F937D66FED68A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\state.rsm
Size 960B
SHA256 2ec74ba84f5037adff5edef975dffbb3bd4e85025ec20c65cab98bdcf6595c6f
MD5 eef478c2663866d3434880b04da2f388
SHA1 1604119e65d8e0b128ea190be0e0f7c0c4400dc2
SHA512 ccd6fdd6b184bca5e1aa4bec998375edb6c159877ba047100bddf77a82fb6dc97f9954e0f53298ebdfdcf67acef6351fa816e3346455e2ab73100d69f3d2afb1
TLSH
T1C511C261AFF65019F3FB7A307DF50615A9BEB4129D32D11D0142618B8E32B80CD64B6A
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Battlestate Games\BsgLauncher\CefCache\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Battlestate Games\BsgLauncher\CefCache\Default\Preferences
Size 10KB
SHA256 314b485b03dad721df04ab94da1f677b9a8f53d269cc80c44c06e5bc0a6cc7d4
MD5 799b6292c0f90c1deefd0b943c7d6061
SHA1 8051c23499d3fd4d34d017e859b013be43bb58ec
SHA512 d49b77e19b9f4c5bd9de6a5f15ed8044fe8eb330147022337ecd78e70083721fe5b35b2ff97dd1bcc37aba310bf7259e1c2092bcf21ad77cb2654f270cab2b17
SSDEEP 192:zRaZTWCFv7Eca9eHsb+WNy/4IOQ9bllWCyIsnDUg6:zRaZF1kcwP6l26
TLSH
T18722916EA930767BACDBD229FA217753E3F2102538D12E84D6F8893C15D7ACD2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59e44b.TMP

Path C:\Users\Admin\AppData\Local\Battlestate Games\BsgLauncher\CefCache\Default\Preferences~RFe59e44b.TMP
Size 9KB
SHA256 b2c47e465462443ab0cdddb4ae0a5f4ba2654ce8eddf1e61e567d03400a82b51
MD5 678e49dadcf713a42dfdc93280b06a3a
SHA1 1aa4812f20984c0c50c55973d35ce999b32cf909
SHA512 c9262c236859dd5f66c137b921a572a8de0fd39f1d3bdba34bc2eeddfea11c55a6089c6618a93d701d5e68a151dd92bca952e3d0b8f449c8ff5b6dead4a6065e
SSDEEP 192:zRaZTWCFv7qca9eHsb+WNy/4IOlaWCyIsnDUg6:zRaZF16cwPlb6
TLSH
T11B22A16EA930757BACDBD229FA207753E3F2102538912E84D6F8893C15D7ACD222301B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Battlestate Games\BsgLauncher\CefCache\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Battlestate Games\BsgLauncher\CefCache\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Battlestate Games\BsgLauncher\CefCache\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Battlestate Games\BsgLauncher\CefCache\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Battlestate Games\BsgLauncher\CefCache\Local State
Size 2KB
SHA256 636da5d6a428a14bd05c25d9a0546a93b71d476def9d217773df6b3144e59bfd
MD5 a51a74fba19b481114146f866f3e591f
SHA1 af70ddc150dd580ed5122f199a6b48a7d7589922
SHA512 e6b04d4ce0968054e5765294be148f3a7d21dbc1a3c95cd69264c94e761aca9aeba3be0e8f825f52aaefcf579e71148cb4073f6f9d799a232684d4d479abc6e9
TLSH
T14151947365349DB359FBD891B5523A42CFB4102AA5237FA8E6EE4E1C05E7AEC1343813
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Battlestate Games\BsgLauncher\CefCache\Local State
Size 2KB
SHA256 8a9c066f960e038b70172a0919fde77d7d8af8e4638c37d3bb91649bf8c10d4d
MD5 4eaccdfea0bb68c9b007222184d149e6
SHA1 840124ee8be5a47401830b5d65a9ce95b7f23bc3
SHA512 63734dae3a0d72f77b4ed4eed1040482489303c11c5528424ebdc2d7c6a4e93709dc72453facd01361d31ac4c9934e4bec7434c4664460623b52df7a56dfafbf
TLSH
T1DA51957365389D7359FBD491B5523A42CFB4102AA5237FA8E6EE4A1C05E7AEC1343413
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59bb28.TMP

Path C:\Users\Admin\AppData\Local\Battlestate Games\BsgLauncher\CefCache\Local State~RFe59bb28.TMP
Size 916B
SHA256 c206793598fb57cd17c490fd809d2136b1785e4d219bde58713f6abd160f29c6
MD5 15f306d7d105c6aa13e8b11a9776accd
SHA1 a173280211ee433570dedf9b403b46d863f84cdf
SHA512 ac4dcb3e6a5f7f5aa2f4e5a6023be56a3432d2e214ef4f6c534bd1605aa6509ab8935cea17d7dc03f6cb4b0e9437d35fe483f4ccb85c253ba2f0dd9107bf460b
TLSH
T18C1156B351207E62BDD69D7A61967F570F75403AD0131F0DB3DF460502B76A4412BC34
MD5 SHA1 SHA512 TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Battlestate Games\BsgLauncher\CefCache\ShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Battlestate Games\BsgLauncher\CefCache\ShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

dd_vcredist_amd64_20260807003753.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260807003753.log
Size 12KB
SHA256 ca745c08cca0b9fdbbc50bb08a184b595c24550df52926e29b42532e8b1c37c0
MD5 086af294bd9f5f7ce814cf522746b45f
SHA1 1a977d098957399a48691ffedd4986686c64c1b4
SHA512 1fd6bd6461b8f7ec237051c9066fc7a274c17eb55f3d1174b149b7fd97d90b5696c9645d013e6140c39c53bf52eea13552f6799d9a187b6cd9264da29bc2121f
SSDEEP 192:wKr6vYTp1Xs7Ez+Tvy+y+ByLUv2aR255aAWIZF1jVD8Dxou52xQOlORnOVL7fjN7:lc36XdP1syg6rhQu2VlszcfCf4hRO8e
TLSH
T1FF423202EAE961713CF3D3DED4E43F95AA3032582BC066B0EB6D479C1685D35938D6E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_20260807003753_000_vcRuntimeMinimum_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260807003753_000_vcRuntimeMinimum_x64.log
Size 2KB
SHA256 929aa24ac8a728525080c35304576b173ce1217c2fef75ef5a29ece5d8fb3eec
MD5 737e5d14bbb29319031cd68f82478040
SHA1 2eb563befa3cec33e156952c35214ed4af678918
SHA512 d7f2ea431279f0dd9115b5472d3cb0fee85b1cb780bbd0f2de3ab959b06dd0656856ad0200d6027d79a2326a315d4730a2c75be8e32593a384c7fe59dc4476e2
TLSH
T1C441D8601FF8090AB2F217479EF3C4635A73FDD268749B0D2385831A8667D059DA876A
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260807003753_001_vcRuntimeAdditional_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260807003753_001_vcRuntimeAdditional_x64.log
Size 2KB
SHA256 cf2bda0c5196b06bf670e86956268ad697dd3239b58ecaca19856f74e6075ded
MD5 df44ae91e19094d66f2174743bbf831d
SHA1 6ace323a8a0370b933874509f39e838893ae2e5e
SHA512 5a0bfbe0b1ded954c728f55cb306dcfabd112912e1e0e08d4318682e21e047f6d6c07fa4337aeae6d288ba33628d85e501beccb50c4cdeec74975f893da0dd40
TLSH
T15B41D7701EF80856F1F716479EF3C0526A73FDD3A8789F0C238682194677E0599A877A
MD5 SHA1 SHA512 TLSH

Submit Download

vc_redist.x64.exe

Path C:\Users\Admin\AppData\Local\Temp\is-5O756.tmp\vc_redist.x64.exe
Size 17.7MB
SHA256 8995548dfffcde7c49987029c764355612ba6850ee09a7b6f0fddc85bdc5c280
MD5 23985a8a66ae306aedf0a9feb1a3d14b
SHA1 7ee9442ceaeef605ea66849f042b8410433c988d
SHA512 b618f601a1989a696c8efa0208efd977a3bfe9a8df8ace8fae9eef20262240e7eefcb67ce466fe166bdc606d80d594d2de80b3b4e530749aab8e99f5cecd86d4
SSDEEP 393216:Sr3bJsxx3E2DiCLwmQQp5MTFarWznCY1LHRqLJ:S3mx3D585AI+WDCYZHRw
TLSH
T1D717333160A0413BFBF51077B928A2202E7CE73C2B5598BAD7D8AD1D7D6A84147FB163
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BsgLauncher.15.0.0.4574.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-E8IPF.tmp\BsgLauncher.15.0.0.4574.tmp
Size 3.1MB
SHA256 41df9772338641cdd12ba411e27f6ea54d9d07b989246053e55452f2ce7fb4fa
MD5 157330a80a35b5bf7dac559ebdc8b1c3
SHA1 6964b8dbe3da48efa9c3932d8e6f57a6cf729988
SHA512 6c6e4f90da931f2db89484b688fe68288a72643beadc812954eac3039b7b86d2de57c9d91eca3bd05690fa97e6e4f3525d6ae3ea052c1dbda65f9ee6b5873617
SSDEEP 49152:YWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTb3333T6:stLutqgwh4NYxtJpkxhGs333O
TLSH
T1C0E54A27F28C713ED06B3A364A3386909837F66179128C6797FC794C8F365942A3E647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Windows\System32\msvcp140.dll
Size 540KB
SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
MD5 4e3fa9bd90ef020c14359639dc19312b
SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
TLSH
T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Windows\System32\vcruntime140.dll
Size 120KB
SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
MD5 0d35c5e99871b4f02c490b9fd9dace34
SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
TLSH
T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Windows\System32\vcruntime140_1.dll
Size 46KB
SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
MD5 03b43160d21c08de07a79d0a1c5ee81d
SHA1 0a449093006af667432b83303614b53b62fc0d05
SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
TLSH
T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{07FB0EF9-E3F5-4122-B413-14536CAADBC0}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{AC3E8CBE-C2CE-4CFD-9831-6941A6F34549}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{AC3E8CBE-C2CE-4CFD-9831-6941A6F34549}\.ba\wixstdba.dll
Size 215KB
SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
MD5 f68f43f809840328f4e993a54b0d5e62
SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
TLSH
T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab2C04DDC374BD96EB5C8EB8208F2C7C92

Path C:\Windows\Temp\{AC3E8CBE-C2CE-4CFD-9831-6941A6F34549}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
Size 5.4MB
SHA256 62a859b0db8bca416c7b6ad2ad5d2c84a4890a39e5d45cbec75f90a2fd328749
MD5 504150d63e81e949371003f6639fb1f9
SHA1 f1a665c19dcdc2d88b985935108c7a660a004339
SHA512 87fd95adb97a26dbf168523f838eb07ed9720a62c1f4c266bb33cbff66ef0993678f5f09c92cd85dde6bc4d39d1c781ea3879fcaa166ebc3a5da257f24e45a07
SSDEEP 98304:E7ja9ivJoWIR34H7Xk2aXpdoearQ3KmTT0oVGdrK8qqjlYxtO2mqvwiIBXcQ4qj:QGTebX8XpOea03WhLjn2m4cb
TLSH
T19B463334908E8339396AFE68251F7BCF0B319EAE2D315537B4D784158EAD9432534A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab5046A8AB272BF37297BB7928664C9503

Path C:\Windows\Temp\{AC3E8CBE-C2CE-4CFD-9831-6941A6F34549}\cab5046A8AB272BF37297BB7928664C9503
Size 967KB
SHA256 c346d91193246b18301cce532f2ae784fb377cb068d77bd22edec238e5746aa7
MD5 b1e651d0456b9fc783e96122e835f7dd
SHA1 8e8a4e9fc1a1e6ef34855b036c6737dad81af95f
SHA512 7fbdfe78c047dc6f73afda097a90da007a06bfcc490f25ddbc3958691ada652f2269ceeb7cec6f35d577ae4a8af41d30c407238eba65b7ee874e625dde4593db
SSDEEP 24576:zE3+9Eaeu1l82zQGjLhQPV7dr/UY/UEWYDxy24EBgbog4wi:zefeSoQGXSd5/UEWYDxnNnFH
TLSH
T1F5253379685DBAC058FF4E1A44C1F5FC08F7489F869CEF160E2C9F6A3E8AA741345099
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeAdditional_x64

Path C:\Windows\Temp\{AC3E8CBE-C2CE-4CFD-9831-6941A6F34549}\vcRuntimeAdditional_x64
Size 208KB
SHA256 275d770dc4332bf6f3eae9ebc544ed07e3b169de791ba3d20ad50f04d9d222df
MD5 e4e29cb648ac2ea9451639e95395b9b0
SHA1 d32a6cd7705b5eba5544175d4a8f9f4da1abb29e
SHA512 bbf76d5008d263adb3fb38e67e6d703774a268d454b98ebb90b39766cb78ef7cf65d77750182ef5e24d13dc1792a23c425dd955f468a39204f68943e9838f547
SSDEEP 3072:u9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTqn:AlaZeKFxCnBheIdlum
TLSH
T12924AF12B5808033DAFE1A311178DB615F3DBE608F544A9B6364B6AD1E717C08F369BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeMinimum_x64

Path C:\Windows\Temp\{AC3E8CBE-C2CE-4CFD-9831-6941A6F34549}\vcRuntimeMinimum_x64
Size 208KB
SHA256 57d65221ca418dabfcc6320215b2c05eec907690aa4f93384f2007eb9e1394b0
MD5 d44663b4fd6516e849efc5b7532c8d08
SHA1 57e9da2129e87a5433cdf585de8d23c0ca926365
SHA512 5a4f077f6f86b2a277641e36b37b77d11fdb7bf05fdcb7915b7b386d525b1e7a50985c3f1a826586064b2c70285519f9f2655e681820990fc062af15c7499394
SSDEEP 3072:I9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTLFI:elaZeKFxCnBheIdlu/2
TLSH
T1C624AE12B5808033DAFE1A311178DB615F3D7E608F54899B6364B6AD1E717C08F3AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_redist.x64.exe

Path C:\Windows\Temp\{C17D3756-DC49-4DC7-A249-F71C7D0F581F}\.cr\vc_redist.x64.exe
Size 615KB
SHA256 806e6252db45be78bfc064eb9a774dd1320d8f9aa70dd746996a1d9ddf9b8fd4
MD5 e5237fba0388d7d5ac22e823da709438
SHA1 d772562f32eec346f0ba6260877a3caffc0d8dac
SHA512 af99bc56c4c1f1ed0fb4302a301a7a1a6a85baf8343e3abbfa38533085ffa3cc5fe5d004efeadb22daddc8f7800fb27b040eacbaece4a234b8fcf49e3a1e183a
SSDEEP 12288:P3mgqnIZuYfCYqFet4CovkM7wVYnEvIhqFxVKLxYGHLNJk:P3WnIZuMCxezot76gTqFxVKLxVk
TLSH
T11CD48D32A5614033F7F105B3B928A6303E7CE728275189A9D7D4BD1D7EA84C2A7F7216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1072-1754-0x0000000000BE0000-0x0000000000C57000-memory.dmp

Download

memory/1912-1752-0x0000000000BE0000-0x0000000000C57000-memory.dmp

Download

memory/2520-1779-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/2520-11-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/2520-1-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/2520-0-0x00000000004C2000-0x00000000004C3000-memory.dmp

Download

memory/3388-1755-0x0000000000BE0000-0x0000000000C57000-memory.dmp

Download

memory/4760-1802-0x0000023DFFA20000-0x0000023DFFA6C000-memory.dmp

Download

memory/4760-1842-0x0000023DFFB60000-0x0000023DFFB6E000-memory.dmp

Download

memory/4760-1789-0x0000023D98DA0000-0x0000023D98ED4000-memory.dmp

Download

memory/4760-1785-0x0000023DFFBB0000-0x0000023DFFCBE000-memory.dmp

Download

memory/4760-1819-0x0000023DFFB00000-0x0000023DFFB12000-memory.dmp

Download

memory/4760-1783-0x0000023DFD4C0000-0x0000023DFD5F4000-memory.dmp

Download

memory/4760-1808-0x0000023DFDA30000-0x0000023DFDA40000-memory.dmp

Download

memory/4760-1812-0x0000023DFFD50000-0x0000023DFFDFA000-memory.dmp

Download

memory/4760-1813-0x0000023DFDA70000-0x0000023DFDA8E000-memory.dmp

Download

memory/4760-2035-0x0000023DFFE60000-0x0000023DFFE68000-memory.dmp

Download

memory/4760-1832-0x0000023D998D0000-0x0000023D99DF8000-memory.dmp

Download

memory/4760-1833-0x0000023E000C0000-0x0000023E00172000-memory.dmp

Download

memory/4760-1834-0x0000023DFFB70000-0x0000023DFFB92000-memory.dmp

Download

memory/4760-1825-0x0000023DFFE80000-0x0000023DFFEF6000-memory.dmp

Download

memory/4760-1836-0x0000023DFFAC0000-0x0000023DFFAC8000-memory.dmp

Download

memory/4760-1804-0x0000023DFFA70000-0x0000023DFFA9A000-memory.dmp

Download

memory/4760-1838-0x0000023DFFB40000-0x0000023DFFB4E000-memory.dmp

Download

memory/4760-1828-0x0000023DFFAA0000-0x0000023DFFAAA000-memory.dmp

Download

memory/4760-1840-0x0000023DFFB50000-0x0000023DFFB5E000-memory.dmp

Download

memory/4760-1844-0x0000023DFFE40000-0x0000023DFFE4A000-memory.dmp

Download

memory/4760-1829-0x0000023DFFAB0000-0x0000023DFFABE000-memory.dmp

Download

memory/4760-1823-0x0000023DFDA60000-0x0000023DFDA6E000-memory.dmp

Download

memory/4760-1831-0x0000023DFFF00000-0x0000023DFFF50000-memory.dmp

Download

memory/4760-1830-0x0000023DFFE00000-0x0000023DFFE38000-memory.dmp

Download

memory/4760-1846-0x0000023DFFE50000-0x0000023DFFE58000-memory.dmp

Download

memory/4760-1847-0x0000023DFFF50000-0x0000023DFFF70000-memory.dmp

Download

memory/4760-1826-0x0000023DFDA90000-0x0000023DFDA98000-memory.dmp

Download

memory/4760-1821-0x0000023DFFB20000-0x0000023DFFB32000-memory.dmp

Download

memory/4760-1806-0x0000023DFDA20000-0x0000023DFDA2E000-memory.dmp

Download

memory/4760-1810-0x0000023DFFCC0000-0x0000023DFFD50000-memory.dmp

Download

memory/4760-1817-0x0000023DFFAD0000-0x0000023DFFAF6000-memory.dmp

Download

memory/4760-1815-0x0000023DFDA50000-0x0000023DFDA58000-memory.dmp

Download

memory/5640-1861-0x0000023BC3A10000-0x0000023BC3BC8000-memory.dmp

Download

memory/5732-2057-0x0000026001D60000-0x00000260035F7000-memory.dmp

Download

memory/5864-1597-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/5864-1210-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/5864-52-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/5864-1761-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/5864-12-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/5864-10-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/5864-8-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/5864-7-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/5864-1778-0x0000000000400000-0x000000000071F000-memory.dmp

Download