1a4d5fc5f07cb48446bfb05cb4924ef9217f1695f39dc1bb0dfb156354a53add

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 03:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
osu!.exe
Size 4.3MB
Sample260805-dtmlhaxclg
SHA256 1a4d5fc5f07cb48446bfb05cb4924ef9217f1695f39dc1bb0dfb156354a53add
MD5 88394100b61ddd13136085498ea180b2
SHA1 ad7ed6dd66adb634e6f951332cf829d125fcd9f4
SHA512 c251b7a3cb6610d9e993704a16db61e32b2991d8fa7af4d8ee8802b03c5b48222223d7f721060064c47704e52c5c91f3c5bb882ac15a4984b9f99354fda532df
SSDEEP 98304:4K9BadB+8IGHvBQg4UwnsOF6y2xRxpDOh0:/9I+FAUnl9Ki0
TLSH
T16B267B08AAA44F3EC66F4BB3A0651A1963F5CD5833C7FBCF5540B7B425B2362590326B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
748	GameBarPresenceWriter.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	osu!.exe

Loads dropped DLL 4 IoCs

pid	Process
2960	osu!.exe
2960	osu!.exe
2960	osu!.exe
2960	osu!.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	osu!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	osu!.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{4F6F5C6F-6673-4D3F-8656-4E7353F4C709}	svchost.exe

Modifies system certificate store 2 TTPs 7 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	osu!.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	osu!.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	osu!.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	osu!.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	osu!.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	osu!.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	osu!.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2960	osu!.exe
Token: SeDebugPrivilege	3316	osu!.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
824	OpenWith.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 3316	2960	osu!.exe	100

C:\Users\Admin\AppData\Local\Temp\osu!.exe
"C:\Users\Admin\AppData\Local\Temp\osu!.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Users\Admin\AppData\Local\Temp\osu!.exe
  "C:\Users\Admin\AppData\Local\Temp\osu!.exe" -repair
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3316

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:748

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:4688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
Size 765B
SHA256 e34859bb5d9e1be9d43295be5b519a98b8082a88e513d013d745187c9b6c049d
MD5 cad995243ee381647c664c3e4dda482f
SHA1 8a052a9942591515e48dea1b823c04d090eba07b
SHA512 4332e5ea09e3e615cf70cd11d1105db43a0efc209797b25f4729d23acaafd4688814b99547cb9b9e76cd2cb914eaad7a8900511b85f2ff1ce2b5e538e9d05859
TLSH
T1440125224F4189423F1699C4D665D4792605B2A53C9606F33027938852E7FCD5782DC8
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Size 1KB
SHA256 a0d6ce27684a757d37eab3719f249b191a0479b5e63a1ec2be4bd6779ff85ad4
MD5 c0b4f7a55f44500152fdf5d834e9b66e
SHA1 1d8608e3403296cc60a7685e22ad243d004a0138
SHA512 6e040d6531cf12ec13f9f902c161e3807b781ae8ae96e193e5391c22a7c4c597bc7303548ba8b2465f559829dcc3add5869347466926401a6f23a1196096d289
TLSH
T19C31C6D36EA87831ED088DC4585DCFF27CB025AAF45808743498C56AA9A3FE46C4A81D
MD5 SHA1 SHA512 TLSH

Submit Download

18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
Size 484B
SHA256 0cf284b339f27e1a754c3e1d4a5a9e9f2388d30f7191f06f13b18a2158c6eda4
MD5 2fd7b5b88bb6cc6e3a5f14f2e7bfde2c
SHA1 4e5ec572004bbc3e8152ae4493eaa54aa2b61ee4
SHA512 0709c5555c0759a81bffd7ce2c3ed56ca1450179d6c18d8ea93cbc9452a6d90261a138ade8cec807b1c98b5797a98bff4a5d9e3c75afe7bbcff7d175da264651
TLSH
T1EEF0AB2C1DEA013FF1BB9D75D7E4B1A7CC4AF113280048A51AFA03045B8BF8E2C6206E
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Size 482B
SHA256 ffe18f037e880971df50fd6484084b9c132d24260d64f1af357869f65964fb52
MD5 95816efcaa5cdb2929c873811d75f5d0
SHA1 b448b7bf6b1d665d38c2d82d5e31688cb4d9de94
SHA512 3a3cf32890d702b1a38553ad31a61a34d7c5a761d76ecbe11b3e5bb022c0ab40fd53c66d2d8d129672e65360d6de7ec6cde774f8c0bc8e19707cce5a056c9f05
TLSH
T13AF0AB2827BAA02DE17B9A79CAD5E3275DBDF30168000262075143076F0B6C21E55573
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\update.log
Size 2KB
SHA256 6da3f4e7fc757a244dee53cb8681b0128236a1cb93018b8f7caf61f92abeede8
MD5 d5bead6b49213e740f4d900938d04a68
SHA1 0a3e5701a96822873143b4bff25ff8f5b820f9a6
SHA512 b44476f1b0216e5bccc399660f5db58f5db6dc48546ef9843845dd7b892cd166745e077b42b7291ce454a908320f41a32b276a032868905300b74b55939d446f
TLSH
T1BA517AA384F660953AA34699C09CEB5E8D83BD33725CB7C8F6B952480305139FE39E31
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\update.log
Size 3KB
SHA256 4e3c5a9dd5b65c21c92e4bca5bfd1e4824da0462b42fc029feffd1a98b23d8c1
MD5 09cb1c0268946913c4d5af1eb2f854cf
SHA1 91ec3dd0e782977e698d99ae0e5f341273adb253
SHA512 a5648baa5582c6d8dc0a8e3f65a451371f877d187b7da1f0c73f7451445c949701ccfaeb093cb9e486e6179acdd3034735e8cfbc043b11c2eaa3ba102440d5ba
TLSH
T1B75158A385FA60953AA34199C09CEB5E8D93BD33735CB7D8F7A952480305139EE39E30
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\update.log
Size 3KB
SHA256 9baeddd412f07a446afa1fe1b62009bcda80043ffaa0cff05f8f92a6495e99cf
MD5 043fe032fe731c588ddeb77481acd6e0
SHA1 5cef68737333992ddfce40b26ca68ec1641fe81d
SHA512 82fa017cd9b820bf39b6b42c12e0056947ca34c78fc7055928afbddbd74ec1409fbc85fde9cc3b6b2afb0cad443c53b9516c73aa86e53a5769d5e8ced9400b05
TLSH
T14C7168A385FA60953AA34199C09DEB5E8D83BD37735CB7C4F6B952450315138EE39E30
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\update.log
Size 3KB
SHA256 c457d9f0f293d39a843b9807fb69957d8fc94b338e16ef5f4cfa97cb638870e6
MD5 2b50aa4af91c8a70c8570512330bc1c4
SHA1 53b37794dc2af53a304d360b9b657b4212b9241e
SHA512 783e6fc7f6db29cc3b4b220d707626c6e525b6acf3845a4dc5c0c6c63acd69d009f21f8abbb0d65d4882ce9da98ec57dc669df352af6908668d43ae836cbb2da
TLSH
T1A88157A385F960953AA34199C09DEB6E8D83BD37771CB7C4FA7962450315138EE3AE30
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\update.log
Size 325B
SHA256 492ca4a0a47e8ca9f3af35d2d787f70c9ea7f325795032e3198dce277ef632d8
MD5 c51fbb3560cdfedf06cb0e04eb81ddc0
SHA1 eb6db7972fc0033d0ec2c6227b46595ce9fb195e
SHA512 919d9dca644d027858d517fcdc0a8a33850a74283b0caeae1b325e18c07f0fc1bcad0bf4b7597580c155914d84e7d986c39edfc1f0d13cee92930f96809988f7
TLSH
T19EE0BDA381F26085BEA34399D088EB2CCD92BD732308F7D5F6756288030A138A826D34
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\update.log
Size 808B
SHA256 74eb60364d28641de752f4d8701bcefb88f0856e300ff5e77dd4fb692d50c161
MD5 6e5d4621f5598978f5ee802e33e9a725
SHA1 f7e385609f9287ee35e08b399aa527ac3832f3b9
SHA512 ee687800a61b18a123cff22981c088dd5a012341e8b8002b59307ff805caa59f4f8629a112fdde83483394d9545fe52ab812174db6f90288d043b3521bfd0cb5
TLSH
T1750169A390FA60D579A3438CC098EB6CCC92BD33320CF3C1F6AA12480307134E925D30
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\update.log
Size 898B
SHA256 f8f4b4e237ac3456a9e9149af40c98b43c220b6552b16d3f6d6a1a53cf704c26
MD5 392c429a71d825d2c12eaecb44cd1a06
SHA1 db59910a9298ba9feb9303c94bdc312714cbdd4d
SHA512 b9450a0c07ab3caf9f7c1f6b58301b874089473595279acb5f1a424b61ca93ae029596598f260c43371d5daf06cfd92ea150fc5b0b450775f1c052cbbe5e65e4
TLSH
T1CB1127A394FA60D57AA34289D458EB6CCC93FD33360CF7C5F6BA52480316134E925D35
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\update.log
Size 1KB
SHA256 ef1b97acdeab2489ea90471e199bf9f825e3db95e58e19a2debb1fb19f142dce
MD5 c7a20215f469653af9792f265c734896
SHA1 d8d84ed57bf99cf40c3a78b0eaa08caa47e160fc
SHA512 381475278501ceb68d6d7d4e06ea28ae7ac54479bea606b04f5dd337e7af87986d7a68e76a9bdaf5ec5aa20503f2ab89f5d75b4a84c1d999f9884a10b91047c0
TLSH
T1E72157A780F660C57EA34289D498EB2C8C93BC33364CB3C8F6B912480306139FA35D35
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\update.log
Size 1KB
SHA256 df9011e3050c0211b6d66620a68347044b34078147ac46428b89a67aaa046209
MD5 18738a50fdd24d2cdb3146312f06ed85
SHA1 9bfdea60af0b26e048a4765395fcf05761e1a0f5
SHA512 6ab82408f04ab269a2c0be1bbd0c142e883986f2484418cd56c74b4ba76d7c2f2f8033d91db22ab3c72218f4be132338795cb2bee0579ab38797d6bca6d98e72
TLSH
T1C1318AA794FA60D57AA3028DC058EB6D8D93BD33364CB3C8F6AA13440306139FA35D35
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\update.log
Size 2KB
SHA256 077dda6820f82dcfc11041bc0a63e23b7f33ea9e67a158f2dc3d19917f0e5142
MD5 26e64bcc8a6802ed519760c167422290
SHA1 8eec9328c38635a8e57484636d7dd78712482e80
SHA512 9c302618a93beab0fe5ee7350d87ca542bc451ca0a06c94a1f787f36cd30a80f08ea84ab20ccc17e49d3d4b770b7a86defc69b7d9d1e3d525fa911dfa396f9ce
TLSH
T1B94169A384F660953AA34299C098EB5D8D83BC33720CB7C8F7B552480306139EE35D31
MD5 SHA1 SHA512 TLSH

Submit Download

OpenTK.dll

Path C:\Users\Admin\AppData\Local\Temp\OpenTK.dll
Size 4.2MB
SHA256 b415f3e061d9758316074dcbf31d6dba48cb0b89405254db94ead0e43ed88511
MD5 b4d949571134fc3ec6c28f1af7a75e49
SHA1 07eb5685ff4f19ff8ed466c68c2426e2ead69241
SHA512 7abb1128d4f9312ec714f7d3f4e1d1ce12a6f93235d6382cf25c39dae0d7d88b5ad5141f512659c33cf57a762e14711b6b690b33da7d16c7d7be35c8b292131b
SSDEEP 24576:gGg1QKR0dSMIK0v6FMF2Y9JhGtZuD1/TMvXgZ2j41WEfyj+jNhlxZ:UQ1d0K0jT4L4htPlb
TLSH
T18B160759EAD6087BCA972E7E906304433136966B5B57EB3BA047D37C3CC6F642C1A1C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\libEGL.dll
Size 146KB
SHA256 041a631d114e45a11c43efe3b7712a10ce8052cf4b313c7f4577a5b9adb78072
MD5 9f7f22cef980ec272a9b73bf317500e4
SHA1 ae11d7cdfa84a242e31efd6f03b0ef764d5f900c
SHA512 19e432313c1e28fc076fb9e9c3884c3c97cc2d05b6d1aecf429180a6f5cc407734fe758bcc63936d5fe7ef8ac01abdf5ec4b17bb08b26c5cc87c560f4b89c5bc
SSDEEP 3072:AQpSfKDSjkC6G3a3xX4k6es65psG6gX6gr:AQpSfKWkCDeizA
TLSH
T1C4E35A0175E84030E4FB427A8565AA120BBE7D66DF268EDE3BDC4D4D06785C1BB39B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll
Size 3.2MB
SHA256 cbfc536b80405da7b5c37c97fceaf2310daf58d78c806140367b8f513352342f
MD5 a4dfddff62d1e917ebb0688cf8d96be7
SHA1 9376bfa069a72da76733cc72cf90386920815142
SHA512 97de24a94f7aaaf3035853c0eb93f44c5c2cdfad99b563fef225d9f2b6f4fa3fe8f89850895d286322191cf8b372aa87da6620796cd32fe368f75b6722b556c3
SSDEEP 49152:lnXliT77777777E377777SaTm7NCO7777ovwwz7777777y0pIyRTNEClTRyAlllD:Eg9TOW05n16Entwr
TLSH
T1EAF55C11BC408275FFDA01FBDAFC3E645A5C8664032E61D7D69C0C996BA07E32B71A87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!.Admin.cfg

Path C:\Users\Admin\AppData\Local\Temp\osu!.Admin.cfg
Size 4KB
SHA256 7c3b50e6cb86863d8d21c8cd1d34f6d1906d5f6856d19ff35b7d03307fab5806
MD5 1c5e498f22048a5fb820aa97e8a41fbb
SHA1 799509ab95a85bad35ab720578ad1647904a75e5
SHA512 864014dcbe2d8ce28a0aff4437d0e5db374c9e8fdac9c8aa68938b07a29333e893bbaafa0ea958439a2a6f695c30607ef99668b0f9b71f79e5ff613baa8b44e7
SSDEEP 96:MGcFmx4K76XbA6gXOo7wpwYWErnY2b8IxfG08hOKcYbkSoX4hW2Ta1Au3EJLROOq:MG6+N0wZqY2oWfGQbtXkw09JlK
TLSH
T13FA194F86313395F4D1E77E3B840B2042EF164955901607BB7AAC4CC2B66D88D7A792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!.cfg.639215004523096294

Path C:\Users\Admin\AppData\Local\Temp\osu!.cfg.639215004523096294
Size 49B
SHA256 f11b2f84271b332b901d6394fd406553d1687af9e265b9a2757138f8ee31938e
MD5 fd8945f7c9d67594283e2cb2b48829d2
SHA1 d000454a6f0b279f89cc94138f1381d06a5abd18
SHA512 64c70d231fd425fa5a34445b54ff6ceea9ce255ef2d7a12cd4e44f191b555f2512b4d2e5e1be23a9f4656eb85f4e0c902b6b65628956b689c5f84d89cd4e9e23
MD5 SHA1 SHA512

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2960-11-0x0000000007D10000-0x0000000007D4C000-memory.dmp

Download

memory/2960-10-0x0000000008050000-0x000000000857C000-memory.dmp

Download

memory/2960-0-0x00000000006F0000-0x0000000000B36000-memory.dmp

Download

memory/2960-21-0x0000000008780000-0x000000000878A000-memory.dmp

Download

memory/2960-15-0x0000000008D90000-0x00000000091BC000-memory.dmp

Download

memory/2960-26-0x0000000005620000-0x0000000005630000-memory.dmp

Download

memory/2960-9-0x0000000005620000-0x0000000005630000-memory.dmp

Download

memory/2960-8-0x00000000077F0000-0x0000000007846000-memory.dmp

Download

memory/2960-2-0x0000000005630000-0x00000000056C2000-memory.dmp

Download

memory/2960-1-0x0000000005BE0000-0x0000000006184000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads