0dafb664a0a0b9f1d69409d266a687a199808f3c58b7f7257d8b1761d73aed2b

Analysis

user interaction
yes
max time kernel
389s
max time network
385s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
osu!AerisSetup.exe
Size 8.0MB
Sample260723-pc3f6swtex
SHA256 0dafb664a0a0b9f1d69409d266a687a199808f3c58b7f7257d8b1761d73aed2b
MD5 8f6e8db9656e85797dc5310c5d5c68bb
SHA1 dc7e037a1710d695fadced9ecd36ce8cc9c95f49
SHA512 0a1a6794bed811cf4391a98d5766a71121a1e23b53c8a88135385f16091ab665e37a7ed74111bcbbe44d33ebce320634f60e9c77a0e471de899f8db735f1f642
SSDEEP 196608:JjPEtZuJY+IbS7vCUW7xIILlTmOybNs3ncB1kD3bWzyXYr7iUy:JjPEtZaF7KxJpmr23SQIyqU
TLSH
T1FB86223FB28B253DE06A1A363A73D510443BAE61A5234C5697E4F85CCF754B01E3EA93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery installer persistence

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
223	3328	chrome.exe
258	2940	osu!.exe

Drops file in Drivers directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Drivers\PROCMON24.SYS	Procmon64.exe
File created	C:\Windows\system32\Drivers\PROCMON24.SYS	Procmon64.exe
File opened for modification	C:\Windows\system32\Drivers\PROCMON24.SYS	Procmon64.exe
File created	C:\Windows\system32\Drivers\PROCMON24.SYS	Procmon64.exe
File opened for modification	C:\Windows\system32\Drivers\PROCMON24.SYS	Procmon64.exe
File created	C:\Windows\system32\Drivers\PROCMON24.SYS	Procmon64.exe

Sets service image path in registry 3 TTPs 3 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCMON24\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCMON24.SYS"	Procmon64.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCMON24\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCMON24.SYS"	Procmon64.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCMON24\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCMON24.SYS"	Procmon64.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	osu!.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	osu!.exe

Executes dropped EXE 10 IoCs

pid	Process
4220	osu!AerisSetup.tmp
536	install.exe
4672	osu!.exe
2940	osu!.exe
5788	osu!.exe
2064	osu!.exe
5756	osu!.exe
3840	Procmon64.exe
2692	osu!.exe
2684	osu!.exe

Loads dropped DLL 64 IoCs

pid	Process
4672	osu!.exe
4672	osu!.exe
4672	osu!.exe
4672	osu!.exe
4672	osu!.exe
4672	osu!.exe
4672	osu!.exe
4672	osu!.exe
4672	osu!.exe
4672	osu!.exe
4672	osu!.exe
4672	osu!.exe
4672	osu!.exe
4672	osu!.exe
4672	osu!.exe
4672	osu!.exe
4672	osu!.exe
4672	osu!.exe
4672	osu!.exe
4672	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
93	camo.githubusercontent.com
94	camo.githubusercontent.com
96	camo.githubusercontent.com

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
5580	GameBarPresenceWriter.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Procmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	osu!AerisSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	osu!AerisSetup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3328	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/2340-0-0x0000000000ED0000-0x0000000000FD6000-memory.dmp	innosetup
behavioral1/memory/2340-60-0x0000000000ED0000-0x0000000000FD6000-memory.dmp	innosetup
behavioral1/memory/2340-384-0x0000000000ED0000-0x0000000000FD6000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292823387070828"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\osu.Uri.osump\Shell\Open\Command	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\osu.Uri.osump\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\osulazer\\current\\osu!.exe\" \"%1\""	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ProcMon.Logfile.1\shell	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ProcMon.Logfile.1\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\ProcessMonitor\\Procmon64.exe\" /OpenLog \"%1\""	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.PML	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ProcMon.Logfile.1\shell\open\command	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.olz\OpenWithProgIds	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\osu.File.osr\ = "osu! Replay"	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\osu.File.osr\Shell\Open	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\osu.File.osr\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\osulazer\\current\\osu!.exe\" \"%1\""	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\osu.File.osk\Shell	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\discord-1216669957799018608	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.PML\ = "ProcMon.Logfile.1"	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ProcMon.Logfile.1\DefaultIcon\ = "\"C:\\Users\\Admin\\Downloads\\ProcessMonitor\\Procmon.exe\",0"	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\osu.File.osz\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\osulazer\\current\\beatmap.ico"	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\osu.File.osk\DefaultIcon	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.osk\OpenWithProgIds\osu.File.osk	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\discord-1216669957799018608\DefaultIcon	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ProcMon.Logfile.1\ = "ProcMon Log File"	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ProcMon.Logfile.1\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\ProcessMonitor\\Procmon.exe\" /OpenLog \"%1\""	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\discord-1216669957799018608\shell	osu!.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{3603EC29-3964-47C6-99C4-8C287680F238}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ProcMon.Logfile.1\DefaultIcon	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ProcMon.Logfile.1\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp1_ProcessMonitor.zip\\Procmon64.exe\",0"	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ProcMon.Logfile.1\shell\open\command	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ProcMon.Logfile.1\DefaultIcon\ = "\"C:\\Users\\Admin\\Downloads\\ProcessMonitor\\Procmon64.exe\",0"	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ProcMon.Logfile.1	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\osu.Uri.osu\Shell	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\osu.Uri.osump\Shell\Open	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\discord-1216669957799018608\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\osulazer\\current\\osu!.exe"	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ProcMon.Logfile.1	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.osk\OpenWithProgIds	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\osu.Uri.osu\Shell\Open\Command	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\osump	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.PML\ = "ProcMon.Logfile.1"	Procmon64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\osu.File.osz\ = "osu! Beatmap"	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.olz	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\osu.File.osk\Shell\Open	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ProcMon.Logfile.1\DefaultIcon	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\osu.File.osz\Shell\Open\Command	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.osr\OpenWithProgIds\osu.File.osr	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\osu.Uri.osump\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\osulazer\\current\\lazer.ico"	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\osu.Uri.osump\Shell	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ProcMon.Logfile.1	Procmon64.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\osu.File.olz\Shell	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\osu.File.olz\Shell\Open	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\osu.File.osr\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\osulazer\\current\\beatmap.ico"	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\osu.Uri.osu	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\osu.Uri.osu\DefaultIcon	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\discord-1216669957799018608\ = "URL:Run game 1216669957799018608 protocol"	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\discord-1216669957799018608\shell\open	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\osu.File.osz\DefaultIcon	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.osz\OpenWithProgIds\osu.File.osz	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\osu.File.osr	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.osr\OpenWithProgIds	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.osk	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\osu.File.osz\Shell	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\osu.File.olz	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\osu.File.osk\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\osulazer\\current\\osu!.exe\" \"%1\""	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\osu	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1424	chrome.exe
1424	chrome.exe
4220	osu!AerisSetup.tmp
4220	osu!AerisSetup.tmp
1424	chrome.exe
1424	chrome.exe
536	install.exe
536	install.exe
2940	osu!.exe
2940	osu!.exe
4768	chrome.exe
4768	chrome.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
1724	Procmon64.exe
3820	Procmon64.exe
3840	Procmon64.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
1724	Procmon64.exe
3820	Procmon64.exe
3840	Procmon64.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
4220	osu!AerisSetup.tmp
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
2940	osu!.exe
2940	osu!.exe
2940	osu!.exe
5620	OpenWith.exe
1724	Procmon64.exe
1724	Procmon64.exe
1724	Procmon64.exe
3820	Procmon64.exe
3820	Procmon64.exe
3820	Procmon64.exe
3840	Procmon64.exe
3840	Procmon64.exe
3840	Procmon64.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 4220	2340	osu!AerisSetup.exe	84
PID 1424 wrote to memory of 4604	1424	chrome.exe	88
PID 1424 wrote to memory of 2936	1424	chrome.exe	89
PID 1424 wrote to memory of 3328	1424	chrome.exe	90
PID 1424 wrote to memory of 2936	1424	chrome.exe	89
PID 1424 wrote to memory of 4616	1424	chrome.exe	91
PID 1424 wrote to memory of 4616	1424	chrome.exe	91
PID 1424 wrote to memory of 5080	1424	chrome.exe	92
PID 1424 wrote to memory of 5080	1424	chrome.exe	92
PID 1424 wrote to memory of 1728	1424	chrome.exe	93
PID 1424 wrote to memory of 1728	1424	chrome.exe	93
PID 1424 wrote to memory of 3300	1424	chrome.exe	95
PID 1424 wrote to memory of 3300	1424	chrome.exe	95
PID 1424 wrote to memory of 4792	1424	chrome.exe	96
PID 1424 wrote to memory of 4792	1424	chrome.exe	96
PID 1424 wrote to memory of 548	1424	chrome.exe	97
PID 1424 wrote to memory of 4672	1424	chrome.exe	100
PID 1424 wrote to memory of 4672	1424	chrome.exe	100
PID 1424 wrote to memory of 3984	1424	chrome.exe	101
PID 1424 wrote to memory of 3984	1424	chrome.exe	101
PID 1424 wrote to memory of 4044	1424	chrome.exe	102
PID 1424 wrote to memory of 4044	1424	chrome.exe	102
PID 1424 wrote to memory of 2276	1424	chrome.exe	105
PID 1424 wrote to memory of 3520	1424	chrome.exe	106
PID 1424 wrote to memory of 2872	1424	chrome.exe	107
PID 1424 wrote to memory of 3192	1424	chrome.exe	108
PID 1424 wrote to memory of 3192	1424	chrome.exe	108
PID 1424 wrote to memory of 4244	1424	chrome.exe	109
PID 1424 wrote to memory of 4244	1424	chrome.exe	109
PID 1424 wrote to memory of 5016	1424	chrome.exe	110
PID 1424 wrote to memory of 5016	1424	chrome.exe	110
PID 1424 wrote to memory of 3916	1424	chrome.exe	111
PID 1424 wrote to memory of 3916	1424	chrome.exe	111
PID 1424 wrote to memory of 4328	1424	chrome.exe	112
PID 1424 wrote to memory of 4328	1424	chrome.exe	112
PID 1424 wrote to memory of 4264	1424	chrome.exe	113
PID 1424 wrote to memory of 4264	1424	chrome.exe	113
PID 1424 wrote to memory of 1232	1424	chrome.exe	114
PID 1424 wrote to memory of 4044	1424	chrome.exe	115
PID 1424 wrote to memory of 4044	1424	chrome.exe	115
PID 1424 wrote to memory of 3264	1424	chrome.exe	116
PID 1424 wrote to memory of 3264	1424	chrome.exe	116
PID 1424 wrote to memory of 2064	1424	chrome.exe	119
PID 1424 wrote to memory of 536	1424	chrome.exe	124
PID 536 wrote to memory of 4672	536	install.exe	125
PID 536 wrote to memory of 2940	536	install.exe	126
PID 1424 wrote to memory of 4768	1424	chrome.exe	128
PID 1424 wrote to memory of 5472	1424	chrome.exe	144
PID 1424 wrote to memory of 5472	1424	chrome.exe	144
PID 1424 wrote to memory of 1016	1424	chrome.exe	151
PID 1424 wrote to memory of 1016	1424	chrome.exe	151
PID 1424 wrote to memory of 4072	1424	chrome.exe	152
PID 1424 wrote to memory of 4072	1424	chrome.exe	152
PID 1424 wrote to memory of 5152	1424	chrome.exe	153
PID 1424 wrote to memory of 5152	1424	chrome.exe	153
PID 1424 wrote to memory of 1348	1424	chrome.exe	154
PID 1424 wrote to memory of 1348	1424	chrome.exe	154
PID 1424 wrote to memory of 5464	1424	chrome.exe	155
PID 2356 wrote to memory of 3840	2356	Procmon.exe	161

C:\Users\Admin\AppData\Local\Temp\osu!AerisSetup.exe
"C:\Users\Admin\AppData\Local\Temp\osu!AerisSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Users\Admin\AppData\Local\Temp\is-L4A6YTMGMW.tmp\osu!AerisSetup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-L4A6YTMGMW.tmp\osu!AerisSetup.tmp" /SL5="$A0068,7133786,1012224,C:\Users\Admin\AppData\Local\Temp\osu!AerisSetup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:4220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8bddfc728,0x7ff8bddfc734,0x7ff8bddfc740
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1752,i,14362200776048531085,2026759619125409092,262144 --field-trial-handle=1816,i,13687470050034568166,3665573629214618749,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,13596439760706893524,1060348230998721207,524288 --field-trial-handle=1816,i,13687470050034568166,3665573629214618749,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1984 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,2514265010696500886,2413285713612698986,524288 --field-trial-handle=1816,i,13687470050034568166,3665573629214618749,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3184,i,3855709329895470104,15656878656780822858,2097152 --field-trial-handle=1816,i,13687470050034568166,3665573629214618749,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,18031964525717599113,11964604435688668463,2097152 --field-trial-handle=1816,i,13687470050034568166,3665573629214618749,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4552,i,15603210762315999774,14239417066585401569,2097152 --field-trial-handle=1816,i,13687470050034568166,3665573629214618749,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4732,i,8037770999880866094,13857239576083355219,2097152 --field-trial-handle=1816,i,13687470050034568166,3665573629214618749,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5348,i,1420315862519323026,2046863963494640083,524288 --field-trial-handle=1816,i,13687470050034568166,3665573629214618749,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5344,i,2150131416834589263,5898182959769430289,2097152 --field-trial-handle=1816,i,13687470050034568166,3665573629214618749,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4848,i,4628880003372804436,13778309793022699949,2097152 --field-trial-handle=1816,i,13687470050034568166,3665573629214618749,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4772,i,17885926620176889952,11461830224610250246,2097152 --field-trial-handle=1816,i,13687470050034568166,3665573629214618749,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,7896379875913760537,4493034461725483135,524288 --field-trial-handle=1816,i,13687470050034568166,3665573629214618749,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3244,i,1504399423981285854,16841741779763539707,524288 --field-trial-handle=1816,i,13687470050034568166,3665573629214618749,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5824,i,13917641567568497462,8276109912658021448,524288 --field-trial-handle=1816,i,13687470050034568166,3665573629214618749,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5776,i,1691358599661692753,10163206365199703650,2097152 --field-trial-handle=1816,i,13687470050034568166,3665573629214618749,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5972,i,10654065020371758921,16740830066342037534,2097152 --field-trial-handle=1816,i,13687470050034568166,3665573629214618749,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6164,i,4765967654610037963,1448306278412747757,2097152 --field-trial-handle=1816,i,13687470050034568166,3665573629214618749,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4676,i,6638617895388824825,12634491974016219500,2097152 --field-trial-handle=1816,i,13687470050034568166,3665573629214618749,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5940,i,9522289895980865174,8029321830926654108,2097152 --field-trial-handle=1816,i,13687470050034568166,3665573629214618749,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=864 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6216,i,16349331098541480178,3256920683524415665,2097152 --field-trial-handle=1816,i,13687470050034568166,3665573629214618749,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,7922862845667443384,4071786474958824949,524288 --field-trial-handle=1816,i,13687470050034568166,3665573629214618749,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,17660583500380585350,12373027576228702599,524288 --field-trial-handle=1816,i,13687470050034568166,3665573629214618749,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6380,i,14105630499274019369,14737044037502214739,2097152 --field-trial-handle=1816,i,13687470050034568166,3665573629214618749,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6272,i,13567276520295956098,18301634377005208358,524288 --field-trial-handle=1816,i,13687470050034568166,3665573629214618749,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:2064
- C:\Users\Admin\Downloads\install.exe
  "C:\Users\Admin\Downloads\install.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\Users\Admin\AppData\Local\osulazer\current\osu!.exe
    "C:\Users\Admin\AppData\Local\osulazer\current\osu!.exe" --veloapp-install 2026.711.0-lazer
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4672
- - C:\Users\Admin\AppData\Local\osulazer\current\osu!.exe
    "C:\Users\Admin\AppData\Local\osulazer\current\osu!.exe"
    3⤵
    - Downloads MZ/PE file
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6300,i,5139300164106405950,8311665934967861063,262144 --field-trial-handle=1816,i,13687470050034568166,3665573629214618749,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1280,i,10501016619164967688,10322199094316154152,524288 --field-trial-handle=1816,i,13687470050034568166,3665573629214618749,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:5472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5816,i,15536851950768583161,5045882516177017768,2097152 --field-trial-handle=1816,i,13687470050034568166,3665573629214618749,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1536 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6756,i,11987217853573051345,16788881744877329964,2097152 --field-trial-handle=1816,i,13687470050034568166,3665573629214618749,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6704,i,7185795529222041995,11996075585860690155,2097152 --field-trial-handle=1816,i,13687470050034568166,3665573629214618749,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6760 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=4480,i,13394892458048021198,7300598398359872218,2097152 --field-trial-handle=1816,i,13687470050034568166,3665573629214618749,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7064,i,8377697354670628297,2848517446553634431,524288 --field-trial-handle=1816,i,13687470050034568166,3665573629214618749,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7044 /prefetch:8
  2⤵
  PID:5464

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5064

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:5580

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:5664

C:\Users\Admin\AppData\Local\osu!Aeris\osu!.exe
"C:\Users\Admin\AppData\Local\osu!Aeris\osu!.exe" -go
1⤵
- Executes dropped EXE
PID:5788

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4668

C:\Users\Admin\AppData\Local\osu!Aeris\osu!.exe
"C:\Users\Admin\AppData\Local\osu!Aeris\osu!.exe"
1⤵
- Executes dropped EXE
PID:2064

C:\Users\Admin\AppData\Local\osu!Aeris\osu!.exe
"C:\Users\Admin\AppData\Local\osu!Aeris\osu!.exe"
1⤵
- Executes dropped EXE
PID:5756

C:\Users\Admin\AppData\Local\Temp\Temp1_ProcessMonitor.zip\Procmon64.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_ProcessMonitor.zip\Procmon64.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: LoadsDriver
- Suspicious use of SetWindowsHookEx
PID:1724

C:\Users\Admin\Downloads\ProcessMonitor\Procmon64.exe
"C:\Users\Admin\Downloads\ProcessMonitor\Procmon64.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: LoadsDriver
- Suspicious use of SetWindowsHookEx
PID:3820

C:\Users\Admin\Downloads\ProcessMonitor\Procmon.exe
"C:\Users\Admin\Downloads\ProcessMonitor\Procmon.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Users\Admin\AppData\Local\Temp\Procmon64.exe
  "C:\Users\Admin\AppData\Local\Temp\Procmon64.exe" /originalpath "C:\Users\Admin\Downloads\ProcessMonitor\Procmon.exe"
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious behavior: LoadsDriver
  - Suspicious use of SetWindowsHookEx
  PID:3840

C:\Users\Admin\AppData\Local\osu!Aeris\osu!.exe
"C:\Users\Admin\AppData\Local\osu!Aeris\osu!.exe"
1⤵
- Executes dropped EXE
PID:2692

C:\Users\Admin\AppData\Local\osu!Aeris\osu!.exe
"C:\Users\Admin\AppData\Local\osu!Aeris\osu!.exe"
1⤵
- Executes dropped EXE
PID:2684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d3dec47f922ac36c392aebb979099aaf75bbe4702fd4b3cc311d922cce17962f
MD5 99b79b35ba4e8fd70fd105aa0dc79c43
SHA1 6d1b6cefea1db4160485d971d1016d06f7fac437
SHA512 b6d86f4c17cff9859f1bc5829bf0346f31a41388a1b5c24bf01bee7d4753c1d550ba56d14a8603b2790fa41f62fce8fe31dd60bacefe3ecf569b12db976d3748
TLSH
T1B7E0E5AED9269C2729F9172C60940786EA4013573B80D94B7A3C8109CFB473A115582C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 82KB
SHA256 33b18bd9890aa292639a21b718f476107646d533da26494506f77118e2bf72bb
MD5 8bae731acbdf4dab36b69ff3ff96627f
SHA1 55e90b5a171b290a8bbfe1fae73662ab4faa2a3c
SHA512 4051606131bacc30f1772d2daa0b15d3268c06988cdb0c4f641dadffb4d47331dfd85e7bec15cb1691e035776f1321ca4f83873a07b22b0013f29de90d72a0e9
SSDEEP 1536:TPhiFbiLcU6ABlYfHc302PiRb4Spx0bm5UuHKRf8N8KoNlYhgIw88m7JWVZw:zhJo5uYfq02PgbFa9kKiNvylYhgWTwjw
TLSH
T1F5831283A367BDCDEDC4262954854E8819498E7697CD8199A443D0E9CCC8DFA2235E3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 436KB
SHA256 0b320d2cf00e9215763a5377904e2301b2edb7a5d299bd319259714cf8bcd9a9
MD5 38e965609b7e0769e6754549cfa3c2fd
SHA1 8ef9e62fa3ae6d8b371f5a9e9344a6cdf31515fe
SHA512 18cff962b979abf3e3d06261422f35502463a0e196aa0cf801cadcff8833a83f20c9e9f22fb3133041e406fdf2304088a0a5eaa4bbb8aff07ab15a0c1b46b0e4
SSDEEP 6144:HT+7EhQjYpz+XUGr9+7Km54TxcjJJEWv6p0qOJ7kuKtAiDL6GnkES7+S8HBWzDi2:6vj0iUI9EKFEJdU0p7riDxw7L8oviJ3c
TLSH
T147942367DF08D99BDA158361EA30EBDD1158EB6EE00A3CC844BB462CE54C0F9F6913C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 514KB
SHA256 0bd5ca5a308f6a28d6ae7fe2af76135ac2753f0ccb7da9976602294ea65b4b37
MD5 d522a0dd9775c72826994724cb4117de
SHA1 81794ee8057b126dc8b68eb97e93a1d5894b429e
SHA512 d5a6c6584ce9ff9325c6a267aca220737975447779278a5a2991b9e04ce3288d056d8ca9eababf47c4ef3aaab7c5d975e6762944e0eeb144e267eba29054a960
SSDEEP 12288:p6yttbet8rsgGBKAhclK2TQpBjfI2Mv5wfq4nXsn8:AFt8YgstBjfI2Mveyuc8
TLSH
T1A7B423F54F42A47B25B8919D77BB7AB03504CB0AE8C000B474128CF9CBD998D6D6E6CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003a
Size 61KB
SHA256 209ee2a97b171927fa369c3a1f69099590e2c730589149795ad8c5af51e88768
MD5 77ee1fb8fc271ce9ad2582918ac6d4fe
SHA1 b94777e3d6c7e802a70fb9795410c0b2219421fc
SHA512 b7d0f2e8fa47e0cc8c597e811025bd263437ec43e90135396d8d3a5a9dea315d63fd6d698c5ad972d948e293dfd1566a0e56a71103b75cb9a47ac798d7c114a9
SSDEEP 1536:luzbqMv8OlDfJQpyBali3pQUTVXfl+2OzsDv:gf/v88fA2hZQAVd+2OGv
TLSH
T1B753F1C17D096184E846B23C4E778330957AAC4FD3A78DF6986774C48E9A4C8B7185FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003b
Size 44KB
SHA256 1b5fa95e3cd8312ef743badb655648a0b7e834a075e55e58ef3c2a4e02e49511
MD5 a0d4477e19be922fedc6f7b8b60be33e
SHA1 957ec7049c66ff28609b081ffbceeb7f290d386f
SHA512 f8d63cee9bd62c7c77851df9e6272ffacdb71a518227fa362748f31e916bb151a93efd644b965f0a5e378b81c3d75c37f0569be7eb88fbf5e6511f726557b038
SSDEEP 768:GYiDiR4CghVQ41ASbANEnrHJAF4fub8NSL5y/PttWfpMNH6CnoWSylkU3MYB8:GhrbQ42SbQEn9AFONSLwNtapMNHHnoao
TLSH
T1C723F2E0CC7E41A46ACBA8145264D1A4D1D42D4F29A72B99227F0436DDFB14D2FFFAC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003c
Size 75KB
SHA256 0a713a9670c7725a4b8df0846a2f4ddd8082ac6032319c2bd3f6db6dc68461f8
MD5 b9dc9c66715f6889b95bcbfdbf469036
SHA1 da07ae176fbeb084aaff6bf51ecb62e228d40b84
SHA512 85e30cc4eff33630c7df02a53019dd0ecd7bec0e70d71ebee1197fb9085fb879b36ecec7d0db511ee9dcc863ee5537105f494478daef27a5a2cfec2a6e97819d
SSDEEP 1536:VIQbjV1zIfooqHOv4k2o12A6J29e5teHE8ITg3YUfrkdZFE:tJbi18c9wtgEPTUYUf0w
TLSH
T1DD7312221A09EB4CE1C6B46921867C390B44AED1171FC590F278D9FBFE134A751FB90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000068

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000068
Size 72KB
SHA256 25ddd39f9b797ee8acf5791c83b77114daa7cd8d70cc20915a6421bb19270ce6
MD5 e520b6af4f29af3cec42907e24ab07d2
SHA1 d52104370dd00a235336bd4bdf0ea909b0c1f4f3
SHA512 71c6090c6d7cbb6a28b59b51d56a36d9db0ae16d92c091a9dfb4b6befdb55beb90122b67c844076a534d53724f150e0cc1f905bd2f88148c56aec8015c9d5cdb
SSDEEP 1536:mXbzppj420PpCmvNmKDqM96ClK0eFr8LirXg//00VRdbtb:mzpaxpCmgo6Ggh8LgX5URdbB
TLSH
T1277302E5E785F3A6EC066463545FB801B12831BD4DB89211602D20FD7AB0196BEFA27D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 917d51a5df4bd41921007ab18a95064a72e61d1f446ce6b6d2937391617d69b4
MD5 1ca03b8209efb14e7ad84357c6caa5e2
SHA1 67b6bdea0214d0d71e6042ea579b4676275ea77c
SHA512 e715cb55e55e10fce4e5efdea08f0236b13e0e933ad2cb3a2aa53396bdf9d905a9f33ed574d0517852c7d95336494b1d0fd14521654aaf403eda3c096c422dfc
SSDEEP 96:LHhWnLZtIW1fVwBFWaZJdh9RDDXa1Q5rvZPytmPpAIXXOLwU0PG8473Y:LHhWdpfCFWaZR7DTGQ5zIt5+Xhx56I
TLSH
T102910A09E0915493CB646D7DB1EEAA85757859B4C6B30F2942C0DBB026C2BB3F53C314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 2b81b16584a445f341cacd0e6569f267d729d47ff59615d59cf19e118fd8f57e
MD5 0fc3519b6027c7a53187a1597f4ff8c4
SHA1 7b7b984fb254d64fea28169a7de2673ad2c63e84
SHA512 99fb4a6eb3f3534c80bd323259cb263ef96bfd6d7f88aa1cf8e987049141db19d1fe97b7f14d210c2ff18268f6e063bbecb3c0cfa0f33d418142f1e5517e1749
SSDEEP 96:OhWnLZtIW1iawBFWaZ9dh9RDDXzQ5rvZPytmPpAIXXOtU0PG84A3n:OhWdpixFWaZt7DTzQ5zIt5+Xwx5J3
TLSH
T12891F808E0515493CB646D7DB1EEAB89757899F4C6B30F2A42C1EBB026C2BA3F03C354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f63237b57e1c008521db741acf87218255bd6f74fd5a7eb4ae9ed87b6e4b351c
MD5 72a784215019bc748eceb5197b753729
SHA1 7faf31f6d1f024fad3a4582d1c1b33f0710cd266
SHA512 312853e248f89e56633d0c3f0800595ee13b08a9a5fd0318326b536345170d06af654f25a6a0b0bf5aac371fffaee34e9079b04412aa3b21bad6520ba4c27488
TLSH
T163713E05E0812093CB985D7CB2EEA9C9797896F0C2770F1A57D0D3B466823B3F039340
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 4c97359f294c7e5d903667c98ec3cfc575d104f201aa287b0c5868b92efdfdcf
MD5 4457d99e71d6838ebe503e1c938ba579
SHA1 ceb407c55ed7f7fd63b1c01c6d016def0490a72b
SHA512 5c9f92f2848869ee8306a2aa22083db2768cfbc5deee5b0d5ea07da5171e9cd76bb94564f01524cf6b5cdb81b542b1f8419046d85acffeae9c83a0ad139f1398
SSDEEP 384:D0uVtrQJJNyJm9mjw1VIefs1aIAEddZaZSfqm9mmmzm9ImIMNIIueojdORrwfvq/:gGYMs4bMXSOZc7Xw9y
TLSH
T14342BEF7C3E4852DCA0165F4AB14AF1FCE2D0624431C3C6689D8BE4BA3E2971E25174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 7c382be9bc5e11e689d491d6468cc73002b1a0354625fe849a4984cbe4306ff1
MD5 e8c6751efb11626a695a9301214cc10a
SHA1 53909d4b1af43b8c9178753436a794cd7d02a8f1
SHA512 f6a119352a373e025ad1273c3480fa0e7a14de22a518ccea2d434a27774d67884d924096d4d81d6c1df00a2e59c15e7d61db744b88ae2ec61313845c5a033386
SSDEEP 384:D4ZTauRvJ59Jmrm7/1VIefs1aIACJdZaZWfqmV1mmmzmbLFQImIiNHUIub+ojdOm:W5YqLMbiXSFZuPb19A
TLSH
T13452BFF7C3E8852DC90166F4AB157E1BCE1D0A24432C3D2789E8FE4BA3E1971E25564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 a48e8d80ede28581e2806477920020ca5bd9753803062fec8cfcf1e505f0f8c4
MD5 5e578f9c1904d65ce7478cbacfe7c531
SHA1 1b84209cc1c4f599e079eca3aeff5819300a43c8
SHA512 46fa65705ef6a013fe7ba2e4d7f03ba650b3914512ce55e20dccbcd17939ee05088a1bb510eb7c11f20acfc97a7c06489eecdf31a85301c088ee6058f33893bc
SSDEEP 384:D4ZTauRvJ59Jmrm7/1VIeDaIACJdZaZWfqmV1mmmzmbLFQImIiNHUIub+ojdORrV:W5Yq8MbiXSFZuPbLdL
TLSH
T19142BFF7C3E8852DC90166F4AB157E1BCE1D0A14432C3D2789E8FE4BA3E1971E25564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 e8ff109d0fa5acd774c2094b67c4708cb2e49e04805adb2661eec6143da084eb
MD5 c3f818d5cf3003cfc263661df4b19e7f
SHA1 08509d4334794c0393336896f49271a5ba2f1b06
SHA512 0e7ea9bfe4b9d905f4b32dc059f69e13fb11ad1b766c5a370f9949824827ebe76e317bcfd833fad84658cc128506a7a901a36345ff34fd5a61d2ca94d9d808c3
SSDEEP 192:D4ZTauRvJ59Jmrm7jaIACJdZaPhvefPim9mF1mTmDmzmu8TXFQImIiNP/UIubN4:D4ZTauRvJ59Jmrm7jaIACJdZaZWfqm9b
TLSH
T110028EF7C3D4C52DC90156F49B15AF1ECE2D0624431C3D2688D8BE5A93E2871E25575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 cdf7fd74847f35fad1580a03a1702c3f4d6c08c003349462289176e59f49d943
MD5 91ce47e9df0aba6e9c2190d72c7b9750
SHA1 58b8a7304c323a2402451a7bf8f2718fa65ee17f
SHA512 9ea6b5c6efdd2b54dab141a5477267ad5f461fbfea6b1347de61d50ef3b8810f1a49ac8dfe76a500148faec8a17861dae368fa04ab45e8479a43ee3c33c8c28c
SSDEEP 192:GRDcBh0x8ov78hAPRp2bJwjM9DHsb+WNZHLh54SWe8mes2u/a7cVyIsnAUgraJ:GRDmh0S048Xu5wBT0et2ua74e
TLSH
T12552B52FA920693B5CDAD219F9657757D7F61022B1D42E84EAFC8A1C14D7ACC321702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 303945a8fbe008270c0e930fe6027013f7eac0af8e9b8413059e00f6466c11a7
MD5 037ce91ddfd01a44e382030268e76ab5
SHA1 2de1370331b44d11f1fd739870cb7f5bb3a875b6
SHA512 f1f5dd13d3344efe0114689aedbc280af928414a25d2d3861d26c48cb3ebb42e969dd95b522d4abbe2ad57044390b87db24c25c5e9795ea5e2c8d76c7841d58f
SSDEEP 192:bRDcBzgxG7v7ThHPRp+bJijR159DHsb+WNZWyWHs0WgfoJWkEmes2u/a74VyIsnB:bRDmzgEDPdXZ5wUDFtkl2ua7ce
TLSH
T17862B76FA910297B9DEAC219F9657757D7F62022A2D02D80FAFC8E1C14D76CC721702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 2d1e9d5fe952a9900c9399313bffd18e459d09968b5fd1138d499ebc62ea027a
MD5 a310bd55e5864cf12d1be170c859de9d
SHA1 67cca328a78f9c74b9d5ea0171663a4c2d63e94c
SHA512 9752cfeb28b8e452469fc36c44f9cf28de4f146362356bdc9a32eb1b61ec013b6180b1a0e42f731580114aedeba3bf75531d97233729f44486d0ab1b8b2f1dc7
SSDEEP 192:bRicBzFxG7v7ThHPRp+bJijR159DHsb+WNZWyWHs0WgfoJWkEmes2u/a74VyIsnB:bRimzFEDPdXZ5wUDFtkl2ua7ce
TLSH
T1D662B76FA910297B9DEAC219F9657757D7F62022A2D01D80FAFC8E1C14D76CC7217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 bd2a8e60907ad3130331b7fa236fb87bc9ead205c2ae688d3f7ecb4c5533eade
MD5 1afa65f70a80391c0369665c76ad9796
SHA1 4c41fde6b23974de362b3e0ff7d77189bdd1b9d6
SHA512 de73937dfecce5efd8f56e625569535f50701511f77089645e84f0d952aa913112a6d17416af4899c9faa7fec7506e52888ef924ee6fec94a49482f12416d02e
SSDEEP 192:GRDcBz0x8ov78hAPRp2ZBs9DHsb+WNnh54S9Wp2w6mes2u/a7cVyIsnAUgtaJ:GRDmz0S048XF5wH82y2ua748
TLSH
T10042A72EA910693B5CDBD319FA657757D7F61022B2D42E80EAFC892C14D76CC322702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e3787a55d124a0116dbbe8ac9e811fcfceb71144ec7e9720d82cbb20219d1c80
MD5 43e8cb560f8b854965f93de87ddeb958
SHA1 f298c4a66ee745dfbf6da83027c7fa8fb7ae636a
SHA512 f34ad11fa50f0dcb79652d916339ce4f99c847cf88b454478b08ea63fea1acca3e5815f769a024359a11fb7f23397967e0e226c33afec16938ea2945f2c50dc9
SSDEEP 192:GRicBh0x8ov78hAPRp2bJwjM9DHsb+WNZHLh54SWepmes2u/a7cVyIsnAUgtaJ:GRimh0S048Xu5wBT0eK2ua748
TLSH
T13452A52FA920693B5CDBD219F9657757D7F61021B2D42E84EAFC8A2C14D7ACC321702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 eb2f2a95a4503114d9ec21ee2f06d6e8dea4d0c905de023cb0597364b96bb909
MD5 f77ae90677e55c874f28829b90056a4f
SHA1 d5d0904411d2eeea5b7a318610f728e8b904083b
SHA512 89d97608075887f0cc3344b4fbb32249ce6d0db3fb6c50198da814402d7827cfb56dd0187a75a82a52612db0e18c510b69075f521453aacafdbbbc2b0fb6fc64
SSDEEP 192:bRDcBzgxwVv7ThHPRp+bJRjw59DHsb+WNZWRYs04XzEimes2u/a74VyIsnAUgraJ:bRDmzg2lPdXh5wUekEL2ua7ce
TLSH
T1FC52C72FA920697B5CDBD219F9657757D7F61021A2D02E80FAFC8A1C14DBACC721702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 692f3688d86af7577191836b596d332e2a6d00e60c0814d11c1606b70c3cfafe
MD5 63be545c77384ce9c86ec358ac4be37d
SHA1 58a48ad68ab92927d10801a83dbf1a329a4e6502
SHA512 44e396358e20123f40eabf6ded5ba95bcd42928b5ee6dcd2b829e61386d6542f4442e845d6e0513091f6eaba1157e5ac28e92419c9d7506e2ed1e786232217c3
SSDEEP 192:bRicBzgxw7v7ThHPRp+bJRjw59DHsb+WNZWRYs0WgfoXzE9mes2u/a74VyIsnAUp:bRimzg2DPdXh5wUeFUEG2ua7ce
TLSH
T1B962B72FA920597B9DEBD219F9257757D7F62021A1D02E80EAFC8E1C14DBACC7217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9ae5e9b51356758091702e75ab77256887f032c991a3356be3227bb40ec3c052
MD5 f31a8e9702b7b29e5f5ca89639b8ccfe
SHA1 94044755ca8b45f43618a84f571a6eec4a7a64df
SHA512 fbde3a741dce5c1bb04aa9e81220460235a0a8246f7ad2a0b57c313c4887324bd67b177b9ba46fff5d6933a02fe0fff08fd2323665efc46cb2850040a6b21819
SSDEEP 192:ZRDcBh0x5ov78hAPRp2bJwjM9DHsb+WNZWHHL5BBSWermes2u/a7CVyIsnAUgraJ:ZRDmh07048Xu5wUnPxeE2ua7Ce
TLSH
T18752B52FA920297B5CEBD219F9257757D7F61022A2D42E80FAFC8A1C15D76CC321742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b26795d7f5c860b5c96b96c7d9e77d6a520bc2399c426639a3901291844435c1
MD5 e508c514dd497ea0eb8c8ce0ced06cb0
SHA1 cb93149ef87056ba5db8d425b62d937d4550aba3
SHA512 e774cd026144bee1133317d1949478765fc241e7364aee190bf873fa2a4d0074c630c33d726856a19557b52e4a1e2471dfd99e9073d3b4ef9911284fe15e92f3
SSDEEP 192:bRDcBh0xwjv78hAPRp2bJwjM9DHsb+WNZWHHLs04SWemmes2u/a7CVyIsnAUgraJ:bRDmh02b48Xu5wUn70eX2ua7Ce
TLSH
T17C52B62FA920693B5CDBD319F9257757D7F61022A2D02E84EAFC8A1C14D7ACC321742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 c7ce219e8225b618fc1c29afb5909a463e8ad94c19f76466da41d913a9be05f1
MD5 d536b50aa148bf67f195d546135307b7
SHA1 ba6c1ff70aeba046187aaf41ecf66965cb2a5f1a
SHA512 04b918fdc52a15f68f736c06746be93a2e3f415d301404e062666b9d0c4ac490758c9e7a75e92b9476912da5496b4d2b7047563fa694de3620ccf85ffb8f0cad
TLSH
T130B00235802A519BC226E37898C795C97A309C60A783134690A912EA9C7C7F2475F9C7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 f48957909727fde1853d97e80562ead44f8ca3b79039965734ef6739f14e567b
MD5 5055269dd9451ce4378441f4591b4b16
SHA1 6474e1813992f84707e77a58d3f6379f7c867a07
SHA512 fef60bc0764966ad0004bba70320769a908c38bcc2721b70524616c95030638969d26c820327b3b79ae551b56fe6de8066429cef7dd6e920dbc7bc0dec279a1e
TLSH
T138A00235124A0573D02C56782DC3464572108C2011D1230355E581688C6D2A441A5D51
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\751c1801-4b56-4103-bba6-0509e7f0fc47\index-dir\the-real-index
Size 72B
SHA256 7fee03bb18bdb7e6fe9d14229973975466740d6a5e2ec886ab9f69b6739d62c4
MD5 7dde77d0e09d43f66f69ce31d0410871
SHA1 ee7260eabeeda9c6c4dd36c64abeb4b7832a2a3b
SHA512 b6f4168e49197d0df235f396283e8890b2ff43d5740c92b908fd68c060552eb2c21044a650f5b7de4b42f6d1d0d112788d7fa08c04545b23002374a1efd05d45
TLSH
T181A002A881644301C80002742C5B137532764A75FA090787D1D022A4CDE5599A54B138
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596121.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\751c1801-4b56-4103-bba6-0509e7f0fc47\index-dir\the-real-index~RFe596121.TMP
Size 48B
SHA256 2ea80e0008717cba91c6421c8d2095552d9a7e3d4a812aca886a7d41c989e7a5
MD5 5fd01d5943492d0ff615fbd8da106f3e
SHA1 d523f5a16d9ba6e1f8a73aefea56085230d024c3
SHA512 098aa32e79dfe17857e9fcc64e11e73b0796de51468b68a35daa6ff4dc1aece129133ba7854b52872eb73fb894cc10709426b2494f9c5c7a733c7f68b7410410
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 230B
SHA256 192a4e315040c874fadb4a6cafb5da696e89ef36912060ed76da77e61185c5f8
MD5 5f3096274acf643b40cb082e77a942d7
SHA1 12fb7dc5323ba87d10af74c16f593c2748c3f1c3
SHA512 bf68b0fd88b642086c8d3764c2e19e10307ba6b0464eee5b0c399ce4f727363c58873917c787b1021bea77f82aab01133bb64422630bd8c36b8eae0f88b9d579
TLSH
T1D1D0A7CB49724E06473066D6B434724CD4638D159CC8D8E48544B06134792578005535
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 146B
SHA256 dca63df854df862540773d1c5103fbec4ebff827b803ac458ce7d7a24acac8b5
MD5 801cd0cf479e94f31a8c5e986f5be186
SHA1 07e88cc74bb287f4e34eeeca35d6ffe1bcc2b971
SHA512 98986aeec1b4c21db40a79ba50eb1c4cb7cb82b3c9b16115ecb248d4f37b029d95831ded453bc0b0139461669ec81adbb48e57c2aaaad98ba56034de7c11e3ba
TLSH
T1E0C09BDB54724B4B0B34ABEC7164771DD957C24CCDC4CDF4D508D41638366234515574
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 147B
SHA256 9fd627511b9b5bc90abdfeaf2340819c7e001ffe8daf2f9b1b1ff3bb669970b4
MD5 4c64e08b0187946767135b03f000c383
SHA1 986289177b8a9342b4d7859f5a85d4ebc083cfe1
SHA512 f031e8ff15b0c8115c882a237b362b18793e9b07e69a757521a3eac44b15408e315a554fb1d6913b26c9fec168059e6542e9d6ba8e13d4ea56c73560c386cb76
TLSH
T187C02BDB14724B4B0F30A6EC6064771CD817C24CCDC5CDF4C008C01234756234412534
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5900a2.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5900a2.TMP
Size 156B
SHA256 2818066d0fe50e9099b98e937da3be8c88016eda8ada29b33b9bd0bd5a0ea703
MD5 bb34288e3e15bb3693a8c89cf3319e6e
SHA1 656a750ca6f416a7e8fc5e6cb6831de78f1cb201
SHA512 fa07aea6fc4f1544cfb81fec0d301bf27eac98a3b9b400871bc9751d9ed2cdfd31cb469ffc289cea980b1062e0edb51b65cbc253ba16a1924d2e9e994e8e081d
TLSH
T1F6C02BDB4E71880E0730A5EBF838718CD0139D2C9CC8D9F1C840B0C23078317C04B611
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 e1f31fc8f2e0403817a24019373b3cc0cf087438cd5e57786a46f9e019e1c8dd
MD5 e1c0ed9b6c1e229b43a21c2b63e331f4
SHA1 d0bf6ad5532048da47564602aa7b0ae551a14574
SHA512 38c179c330ae4c4be88f5d57ef777895a5b21a80808c66140abfdc27a4c5c43d9ba70f30754bebdb5d7faf85ab3cd2814840b53c197db87e7f0a1b1d967c7929
SSDEEP 6144:21bcTYgoiyNcl1Npm7Rkm1tYpBeh2BAo1:6bcteA1Ng9oBGcAo1
TLSH
T11B34233B5C596CB3599AA71DB04E290E3AF24F319C28DAE5ECC8690467F94CC1F44DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 a5b66d33695bdb98067d159ae0c5ef770c9117b97edcfe3770a1457e4d24ee01
MD5 095eb53392bc2553c45d76178e101a66
SHA1 41e0c1069b1f963d566c42f6ba57d8d35e2833a7
SHA512 fbc6e0104ff132f0baee2506e36e40d25cbb93d7141839ae08eb016d40519d83d18cf6712eb8b27d4b1e3d0d662c2db42791c17f283d7d1bb66ed49f251eab3e
SSDEEP 3072:rKcsjV/r5lUZF6rk0QCs3vI68Ncl1NuGm7D5Lk17ox1tIpud63U8BehbCBi9fTri:rKcTYgoiyNcl1Npm7Rkm1tYpBeh2BAo1
TLSH
T19434232B9C5DACB3199AA35DB14E190E36F24F205C39D6F2ECC8590467F59CC1B84EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 2c5666730b3d32897b9eca92cca4184a5a2884d22ccf55ad01788c08f9190fbf
MD5 0cd20b21b3b89b7066817c01c450aea0
SHA1 0b29375368fe4575d78219a2143888eb04bcae59
SHA512 a3edb31ffa31842a31bb232d5a0509fa6c15fa0f554a3000c9c3f8d3a8d3e926b4e1c80c1905ca69b1c4bb292e6a89af129366f046c120db2f5113da4d646125
SSDEEP 3072:iGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:Vm7Rkm1tYpBeh2BAoO
TLSH
T194C3123B5D65E9375979A71EB48E0B1E1EF24DA6C930DE4288D86B0437FA7CC1A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 780a83ecc252f871d458f4c3a63e45395f127170cf0ca877082512859c026f97
MD5 48ebeb907819162a04334f258517bb10
SHA1 2502aeecb2e67d3c985569033840945c3af3d356
SHA512 fd7a5a895ac658db49f41625e56638fb5c713ff168403bc4d87defead55c6b3a4150baa609155348b8f4e4906f30e9117b622749cee4255d2069d41eb1400848
SSDEEP 3072:eKcsjV/r5lUZF6rk0QCs3vI68Ncl1NuGm7D5Lk17ox1tIpud63U8BehbCBi9fTri:eKcTYgoiyNcl1Npm7Rkm1tYpBeh2BAo1
TLSH
T15434232B9C5DACB3199AA35DB04E190E36F24F205C39D6F2ECC8590467F59CC1B84EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 3d947e1d6db7487524a3c9be50979bc7942a25bbdb183050a414eb2e982e7791
MD5 25f2b8c2945fbc9a74d53cfaba0097e8
SHA1 ff27335329f34a1e42e5882e5d6cdaad5663766c
SHA512 a6ae99b4f4f4ada1f6eaf2b2aafd808d0f26e4e34f219a0173a8136f61ea7f4b001dab777c9e8026cf3f647f5704ceb9133d922c058eefafdd32b02d9c499ec2
SSDEEP 3072:rKcsjV/r5lUZF6rk0QCs3vI68Ncl1NuGm7D5Lk17ox1tIpud63U8BehbCBi9fTri:rKcTYgoiyNcl1Npm7Rkm1tYpBeh2BAo1
TLSH
T15934232B9C5DACB3199AA35DB14E190E36F24F205C39D6F2ECC8590467F59CC1B84EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 4b288b4836d02154a79a713f084952c0339fd033de946f733c60e55d9ec4b05e
MD5 53700f27a3d168ca15019c12df7c872e
SHA1 786abd82fb4fae9cc4c444a2916476039fb35d63
SHA512 8b823a3cd7d8817fcb4915a9cbe7461aff727291b08736dff1b810dd2d89446493ddbdbf213aa347119142b493e1675d8aaf49aee1d9c9655a0cf423b0da3f18
SSDEEP 6144:I1NcTYgoiyNcl1Npm7Rkm1tYpBeh2BAo1:QNcteA1Ng9oBGcAo1
TLSH
T11334223B5C196CB3499AA71DA04E290E3EF24F219C38D6E5ECC8690467F95CC1F84EB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 277KB
SHA256 d36e6accb55ddb70533e8fc0ff902e81009d29a4ede177ea4a754eed86a99be6
MD5 2d2d667c4354525a79bb9b6f4235f853
SHA1 ed8ab84fea8f16f7d6c64eacf983325e0cfe14ee
SHA512 52c07d1b0052b20f896849755878332682b2912ec9ff98ff139eca4fdec96800e6c36c14b820aaa250e7d5d139c82996ab8428318ac126434635c5b1e9d6a2bc
SSDEEP 6144:ED3rMS15cTYgoiyNcl1Npm7Rkm1tYpBeh2BAo1:ED3Qm5cteA1Ng9oBGcAo1
TLSH
T16C5423375C1928735A9EA35EF11E2A1E29F28F119C28D9E9FCC4284073FD9CC1E959B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Procmon64.exe

Path C:\Users\Admin\AppData\Local\Temp\Procmon64.exe
Size 2.1MB
SHA256 a7ab46fbe97fbc03ab66ceb786ec8c38c6588ccf21bf390f314857d1fd91d608
MD5 a6e0de916e79d21bbf779471c77e09d7
SHA1 042e59cc2ac4b25741b46a4322ac3e42f8bbee36
SHA512 cb36a4695faffe33589145adafbe032571a78c944a90d79eb61cf4fb6f64ce4c0a291def16603c130d9d9a98d3fce9d5e446b890bf45c0bf50d1d43da9adbe78
SSDEEP 24576:c3kKl+lPtMpJ9Ug6hiBhFHe/hegiQEvRq4mRNpUp2K2K3:c34lPtMpJ9Ug6hiBwi84mRop2KZ
TLSH
T16EA54A1363E84098E06A9234CAB7C53AE6737C55177196DB16E08D5F3F33BE60A39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!AerisSetup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-L4A6YTMGMW.tmp\osu!AerisSetup.tmp
Size 4.3MB
SHA256 ac9a026b20fd41cfa1ebb0e01d9affb882f37e865f2d8b08335cd0f30dd6445c
MD5 76ee8b891fc769a58b3a66b112da7e69
SHA1 8d8a458aee65c2a23400a0e655f5c5a17a4e7806
SHA512 0ffdac4df8a8d62f37deab42b45373b440ec0d7c316d8217637d08a90de98a3203e76738aed13f809303bd42ab22eb974baafef9a91082188a85ac8fc611948c
SSDEEP 98304:e9SZUvl30aj90ZFcvdQ0hdgvminQLMj+JT333+T7:dItJj90Z6RgKwxn
TLSH
T158268E03B388753EE4B71A3A883FA254583F7E213A26CD4B6BF4195C4F396416D2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!.exe

Path C:\Users\Admin\AppData\Local\osu!Aeris\osu!.exe
Size 318KB
SHA256 269e3d3437af32e486b3c22523b95222babe7b5b6f3c7380b61643a7ae587b71
MD5 6765b4f2c1e326f66b2f6ea1a9550dfe
SHA1 3a8d411ffaeacd11575745154e7e9051d19495c4
SHA512 49e95ad1277930b891747ad66692451fe9ef55aee2822b42f7d6ce947f5f8d95699daa02c139c7beb13e38628161f80a949aea2950e6022003f70feddab72bd2
SSDEEP 6144:OvgvkNFNaxmNEWJUwk+2HFhbXwtnQVsrlrkWT:OvggNaxm/kPxXrKrkWT
TLSH
T1EB648E13E3A851B9E1728A79CAB38941EB737C194B71A6CF03507A765F73AD06E38311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Realm.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\Realm.dll
Size 369KB
SHA256 710b1994f71488ef0438773e274d5f54f93c8b7019efa700f0efda09d0d978d7
MD5 41cccc86fd16352d30f0a6a3fb85170c
SHA1 9aea106a8e70c91dc5153bb0d28aea6c04e6af21
SHA512 bf8e5c9704bcd387356a32274da13fb14e1ffcf15444f11d3dc509eac13c1966563c5efc8cea94d11983c43d620465ddffdd65fbeaf9b1ff5efc263fe907561b
SSDEEP 6144:opmRTc79L7+PueOmIO69aQLp0LBFX5elZxWxYTfHJrxqhhWudwsb0YlyTOsdaviy:3TSC7IrPp6X0PfHJIhhWumsYMBwpGb
TLSH
T1288429D923BD4B32DAFE4779F07459418AB2F981B8EAF78E56C6A0E60C43B446D00357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sentry.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\Sentry.dll
Size 822KB
SHA256 9cf94b0b761c5b5a0a6b67cb8949baff8b45fff5e2c0c91d5309d27c3d0e60a1
MD5 a17f9d15faabaa1b0c0d4a1415063a44
SHA1 4923f0470a5c3dd92f73530f9b7413751a9f7c3c
SHA512 33cafa4785c4d74575f7b9d0facff39804886c214e1f8743b4ddb62011b6ae7ad3efaa614641282e906b32a1fc0ccfc85751f5ddb1011b813ece48d0076a56ce
SSDEEP 6144:xZTDBHjL2symVa+d7KfKY1tujanFTqoDvoePUY9VitqZ+XAwpTpHlvk5JtsLUERu:xZBHjL7ye1KtrNpJJtt+tfNs+m66
TLSH
T17B055C5163F8D756E5AF97B4E43852C80FF1F71AA5B2E74F131491CC2EA23428E42B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.Immutable.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Collections.Immutable.dll
Size 817KB
SHA256 f134239f34d90e805fd44c26d2b350f31915734b1dc1b008e5ccec89a39a90aa
MD5 d012e446681c62a8c4aba4688bb0644c
SHA1 5cfecc16ad3fa36cc9e1e8cbb0ff10ec62482c16
SHA512 b3f9b73194646458e6fb4767736b4a9656f5f0c5de6fe40fb765a72c1bfbd9cf7af81b5812ae424a15c79d774b91b832643bf7df574b1523f0c04f1bb75bae11
SSDEEP 12288:RrJR+uRoPwKseN8/98vTU4dQEE3k0T9YLVgHr4iuLvkgllggP:J+uC8abw+CMiCrllB
TLSH
T190055B96E38C0B52C62FC5BFD6534AB9D6A1C45253E291CB00DAF6B03F93BC1E57A424
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Collections.dll
Size 253KB
SHA256 f0fe3fc9cecf713d5c29a2fecdf6aafc50b41efb8130a56af54b8c9330c1ffc1
MD5 5e013ce9a5a3cb2840b4a0d56f86c849
SHA1 ce783a1bc6c03b5082059d6935cecfed6944da8c
SHA512 8041a3486e1e72079a111c2354f242dd74a43ce1ab4e5dc76b05e24e17bc2654f1ad462358be14e2ea2bcc921e79a17c3ccdfecd2398783f95ed0d499989afcd
SSDEEP 6144:SnxoXLkDXDiKNYX8qTKfAyryS1rIgH3iPt:axCkDXDiQ+jTURrhFXi1
TLSH
T119444A2A778C4E12F56F457EE663C012D7B390A34712D2CB06BEE5840E97BC2BEB6055
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ObjectModel.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.ObjectModel.dll
Size 77KB
SHA256 015061c7fea90ceaaabe2669db8b8110249295e19a6a571363c8a581ad9ba7dd
MD5 d10b29dcb31dc4a40d6d4ba7dfbd5547
SHA1 68f2112e206fa2da19e20b8b6dfca1495017abad
SHA512 43ab0eb7b84e9ff279d1cf1c5fb991806fe6bb4554a83a623aec37094be70b221cf6e64de3f94c067dee8b9269fa89cdf701fe248ec194b835ab5fbfb006b5ef
SSDEEP 1536:OXtGEl0XKXrgcCGfN2QSsMWrHGI35uzEl:Ovl0CrqQN0yHGIJug
TLSH
T16E738D18A7C80727EAAD067DD1E25822F135F6E31323CACF45E5D14E0F93BD2663616A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.CoreLib.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Private.CoreLib.dll
Size 12.6MB
SHA256 2127c8c1dbd9147205be92641cc6302e944ec49f002e51b4320599b765ed2f2b
MD5 1cb74bd09c44a2e728d218926fda8398
SHA1 7a8b9a9e613ff958ac4c446488368a2807ecb7e6
SHA512 b96fb045c200a055fe00a654ffa0e970e7651a669e606071eb3e872a7a4563b52c932e7611b981250ee8781a50e561ad8c47709f5929039292e97cfdffc85b79
SSDEEP 196608:1svipKY4Zb6wf5ks5OtsFSy8EQOkLUPB5:RpT4Zb6m5L5OtsFYPOke
TLSH
T198D68D21F3C85F66E52EF23E81678281F670B4921352D6CF914FD6892F17BC19A3B261
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Runtime.dll
Size 42KB
SHA256 1b56f3da3567ff55f013332ae17796ac6cd067018878d8f322f8425b04b70720
MD5 987f0dd92a97fb1be99df665ec6dc7cf
SHA1 1e74284c11aff202de0b52ff2cde89b12ac77db3
SHA512 0e8142ba5274b9cd60fd2b956d2a392e47287c041d0831621674998ecb5642c7d62aed50299a726444245882ef36e8457f183e73f9346bef133a8e4cfa5941cc
SSDEEP 768:99q+1fsSED2vCeDQvRzXB3gWql6375IVxedktN7xPBhwsR/JG39QRoNvsh2JcfoQ:99uB/LuYdy50b4b7RSH9Z+BzJ
TLSH
T1BA13C4A5AE485333CD8AAB719C73AC811DF233C4047A5D7ED88FE51913867A48236B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clrjit.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\clrjit.dll
Size 1.7MB
SHA256 a4fd149cce5d20b8f09532dae07b8df761651088eb414c0dd7683d63184c207a
MD5 a50cbfa255f4917f8c38235edf0d38b4
SHA1 376ec8af4aa9d27ac79e6e0dc7204f8c66aea74a
SHA512 adc5b5d7520f5a63a88d7ac92e72b4a96be5f716590c12e4335a7582d84420f65d15a682aa998cf67c74b1572b4a8e5b73527f60d6035cadb42617eef0eeb2b5
SSDEEP 49152:LSGsSAvQB2UJB0GjtKPuXScRhzpBPPGzUlKCUPQEE4NBWv+dy:ufQjCGjLSwJpxO9CUPQEE4rQ
TLSH
T12F859E43A2F805FCD0AF9534C6574A1BEBB2B45913609FCF42F40AA6AF237E2561E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

coreclr.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\coreclr.dll
Size 4.3MB
SHA256 f896ff2163768dfb732ba52ebf090393135d236b4f5698f5a054540fda5a6088
MD5 d4d1d21993fb0a03c6cda67a0fc337bd
SHA1 3b3d8d03580b1b48ea7949a56596b23770857ce9
SHA512 554505a899a10f950e2f22765dc934ee0b9724b39ebd0110fe56b50584543067f726dfcedf2c8ce903894aa3515cce6adf5e6f4b0f6fedf731f0e22b0e780d90
SSDEEP 49152:6wDQnowvJmq4y7YDXJyihhNnw1jSOsQNGUjTWNa1VpEWPFAUK3R2cqmle1z16Zc4:eowvJmq4yEWS1TRBg04kvP76jAxss
TLSH
T1D926AF16B6AD00E8C17AD0BAC5E74917F7B27C590738DFEB16604A251F23BD16A3E314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostfxr.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\hostfxr.dll
Size 357KB
SHA256 99bdd77e4fe14ab284c4a335ac13affae11c840506b032462d26273143f0b767
MD5 214f2e859995128c7ff52c2d3ee52aed
SHA1 009d8a3a13d2a73d6db26b5b218545e786f3849b
SHA512 859c39d176a4ac637f14a43b6fcbd20386cf496928048f37da783f0f97eb28871b2fd0371172b740ff4f07b8d012738a2b0bfff04843670343577464df23a7d0
SSDEEP 6144:UE7Djww5R1Gv0crFfeUtJ9NZFSKJGDjq/2n1NonJLSHD6DPDh+vJpmE0SfxrTZ6g:fMjrFPJ+OyUriJ4ElntXZPt
TLSH
T1CA741816D6E8017CF0B7D679CAB28901EB727C494BB196CF139099661E73BD09E39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostpolicy.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\hostpolicy.dll
Size 397KB
SHA256 a2f6f864b9a41c56ad22490ea882ece574539eb7b23f8913c943613990818e89
MD5 80bb6eda76ce06e8c4cc0fd0fc65b332
SHA1 fdf25c9dc5507debd5018030a9dfcbce348d4b1b
SHA512 824424e5756ed4a5b1ad8f6342b4baf138e30437803bc152dd444764cfb5174e82028374199e06b49b3d3652bef90a0ca62d764d2360411f9ed535a74605b2a1
SSDEEP 6144:9/P1pnG2PGDYdnPkLoem0Z+1zlBVec2cKTjlMTd4PKkvCG78teytpQDZXadtYyKh:9G25cL0LfecMUZLK4bUyGbCTXoyFrg1
TLSH
T177842916D6AC007CF0B7E6798AB38941EB72784D47B196DF1390896A1F73BD09E39312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mscorlib.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\mscorlib.dll
Size 57KB
SHA256 8cc7442f997a6e0de9157b55058e5e85011fa240a903806f2c501f069e8a45a1
MD5 bd5753d5d325aeafef4a7f958067d28a
SHA1 abf1d0517fdc911816339d64d2aa0488b4d1b30d
SHA512 ae138cf33e8534495daad6004a406937ab49a1788fce4f728084dc517d2b6b1e489e5931bb1dfa51552eea6bcfb15a213ed9a4be96619d6017c8fe424f4b7db1
SSDEEP 768:zt51EDMpCUoqFY66Gw17oqZn/TEHmyrchswz6EEZcYf5o4ba2yGlG1QeY48lCiSP:ztFcC3ZcYf5o4bZyGc1A4cS+4Bzd
TLSH
T149430872ED0C9733CC8BAB79EC77A48905F133C634765AA4A849D51714CE7A092337AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

netstandard.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\netstandard.dll
Size 98KB
SHA256 b7c85ff82edc3db1424e9b387eed0517cbe2c59691951ed70b41d46f79397696
MD5 c19ab175de224496d2786ba895066f05
SHA1 78c2598df10bc31feee47d770208bcf4e79d02b7
SHA512 596dab99e9e3858450546e2a33488105b3ba7e24d4d39eb9473d4c114730eb5184e848e424355176ad5c39f3f8302fcc609359933cf3e02c8d5706db43dac1f9
SSDEEP 1536:hYsYXj0p2NYq5V4bgDHsPdIpuSE5L3Ukcz9w9Qvyz5:6MkYe4bgDUAxC9Qvy1
TLSH
T14FA30660BE14D7B3CDDF97B6CDB7A85117F232CA11720FB5A15A800B45C7A94933A38A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!.deps.json

Path C:\Users\Admin\AppData\Local\osulazer\current\osu!.deps.json
Size 208KB
SHA256 c80ea4618d34571454d141b090da7c4f7e50e43a17875a0388bfdf56991820d0
MD5 a6a49b3665a1aa023f7b6e476b457264
SHA1 f2a26dfefed2bd9a32bc8857a2d70d7eec1bdea6
SHA512 5733514964da855f62cf2f202d7ce25fff9499923b56ca3f1e8df39fba913647efdcbad260332c85cf2236b558d7ab39d4a898e8af5c8d692724e4b1bf36bb26
SSDEEP 3072:K3FMitPdlcu7rjYrylt1YA2qtTRdTDKXtSh0BaN1O1SOG4CnHSE1+0U5+KPP3A7x:XxA7+S
TLSH
T159247825CA589DA30EB2ABAA243481C2F365432F6010688F78FC255DDF73E975166F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\osu!.dll
Size 244KB
SHA256 e7707fff8643772606822fe53333e9f9becbab37e52a27fb67344e1f47745de1
MD5 ac5a3553cd9658df6a74a6013558359b
SHA1 4ae780eaeb392e40bfe14bd4d386c5a6b2c14868
SHA512 58962e6b5ac80e77376dc64bde877ad8e33bfd8dc0ed8599efb944fb8499e025b4637d7968c889ba8cb1b9004d39907e625664711abd5e9a63cda550e14486a0
SSDEEP 3072:Yx06OxDqVK31nJvBSGtvffScXQYrB88Ibv7xXONEGtvffScXQYrB88Ibv7xXfwZu:v6OxDqQXSq6EZ+pq6EZ+kq
TLSH
T1B634E080B664C726D6FE4A72B4A196421A7DFF8F39C6D349A808B3CC09737164663727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!.exe

Path C:\Users\Admin\AppData\Local\osulazer\current\osu!.exe
Size 239KB
SHA256 8383f49b3dd3483ae429691d4473ac94a0750fe30523ec735ba456113ceaec7d
MD5 4384f95c276853d44ad7728482d41f3b
SHA1 9b99b7306d227e416870c694cd394dca6abfe8a0
SHA512 967ae46195e12f957723858199370640c95abaf02903105156e83536d539c86f6f8e7eed14c1e7548e0012792cd4d29e4c5141747772fa6e6c87da811df8e860
SSDEEP 3072:pqeXA/4yIg9vkNPNu6H6xCYOiVUE2652JtGtvffScXQYrB88Ibv7xXvNw+TK:pvgvkNFNaxmNEWJtq6EZ+zK
TLSH
T197348E07F66850BEE172D675C9D24D41FB727C5A4BA1A6CF1310AAB60E737D0AE39302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!.runtimeconfig.json

Path C:\Users\Admin\AppData\Local\osulazer\current\osu!.runtimeconfig.json
Size 412B
SHA256 ef068dddd08a346fbad35d1558393bee8f89163722734452d69518b67e5f6a6f
MD5 e15a05b6fd18e5732e4071042a05c04f
SHA1 2b0bad1e36a0cc60a2a8f871de9fdb19f0326d3a
SHA512 b2133108d023b603457e65d6eed952d277fcc2a192422e9df2ee29bbff435b88ae69b454e8d378656683899dd83e29af3d963651a845071c6112ba3a5eeebe66
TLSH
T15CE02265CA206DB711F9B23EC521C083EA3053270000289178FC040C6F3B9BA1122F96
MD5 SHA1 SHA512 TLSH

Submit Download

osu.Framework.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\osu.Framework.dll
Size 3.8MB
SHA256 2d8e9637db98e09025e8f9199a22de7bdbfabdbbdbb9738b8e70dd81ed1861d6
MD5 646c0459843d0d063ce9636af2b9c96e
SHA1 5e79b26b45ac02f04aa7e50f50f03ba8d57f361a
SHA512 9789e8935137d541953dbe54d4ca74e0904930927fbc608ba7372ba9f83cb1c810bbd4ea7bbdf27c3e6d3e2c931e9a0064f8e145ffa38d562b128e29cd7d6c5b
SSDEEP 49152:+CuCUoPYr5z8eMbCFgR49gt/A4rlVWNsFoZ9t+WGZVuN93KHDHRA/72L6gGnE:+Cwofg6oZ9t+WGKf3KHD/L3GE
TLSH
T1AF068B917398CE3BD5AE1B7BE42185D51376F8423711D38F784AEB781C627408E86BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu.Game.Auth.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\osu.Game.Auth.dll
Size 238KB
SHA256 9bc7b10823a3d9f1abe86aa104e424199ad5699f4d41db7196057838482e4588
MD5 6ce3b5a584643d757a84053a3a3d0bba
SHA1 acaf1fa67e2dc546e0ccb4f22031398ad21c2fdf
SHA512 73124b34bf1c895e2c479581bf8e5f7eebc5b8c14458dac7eb48d1adb4c489ec7d74198116e2845c35bede440da29d0da832ce7fc59434a00ae825ebd5c317d2
SSDEEP 3072:kRVxBPn7fnLLnNSkJcemNFmeEfVrKy50rS7nlrUVUhK4VEXLqtOOy/j5Nh5mm/gt:KvBn7/L2eqsekVuy5hrwXc05Nh2j
TLSH
T15E34196517983B43DA5F86B9E0F30A0BD7E4951B900BE7FEBC41A1E209C7387C596287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu.Game.Tournament.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\osu.Game.Tournament.dll
Size 227KB
SHA256 7b1aa56612cc1858135095cba0a8aaca3c389e23700dc3f6456769e807c833e4
MD5 9580923c2f4ea76704ee57d352d67fc9
SHA1 6a714cc513f7f485035c9eb8aa0610394dd108b4
SHA512 2186119c4ca25143a9df991ef82c46a51696dbde8dcb2510728ea9f611410dd0e810991a302586b1f650ff7217de07941cdafd8cb0b5f32b52302c55d6dcc4fc
SSDEEP 3072:efCtjAgCtyvinPKyXyBTZvtoSmztvmsEl0DI/3JktIrDE:eqxCtyv8OQSmztSloo3Sqs
TLSH
T1A2348D6873A44A27CB7F1776B0D40948E2B16A07F4DAEF7D8C8594D91A43322F94336B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu.Game.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\osu.Game.dll
Size 6.5MB
SHA256 e452f7683c0e63d1900c2441c4e724fdf9b5c02123a4b9096e049a8d0d37b5f7
MD5 9889476c2a109c4b63e3cd333676c1c5
SHA1 8adf73ee07a02999afe6a94fd8fb11d236154993
SHA512 0465e193eb1f6f49030a54f7d2ed8ac6bde9e6760ad6892463bb89aa0f42f876fdb3b685b931ed87e575a5b0b9939b909cb9f3b6b0e86fb06fc126047507f2d4
SSDEEP 98304:9h6ObjdSDzMg2Ny19xPauj6QZRbwbKoM4:WObjdRY7t2
TLSH
T1A7667C95DF688F36C97F8A73A0A6610213B0DA1B7B37DB0E60B5F6B635423056E50327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osuTK.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\osuTK.dll
Size 6.1MB
SHA256 831ddce8dcec165e4212093279e22e047489c29b43e8832faffb3fb09b090371
MD5 b163095be55e572cea59c2ca50a8f611
SHA1 169a8be0d6e75a4d22b424fd6ece0d01efee203d
SHA512 5925730fc3e948831616b396db2ddb80d0024a42998aa747cb4aea29ed5a3af526d7ade3403edb4ac5fe27f83b4c44c53a88ca42a975694e016de5ec2a5da578
SSDEEP 24576:jpugrePBtmdE11MUk2JcN+4JlIVOX/9P8NW/G5oIpQ/U6472t8C8w4RikVzcbqsF:ogUtYeNyFyHz/ERdDtw5Je
TLSH
T1B756D709B7E12F2BDA56737BC42E1012217AC99917839B13B037DB3E9CF27A919191DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!Aeris.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\osu!Aeris\osu!Aeris.lnk
Size 1KB
SHA256 d6ca4bf3e5c46e0eb12857107e96ad527ace3629975f84a125dc8f606ce6caaf
MD5 f5cdc63f28fee879662774842180992f
SHA1 b0ac0f788f95586d233363f33e2488ea7fde8306
SHA512 89d3b8a0be87a61566776359279f9deab4e3b00a949be5f0b49f22d6e93e576764936ec9f66534f40ca242b1673099a927b0c115463e4ccf2302111127dc9151
TLSH
T1DD41C206D6E16A21C7B5DC3562B79114F5B6F81ABE492F0C418083467C12E06DF25F5F
MD5 SHA1 SHA512 TLSH

Submit Download

AuthNative.dll

Path C:\Users\Admin\AppData\Roaming\osu\AuthNative.dll
Size 10.4MB
SHA256 2bd9669ef0db2652b45c730e5fc7efe28c2cb79bc9b2757b12ab1abf4cf7f2c2
MD5 bd7092b594b87205750ecd9458e85128
SHA1 b326c2e5feedcfb0eb45385b43fc64fa8b584204
SHA512 9efc6d664c3060a9d4f0abb334dc645b7565f23cd857218d2f2164a0dac779f6253e7ed4c0d950d903580d0ad444efef80dfb6232affcb128282b5ca92f39b90
SSDEEP 196608:SfzAwSt4GYpBTU4+0MTWhN1q2RAUznWl973dlN5C:SfzAWWDZkzW9DHN5C
TLSH
T112B6AEA37AD1E5E6C32ADCF4C852B22F9BD77C2A171972834556F39D9A33A043528F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1556d0801b3a6b175dda32ef546f0ec812b400499f575c44fccbe9c67f9b1e5

Path C:\Users\Admin\AppData\Roaming\osu\files\a\a1\a1556d0801b3a6b175dda32ef546f0ec812b400499f575c44fccbe9c67f9b1e5
Size 988B
SHA256 a1556d0801b3a6b175dda32ef546f0ec812b400499f575c44fccbe9c67f9b1e5
MD5 27d9765612170a9517f0a5e8b4613f06
SHA1 660d4456ea71bdb48a9ef84cf65cd68d40d05a6e
SHA512 eda5ae2dc0e123418f0e50a51ea651c10c82aa0620d89bbef47cad1c5ef336b43d19604a6281853cc2603dd0c25d445b0195780897f8606beb768132222fa41f
TLSH
T12911CE7E800B4139C38F33553124628371E45179B63BB7E4BE46E94A0221EF9A33926E
MD5 SHA1 SHA512 TLSH

Submit Download

1784808839.runtime.log

Path C:\Users\Admin\AppData\Roaming\osu\logs\1784808839.runtime.log
Size 5KB
SHA256 162f0f77f5e10a57ab9831fb99448c97c50fe5afb1703e888e1253bd6d0ee335
MD5 37c7839d8b5fb5cf9737bcb8346e456a
SHA1 b2389dd2f14d0b599bef2d7212762d9047c684bd
SHA512 61feab051df32f876f306b7b398aed772cf15a02ccac67beff626502cadf80a3492c251d438439dd665d0ca6a77697a6d767c375bb2996f34325015a93af10a5
SSDEEP 96:L1NPVzIKJQ5mfc9UuyJc9Uuy6qHRP+dYVxZn9taJPPa0:NzItW7bnbaJPPa0
TLSH
T1AEB1F653DEBB80902D01C313F4334D98DADFF28969686A583A6D01E6035219BC7EDBB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!Aeris.lnk

Path C:\Users\Admin\Desktop\osu!Aeris.lnk
Size 1KB
SHA256 91250a154d165ce659574f93cbe3dc788351b0aa153e30bf15994e0d2e5d3884
MD5 7fd291aee4ef82a511fe302d870b3b53
SHA1 92aac9b13d104b0c64c6b2d99eef7d13fcf201e0
SHA512 d710f13e82fcbc1322dfe0e7647fdab256595ba7556ac979be1ab2205f018a05184e92b69563798aa73c55bbaca7a8acc284a80e2f1c0ea66a5fa6ce124f1250
TLSH
T1E341A203DAE55521CBB6D83562F79204F5B5F81A6F092D0C418083067C22D06DF25F5F
MD5 SHA1 SHA512 TLSH

Submit Download

ProcessMonitor.zip.crdownload

Path C:\Users\Admin\Downloads\ProcessMonitor.zip.crdownload
Size 3.0MB
SHA256 dc2ccfa360e5f94ac535f3fa14ba27578049b16290cbbfe5d2f11debf29efe8c
MD5 98d8d220012af9a5405381d47899a6ee
SHA1 8126bf2bb2c234a9fe47724c520e77b3720217fd
SHA512 9dec42c15294d48a97ccc9fa7d36ee87a67fd4e128142572aee8a734d8d3c623336841f439bcfb9e7e97a8b1f9b04f16f5a55e330e7ccbce1b42c98be9688ca0
SSDEEP 49152:acPGTbbCvTikqIIQS18Q7CC9BFdjtnUdFr0oS/hfm78WmZQL9J35NkOPAdXhe7co:aMG+biTVb18kJ9LhNUIockB3Hkhphoq8
TLSH
T182E5335FD8F90FA222C651F7B4CA89B45F709A89A8B6C49C5E10726E44F6B710FE1370
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2340-60-0x0000000000ED0000-0x0000000000FD6000-memory.dmp

Download

memory/2340-384-0x0000000000ED0000-0x0000000000FD6000-memory.dmp

Download

memory/2340-0-0x0000000000ED0000-0x0000000000FD6000-memory.dmp

Download

memory/2940-1197-0x00007FF8AFDC0000-0x00007FF8B0828000-memory.dmp

Download

memory/4220-383-0x0000000000F10000-0x0000000001371000-memory.dmp

Download

memory/4220-61-0x0000000000F10000-0x0000000001371000-memory.dmp

Download

memory/4220-62-0x0000000001700000-0x0000000001701000-memory.dmp

Download

memory/4220-5-0x0000000001700000-0x0000000001701000-memory.dmp

Download