53b5640a14589b491961811c8b84bf57f8017cf6784a504162869d84656ae0a4

Analysis

max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/05/2026, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.exe
Size 172.6MB
Sample260505-se7epaev4m
SHA256 53b5640a14589b491961811c8b84bf57f8017cf6784a504162869d84656ae0a4
MD5 fafd932e6bbe5f50bf055d0430306973
SHA1 69f09fa5bc6020046afae2f31f00d2008583b499
SHA512 a191ff7ea494bdc4ad4e5f8c2267c8508620ef4c5dc9806d188793d0a2953c073930a8356649b479f755db86cc22461830b299fa16f02af467ff78b1b519aa12
SSDEEP 3145728:OD51B7RHXw/CHf2F0JU/v1xIFVoOUAigkSUfvJj8LSSFdD65hEynHcgc4n2h9gEP:OD51B7tw/C/c0C9xOVoOjkRhOS4h65n6
TLSH
T12C883381FDCB82F5D85B0875592EA33FC33A91018514CA6BE7D01E19FDB7B610AAB11E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
5036	GameBarPresenceWriter.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 29 IoCs

pid	Process
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 2 IoCs

pid	Process
1704	osu!.exe
4744	osu!.exe

Loads dropped DLL 64 IoCs

pid	Process
1704	osu!.exe
1704	osu!.exe
1704	osu!.exe
1704	osu!.exe
1704	osu!.exe
1704	osu!.exe
1704	osu!.exe
1704	osu!.exe
1704	osu!.exe
1704	osu!.exe
1704	osu!.exe
1704	osu!.exe
1704	osu!.exe
1704	osu!.exe
1704	osu!.exe
1704	osu!.exe
1704	osu!.exe
1704	osu!.exe
1704	osu!.exe
1704	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\.osz\OpenWithProgIds	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.File.osk\Shell\Open\Command	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.File.osk\Shell\Open	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.Uri.osu\Shell\Open\Command	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.Uri.osu\Shell\Open	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osump\ = "URL:osu! Multiplayer"	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.Uri.osump\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\osulazer\\current\\osu!.exe\" \"%1\""	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.File.osr\Shell	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.File.osz\DefaultIcon	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.File.olz\Shell	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.File.osr	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.File.osr\Shell\Open	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.File.osz	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.File.osr\ = "osu! Replay"	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\.osr\OpenWithProgIds	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osump\URL Protocol	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.File.olz\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\osulazer\\current\\beatmap.ico"	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\.osk	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.Uri.osu\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\osulazer\\current\\lazer.ico"	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osump	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\discord-1216669957799018608\DefaultIcon	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\.osz	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\.osr	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu\URL Protocol	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.Uri.osu\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\osulazer\\current\\osu!.exe\" \"%1\""	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.Uri.osump\Shell\Open\Command	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.Uri.osu	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.File.osz\Shell\Open	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.File.osr\DefaultIcon	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.File.osr\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\osulazer\\current\\osu!.exe\" \"%1\""	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.Uri.osump	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.File.osz\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\osulazer\\current\\osu!.exe\" \"%1\""	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.File.olz\Shell\Open	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu\ = "URL:osu!"	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\discord-1216669957799018608	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.File.olz\Shell\Open\Command	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\.olz	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\.osk\OpenWithProgIds	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.Uri.osu\DefaultIcon	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.Uri.osump\Shell	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.Uri.osump\Shell\Open	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\discord-1216669957799018608\ = "URL:Run game 1216669957799018608 protocol"	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\discord-1216669957799018608\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\osulazer\\current\\osu!.exe"	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.File.osr\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\osulazer\\current\\beatmap.ico"	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.File.osz\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\osulazer\\current\\beatmap.ico"	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.File.osz\Shell	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.File.olz\DefaultIcon	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.File.osk\Shell	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.Uri.osump\DefaultIcon	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.Uri.osump\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\osulazer\\current\\lazer.ico"	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.File.osz\Shell\Open\Command	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.File.osr\Shell\Open\Command	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.Uri.osu\Shell	osu!.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-600123060-2148212387-2211176695-1000\{D34F88A8-9FFA-4B5B-AF72-ACE53118880D}	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\.osz\OpenWithProgIds\osu.File.osz	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.File.olz\ = "osu! Beatmap"	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\.olz\OpenWithProgIds\osu.File.olz	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\discord-1216669957799018608\URL Protocol	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\discord-1216669957799018608\shell\open\command	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\discord-1216669957799018608\shell	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\discord-1216669957799018608\shell\open	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.File.osz\ = "osu! Beatmap"	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.File.olz\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\osulazer\\current\\osu!.exe\" \"%1\""	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\osu.File.osk	osu!.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
3332	install.exe
3332	install.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1704	osu!.exe
Token: SeDebugPrivilege	4744	osu!.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4744	osu!.exe
4744	osu!.exe
4744	osu!.exe
1696	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 1704	3332	install.exe	79
PID 3332 wrote to memory of 4744	3332	install.exe	80

C:\Users\Admin\AppData\Local\Temp\install.exe
"C:\Users\Admin\AppData\Local\Temp\install.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Users\Admin\AppData\Local\osulazer\current\osu!.exe
  "C:\Users\Admin\AppData\Local\osulazer\current\osu!.exe" --veloapp-install 2026.429.0-lazer
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:1704
- C:\Users\Admin\AppData\Local\osulazer\current\osu!.exe
  "C:\Users\Admin\AppData\Local\osulazer\current\osu!.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4744

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:5036

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:4224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Microsoft.Win32.Primitives.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\Microsoft.Win32.Primitives.dll
Size 15KB
SHA256 50e52f74a18cf64efd7e3635c4489264a39207b221c69180999371c5597d899b
MD5 c4840cf4f5f1f804a8ef4a4ae364338e
SHA1 e5988cdfa41911fee14abadb454ebb1d65d52c04
SHA512 01b8559f6ea993b987cee97df82c964a8e2a0b431208fe97658f3628c2c7a54cf61d5ad8d5baa316aba90d0e567d8db0f0a30ed278bf46eb88008ed4b3de6bd9
SSDEEP 384:0HiLedHWhPBpWG/hljHRN7a5XPUwleR9zOETb:YDd8PDjtz9zXf
TLSH
T1A56239E2CB7C4247ECA79EB086B9DA873D3D57C709009A6B1995F6081CA3784DF30639
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NuGet.Versioning.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\NuGet.Versioning.dll
Size 63KB
SHA256 bfcba996b3fc59fbee4d67ae42cc86acae455cbe55119216cda2b84b4457256f
MD5 a4d494c769cf531a65dacc7f650a401d
SHA1 abbc940997344fb8b97214752c7077831d8368f2
SHA512 f4dec1fcf52d5ee91e358f8a28e47236d3616c0b45bd948d93b1ee75602be3d061280712c1b6eb75811a3a1aab704444fc636a837fe785e4df8530ecd77062dc
SSDEEP 1536:J2gC9A6r+R5JP7Y0YCrZNyzbrwJGIQCePQEdkz1:4HLW/f1G8ePc5
TLSH
T127536B2993AC4716C7DE1A74F1B421225BFAD7C97643DB4E2C4CE2E72E533C44A206B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Realm.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\Realm.dll
Size 369KB
SHA256 af7fdab9d38fd2fafc8745284e5190ac61a62acdd7b7c6d07bbe505f2200143d
MD5 84e7335bfe7a2573d6d4e04007190dbc
SHA1 5d33eadd8df5fd7d050a3ab4611bd5ce070786b3
SHA512 5ffba74b5ea89de7731e58503c4e2960c5e6d392a1ba01e44af72d03405ceecb5660c381c282852d3c396c4abc2f3cbd00554e0f27f3b10d9f24a3ee1c4f030b
SSDEEP 6144:7pmRTc79L7+PueOmIO69aQLp0LBFX5elZxWxYTfHJrxqhhWudwsb0YlyTOsdavia:ITSC7IrPp6X0PfHJIhhWumsYMBwpGH
TLSH
T1128429D923BD4B32DAFE4779F07459418AB2F981B8EAF78E56C6A0E60C43B446D00357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDL3-CS.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\SDL3-CS.dll
Size 352KB
SHA256 78455795ac97a7ee6ed199311017244f12ba7e09db06a9ea3aa36cef6c780580
MD5 6a7ccb6ed7c429617ce28ac6ab870ec1
SHA1 05bfed964ec54c1e33ae671b61f60004b88ca7e9
SHA512 ab1c1caa16e73e9afaefaad67368d6743d343b62f23ec40f1e3c490ccd55df07251fce00ac53bb18bc17a88e1d49f39d401ec5101b782b7d01deefd15bf5caac
SSDEEP 6144:yGadxvTM+Tr6WOIN8rPZhShF5dPBowA35pZtgf5s1mntXfFy0/veYs:FixvjrvwPZYLBLs5GI+ved
TLSH
T16D745B96B7A72D8EC7611E3520071722E0F5F5A027190BA757E2024F6DA76EC067CBE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sentry.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\Sentry.dll
Size 814KB
SHA256 d04f91ad63e6c6b10712329804863da5d8859ea0226ca31b38d561dbe2889f66
MD5 7cdd90fb93294c0fd3191a3f3868c53b
SHA1 c3d5425e621c0922f09c25b6c8d922ffb54828fa
SHA512 9304f01137086749fea1b09f2263c8604d07276addcc0e183381b45221bba02eb0973c55988e906fa624be1ab8f958aada30b3c39eafbeab8bd179a82d398a6b
SSDEEP 12288:5USFkpimEmn6IOKask7+Jz92IxoFFpvoJu3tfjw+8tY52Uf:yZpiJmn6IOKasZpDSM+8W52Uf
TLSH
T116054A81E7E8CF25D6BE2B3DA434D1880776FB666562E74F013CA6CD1C923469DA0723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.Immutable.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Collections.Immutable.dll
Size 818KB
SHA256 1d94d76703ccef97ff962d60701c10009bb83b2ed65b5f4f28c8535adf17ecbc
MD5 ff1220d86cc6ee832933016aaae52bac
SHA1 32a4592c46d3377c16609996e21f6c759682b099
SHA512 3d18946d3103dc8a90dea652ce1846140872b67d49e32ba04456e29a73a344a8ecc668798f2ddc34942c63f7dc3da97cf6d928df391fde4682a1ac3f6181e203
SSDEEP 12288:rrJR+uRoPwK1eN8/98vTU4dQEE3k0T9YLVgHr4iuMvOgllggf:j+uP8abw+CMidlllF
TLSH
T16B055B96E38C0B52C62FC5BFD6534AB9D6A1C45253E291CB00DAF6B03F93BC1E57A424
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.NonGeneric.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Collections.NonGeneric.dll
Size 102KB
SHA256 8a4845d14b6c46234a34b4ff1fa9ee0eb157339928b58e708212daca68048294
MD5 a460111bbe2f2f341443a81823ee1aa6
SHA1 7159b313c69c349e47399385c466152f857409b3
SHA512 c8941526d8672f6e529a2063baa3820a064afe31101eaa83b200c02bd23ca2e667e8c497164f631b339017770fd616a85ec3607be9790e5f4638d19a3168c5f1
SSDEEP 1536:5xM0tJVDX9LpIbwNC5IQ7XVrMZqz9A6W5Ud9bzIk:5u0dzNpIc+IQLGZqzK6BUk
TLSH
T1C1A3282677D80322C69E6BFC81938A02E675F4D26713D1DF1618A9CC1F9BBC2D6B2147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Collections.dll
Size 254KB
SHA256 43f1812c74be62e65bb6e232d2a61a24f1ad732d014ed5adc6fe1f13e454de8e
MD5 6978b1095bc26fcacbca7bb98c8015d4
SHA1 ec187d72265bb390638743f65c46796d234fd545
SHA512 de2e50484e99a8e7fc5d4ccf720aa84c32362c8c6afd8d6907dca2b4435cf0365aee1832242304a90297d30ddd4dbce552f78760a6d19999bcf187d1d2e1f636
SSDEEP 6144:rnxoXLJDXDiKNYX8qTKfAyryS1rIg93wh:rxCJDXDiQ+jTURrhFNwh
TLSH
T1D7444A2A778C4E12F56F457EE663C012D7B390A30712D2CB06BEE5840E97BC2BEB6155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.Primitives.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.ComponentModel.Primitives.dll
Size 78KB
SHA256 719473d4afdabd721abe970b1f2bf20e40f3e447da6d0b784a579badb82b5a50
MD5 85022543bf52cf2e5b6eb660498ddc89
SHA1 fb9709e9d6dd95f50f8813040ad9ec13831a8844
SHA512 8d1a1b06daebc78ff2db7c174c8493e11ca9d3d3bf9f626ae0c63a950d4ba5be165ce3f03145a45eeaceda1c6496ce8f715a0614a8ea79be66d46b0a9787c41f
SSDEEP 1536:De5/UZMu4Uhd+Cv8A/oqevD2olsjBbkt9oWaz4h8:Dh4W+S85qKD2omjBDM2
TLSH
T1CA733B1823EC0216FBBD467C9673A8219575F6821713D9CF4AA0D90E1F9BBC2E27152E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.Process.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Diagnostics.Process.dll
Size 330KB
SHA256 03abe0088509b77206a19d3a1f57fb4fad654cc21a57a7f342520936c05dcf32
MD5 ccec3c052d91d3b62d40d674a0770f1a
SHA1 2aae7fcff58cb0e15a7f190a9b359482e36fc0e6
SHA512 f38ad9dcca1552b411b86dadc68092ff10ddc670d53baa4cdd2b453c5568dcc2d46abb67a6596703c1112e5f9a12bc37d2cf479dbff5df08420da67cdbac81fa
SSDEEP 6144:KBkD2qaP75vD9eEIdghrT9jb3b41PlmFjqZTdiX2Jj:K+D2qAeDdqJt8j
TLSH
T13F748D247B980506FE6E86788C63D502EB78949707D1EBD743A0DBDA3F4B7C2E632116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Linq.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Linq.dll
Size 530KB
SHA256 02640836e88e14fa8f85c90141d2cbcebf2919c2d8681123e9c309b92df8449e
MD5 4d4e4e54839e639763c503eededf4180
SHA1 30e19b19d5e99ff196bf832dce3ec5587325cce2
SHA512 0f816ce76f0f68284acf013d737178e8dbd508bcd7a5465e747663bb8b04529c6c77fd491ade5575c1dce6de713534c063375e89bddec6de3f864c512845d385
SSDEEP 6144:ANYb3QypY1hh8r4bdhR+JU1/0kxryufbFHJMyS5IHoYzJhMxjCkoTcO:AYb3VS1hh8rwdh8UxeEvAEMmH
TLSH
T11AB46A2493B80F07C2AF86BFE553E151D7F1859283A2C1CF995CEE961E93BC165BB024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Memory.dll
Size 154KB
SHA256 cb69cadc77e09c964dd7c07151c0297ca33ccc617de68386abc66dd782c8d2a8
MD5 37a18ffdbddb28395b9637f3b41e2a6a
SHA1 f438e5fa37c00d88b8c9d87e68f9572641e940f4
SHA512 ca5db0d3b1e2dc9882f4feae40005f900a7b46204c8e39cbb73630160a773edb4b9ffe1d70616f7aeb5b1c978bf598184520bf2571f4bf1f1205fcf7f5d75353
SSDEEP 3072:yuyyjN/j+0sbFbqX63vwZuIBo7M5F8966oYduCBuqmwJhtTihd15:XjCb6oIBo7qDGuCBumha
TLSH
T160F35C1BE2980617DA3FCAFAAD625302D7B36152672192CB8CE4DA441E53BD0FF73461
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ObjectModel.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.ObjectModel.dll
Size 78KB
SHA256 934a1b87711d9ff84f44956ef4e5436ad615bbd2b62f1d96fe0e2676723a3113
MD5 a3ba463dffa5b7909e89005076f050a0
SHA1 280fcd281863334da95d365f1aaf53e5308fdfc1
SHA512 776e36e1851a7b5df051e93c5b05edfe8f5c82c8a8cb47dc8a602614fd84338c5a6d8fb4743a956b7594b3d5ce3267a3bd828c500c0a5812fc2c7f8679dd4546
SSDEEP 1536:Fq6fGEl04KXrgcCGfN2QSsMWrHGi3vLJgzn:F1l0trqQN0yHGi/tg7
TLSH
T145739D2867C80723EAAE067DD1F35862E531FAE31323C6CF41E5D54A0F537D2663A16A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.CoreLib.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Private.CoreLib.dll
Size 12.6MB
SHA256 6f17b1d8fc16b2df01f8b20787f7ce7b8e429ca2645362fe591fa6b81a3bd0d2
MD5 286e28e046930511595b947d026aadab
SHA1 48a3f2b58f63e53e974bdbe898ac484551f6a4ee
SHA512 3de6ce8ac8b07715b5ccffaa9f02cfd7d16740b668ca1b629c5dece96578e4c2ad698b4c2c48464ba9e61316fc866ef0b668f985bc9e544d013701e475f27897
SSDEEP 196608:nsvipKY4Zb6wf5ks5OtsFSy8EQOkLUPB5B:bpT4Zb6m5L5OtsFYPOkej
TLSH
T187D68D21F3C85F66E52EF23E81678281F670B4921352D6CF914FD6892F17BC19A3B261
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Uri.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Private.Uri.dll
Size 254KB
SHA256 b762dfa0e052d5fd9fd05309b4ae9e03d6ae46f262b620cfaad961a6070ef7fe
MD5 a1ea692411141192427feca246e92791
SHA1 5bd3a13a2e889b51da2900f2b37524792b8d07de
SHA512 c9f138021a702744eb83e26d27be08d0b65b966b7d8b71bbddf1cc990e75130eb31f5227fe3f46366bcbf1167206969400034b8db909ab1e13b82158a44b399a
SSDEEP 6144:EfAAcZTInBPKCeDc6Ci9MG3CMeVmtGkFsGu6Myc:rFlDciMG3HamtGkfuVX
TLSH
T166448C25E3840E67F73DC2B881D3D152EAB270665315F7CB0AB5E1821F177C2AA36963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Xml.Linq.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Private.Xml.Linq.dll
Size 394KB
SHA256 0b8e738deb443240a61ed5cd488bb5c3c1c798d6bab6372b804d82997db2e35b
MD5 98d2c873171b8515c9cb92fe80bf6b90
SHA1 b675653d24cfac6270cfd3eadf02d86206728e33
SHA512 51f520e502c3808394731ae9fc1c9861d05c0bd1c6dd0f97f422404f8944d28a7fd42a7a2aeb3a9446855da4227c9734805b5ae6a86ac5f298b4ea0a0db48518
SSDEEP 6144:CxvRCkFa4oBSKGFCoMPxSOpXQgVuThCDCHYlzrZjzEOQlIZj:CZRZM4oHGhU/4WC4lz1ffZj
TLSH
T11D846C24E3C80B12DE6F92BCC1579210E1B1959243D9D6CFC418DDE5AF8B7C1B63A16B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Xml.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Private.Xml.dll
Size 7.6MB
SHA256 2ef8cce40566cfec7afc2d171495e7b26b96a5ea13f66647bcf2d0bb45beb955
MD5 848108c51f145ff32b2d57c4377bc9df
SHA1 8fe5fdc916c97038a4022890ccf83997987d6b23
SHA512 058ed4438f2cee12ec1726d39af3c7612830133e511b6905a19793394c01e131af166b347f89c280a391cf52a133c396d213a33e2b5e50a519e4942e84c34962
SSDEEP 49152:uQ4//hGMR1H4RgI5Uymd+YItx2TOMAKfW0rMZDSO3EzwAanU54BQcezIEBopjszS:ubxoemUo0rFagxVmIwo2uaav5WtF6cgy
TLSH
T179868C24B3D40A15C73F827D8272A625E2FAF453139697CF0458EAD91F837C1A67A1B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.InteropServices.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Runtime.InteropServices.dll
Size 94KB
SHA256 7c53e031183b36fe378205ac894b1ddc41bca992393b153c7e68b951dc14f657
MD5 15240c525d9e48a75dfc7092b867aca2
SHA1 4f01a92a62bf0e5cc5c00a99502fb242661e6707
SHA512 18d3c43a191c004bc0b7d14e0e255c5cf9922de9f053575e515774a5cdab5705ea6151670a3dcebbd7e704f6ab20c469aa5f06bb83e4806087e561d2799fcde4
SSDEEP 1536:nT6zupEelCtJfKS6+67NspnSPM+l5+GkmVGKWHz813z2:nT6q3lCto+dSPM+rBkmANu36
TLSH
T193935A2037D8466ACA2A473C8C779D50C9B1F6C613A2E6DF5781895E1D9B7C0C3B23E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Runtime.dll
Size 42KB
SHA256 55242c750d5817ab526ab17be00a604d88458c49001eb520c0538194a9a46f26
MD5 5508a5998bebf73c3062adada116a49f
SHA1 6518aa8ebd1e62591bd9b1c3cf5d6d2be0d47789
SHA512 2ddd293df6442700ac7de81b2c1d2a024123e449aa63060b6fe683fa38bbea4077f269b82cc3431b416e25ff623f66205d4df6cdcc14260d50276e5f952b3ddd
SSDEEP 768:o+1fsSED2vCeDQvRzXB3gWql6375IVxedktN7xPBhwsR/JG39QRoNvsh2JcfoDLP:8B/LuYdy50b4b7RSHlIKUBzO
TLSH
T1DC13A4B5AE484333CD8B6B719C73AC810DF633C4047A597ED88EE95A13877648236B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Encoding.Extensions.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Text.Encoding.Extensions.dll
Size 15KB
SHA256 038082536705e63ff31a8f0038f3f87601d347c6f71d4dfa99a5bbb7f78ef2c1
MD5 42fe948d0e76c461ab4ee6d581eb36b6
SHA1 879877e0acf2c7fde49a48d93cea391873babede
SHA512 3e83c5f7d37b806c8f3bfe6802f27581ea650c297de21ad34bea267bc7c5857dc555b54e6836f9e7d367bde60eb16fad5145723c493efb6b966309fef6aca715
SSDEEP 192:0kmXhp/0xzRW6xJWeZWQhFJtvUmmnoHnhWgN7acWk8ATNceKyX01k9z3AUa68Jb:GxEzRW6xJWe/hljHRN7t8AUyR9zVa1t
TLSH
T12C723AA29F6C4243EDA75EB0C6B9D9823C3C67C75D1196AA06C5FA891C533C5DF30A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.Thread.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Threading.Thread.dll
Size 15KB
SHA256 61d68e044876e5f4767c8d77c2d2be15fc292478e4f6a1833546613771f24d0b
MD5 fd4beb1a185cdc36e08004fff3249463
SHA1 5b52dc9e15b63ce78b831010905e1d4a783571aa
SHA512 27040e87bff1f04f4e428b0af1d60f355a8b91b6af7d5634ffd065dba9736f903f5361cf0b31b79f16a31f32e5e3a7f701a611063d631a77ec7b847fe7c388a7
SSDEEP 384:c4z2ET0aT80Wcb7W+/hljHRN7ZUwleR9zOw6r:cObjjNDjmz9zG
TLSH
T141723AE29BAC4283EC672EB082B9EA833D3A67C35850D56A1695F6051C673C4DF31638
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Threading.dll
Size 82KB
SHA256 72e11fd27c4e00cf5f1b78d009bc782d4d594a9d149f9c455c067f0be7f38f4b
MD5 9b0d028fa14ce58791a152f6c34e46e0
SHA1 b08349d7f4438f409ab15203a1333793078ac7e2
SHA512 373682acbdc0adad73673112801b9d7c3511020fc476a6990934cbe5af436cb65d4c828df34f39f75870c48af79f65cefea20d75cac9ef454578a98e629b438f
SSDEEP 1536:05goICPLSImrmODZcUBeZ8j0GEH9wdB3IGRm3LGgr96zq:05go9PLfFtZ8j0GEH9wdBJR4GgZ6G
TLSH
T15F83592A7BE80516FA7B47F9EA769946C472FCD20710C6DF5049900C2E67BC0DBB2267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Xml.ReaderWriter.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Xml.ReaderWriter.dll
Size 21KB
SHA256 0ec354529c989e708b71db0813fcf0835a4be1deeac0a18be2c0f655d2ea6758
MD5 c4fb7370875994d931cab4171891b589
SHA1 19543fa9bff4f97832259bd7dd44c793b471247e
SHA512 687bf7eea1409ca477c8934355e13bc9e7ab415368397ab5fa9e3a9eab22f1a0defd6f0e5ea411339bedf7f90ec6f8401c6f1939aebfbb02d5bb2959e3eadb43
SSDEEP 384:EW1G5qkxK67ex4FClQPW1eAW3/hljHRN7mBFAUyR9zVaCF:Es6LqQrFDjSAU+9zVj
TLSH
T11EA209A1CD68CE13EDAB7BB0C6ABD4C33FF5629230718775D585A50B8892384AB37714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Xml.XDocument.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Xml.XDocument.dll
Size 15KB
SHA256 4a06159cedc51469dff4a78ff572e4581faea83a966649a24b7ebf9e759005d1
MD5 028b68c6bd25124270129c86e6cbd3e1
SHA1 b1c55a704f1f21b82ba67a92a1d7a245770ce7b8
SHA512 7477b5336baa7f71fb5409156a3ed5e4246eb9d2fdc5f792e9d204725722c7639f885157e1412409acf123ab2603910ec72ae3095127f99a80730ccb797e6a2f
SSDEEP 384:dhZ7W/NdWs1PDHRN7HkwifX7R9zwqhBGI:jZeZyF9zw+cI
TLSH
T163725AE59AA84203DFEB5F3056A9D607BEBC63C25910C63F2145F5491D623C0EB30B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Velopack.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\Velopack.dll
Size 273KB
SHA256 33ec0cb33f8b589ecd56bc9412308f973a97f90592621bc0f56af78092144b62
MD5 efb6a44edc9c2ca25ad74cb9ecf6af67
SHA1 e88c0fca20ee0e86837ca199e319580a6a1a035b
SHA512 42fb6c053df6dbfc9cf6610a1edf6677ae19d8758e8129ef7fa023ec2462ab83404a1914101b92f34895e266d9d3b931d41e06272c7a5f166f2dcd20f235cc21
SSDEEP 3072:z+wrvbbZ34aP0yjDYxqVcl7TKBzZrW9KWVPxMLL3VulZQ0ajefg7WKPxrdEOzZPV:z+wTV4nyjDHg9JvY88UDiT
TLSH
T13F547D0563F48326E1BF6F79F8B420058AB2F643B8AED36D1844A8ED2D273509D51B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clrjit.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\clrjit.dll
Size 1.7MB
SHA256 139627d0969afcbe8eb75c951c7a46b8afd63f998607633ee5765f41eee6e3b3
MD5 8ea718a6452d471943f70d01a5f38d9c
SHA1 a763f60d9a8450d6aca3d07c8f1796061be897f2
SHA512 f24a9994d3ca58146d144aff88bb3c95edec0c73d606a7f13d87fbd718f4b5709b568ed1fae4a201a70e9d4bcd49bd775947f0e2f46856ec1625dc57601a649d
SSDEEP 49152:eSGsSAvQB2UJB0GjtKPuXScRhzpBPPGzUlKCUPQEE4NBWv+dW:HfQjCGjLSwJpxO9CUPQEE4rs
TLSH
T13F859E43A2F805FCD0AF9534C6574A1BEBB2B45913609FCF42F40AA6AF237E2161E715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

coreclr.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\coreclr.dll
Size 4.3MB
SHA256 34b035ac702ddfb67b10536a7d44caab914202f40cf310eaeb4e634871dba0d4
MD5 f1d836cedb2443d4500ba53801669e16
SHA1 5007141a70ceb697521cb71a5ad70986ed53d977
SHA512 3d658a14a1182672ca9e04f7a72ba7ff0d4c7a3f2f641f3e1e1f383b61a78cab42938f9dc4b57ed4691ad8d6020056270de04c4448e81ea8e569f0fbfb2514ec
SSDEEP 49152:DwDQnowvJmq4y7YDXJyihhNnw1jSOsQNGUjTWNa1VpEWPFAUK3R2cqmle1z16Zc1:LowvJmq4yEWS1TRBg04kvP76jAxsZ
TLSH
T16026AF16B6AD00E8C17AD0BAC5E74917FBB27C590738DFEB16604A251F23BD16A3E314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostfxr.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\hostfxr.dll
Size 358KB
SHA256 6030fa4943ff98b4d29787c1b3045a98d4fd03dd644a3de223f0aac2ed984b3f
MD5 2c75fe3e96dd0f43f2ab30c33f949152
SHA1 5b94ba3d92b0c0d34582bd3850b28f45046921da
SHA512 7f91a0275a0ed0e825eed52db97b64f3b097ae33b4386ee61132c95ec373a92145cad8b1e95426e1800e64a0328827aa429940965e0de2f82b8101e31c2fdce9
SSDEEP 6144:/E7Djww5R1Gv0crFLeUtJ9NZFSKJGDjq/2nhNonJLSHD6DPDh7vJp2EEJsxqTZ6n:YMjrFzJ+O+Ur5JoEbYtXZPe
TLSH
T16F741916D6E8017CF0B7D679CAB28901EB727C494BB196CF139099661E73BD09E39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostpolicy.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\hostpolicy.dll
Size 397KB
SHA256 d6fd9ce40c9e2ff31f552313773b8c870249fe8e5f0140808a2bd26a238afcb6
MD5 c1c0c9769a9474e974f9d8b6d4c3588a
SHA1 1e2c77e611406ab9ed2e3fd97c85696a74128bee
SHA512 603d8f61c7d5659bb7954ab6929b606c57c3cb177b0ccf7d10e1d682b281f5fedb8ef290272ea575f9768bfa0ac4ebbf57448876205de07aef0a77ca84b722d0
SSDEEP 6144:Yvf1pnG2fGDIR/Sv2WE5W1TlBVe8Hz7jTl3TtCOa9/Cm8Q9NCNGQDZ0JN94yKjcG:Ym2YFrfe819mBKYTJMRLSqToyJrg0
TLSH
T1F5842816D6AC0078F0B7E6798AB38941EB727C4E47B196DF139089661F73BD09E39312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mscorlib.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\mscorlib.dll
Size 58KB
SHA256 314ce67a1b2b08ed5b5e70bad1724efd5797e45d7cbfbfd757089afb64812d8f
MD5 d3a209aed6b3d573c632e266861e3610
SHA1 284338825c8dbb7dbedc04e37e0bb721cebd7e2b
SHA512 9ffa111fd19b2aa1a493a7a096597b6d9571972022873537d0382541b587f5a726c2657a916aa858a712a1022fbf17e0970ea2e1a5ef5b599e9f2c5f7b38effe
SSDEEP 768:Gt51EDMpCUoqFY66Gw17oqZn/TEHmyrchswz6EEZcYf5o4ba2yGlG1QeY48lCiQV:GtFcC3ZcYf5o4bZyGc1A4cn/uRz8k
TLSH
T13C430872BD4C9733CC8B9B79DC77A48905F233C234761AA5A849D51714CE7A0A2337AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

netstandard.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\netstandard.dll
Size 98KB
SHA256 44e97c5183223e1460f6bd2526b6df6b3e7bdef19d11a262c2404d7f7b2f0158
MD5 db97bb63e942512abc432c863a5b756f
SHA1 512b5a53652955c68bd37762de69d2554b9bc5a7
SHA512 45d3c39e4048c7fc56c7d4af55df7f4ba6b77ad55a526c82b26ad6b93aecf2469bc48af0dc101f6bc1086f5320f4759dfe8f39f5a5c3368bc7e3953d2752c6d2
SSDEEP 1536:iYsYXj0p2NYq5V4bgDHsPdIpuSE5L3Ukcz9wZcxYczqO2:XMkYe4bgDUAxCZm+O2
TLSH
T188A31660BE14D7B3CDDF97B1CDB7A85117F232CA21720FB5A156814745C7A84A33A38A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!.deps.json

Path C:\Users\Admin\AppData\Local\osulazer\current\osu!.deps.json
Size 208KB
SHA256 3bf80438f95b8f0e255e9fd0574c3a2a402292bd740097f15b97bb291af19a15
MD5 cd5156467699fc2b0152fa7e3e14438e
SHA1 d3dc07f2fb530e97fd70183ebfd6aeb40ff61838
SHA512 f431cefdc955566b35f6278217c085bc40f48a9ec60f105c295b045147ed7e2f10502d35972d3ad4216966c8c53b95c2885d799616205911f13b4440cc3ad8b1
SSDEEP 3072:JXd/UFHSlcu7HjYiKlt1Y12qZCRdTDKXbSh0BaN1O1SOG4CnHS2LvIU7+KP/obRE:yabR+n
TLSH
T11624A925CA589DB30AB2ABA6683481C2F375432F5010288FB8FC255DDF73E9B5166F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\osu!.dll
Size 244KB
SHA256 b4e35ad0f6c2649b6be4d197d95d1ff2fc2f585596eeef39f01874a2ca19eb19
MD5 0e0c41f2166b7532c6aed5ffbea29e88
SHA1 a43ad48ff8f0c8551d841cdffd492b8b51bdac62
SHA512 686dfd1c117c4c9679f8d3b64af98295c739090cfee8bd6d8c49e1d731baaef69e5001da704075f00cbf1dafb59c21f974e9805ff89f649ed8df54b9f2c3e308
SSDEEP 3072:qcC0xb1ndKFBGtvffScXQYrB88Ibv7xXON9GtvffScXQYrB88Ibv7xXfwAETj:qBsEBq6EZ+Aq6EZ+Aj
TLSH
T1C934E1C0B664C626D6FF4A76B0A196420A7DFF8B7DC6D359A80DB7CC09B33164522723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!.exe

Path C:\Users\Admin\AppData\Local\osulazer\current\osu!.exe
Size 239KB
SHA256 69a60fe9190037dbd9c42f47f9880f2f78b88fbbe40062a07a08d67d28254610
MD5 b011b57221520d2895b7205ed8f5c616
SHA1 270c3c4934bb227c3ff7c0a058a6e66e73b42cb5
SHA512 fd92fc1e2853f515b34780e78e4a93cd9da97d31532e5a36ca7eea8c4582f9f1086d71ead2aa3e0dca91be9622dfc5267f77ca6459281164b0d06a807fc82b38
SSDEEP 3072:lqeXA/4yIg9vkNPNu6H6xCYOixUE2652JtGtvffScXQYrB88Ibv7xXvN5qTV:lvgvkNFNaxmVEWJtq6EZ+QV
TLSH
T15C348F07F6A851BEE172D535C9D28D41FB727C594BA1A6CF1310AAB60E737D0AE39302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!.runtimeconfig.json

Path C:\Users\Admin\AppData\Local\osulazer\current\osu!.runtimeconfig.json
Size 412B
SHA256 9d2837ddad683f5ddf213389b072938e935f0c1f896f931fc6656e89e605349a
MD5 c2f3fbd69f807a915ede92ce30a23a79
SHA1 46d30d6555910644da60cb82eea31276350a8a76
SHA512 fac44feb216ddd1b21579409386a72d395cccaaace5af28a828ee1459dc7a61f0520a3dc1b04bdceeaccb30fabdfa47981b7b8b63d9b143c13b1865caaf085d8
TLSH
T153E02265CA116DB711F9B23EC521C083EA3053270004289178FD040C6F3B9BA1122F96
MD5 SHA1 SHA512 TLSH

Submit Download

osu.Framework.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\osu.Framework.dll
Size 3.8MB
SHA256 5592071295baff82740501036989c3e4b82c0be38fe8bc73c4083a964d116967
MD5 88375232389ed7ae0c681d139b7bc1f8
SHA1 25028a32e23dfd2d44288f984b5a7905024a66e3
SHA512 fb8a970c6467176a09279dc660d473312d78cc2845d0ecddd10ee1916839f3cc590dcabdb2ad08d4d99f6c1de9a65f173e2607ce08da860b276153b6e9bbd612
SSDEEP 49152:8mC/X8eHa36VCXgR45gtFAMlVWNsFoZ9t+WGZVuN93KHDHRA/72L6gGfo:83XfazCg6oZ9t+WGKf3KHD/L3GA
TLSH
T13C069C917398CE3AC8AE2B3BE42085D05376FC425761D7CB3946ABBC6D627000E57B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu.Game.Auth.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\osu.Game.Auth.dll
Size 237KB
SHA256 5dc5559dca7f2e400d08db72846ec0796e020185b547cb8bc35764ff42f8de42
MD5 0fa80caa36d8570ee430976281fff9eb
SHA1 77cc0452003a41b1a1459ab3d43ed77bf2540778
SHA512 2724d62efc9524de8a21670987885aae3d35ccdb623891a25edfea0fdc5df4bb65684e534ba6407c1ffa8c3b94d3ef3cf0c13bb7bcd7a8b40306b2c9b011aa29
SSDEEP 3072:cQIvBaxyIQjUrYSZ0rA7XyQZunKjVUZvJcmnhYch+TdNQ8QveROqJOsyh35NhyBC:HIgLQjUr5wSSZvqmKdWZvibq5NhnN
TLSH
T14D34286C139C6753DEAE8ABCE0E20106D3ECC16B605BEBCA6CC563E22D073939547647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu.Game.Tournament.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\osu.Game.Tournament.dll
Size 227KB
SHA256 80967b91d3991c0f88506ff394807702ee76b5765aec0cd01b55d80b9d2920c1
MD5 9f288940fd0b9b5271c254c1adcb91fc
SHA1 8eb987f6538ab8307d6aded55f7c0373284bf432
SHA512 47da952fb4bf287a83fd92062f33c5ce1b1e64fde4963dc461a64225675d440af67c4952b1b8cbc43a0f1d8072e0cff80fa96691052679654a169f2fcbd32f82
SSDEEP 3072:XfCtjAgCtyvinPKyXyBTZvtoSmzt/msEl0DI/3Jk5IShY:XqxCtyv8OQSmztCloo3S2z
TLSH
T1D2348D6873A44A27CB7F1776B0D40948E2B16A03F4DAEF7D8C8594D91A43322F94336B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu.Game.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\osu.Game.dll
Size 6.4MB
SHA256 bfddae0063a114c83423a0fbc4b595cbacf49e38fc2a0031b1322bb038e57035
MD5 2f76e66d16692a595e8d0dc6ef2e1cad
SHA1 0898a6101bad623b54eb295c0811d10d1e3d8bce
SHA512 64b34c4aa485811105336241945cd44992849ebd2dbb7a904c6092787fb4a912a9670fab99b83e2d5d2af305b70e7ed5f961541586eca83c3b032cf640d2d6d8
SSDEEP 49152:7xWrp87U8eBVECjZFVAp+vSt0pwXGqKtMg/RreBsThmCBJaak/vmdt98SSmILZ6M:9Wd87U77FVAZ0q2pH/Be60mCL
TLSH
T157665A88E7948A31C93F493290EF721217F2E84B6737DB1A9311F5B679823197B56323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osuTK.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\osuTK.dll
Size 6.1MB
SHA256 5574d14c53abe988c7d699050c7d3a9032e5d8b8dafd6cb8b6861ceb387729b3
MD5 4b92aac9cc8b84f16baa8b7de81025e0
SHA1 2e1656de6eb1c1b1902b9b49cce088759ebf446c
SHA512 96fbbdad006ea26abb072dfa004bf6c50a45830eaac9d855cf841d470cb2c0c7a17bed780671e907ba90ed77fdf8ecad9d999178aa24db3f218f8ff1ab7a52b2
SSDEEP 24576:1pugrePBtmdE11MUk2JcN+4JlIVOX/9P8NW/G5oIpQ/U6472t8C8w4RikVzcbqsD:+gUtYeNyFyHz/ERdDtw5Jw
TLSH
T18056D709B7E12F2BDA56737BC42E1012217AC99917839B13B037DB3E9CF27A919191DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sq.version

Path C:\Users\Admin\AppData\Local\osulazer\current\sq.version
Size 541B
SHA256 1123df1daa74b50d21d9af2bd951cfcdecef1a64d14df2cf323522dedd933994
MD5 7c879dca0e9ce673037b0b110a6b1554
SHA1 e06c1015eca1e84538bd1acb5d6771c70a058045
SHA512 ddd92825bf995eab9d1e05f90fdb0d81df41a3412dc2368f08d7bdf15a59614f430fa37555210e295e23234df5e4ab35c18bb905c59d79afb9f79db58c1c6730
TLSH
T1D6F0C0449000B607D28A97184CE44208F3FB3EAF30D18488FD88AD4D7AD92DFC866583
MD5 SHA1 SHA512 TLSH

Submit Download

AuthNative.dll

Path C:\Users\Admin\AppData\Roaming\osu\AuthNative.dll
Size 10.2MB
SHA256 9ba5d929acf1f183cb4998640df28350e27133d704dc0a761b0ed6b9dcbb6a24
MD5 e14effbb920f683421ccc714bff60015
SHA1 f52f102cd38a0bc46b7a0e9f8a86b24e2b28ea62
SHA512 1a090bbc3d1d1a73d2be056651e14b78533208e92e6caa47981957d94a42bd8db809cbb33ddf8556f697a6f47db85f69bd6976d613e9ed145ad51dc641fa56b2
SSDEEP 196608:0yZ3lPq1WsY13FixuUuQe2KNVlZRTMb5+FE2eNyQY3lT:0ybiURInuWKvRTMb5+F7eNyQYVT
TLSH
T185B6BEE376D1E8E9C32ACCF4C952B62F97D77C76071972874965B39CAA33A043618B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1556d0801b3a6b175dda32ef546f0ec812b400499f575c44fccbe9c67f9b1e5

Path C:\Users\Admin\AppData\Roaming\osu\files\a\a1\a1556d0801b3a6b175dda32ef546f0ec812b400499f575c44fccbe9c67f9b1e5
Size 988B
SHA256 a1556d0801b3a6b175dda32ef546f0ec812b400499f575c44fccbe9c67f9b1e5
MD5 27d9765612170a9517f0a5e8b4613f06
SHA1 660d4456ea71bdb48a9ef84cf65cd68d40d05a6e
SHA512 eda5ae2dc0e123418f0e50a51ea651c10c82aa0620d89bbef47cad1c5ef336b43d19604a6281853cc2603dd0c25d445b0195780897f8606beb768132222fa41f
TLSH
T12911CE7E800B4139C38F33553124628371E45179B63BB7E4BE46E94A0221EF9A33926E
MD5 SHA1 SHA512 TLSH

Submit Download

1777993458.runtime.log

Path C:\Users\Admin\AppData\Roaming\osu\logs\1777993458.runtime.log
Size 9KB
SHA256 82b5a2aa757d1765258fbf76796e777106972ab8aa058304e60a52e70e8824b2
MD5 33c773ba9d755d7f7c87466bfba751bb
SHA1 b139e7863535c93d300b16f9999d3b121800fd44
SHA512 c8503d1636b5edeb0631d4146c456823eb63084b3e7c7c0b37404088ca51bb1f77a8764096a59101b1cda4b27e4d86058eead7b4c2ca2a415535b165d22c342f
SSDEEP 96:LHNw/t272X7Zm507+JuRe0mF8nvINuwB9Qa+UBmy/WkJBDu5VD0hfLRYFuPCiA+F:VCrbu5KPOjuW+xosqUmmiuJy
TLSH
T12722E9B7DF2AC4E62D518363D3315E9B4F167B012328AA753229005A12471B8E6DFEFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3332-469-0x0000000002830000-0x00000000028EB000-memory.dmp

Download

memory/4224-652-0x000001FBA5880000-0x000001FBA5892000-memory.dmp

Download

memory/4744-502-0x00007FF955ED0000-0x00007FF95690D000-memory.dmp

Download

memory/4744-658-0x00007FF955ED0000-0x00007FF95690D000-memory.dmp

Download