419019f6300713f7e8b1a5c4fd30cdfc0567105a904713f45c6d623c710c1665

Analysis

max time kernel
151s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 16:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.exe
Size 180.2MB
Sample260930-ty883axtfw
SHA256 419019f6300713f7e8b1a5c4fd30cdfc0567105a904713f45c6d623c710c1665
MD5 57b9b8845c2745419f6cd8013f5b5f17
SHA1 39e0acdc6d12e72e63fc38573c0bfa78deff2b3c
SHA512 1aa1ca78e3be6ab3985c265c1222e150a48b11e04bd211588e5eef847fa31bffbddc02ced9b3d557539c758882300697a3d28ef4cd24ca4770ed8b79a04b80d8
SSDEEP 3145728:FSGSTAa00JmgrQBJZ5WQbggyYH4Mv9TC9+ftO0R9km:FSGSzzmgr44QbXH4oRp4y9v
TLSH
T19D983360FE41D1FFC48B017AE47EF73DB63B22618B1985C35AA9489C2EE2760594724F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
10	1044	osu!.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
5024	GameBarPresenceWriter.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 28 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 2 IoCs

pid	Process
4604	osu!.exe
1044	osu!.exe

Loads dropped DLL 64 IoCs

pid	Process
4604	osu!.exe
4604	osu!.exe
4604	osu!.exe
4604	osu!.exe
4604	osu!.exe
4604	osu!.exe
4604	osu!.exe
4604	osu!.exe
4604	osu!.exe
4604	osu!.exe
4604	osu!.exe
4604	osu!.exe
4604	osu!.exe
4604	osu!.exe
4604	osu!.exe
4604	osu!.exe
4604	osu!.exe
4604	osu!.exe
4604	osu!.exe
4604	osu!.exe
4604	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	osu!.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	osu!.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.File.osk\ = "osu! Skin"	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.Uri.osu\Shell\Open\Command	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.Uri.osump\DefaultIcon	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\discord-1216669957799018608\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\osulazer\\current\\osu!.exe"	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.File.osz\DefaultIcon	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\discord-1216669957799018608	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.Uri.osump	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.Uri.osump\Shell	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\.osr\OpenWithProgIds\osu.File.osr	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\discord-1216669957799018608\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\osulazer\\current\\osu!.exe"	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.File.osz\Shell	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\discord-1216669957799018608\shell\open	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.File.osz\ = "osu! Beatmap"	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\.olz\OpenWithProgIds	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.File.osr	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.File.osr\DefaultIcon	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\.osr	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\discord-1216669957799018608\ = "URL:Run game 1216669957799018608 protocol"	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.File.osz\Shell\Open\Command	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.File.olz\DefaultIcon	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.File.osk\Shell\Open\Command	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.File.osk\Shell	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.File.osz\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\osulazer\\current\\beatmap.ico"	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\discord-1216669957799018608\shell	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.File.olz\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\osulazer\\current\\beatmap.ico"	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.File.osr\Shell\Open	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.File.osr\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\osulazer\\current\\osu!.exe\" \"%1\""	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu\ = "URL:osu!"	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu\URL Protocol	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.Uri.osu\Shell	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\discord-1216669957799018608\DefaultIcon	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\.olz\OpenWithProgIds\osu.File.olz	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.File.osk	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\.osk\OpenWithProgIds\osu.File.osk	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osump\URL Protocol	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.Uri.osump\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\osulazer\\current\\lazer.ico"	osu!.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{0ED8FE82-F025-4463-B9FE-6ED9D0EC92D1}	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.File.osz\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\osulazer\\current\\osu!.exe\" \"%1\""	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.File.olz\Shell\Open\Command	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.File.olz\Shell	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.File.olz\Shell\Open	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.File.osr\ = "osu! Replay"	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.File.osk\DefaultIcon	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.File.osk\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\osulazer\\current\\osu!.exe\" \"%1\""	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.File.osz	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.File.olz\ = "osu! Beatmap"	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.File.osr\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\osulazer\\current\\beatmap.ico"	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.Uri.osu\Shell\Open	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\discord-1216669957799018608\URL Protocol	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\discord-1216669957799018608\shell\open\command	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.File.osk\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\osulazer\\current\\beatmap.ico"	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.File.osk\Shell\Open	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\.osk	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.Uri.osu\DefaultIcon	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.Uri.osu\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\osulazer\\current\\osu!.exe\" \"%1\""	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.Uri.osump\Shell\Open\Command	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.Uri.osump\Shell\Open	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.File.olz	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\.olz	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osump\ = "URL:osu! Multiplayer"	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\.osr\OpenWithProgIds	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osump	osu!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\osu.Uri.osump\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\osulazer\\current\\osu!.exe\" \"%1\""	osu!.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
3444	install.exe
3444	install.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4604	osu!.exe
Token: SeDebugPrivilege	1044	osu!.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1044	osu!.exe
1044	osu!.exe
1044	osu!.exe
3808	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 4604	3444	install.exe	89
PID 3444 wrote to memory of 1044	3444	install.exe	91

C:\Users\Admin\AppData\Local\Temp\install.exe
"C:\Users\Admin\AppData\Local\Temp\install.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Users\Admin\AppData\Local\osulazer\current\osu!.exe
  "C:\Users\Admin\AppData\Local\osulazer\current\osu!.exe" --veloapp-install 2026.921.0-lazer
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:4604
- C:\Users\Admin\AppData\Local\osulazer\current\osu!.exe
  "C:\Users\Admin\AppData\Local\osulazer\current\osu!.exe"
  2⤵
  - Downloads MZ/PE file
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1044

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:5024

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:3660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Debugger Evasion

T1622

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Microsoft.Win32.Primitives.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\Microsoft.Win32.Primitives.dll
Size 15KB
SHA256 6c21472b0ae2f9b484a97614fad5485a22f18f9f19ee1adb9ceb3ed8ddb072d7
MD5 1133e0c426161c2b805743358b6c59c5
SHA1 6080b7c514416722d893866568db633df1025d3e
SHA512 b65766bc590e76e8f1b08df94d4b7a249a9ad0da414a74b4d71f0d4487d7bc15d5729858d57004e5647deceb7a2082e5b26b31e156fd423a4085fe8a2cb83263
SSDEEP 384:ZWv2dF/GuVDKWh0pWImZlNUoxR9zxVaOo+:EvKGuV+o79zTU+
TLSH
T194624BD2D72C8107EDE7AE70AAA5DE833C3867C74D509A5A1595F4091CA33C1EB3163E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Realm.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\Realm.dll
Size 369KB
SHA256 273f02fda43d55d464c5231fb87b63135a99c32c07d9315da6ec53bae11cd8c9
MD5 6d6a43d1f03577c4986ea7e2a9b86d09
SHA1 d6fa7b81f029b3948cdc1318b6961d5819debe12
SHA512 8b2e41b31893385df1395522d2cd007689172469cc17008fe51884eb59d70831fe7b243ca091c8b544a5f84452c06263ea9d69c054ec5e1c0ad1b77316c200e5
SSDEEP 6144:JpmRTc79L7+PueOmIO69aQLp0LBFX5elZxWxYTfHJrxqhhWudwsb0YlyTOsdavih:2TSC7IrPp6X0PfHJIhhWumsYMBwpGab
TLSH
T195842AD923BD4B32DAFE4779F07459418AB2F981B8EAF78E56C6A0E60C43B446D00357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDL3-CS.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\SDL3-CS.dll
Size 361KB
SHA256 0e71c278f71bf9a4fdd1a8cca29306a84ac3c465bf01ca3cb6d9231afa38cd3f
MD5 2a28c8b68bb33a875d88662f0697c828
SHA1 131d5f2a4df6779fb070a4bc787436234ed5cd85
SHA512 22ad2a34a4644c3614fa16afde02162ee62a2676fb7ae6edef69c27ef6676acae72fbbbf11c4546bfc1302c09b9e56990c78750ae583fe7dcf306221ac4bfae4
SSDEEP 6144:FKYSgA6SN6WxjnoSOfluISyOvnDjF5dSmy1a4gQIMDet5iZtgwys1GOtP4ZwAMSF:RSiSDxkSOsUO/DQmy1a4RIMat5PESESF
TLSH
T1AA744B52B767198ECB521E3821035766F6F5B5E1171907B31BE3064EBDA23EC4A2C2E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sentry.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\Sentry.dll
Size 842KB
SHA256 ae7812b004dd0f2deed8bcaa982a262c36d7cfdfbac09a6413c6a26139a539a4
MD5 c467c2b0712fe20f6d3c420a39e1ff0f
SHA1 9e594d4683775fedf65f2d6d06d3761ffcce7609
SHA512 8a5b4dd3506db383c973a22987df17d642b0d7c2ef3bc665f28a490eb328b8be80d57b578a2cc9888cb08d70b42cc2a6971bce6920f6698afca6f23a0482ffd4
SSDEEP 6144:ocHwcHytLPoUcaxMRPHz05xrg3qLBKvPCmoRmDWM9fw8Ropy/Bgd0nl2BTNEmZGy:oDkytIyakKzOk925b5KeYfh2+vBSNN
TLSH
T1A2055B84B3F89725E0EF1774B8B495980BBDFA06A5F6E75F0948E1DD1CA27418E80723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.Immutable.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Collections.Immutable.dll
Size 953KB
SHA256 b527dd7b2beb82c22aa39787298cbeb33f3eac9eb9b83a0f0271353421db28db
MD5 7cd058d7d78ad8459795b716331173bf
SHA1 bc6004d66267c1891e76641ef153f32460663a18
SHA512 dc6920c15d5b69b9144000590d9b369f92b075ba68ebae859ce6541c2d9cce44d35524a3a005103ab144af62c61e54bad7488c61ce5efc1a8b43d6e39af19d83
SSDEEP 24576:XpQa3o0Us2h0c1yL3kopWkmy5OHwDriEI9eHbP8L2lqzcFImg49uPsjdHGpGyhpU:X5Hz8L2lqG2W
TLSH
T1E3255A15A3CC2F11DE3F86BEE5B3819BD7A184121325D1CF149AF6863FA37C1AA7A411
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.NonGeneric.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Collections.NonGeneric.dll
Size 101KB
SHA256 aa4d5216d066c91cb489f63c6cbfcaf1f47b6e74e070db45639d3460454fc60b
MD5 4a7454d14f15d1c2fcee4bca9abc9e97
SHA1 006266f12c2e7cdcb95bd5fafecdd5cc25162890
SHA512 e89acf1cd5149390da5cc0c0567b0eb0f52fc96694e6d605d07fc027debca44bba4946c587368f2e2a362ac5a713b7109dad71a9d2a2cff7deb75f8552d2a833
SSDEEP 1536:mIZCdIo/uGITwigm/gF79JjI1RHPFvbWDySjzji:mFdIo/ulTZgm/0QRHPFvMlj3i
TLSH
T118A3382D739C4722D6AAA2BC90978906E370F5E32722D6DF5008548E1FA7BC1C6F3167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Collections.dll
Size 289KB
SHA256 df6f2037eabee28100184e92f7536427ba2f086c1110629804d466b124bc4d54
MD5 e4d11024a5af2fa5f6cad5b53c6d7dc9
SHA1 63b20f606535fb168f6d16a394295d513c778638
SHA512 7aef97f0a656d424aa7ff4f87b5177952f71d982eaadfa05a3089533ad4ef5661f4a88e03303bbfffad54c4c1f53d2939efa50a641c4e2cc6605fb482eecf8e0
SSDEEP 3072:43UwvuGeTbinDHdY81uFqzK4s2QMsf0r3p9dJ2SAmnp8SFK0gwsDim1OLI6mFkeU:m0G4ODj1Fe4eL8ph2wC0acL+1U
TLSH
T172544A1873888725FDBF41BAE593C122E1B990938350A2CB47BDF6509FDFBD12AB6015
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.Primitives.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.ComponentModel.Primitives.dll
Size 77KB
SHA256 1e2451184c287409ea25acde3c90f25950bf34d16458a6e52a94ca4292434f62
MD5 4af300956d79f83956749a2a5c330bf1
SHA1 7e83fdd37997723687e3303e1a6714374544556d
SHA512 a95eb050258c608d944874c69b7f302968c26696bbc004c910d8807d80f4dd9979bccbe790be574593adb7e88eeaa164ad2f54da2d85dfcad4802d80bec64271
SSDEEP 1536:EyRLdlpyxFkIkSyypSM2VLIGOYu2nC248tL1zR:EelUxFJVy+hgLVO52C24m11
TLSH
T178734A1813E80319EBAD567C96B399109570F5871323D9CF8690D91E6F8B7C2F272A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.Process.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Diagnostics.Process.dll
Size 321KB
SHA256 51a57fbe918f8b68930c090792b718fc0850ea12da869d50b97a3796af29a740
MD5 3910cfd67a4ad211cf6695f5d53a5826
SHA1 fd2191bd2343e84579fb511011ffa771762b1469
SHA512 b7e617d2d3c177725a03e8dde7a9c4a8cfaa8f28a1ecbafc8e32524fe1359bfc4afff06458b242932377f1e313a14afe8319735b41541066e454ad533de5504e
SSDEEP 6144:3QjEAFSuTpqNmlS+LeRqI6GnWv9jb3bG1PjdlGODVvYD:AjEfwpqNmYqeRtnfEKvYD
TLSH
T151647E2DB7881509FF6E52B8A077D802E1BD94822781D7CB0350DEA96F5B7C3A771263
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Linq.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Linq.dll
Size 681KB
SHA256 284d38945b6e92e847129bd28af458b19818d0f2181f79882888ab2003f4c519
MD5 1ea7d5e8a957169f7c2fec764f6f0408
SHA1 752f251ed1f97f79d2a061d78306df821cfc02a1
SHA512 022356c78b36492ea1a8c3f7e651ea98d32269c94c8b3aa8e5942a99eb817eac1ecf7e9e25a5ff75edd338728c2f82367d58ce6dc76b36559dfc8da0ebc2c492
SSDEEP 12288:K0GwvqPJLv73KQkvIRR/ZqC6p/XCy3esv:K0dOLzKQkvIRREBF3esv
TLSH
T1B2E45D29D38C4A22CAEF467A95235161D2A195D243D2C8DB844EFD442FF3BC1677EB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Memory.dll
Size 157KB
SHA256 f8f9d38efd6b0de30954d6bf1f353e9617bfb36d3d245c013a3b12be9f6bd88a
MD5 e4713f24bcf42de027702cca61edb548
SHA1 61d84a84b8b2bbe1492875afa6714d4ae36ad7f7
SHA512 adf6b577173f212889cc34c0ed1e90fd833a2e9b8f723ea2705b01658be9a8b1bb29c6f96855c2c5425c5e3bb2d8a633fcf6ce9c085d2ff0b2f88a9f5fd02de0
SSDEEP 3072:mcbIWUQJ8tT49EggVul1co8s2pwaGrpXDXPjT/hd7b4y:7kMhpV6waGrdPH5d7N
TLSH
T1F2F34A1BD3980227E92FC6BA8B5AC602EF337515D30191CB44D4DA486F53BE1BFB6522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ObjectModel.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.ObjectModel.dll
Size 77KB
SHA256 2179bb19f335b4fcacd0994ad2ccfdac6840deff09c7889debfe9dbb5b88a3e6
MD5 440ea42c1b024e632e343b570c320945
SHA1 16cc7d8c2361e77862328573c72294290df46727
SHA512 78e43828b492fb34cf4b3fd6e1a12cd1c5c92eca7eb5aed439627f6c187f4511cb63f2ca293bf11d103a125f5cd4081572bd99c0bfb83cbc3905755b81082d83
SSDEEP 1536:Q5SwoWHLfV7C64aSmXaUbXyvBQ347cc9l6BzD:QQa5XWQ3rc9an
TLSH
T17A737B216B884B29D7AF563994E31412E134F2F31722C9CF46F6E50E1FA37E1963216B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.CoreLib.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Private.CoreLib.dll
Size 15.3MB
SHA256 fbca28e3d335ce45f493d0b6d8b6ccafe4e67e452e6ed29e63fa01f0f4bab0df
MD5 3c7a4d34bc2d594c95dc39dbdf512385
SHA1 5ac524ab9f730d8b3930710600ec608190aeda00
SHA512 84c989b6db23456d85179208adc9d7c4e1e90b114d18c913ef3bc909b7231be498802a4b1ccd52c87400f8762d0fabceb39fa36217a41b5f31fb7d3903fc1efe
SSDEEP 196608:KVBaFmdvRTdmI18Jjj+tyGzROH0R/gpn5f4ufQ7RoVs+6YSKFoU9:MBaFc91I+tyuOH0R/gj/5+i
TLSH
T17BF69E10D3C85F4AF13BCA7C8077D256EA75F892472A56C702D5DA483F23BD1623BAA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Uri.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Private.Uri.dll
Size 249KB
SHA256 b15c84d2120e1ec9612c66ba59bc3d7e67d841e2bce7b7d0478cb212537539b4
MD5 c43ce5d6a37f970ccef29bf9c1d59ca9
SHA1 de0c0f0b1205651b8998bb3ee59a590139d2a833
SHA512 280ad78495c77bdf2c2d0d0d657d7537f537c870d8af28e49861d22205a507db97aa0fa1d0de5e026933735a73a59d85de0a35df5f7d53c8f8c91bfd769aca80
SSDEEP 6144:vjEPhVSYgnYGFr76LGZxJyjMjPhArX+AVSP3m/3tpeB9pSzF17K3O2djHMYYMpSi:vyVuhtBXl2+HtG8
TLSH
T19D447D2BE3D80D2AFB2EC2BD8A93C152E271B5955705E7DB06BC90913F133D09A39593
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Xml.Linq.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Private.Xml.Linq.dll
Size 381KB
SHA256 c832b73de9783e6929ca5ff4863fc313e13ef7cfb5965c52587c4f77f6e037a7
MD5 2494723262fb94caad7684e7a988b746
SHA1 f06af9ee617a9e005fc017f47891a4676cfd8c42
SHA512 a8cee5a0af7a3e5c6d0f68f9740f68c449586123cebb1489081bac2fc5de9b715e62befccc105e3d72442b873ddc8015b5e4aec7660dc9f1e2fa1557aa8a4a6b
SSDEEP 6144:jhka7WzOsGJm/YKcLcCx8tjSqgiVuC5YK6M:jhtWzkxmjlVDH
TLSH
T1FF847C24E3C80A12DF6F92BCC152C941E1B1D25243DAD6CB8538EFE55E8B7C4A67216B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Xml.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Private.Xml.dll
Size 7.4MB
SHA256 d71e72a7a9de324352edd281a46466b51bd0bdd2831b1573f8d3bae8bd2dd4a6
MD5 c40feef03fbe9b62c3eed7f1e1aafbb4
SHA1 01b50a62306f20c63e077f1a3759af17606d0dc3
SHA512 9446086c26c691910258431b6cc87c1f7d12b9c9c4ca24ec8885970651d9e4033e05b7bd7f48933544c566fc0ed3a9d94226a06799e013a84984c1d297f259ef
SSDEEP 49152:Alj4jmpejO/g7eEPlMak9TPxsrVeOeaI2Zf/k7ndpXoMunaQ8ycsIvog7XXgMbSL:Kj4jmAO1/7sM1llqm4z5C8zvF5C08a
TLSH
T1E0768D14A3C40F16D36FC2BC82279111E2F9B453539AEACF4486EAD12FA37C19E7615B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.InteropServices.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Runtime.InteropServices.dll
Size 109KB
SHA256 e5eb1679f3579c9141e2bb9dbdce62624a623f38d299805cc1de07bacd21841f
MD5 eb8efe51e4b0c08806c481396176a639
SHA1 40f678ddaa3d9d0be2d76910a73beb7b7e5e8db7
SHA512 8d7bf648fd701603d1ed86a09e58291f2e43b646fbfec1e1eed23a8b33be3c1bb2a743d3bd17412f4b7d5226b23e9593a2d910914b5c0fd958b444e641b4d46e
SSDEEP 1536:6QCquAttQMxLPQtvC+zucKb2EW4udNY/w2yVvOHugu94RHPXF20g9zwn:6QCHStQMZ4vg2E5udNY42ypaugPc9sn
TLSH
T114B328207BD8863ADA5A87389C336D10CDB3FAC65322A2CF4584849D0FD77C567727A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Runtime.dll
Size 43KB
SHA256 76be53624f64b23d0249dfa0bbe85390086de7c44bfd490642ea86c6faaf44af
MD5 dd6fd06a80e9d90a12b8c7a3ccf0d3a3
SHA1 c60f31d35665c6640fd6aad1fca94a7ef09e6613
SHA512 18a10132b5d1ca4dfd5b349e8ba12693bf56a0a8d15e17cb82eeae7d01b95348edbc92cf3a3b1ececc385f19453daac79e028c2b6b589e92fd3fc01eef440554
SSDEEP 768:yJShN9Yzl50v4boRiPYVbugVJ22Ez2s9zkd:yJmN9Yzl50v4boRS022ESkzkd
TLSH
T16D13D6A1EE289233CCCA93B29CB3A4801EF173C244760D75556FD73664ABB89563637C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Encoding.Extensions.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Text.Encoding.Extensions.dll
Size 15KB
SHA256 8f51b9535db64fe027a40d6076200b1a6b0889bf05f62bb8e68c3eb083c7f113
MD5 36b62bc4aac6e461cd1c71e339e969ad
SHA1 03f3edd6aa9e88f24e889bf2ea3a80991ee2a5d2
SHA512 c10c444b09ea011d812ebe5a4d85e896e4141f8e7d30a9e5ef35b3029c13ca55bab824d5b925c3cce48efe6ac860d0d70f3095863c96ed6333fcd38896e6fd94
SSDEEP 192:OSyHmXhpdSMx+KW1JWIrWCWKie1BzBWseaoWH9FNGMsc+6UQ/X01k9z3Ahs0qbHI:OSyGR/x+KW1JWIPZlNNprj/R9zRJGKC
TLSH
T158623B928B7C4243EDA66EB0AAACD9837D3967C28C409A6615D9F2181C533C4DB31A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.Thread.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Threading.Thread.dll
Size 15KB
SHA256 ce71949bb1ea67b686e799128582015ebf8758f1107e59e43f342ece3f662930
MD5 191e118586803775c61d1a03c41d63c4
SHA1 477a76ebcb165b1ef9df647cfdbe35d98e26d3dc
SHA512 6dd35d403b1ce38d5645e7d6b08706094050b04b01afb97f7c6d871ee88eb19e9b9486a40d981cc258e42c93ec4e4242ed130505d1841566a67b7123a39111b4
SSDEEP 192:LS6z4dEpjxUYKoUWd7WIcWF+GBTBWseaAWHMMAAUYX01k9z3AahhhAiw:G6z2EbUYKoUWd7WIRlNtMMgYR9z5hhA
TLSH
T10E625CA6C7AC8143EDA62E7056B8CAC33D3DB7C299608A5615D2F1092C573C4DF3163E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Threading.dll
Size 81KB
SHA256 6c32ed1bf8067e4169e8feddd15e6489b89d19d1c7aae1520a551b57745d0a60
MD5 e092010e1fb5dd0b1201c968abf080e6
SHA1 e78446bb91c2f89f4ab672ca2a2c6d0a4fdf1631
SHA512 8931f25c8f3798a56ae5d2f120dbf0cc39b2e17186ab2516dd1d9c4164b3693eacc75b7685f4d34aa79b55bb34dcd84800b079f2e93623d0b24961b6d196b9b8
SSDEEP 1536:IaylBo2tUTogxqwXAXXG9Rtd5bFF9o6sion/zW:InlBo4UkgIwXeW9RtHJF9o6Lon/q
TLSH
T1A4836B1173E8091AFBBB47B9DAB36905C171FED21B11D2CF005A920D1FA7BC496B21A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Xml.ReaderWriter.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Xml.ReaderWriter.dll
Size 21KB
SHA256 8e48fed4d12bcffff01e8059caafb564697275797d2f5ec6823fdd82b87fe938
MD5 eb0d0c083ee430d7dfe54f7bc7564539
SHA1 670a0b0c840f26ef64e51b1a2f3f9f39db068710
SHA512 19586e550989ce5f76f9280cf6c74ea63c033d20be62efcf93c6c7e11f3c10f35fd4130ec3a1f819eb72bd30a70f298428dcbdd5e25b1dcb2d426e2dc3005489
SSDEEP 384:ky125qkxK67ex4FCa5FWNAWI6lNVXoR9zZiMRz:kQKLx5EBX09zY0
TLSH
T18CA208A1CE74CD13EDAA7B70C6AFD5C37BF4A29124729735E486910B8852384BB33719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Xml.XDocument.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\System.Xml.XDocument.dll
Size 15KB
SHA256 3ff858607de5146051498a7124ef983bea280d86e165f993516c6c26af81cfb5
MD5 8c7d99baac8aa197342b653200e466ba
SHA1 4b039878a2a6a2b2675becec3b3d9b958d6e4ab0
SHA512 8a2b2cdc90a38a32bbbf866d0b91d896955b1afe9d9884ddf5382662a1110801801293303bfd1f0d59376a6648108eb6be37104a8f9dc3f0dba48eee688e7620
SSDEEP 192:Gmx1mxBWHW4dWIVWF+GBTBWseaAWyUU34DcX01k9z3ADWlJKEzqO:R6BWHW4dWIYlNoUcDR9zMWlJJqO
TLSH
T17A626CA2836C4213FEE61E70A6E5D9833EBCA7D65C21DA7B21D1E50918137C4DB3172E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Velopack.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\Velopack.dll
Size 286KB
SHA256 3793cb47c1ade6dedb2f98dff54bd4bec4a70c6befbf3e93c0855b020e7536c9
MD5 6f92b1513a60053cf409ce11778c145f
SHA1 5b89a278d90cf3de4877f511cbc6066e94195eb9
SHA512 b8c29095a28c23155626dcbf39f565fd850abe8fe59a5dda55f944e2efc4ddf2df05e2407f9a324a9d3c166fac4be0e2d0084739065f094421913b83c6894ade
SSDEEP 3072:yo+y+mz0SG2JczzlOjBo2N/i3Pn3a9VsQcuKa4E9sKSEQ0RyS+W7OFUqAVauFBvC:yo5+ceTfja4ENSE/RyS+8OFUPVNzvQ
TLSH
T1CE545B0023F48227E6BF6F79F8B0244987F5F647F86ADB5D048468ED1D633909845BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clrjit.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\clrjit.dll
Size 2.1MB
SHA256 86b4f6565f36aaf922dad13314376d52e59d9d4af80ab7b298d54a04f3ff6474
MD5 882f21081833bbe198941433bdd766ea
SHA1 e9321384ed7ee251ae4f343d3475f13330caa391
SHA512 88e32952c169ea7339348fd9ce213a8b2746be2046159e58d800f36c24bd3d417b53cd2ee277bf313ec1052369ce2df8b1e9cf424f600f425f54d9c055d73593
SSDEEP 49152:N04kQwD0UlExGsJ0uTnd0PC1h+FKKqun+xYG62zgx2aiDGde9Cx5UCEitjgJ/z+J:JkYUlRsJ5nKPC1hETb+xlgFiDr/2tu/u
TLSH
T19DA59E47A2A900FCE46B9134C1534B17EBB5741523329ADF6BB04A55FF23BE326BA710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

coreclr.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\coreclr.dll
Size 4.0MB
SHA256 3d7b780b17ae3a0c19b7e985837b0195dec5cafa6862708f98689238e4694072
MD5 fce9b5cdc5cd1d3ba01ffcd483ed7b9e
SHA1 134ac09654609b446fcd4bfaa95104ebc0e26681
SHA512 cd623acda934e826e71a219140efbe8a5d739bc342584a621620b5e6bcd86ecd7710feee984920888680f9f9b16f398c4ab869411e31626d53365efabc5ceabd
SSDEEP 49152:k15ZzX68G2h9sUofUGEP404ixuiXnRYb7b7b7b7bS7b7b7b7b7trbBHtDLER++Ny:OlZG2DPnN7XER++NNK9P2cIvhFq
TLSH
T130167C16B2BD40E8D47AC1B9C6D74D17FAF234586338DBEB42518A251F23BE16A3E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostfxr.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\hostfxr.dll
Size 370KB
SHA256 838591885c5396fb0588a3aedc2f3e841d3afc67570868b1bce615264005a44c
MD5 6a3b9c4600fc05e0275d7b1ab20a9ae5
SHA1 0601e1db524cca08efe8dc63d1cd5dea23fdab78
SHA512 c1401763882b408c66940fe4c1f9729746086dc471664f4c643403932843b551994dabb56e1099f7f75092e779ae6b5a56684a3cde82efc65716f1553b9a646e
SSDEEP 6144:hal9vjNggqbRRdaUzIS64W+/zvZ0UCVvfpdAl0FsGxilKmkRAwBAO/Ux62CUHFhb:hFRAOOnpa2vD3Q9Bqk
TLSH
T147841816D3E8057CF0B79678DAB29902EB727C494BB0E5DF139088651E73BD09A39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostpolicy.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\hostpolicy.dll
Size 369KB
SHA256 e92a2e71eeeaf7c574e905935b3e3724ef29bade44317659dbe06f505e99dbe0
MD5 10d0786927018fffb019bfd445ad3d9b
SHA1 c19dd3e6017d8cf0ca8084c87ad01d57604388d1
SHA512 709fce701554b4e65b3a9fa60665391c8ea30f3bdd22e06032b9ab4d7825b414d58b8dd0f2c3b47f105ddbe34874378202e297337a19b849fea8cdf019508221
SSDEEP 6144:Os0pbUUvKO9fssrJDpMBqyiNluCZO7ptsPB7dGd2b1ucZaLr9H/VLuxJb/FDtaDb:OrFvKOHlKcyiB8HB+UDwKkEFT/X
TLSH
T117842916D6EC007CF0B7E679CAB28901EB727C4947B196DF139099A61E73BD09E39312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mscorlib.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\mscorlib.dll
Size 58KB
SHA256 b698595367a7d4fa57ccacab73751fde0bb8f2415345c62cdfe7ced890da2c0c
MD5 22aa301b16905d3c9f36b8edec2d1e2d
SHA1 f927916bc20bb7ac52483c98869c36475e8ecad3
SHA512 0ba5c5930dfdcfc9c025e198911d88eaa0ed3dd3065035157313effccdb0683ed433250912c80c562bf7979a65586ad4a75b84a42a860f345a2e2b91af9d8865
SSDEEP 768:9jMrIdsnTX4XN2taL8ilzJx96qaMsXYf/4yANGLd6cSnnc+YY5k4ba2yGlG1QeYI:9jMJDlYY5k4bZyGc1A4cxvdzw
TLSH
T1A843E632FE08E733CD8A9BBDDC73A6400BF673C514760979E846961710CA7A6533279A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

netstandard.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\netstandard.dll
Size 98KB
SHA256 3dc81dbc9dacd28261632c94410859eda24c2db50cd6c14309cbb2a434b50c57
MD5 9b8bdfca909bb0f372ca4ea75bb2a736
SHA1 76904d235524698a27c9377ea854edf27c810d10
SHA512 ec285dec5ff446f628c70c1f5351c89ffa63ef536557debdbc89f4d8cffa599ffc880bb8b9fb720a608e71193631a99015f6da7c8d2b6a4ebb0dc02ae918fa1b
SSDEEP 1536:lLrFLbuCbYdYZ5B4bgDHsPdIpuSE5L3Hkcz96Aa8z7:5RaddY54bgDUAgkJ8v
TLSH
T1E8A3F620AD1897B3CDCF9BB9EDB39AC107F6A3C505761FB56488815B91CBB804236397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!.deps.json

Path C:\Users\Admin\AppData\Local\osulazer\current\osu!.deps.json
Size 122KB
SHA256 33c747507dc1a65c5dbfcc91fc1ee31fc53627f112550a46c35a668e6736d888
MD5 005587321723b491c595b537694ebf76
SHA1 ed6aec8e2852e05f278030b06ea988e1efb94277
SHA512 102e523b8744afed41e16b15e0f4f1741ae59a88e32accf46250e8b82e325a5f3be9a90d4822d43ba1fff0287db59fb9062010d9469781072898b48b6cf1bf44
SSDEEP 1536:AciqtjG++jYOOL9HTGDp0x26n4WysU8Wc0JBIDq4FXX:AUtjG++jYO5sUU0JBIm4FXX
TLSH
T1A7C37B26C5689D670EB1A7B2A47552D2F726032F6000184B78FC685DCF73F6B6289F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\osu!.dll
Size 245KB
SHA256 bd97f68f8eb35603b0a6f1cf78c9ef5fa89e86ccd273283354d6e516330cee01
MD5 3059392aec16c124bf5d04cd90cbddad
SHA1 e221c7d735b12c3907e0d755c510568eaeb1c5d0
SHA512 3503c86caa997f8f9252b72c86d1bb2c09823a6fc6dd52214fba63e6b15ded6222978f9d05db41c191e6588df56f12369dccac22faf8f1049dae8e58fff484c3
SSDEEP 3072:AioWdDpEK8rVk3gniUXIGtvffScXQYrB88Ibv7xXONfGtvffScXQYrB88Ibv7xX2:AioWdDp2VnlIq6EZ+Oq6EZ+E
TLSH
T1B234E1C5B6A8D626D6FE4A72F0A196021A7DFF8F39C6D348B408B3CC1A733165512727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!.exe

Path C:\Users\Admin\AppData\Local\osulazer\current\osu!.exe
Size 250KB
SHA256 2ea71f129348e93ef04f065f3eacaef8941ab64b8b82fcbce3703e8ee7adc957
MD5 9a91eb024ee30921b84600d98448f34d
SHA1 093eb0143977e3f3bed030b6328a9765b86d50e8
SHA512 c546026628c0e99ba7f35df8945d9a5b794bca90f936d2a1061610aae13ad061cde05a173f42988ba0835e08e7f36713ce2fe9b5b33981e809acd07717e070a5
SSDEEP 3072:9VDxk88wN1nLVu7dL1Z9Qnlf9rE38wGTbEaAT5bnGtvffScXQYrB88Ibv7xXvNPj:bHRu7F1nQnB8KtUnq6EZ+r
TLSH
T195448F03A66851BFE1B3D678C9928941FB727C564BB1A2CF13506AB90F777D09E39302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!.runtimeconfig.json

Path C:\Users\Admin\AppData\Local\osulazer\current\osu!.runtimeconfig.json
Size 470B
SHA256 df8d3e97c1c7c3ac4cbb729142a07253ad21f041a04cb506dbb06f2ceb47d03d
MD5 2cb270a1c896b3a3dbd670bd816e0c8c
SHA1 6cf548eaa6d8c81a480ec00bd1b3e3fd8cebecf2
SHA512 e7106730331e130117e49ea16d391e6bfb4f85d6975c22a06255ca6d236f0eb2fb21d3ecaace17d84c58ae6478eef6ca3351dc502c541185290fa20212c3247b
TLSH
T1E2F0A075CA107CB715F9727AD561C482DA30673750002C95B4FD190C6F7BABA1222F92
MD5 SHA1 SHA512 TLSH

Submit Download

osu.Framework.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\osu.Framework.dll
Size 3.8MB
SHA256 234c4278eb6a377f5cb1bc48e9ba12e8c639891c000b77e0c320947acf7a2e8e
MD5 d6366e0110f0ac5d5ab8394dc883ff43
SHA1 572186cff71660ee1e2b9e56cf3656ca94434724
SHA512 061cc73480e5f38ef82bf5fbb4f96d94a4cf5a71b50ea5bdc52d783b78d6ae926241379252fef2394cd7a210ca52f68396747f502de12ec48c234a1b1f8f4f72
SSDEEP 49152:Fa8VXrbtg6gR4OgtUyyKsVWNsFoZ9t+WGZVuN93KHDHRA/72L6gGMl:lcg6oZ9t+WGKf3KHD/L3GU
TLSH
T1BC06AECD7298EE3AC69F1B3BD42186D403B6F846A722939E3646B77C4D627014F06793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu.Game.Auth.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\osu.Game.Auth.dll
Size 238KB
SHA256 e45756390363527f0fcaaaebc1f65692b96603babe1a6623a1c9c25da439086b
MD5 f36b2b813ca0294cdf44d2283a804870
SHA1 174a266609b40b9fdd633e973bb7a7e3596bfc0e
SHA512 70f24dcc1398566385f5e9554147bf7423e4d16fa957e7738f9549533a2401cc9774dcb27b75536a740bf2a518221e00075e74eb130063761d8e0532e54d6b56
SSDEEP 3072:0Rx2NikolhwGNSqTqmqhLNSiMuKLxdgOcWcPPuqHiO4y/35Nh5vm/o0y15LD:qEwkofwE9Y+DP/SPrEs5Nh9
TLSH
T1B234082817D82A53DA5EC6B9E4E7010A97D4852B9C46E7CEBCC270E30DC7383D6D6267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu.Game.Tournament.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\osu.Game.Tournament.dll
Size 227KB
SHA256 56dc0f6d04050bf6d4b64bfafa4a33192637b91e6cfbc47e97f8dcda5bf82562
MD5 664d8ad09d830a0579b551a9706a7412
SHA1 24ef2643d4b030b6fd9b98bdd94b887abcf73837
SHA512 d3d6848c859ca05809c5e6fe476c63d5cf88bca67d0d90a3709cfd96658f1e1c6147266f75aa29f6f16a3b2608dc10c0fc78429a34afaa9eb50c5cd73169c3fb
SSDEEP 3072:nf380AuYtZ/GaRE6iub/WChRvtuAHVuzMtyYHNmsEl0DI/3JkenShTM3:nfBYtZ/GaFrVzQM0gEloo3Ser
TLSH
T109347D6833A84627C77F2776A0D40959E2B19E03F4DAEF7D4C8996D91A03342B94336F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu.Game.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\osu.Game.dll
Size 6.6MB
SHA256 f4903a29cb81619027c093cf2b9068d6c0a578654885c864451f799f694939b2
MD5 f1b6c9ce20c39620c0965a0d25bf0a9b
SHA1 a4d0ec4b8a75b21d6250ded1ee3ad6a8e2896c9a
SHA512 89f101e7c9c74d7587cf9fc82e63b7b51a5823ba382d27512233b3c6cc86c790b74f62da5287ee83475d024ce7bc726fc5a504cf2d85719e7fc353037646af0c
SSDEEP 49152:NfNGbaq4ygZILJRsfzPWTqY5/y3kZWEENYyV4ko6nf8kn/q+V8vISQtb8o0VoMJt:RN+6ygbeTqw/yUS8kCVo0
TLSH
T1CD665A55D7B48B26C93E4E33A0A7011112B2B847EB37DB5B4152F1BE39D33186AA731B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osuTK.dll

Path C:\Users\Admin\AppData\Local\osulazer\current\osuTK.dll
Size 6.1MB
SHA256 ac86efdbd21ff7c824f9978394c678542532d849f7396346a5d3f914fbd121f3
MD5 7dc993bb691bd3b0b653dfce0e925694
SHA1 468c81e537037ec8a1b24f57633fb4e1b429320b
SHA512 9daa11742e416a3254aa686368febf6d5b7035935734b74136cb4ef0eeeb721fc481935b02a2852ca062bcebe3c4fee4e53d446bfa9b57becc74ba4aae9fe35f
SSDEEP 24576:VpugrePBtmdE11MUk2JcN+4JlIVOX/9P8NW/G5oIpQ/U6472t8C8w4RikVzcbqsY:egUtYeNyFyHz/ERdDtw5JHr
TLSH
T1B756D709B7E12F2BDA56737BC42E1012217AC99917839B13B037DB3E9CF27A919191DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sq.version

Path C:\Users\Admin\AppData\Local\osulazer\current\sq.version
Size 541B
SHA256 ca19f349a26354072c2002ba2f70ed265b6d01a061cff74e27627b717b73e384
MD5 83c85950e7e8be68d7f0efda81ed0d47
SHA1 06d46d215a9ecd08733d3028051a38d6036fab77
SHA512 1c144ab132ec77cfc691da076576c379d654b58ec7a251e9168c3a41463b0f1942dafef9c8347f89a05a2f09f4c25312cc3a21abae884e61fa031067137dda37
TLSH
T1A6F0C0449100F60AD29A57184CE0410CF3FB3E6F30D08498FD88AD4C7ADA2DFC86B583
MD5 SHA1 SHA512 TLSH

Submit Download

AuthNative.dll

Path C:\Users\Admin\AppData\Roaming\osu\AuthNative.dll
Size 10.9MB
SHA256 16c8a3811828c6b2f726e6fcbc0c8805c022d194449d307aaabe7958091cbdd0
MD5 db0e132208845210a588ed65f5c82ab9
SHA1 224e3136e746e562a256f776ec266b6e35bbc5b7
SHA512 d11ad65192f302c7d3d453f8d540f6576e852691ba9baebfb5b95f1eb3b486113a08f7cc08a05c85a007b3bd50d1dc8222cab41a2490598806ffee01d13517e1
SSDEEP 196608:iagsUHH7rsa/9kV5B6Fp+t+y3o1ZKgdxe:iagNnsa/96aY+y3dga
TLSH
T162C66BA366D1DFE6C31A8CF4C8D2A12E9AD67C2A1319F34F0755A25CB633AF46714B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1556d0801b3a6b175dda32ef546f0ec812b400499f575c44fccbe9c67f9b1e5

Path C:\Users\Admin\AppData\Roaming\osu\files\a\a1\a1556d0801b3a6b175dda32ef546f0ec812b400499f575c44fccbe9c67f9b1e5
Size 988B
SHA256 a1556d0801b3a6b175dda32ef546f0ec812b400499f575c44fccbe9c67f9b1e5
MD5 27d9765612170a9517f0a5e8b4613f06
SHA1 660d4456ea71bdb48a9ef84cf65cd68d40d05a6e
SHA512 eda5ae2dc0e123418f0e50a51ea651c10c82aa0620d89bbef47cad1c5ef336b43d19604a6281853cc2603dd0c25d445b0195780897f8606beb768132222fa41f
TLSH
T12911CE7E800B4139C38F33553124628371E45179B63BB7E4BE46E94A0221EF9A33926E
MD5 SHA1 SHA512 TLSH

Submit Download

1790785879.runtime.log

Path C:\Users\Admin\AppData\Roaming\osu\logs\1790785879.runtime.log
Size 5KB
SHA256 018687ccf9cd78853529c33f0ea2fc7fa6aec4556b2b959d73b6842b23135e74
MD5 984d7a8388246856f1b8739eb40c00f9
SHA1 618610c70f7104ed1924a7e5bba80049c1aef952
SHA512 80df87c8ce0adcc28ecaa4ed3a99e09a0e395a5f600b340acb13f4283d2d309b7ab1b964e6b4db4d001ce668f07b190c7fbeb4a4ea4dc78a65f8c5475ee0ba2d
SSDEEP 96:LlNHXUGX85COXAwzUIyXwzUIyonXe/t8AE2mDcjd/5cU:fEGXgI8AE2ccjdhcU
TLSH
T185B1B611AC6F82F02E55C693D228CF9EC75A32496329EE54367D01AE039654CC6FF3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1044-510-0x00007FFF699F0000-0x00007FFF69A01000-memory.dmp

Download

memory/1044-697-0x0000023AD9540000-0x0000023AD994E000-memory.dmp

Download

memory/1044-499-0x00007FFF69AE0000-0x00007FFF69B3B000-memory.dmp

Download

memory/1044-576-0x0000023AD9540000-0x0000023AD994E000-memory.dmp

Download

memory/1044-488-0x00007FFF6AB00000-0x00007FFF6B5F9000-memory.dmp

Download

memory/1044-605-0x0000023AD9540000-0x0000023AD994E000-memory.dmp

Download

memory/1044-712-0x0000023AD9540000-0x0000023AD994E000-memory.dmp

Download

memory/1044-695-0x0000023AD9540000-0x0000023AD994E000-memory.dmp

Download

memory/1044-696-0x0000023AD9540000-0x0000023AD994E000-memory.dmp

Download

memory/1044-523-0x0000023AD9540000-0x0000023AD994E000-memory.dmp

Download

memory/1044-701-0x0000023AD9540000-0x0000023AD994E000-memory.dmp

Download

memory/1044-702-0x0000023AD9540000-0x0000023AD994E000-memory.dmp

Download

memory/1044-703-0x0000023AD9540000-0x0000023AD994E000-memory.dmp

Download

memory/1044-704-0x00007FFF6AB00000-0x00007FFF6B5F9000-memory.dmp

Download

memory/1044-705-0x0000023AD9540000-0x0000023AD994E000-memory.dmp

Download

memory/1044-706-0x0000023AD9540000-0x0000023AD994E000-memory.dmp

Download

memory/1044-707-0x0000023AD9540000-0x0000023AD994E000-memory.dmp

Download

memory/1044-711-0x0000023AD9540000-0x0000023AD994E000-memory.dmp

Download

memory/4604-472-0x0000025452A60000-0x0000025452E6E000-memory.dmp

Download