3adc2d001aacced5f92ba8ae24121980d5e23f5653f37d14cf4765bca1abd9f9

Analysis

max time kernel
27s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/10/2026, 22:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
osu_.exe
Size 4.3MB
Sample261020-2xshxsys4k
SHA256 3adc2d001aacced5f92ba8ae24121980d5e23f5653f37d14cf4765bca1abd9f9
MD5 f845ef10bf97c3260b818fc02e73e196
SHA1 ac17e56fd28d86ff0b5f7d520e17d7237fde3163
SHA512 814372403fb942ba63c44ce1e223ed7fb7c54b136bb3b81b377457da6195c638738c9446d675070b9613ede66fde7cb95caedd36af13315370ebc892d42fc0d4
SSDEEP 49152:UvmS8LTfZMBXdUxmZ0ixDej4V1/i5g+7Z16rPZrpzRXJJA+xaQRfvWtxRxpDOhG:Uvl8LwRZjJV1eFH6lbctxRxpDOhG
TLSH
T1BC268C6067E48E3ED56E87BAE495190663F5CC88B7C77BCF6829B97028B7345180334B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4024	GameBarPresenceWriter.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	osu_.exe

Executes dropped EXE 1 IoCs

pid	Process
344	osu!.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	osu_.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	osu_.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	osu!.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	osu!.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	osu_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	osu!.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{43740E33-AB5A-4069-92E3-32D2AFD6B165}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{DD003C4A-3D33-4194-B3F0-710AAD3C99CD}	svchost.exe

Modifies system certificate store 2 TTPs 13 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2	osu_.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 040000000100000010000000be954f16012122448ca8bc279602acf50f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e0b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000006200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	osu_.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c0000000100000004000000001000001900000001000000100000009f687581f7ef744ecfc12b9cee6238f1030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2090000000100000016000000301406082b0601050507030306082b060105050703086200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12700b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000000f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e040000000100000010000000be954f16012122448ca8bc279602acf52000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	osu_.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B\Blob = 0300000001000000140000008d4c4a23ba9ee84ea7348fa98cc6e65fbb69de7b140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d4040000000100000010000000ab9b109ce8934f11e7cd22ed550680da0f0000000100000030000000a768343c4aeaced5c72f3571938864983a67ed49031c1da2495863caf65fe507011f7f0e70b6cb40e5631c07721be03419000000010000001000000082218ffb91733e64136be5719f57c3a15c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000820500003082057e30820466a003020102021067def43ef17bdae24ff5940606d2c084300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c050003820101007ff25635b06d954a4e74af3ae26f018b87d33297edf840d2775311d7c7162ec69de64856be80a9f8bc78d2c86317ae8ced1631fa1f18c90ec7ee48799fc7c9b9bccc8815e36861d19f1d4b6181d7560463c2086926f0f0e52fdfc00a2ba905f4025a6a89d7b4844295e3ebf776205e35d9c0cd2508134c71388e87b0338491991e91f1ac9e3fa71d60812c364154a0e246060bac1bc799368c5ea10ba49ed9424624c5c55b81aeada0a0dc9f36b88dc21d15fa88ad8110391f44f02b9fdd10540c0734b136d114fd07023dff7255ab27d62c814171298d41f450571a7e6560afcbc5287698aeb3a853768be621526bea21d0840e494e8853da922ee71d0866d7	osu!.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	osu!.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	osu!.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	osu!.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	osu!.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B	osu!.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	osu!.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	osu!.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	osu!.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	osu!.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3192	osu_.exe
Token: SeDebugPrivilege	344	osu!.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3840	OpenWith.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 344	3192	osu_.exe	94

C:\Users\Admin\AppData\Local\Temp\osu_.exe
"C:\Users\Admin\AppData\Local\Temp\osu_.exe"
1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Users\Admin\AppData\Local\osu!\osu!.exe
  "C:\Users\Admin\AppData\Local\osu!\osu!.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of AdjustPrivilegeToken
  PID:344
- - C:\Users\Admin\AppData\Local\osu!\osu!.exe
    "C:\Users\Admin\AppData\Local\osu!\osu!.exe"
    3⤵
    PID:3064

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:4024

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:2052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:4192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5A6896595A9B5FF7A8254147F2B2367B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5A6896595A9B5FF7A8254147F2B2367B
Size 22KB
SHA256 f9ce48802499eed55d2c92b0c6c1f394f445c402ce5a14f42d3055e7dab2eca5
MD5 bc8fb97541e01405aed45a2f2b4c1bbc
SHA1 44a1373885f8e897dbd8bc16f7c04c71ed51dd22
SHA512 243ea46647c4a9b6abf7bc49f546680245197b03887bff5a02dafd3e4516ba7ff6372d8219ebbdcd12ab06739b4d64ee3af17d84c04d3b2e51dee146d3f21fe8
SSDEEP 384:Npmu9beJjn2FN/vNoNyO+w6R60Qlx08Vzktpv:NpbfN9osR/QQ8F0pv
TLSH
T19FA2FBBC695CAAD741C66A71CACB8FE3D8F511A53B92E01F41716E880420FC3CE97782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
Size 2KB
SHA256 6a7a2243cd47a14753c02f921c2779a142f1e1eadccc5e34b133f359b1207938
MD5 d6537eb1b19b26fa1f97bf0dd1b9039a
SHA1 d4a2192db63b64c56462563e4cfca4d0a92cdeef
SHA512 411d3c4948ea4695b0ad3434d68275e945abe7724813470d7330761d15394bc6c0610c9ad67c3a503ba2fecd754ec7ddec611c9c710b87cd8ace9218398e65f0
TLSH
T1B54108034C6E6012DE65BAB5DAC9C53A34B98E532C416AB316A75394085F7A6EB0C10D
MD5 SHA1 SHA512 TLSH

Submit Download

EF7234CDBB1649702229F955C785C39F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EF7234CDBB1649702229F955C785C39F
Size 785B
SHA256 9e153cc9331fb887cacd6f08cfa3dc5aac7b9b26b4b9cfa75d2ac57288e9142a
MD5 13c624bbd9ad9ff627a68b5ced19b228
SHA1 ff158247f5c6bf41d5fed9f3d756b82f735a24f6
SHA512 62251f6fd12706cc3b90b738523a3a32c34b104ed967b0f42da80596fe0a3b03a27dbbbab144afff619c4a910558b2f8f6f6f223f4cc65bb288f7516bfdb7068
TLSH
T14A017561A8BCF3844DA11BD603F4ADA559B407F6294CB2672437A1560562B53EF28129
MD5 SHA1 SHA512 TLSH

Submit Download

5A6896595A9B5FF7A8254147F2B2367B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5A6896595A9B5FF7A8254147F2B2367B
Size 290B
SHA256 669c4f13d30c92942979fe9a4dbaa068b41c22409a7c9da758579fa9e5dfc8c2
MD5 9cc4104e8142611cf963180c3ce3f55f
SHA1 f006bc8df86c4474d244c17303eac6ed9d491590
SHA512 0c262b586aaee2dd621e189f6acaee82c6e0eb97ace6ac35b5ce1b6f3989319e7d5de023dc1e28cd86c568d00214528b861229cf9208e08378f9b9d77a839628
TLSH
T1DED05E1CA3F80621E580C57E99E01867B9B9792A850193480FF1830C3438E1AA931B23
MD5 SHA1 SHA512 TLSH

Submit Download

77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
Size 422B
SHA256 d4089750c242746ca3606657f5972aa55b17f346d2a63049bc5a599dd5bf2306
MD5 77baebf5d9bedc73b69a03994c02ed37
SHA1 4cc6a7ca99d576e2978814bf5744162333594b8f
SHA512 0fa0013fb6741d4cc3f5804ba505fed28b05690ff59e77bc8d7369236e1613c1fa71a1f05b88ac54500778a3af94f6013fb6be4feba6689355ba90fc2743c56c
TLSH
T1A2E0681428FFC50AE7727D3A0B99BA3F497FF313180C6AA5B6500034A41BE028E31B32
MD5 SHA1 SHA512 TLSH

Submit Download

EF7234CDBB1649702229F955C785C39F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EF7234CDBB1649702229F955C785C39F
Size 308B
SHA256 7fa433f925f0ead02675d7bb5f3dadc542022c356d7e704f683fd95653118491
MD5 81f5c826ca5a45ff39210d6d7eae8bf7
SHA1 d91e306d94ef329f26949f2656b7d036a7696553
SHA512 adaa45c6dc806d4134c73a661ff40473c5a058be3e9b3959a038489a331ad3106131c777cfe1c486e9fdc9f92e9db4fe3631c235f1d56bf1960815054db5256d
TLSH
T1A4E0170CA3FA0A22F490CA3D29E024137A35AE648A0483490FF18B09787C981B920B57
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\osu!\Logs\update.log
Size 4KB
SHA256 51b78414bb202c7d4128f90d6d59e0418878f2b48896bb7cc29d14fbe465a46c
MD5 f0f532d7351ebd0e41bd360a55938faa
SHA1 711b5f9b559651170e6fe295d1a3a4dfb5f51d1c
SHA512 310914f84aee48925bab74b6b806f36716fdf3b402aa154ba8e4ffed5ff36436120a052484334a03657e50bd4629e7b6ae17bd63055d8882985864defaa9ebcf
SSDEEP 48:MQWjDJGVsiBcsLIXP2vB7hRtCt3WqXI+dDPuW1MQskSn95JJZnkOIL1U5pNrAf6p:MQW3cVsiYpI+hU3NrAip
TLSH
T1DC911B698518D06F3F941717A3682B0D5F3FA0E3AE5CB1DDBB74A2AC1609440DE2DD72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\osu!\Logs\update.log
Size 370B
SHA256 cbd45eda87defe4a81b490a3535d01e91053846fd2292d489b529dd7a7eebbb5
MD5 60781e0095328a9f7f4d823e8f9cea75
SHA1 54c1baf664571885fce71e02795e18a7162cda62
SHA512 520a35af6c75fe90dc59bd900c217870130ffd8c43a928eb96b81f780736ae2862248fb83d5a0aa0776cdab8fbbd0c5379ccf52eec9c802ff0250172107d6873
TLSH
T1AAE075138560E1AE7EA16392868A6BA84F7F74FB260C74DC7765F2EC120810A8E6D134
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\osu!\Logs\update.log
Size 1KB
SHA256 9af321d91b886610e36053ece5fc5e4e13d48417cd5c0d1c3f168faaad276eae
MD5 4ffde661f7449af05c68c35f40bf3694
SHA1 2e799ff68df032359b771719e4cd7980f0f26397
SHA512 1149a9283ddf70ecf9f7023ebb3e76b5a8aaefa310e0e264ab40560a33a38e096e1631941d803dbef151cbb59647ace182b62ef52cc9830445d71c99cc7bb1fd
TLSH
T11D21CF568028D07E7E52134646496B9C0F3FB4F7AA8C7AEC7738A2AC0309481CF1D9B9
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\osu!\Logs\update.log
Size 3KB
SHA256 48101668f8461b9b05f11c5271cb810d89324fdb86924ca7430febe680987137
MD5 a942a55304ff81c20c300431517f4573
SHA1 43577de67a6a40afe442b69abdccaafe86b368e9
SHA512 cfc9a406ddd7afdaabb11cb1799f3d53be71da4ff96f9817b47fa1b04f2ff4f4ca290d2c229ab8171cff5f296bd743e247805ebc9ec2b69c3d4e842b6c096d8f
TLSH
T1EB7129698528D06F3FD41713A2686B0D4F3FA0E3EE5CB2DDBB70A2AC1609440DE2DD61
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\osu!\Logs\update.log
Size 325B
SHA256 c4872439563c99a6675ce86a7b722c3c0245c739b64ea7ffe98864aa189a847a
MD5 d45ac92151f291a0ce601f87429daaf8
SHA1 b13a30d1621c2d19506edf6af6931c55bccc3c6c
SHA512 e7ad57eb5adc2eb88adae894ab49ae22ffca77452b15fd6cf27849a407d31020f556780450b94d40595d722524006ab83c7e02576d8cfc57a3571d9424559eee
TLSH
T195E092218560E8AE6BE1425190886B284F7F28F7220C74BC776792F0220C11D8F2E334
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\osu!\Logs\update.log
Size 583B
SHA256 d831203b48f6c85665198375cf9ba5c8d2d8b02d32f2c6aa2cd37737fb5272dd
MD5 e03d3b4b632be3ffe2d576a8306749f8
SHA1 72b63e323bfa295df562d16363ff7adf582bf20d
SHA512 acfe866e878a22240361cea17875f15a837fb815289b85fd90b75b2e0bf66a065d63e1663082e0d743ae52d754b4ef3b4a611945a01e2f0a694e06f2619d591e
TLSH
T1DDF0EC125160E9BE1AE113548049AB284F7F24F6220C34ECB36AE6F4321C01C8F2D235
MD5 SHA1 SHA512 TLSH

Submit Download

update_success.log

Path C:\Users\Admin\AppData\Local\osu!\Logs\update_success.log
Size 6KB
SHA256 dd9e1707da8e327b499138656208d425aa0d956474b7b769d695a41f1e2a6326
MD5 f17a2c2e8a5cff7043f40a32316d21f9
SHA1 bd1105c9bf9172ef297c60901c839339855fd0fb
SHA512 0f48fece398671011eebd47ee071360acfdb59dba0336086bc9133b659f4f6905390f8b00c65721c51d3d48f74cccc7abbd815101a622219922438d9afd2d211
SSDEEP 96:MQW3cVsiYpI+hU3NrAiKrCu6mXheDEeq0jRsmR8h:VsrU39AiKrCu6mXheYBh
TLSH
T1AFE129298028D06F3F851756E3192B1C5F3F60E36A2CB1DDBB35A2BC120D454DE6E966
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Ink.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\Microsoft.Ink.dll
Size 456KB
SHA256 1081255de41aafd51bc8f4e4404ef02209e59625ae65fa926657df5690716c5d
MD5 82d4ee89f4a39c764fa6297a95ebb10e
SHA1 87b1f581ad017bf62604d8071a23fde8b81550e1
SHA512 904fd99f7d5951a23af202fceeade044b6d4f40c75db09d0237618ff80b90934ca4ad3210751f6e5bcad71b3a4131e24d420e94292bcfb7acbc3490ebc844382
SSDEEP 12288:X2LyFEvOpwDK9MHGBYbCV0/e5gTaN8XWRIrhGrQFaeyK7+ZkH61Qz2h8fSdILuph:X2LyFEvOpwDK9MHGBYbCV0/e5gTaN8XG
TLSH
T154A42801379C2235E56E97BBD2E62675C3B1E5162916FF4978CC22E60D237528B033BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenTK.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\OpenTK.dll
Size 4.2MB
SHA256 b415f3e061d9758316074dcbf31d6dba48cb0b89405254db94ead0e43ed88511
MD5 b4d949571134fc3ec6c28f1af7a75e49
SHA1 07eb5685ff4f19ff8ed466c68c2426e2ead69241
SHA512 7abb1128d4f9312ec714f7d3f4e1d1ce12a6f93235d6382cf25c39dae0d7d88b5ad5141f512659c33cf57a762e14711b6b690b33da7d16c7d7be35c8b292131b
SSDEEP 24576:gGg1QKR0dSMIK0v6FMF2Y9JhGtZuD1/TMvXgZ2j41WEfyj+jNhlxZ:UQ1d0K0jT4L4htPlb
TLSH
T18B160759EAD6087BCA972E7E906304433136966B5B57EB3BA047D37C3CC6F642C1A1C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avcodec-51.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\avcodec-51.dll
Size 4.2MB
SHA256 e512fe71775f767285cfb3310d8f1ac042639ab3d1a02ca3675b82cfd3cbc702
MD5 b66478cc0f9ec50810489a039ced642b
SHA1 992ede70f0fee5cb323b4b810cc960bf2531875e
SHA512 ed07e71fd6bc2bd9f2ada8b8d6aa80662d6ffadce7d692f078e9ccd8ada2ba47b0e25967809f567fb93ffc96271037f010a0038bb78301812a75e30eee9b2645
SSDEEP 98304:UyIwuFFZZqniDGDHt+elelHjzMvIOFXEkGP0P7g+r0ZpSHA23yQ7D9cpTZY:UyIwuFFZZqniDGDHt+elelHjzMvIOFN1
TLSH
T11C265C85F6A380F6D8470C71902FF37F96392A08C525DFA5EFC02F59F9A2B529856306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avformat-52.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\avformat-52.dll
Size 711KB
SHA256 b155e2bfce3adbbc45d01ec991160ab4fab7e8d33a0ab835463da860d3693867
MD5 c00b30289cc427caff97af5aa3d43e03
SHA1 8e70885a62b0fe510422c2367b1f6de489b67e6c
SHA512 3a70161a5adaba0101f2d2ca1522b1e71d04079ad15cc87a030b00c14b45df9545d5cba55101e25d9bd101769edb87a8e4d893125780e86fa2551290ab720860
SSDEEP 12288:AHi4xW+FLd874nWqfUMSEEmjjUy/M0gDJdvm0yfwea:AHi4AQd8sWCUNEEmjd/M0g1d+0yHa
TLSH
T161F45B85EACB60F5DE0B0C31829BF33F9B259702D420DE95DF986986FA33E62541E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avutil-49.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\avutil-49.dll
Size 77KB
SHA256 e51523f179a8ab8101eaa3e587c5e1dfe6c19636ecfa582896833f06d2e79064
MD5 47c83b958951331ba409d6b80316250c
SHA1 ce14566676a27a0899079781a41888a2f1303127
SHA512 58408238279126e2b478a2f7cda513e5b5908140cc615f271e2baea7a2fe59046f51040406adb86194cc168ff4bc9ea2ca92834b9d90116f9ceb2384a4325896
SSDEEP 1536:qVNjo4PqJXpzUv8e8wyqQwFBo2xDCkCj7TjQiK1WXiHjQi+WXiU:qVpo4PqJNUvIYDBo2xZCL2g4mgV
TLSH
T112737C89FADB10F9E9174E3081ABB33F9F3163018420DDA6FF90D406ED67B52A62554E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bass.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\bass.dll
Size 125KB
SHA256 67766e574baa86eb8317623acc2957e8e28944bb801a8c10a0fa9d29fdb4cfd3
MD5 7623474a8b9bec1e3ffca813cdf93bc3
SHA1 4a1c0ecf8cbed18d0472136a7096ee8c3c2fa774
SHA512 b7e7205e48eade918d63b483fb500867cc8196496fe9136f0177481d654a67af8319b6823fb04787e4bd6ee46c031c2b6fea57f0bf12b8a58cf8e0003834bd7b
SSDEEP 3072:er+5IHiXfBXJ2omnEAOUqXfOq5Nny8+qvUFjuvQniIGwFE:A+5IHiPBJsnyUqvXNZjvKC2Gv
TLSH
T1F4C312B5CDFA60E7C28F45361071E05407F4FA649E428EE16ED9B508C9FE2F1AC1879A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bass_fx.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\bass_fx.dll
Size 50KB
SHA256 81111a1cb6f8f362cf232e21098c563fe1409160300f2a254f2a1762e5d4db04
MD5 3ad3c0fd4dca001a2f9e707b74544919
SHA1 c6176415ecd3e8f38f976e4234325452fe1fd2a0
SHA512 436dac92e4a60dfc02c8c7a7ae496df7199c3fd15ef668bff2565f428f25be9c3ae1d0e120d64767eda1a9d4afa2e8bfeb6d047745440c3fce854080c44f42c5
SSDEEP 1536:Exe5ceArKXVX7XDZjQi5IWXiYjQizUWXiO:E05i4XrDZxIg/bUgX
TLSH
T12333CFF56D786554DDA24E70D4D98A23FEB032914FA808EB2498C0571ECABE1BF2D11F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\d3dcompiler_47.dll
Size 3.3MB
SHA256 efbdbbcd0d954f8fdc53467de5d89ad525e4e4a9cfff8a15d07c6fdb350c407f
MD5 c5b362bce86bb0ad3149c4540201331d
SHA1 91bc4989345a4e26f06c0c781a21a27d4ee9bacd
SHA512 82fa22f6509334a6a481b0731de1898aa70d2cf3a35f81c4a91fffe0f4c4dd727c8d6a238c778adc7678dfcf1bc81011a9eff2dee912e6b14f93ca3600d62ddd
SSDEEP 49152:PyZ9lnpmVm/w+EwVOmufvkQS8MH2J9CqS5Sqr88pPWW5KhQYPsXqUiQ6:E9fWAwVBC8MH2JNSF8+YPsXqUT6
TLSH
T1DFF59F21F701C077C8CA01F0666E7BA6257C9B75033945C762947DA9EC702E32F3AA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\libEGL.dll
Size 146KB
SHA256 041a631d114e45a11c43efe3b7712a10ce8052cf4b313c7f4577a5b9adb78072
MD5 9f7f22cef980ec272a9b73bf317500e4
SHA1 ae11d7cdfa84a242e31efd6f03b0ef764d5f900c
SHA512 19e432313c1e28fc076fb9e9c3884c3c97cc2d05b6d1aecf429180a6f5cc407734fe758bcc63936d5fe7ef8ac01abdf5ec4b17bb08b26c5cc87c560f4b89c5bc
SSDEEP 3072:AQpSfKDSjkC6G3a3xX4k6es65psG6gX6gr:AQpSfKWkCDeizA
TLSH
T1C4E35A0175E84030E4FB427A8565AA120BBE7D66DF268EDE3BDC4D4D06785C1BB39B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\libGLESv2.dll
Size 3.2MB
SHA256 cbfc536b80405da7b5c37c97fceaf2310daf58d78c806140367b8f513352342f
MD5 a4dfddff62d1e917ebb0688cf8d96be7
SHA1 9376bfa069a72da76733cc72cf90386920815142
SHA512 97de24a94f7aaaf3035853c0eb93f44c5c2cdfad99b563fef225d9f2b6f4fa3fe8f89850895d286322191cf8b372aa87da6620796cd32fe368f75b6722b556c3
SSDEEP 49152:lnXliT77777777E377777SaTm7NCO7777ovwwz7777777y0pIyRTNEClTRyAlllD:Eg9TOW05n16Entwr
TLSH
T1EAF55C11BC408275FFDA01FBDAFC3E645A5C8664032E61D7D69C0C996BA07E32B71A87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!auth.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\osu!auth.dll
Size 15.2MB
SHA256 d30b1d334a8b2d9e833e48a657ff1647a74f96b49d296522a4979428db1bdc22
MD5 c2d76f1da2e31b6c39b22625482800e1
SHA1 a3e6a0210091d43a3c1f811a2801b228467302b7
SHA512 8731d03dfaf0766d8fc960e2a8fdb58865dbdc775d5a12095b1b227f5c7319e74cdd7965858ae1e7c31502d1017a34c145420adfd7a4b1a91818110e04a97a30
SSDEEP 196608:AUpUpSGKY1fQkBUmiY99mp/EFnbMFZWeSsShR/4nFzkhKTre0JefDxIbtu70lPuY:AQK1BzBRiIaENirFSr6p3HoSEYlPuLU
TLSH
T1BBF612E13A0DE1FFD00F1A798516CF11E96C53F045118A57FE9A353E6A43F82069AE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!gameplay.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\osu!gameplay.dll
Size 30.4MB
SHA256 ba3467a8db908d81a0729f78fdc5c8f1d1595d3da4e5a9a34be9a16e06da9f87
MD5 4cb98d63f1b2b9dc38e10e9901ec52d8
SHA1 42c0e8b8e5c7a4113e38a977221f845ef8406722
SHA512 d351b9ff851490187b003c675047b6a20a2519df3818bcd18a674d6edab1d211c9661acc98403b562ff3268576ea203b4e0f10e962467b9849b72431c92735a4
SSDEEP 786432:zKhRG6tozgdXGWZlwECKH22SkMu/7WHV0g5QQw:zKhRGSIgDVW2hfK195Bw
TLSH
T13E673352F0039694C96F09368CA2D5805B223AAEEE52052F706CF715B4F32177F67ABD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!seasonal.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\osu!seasonal.dll
Size 3.5MB
SHA256 27decc7e0c959078325eb800b04626d6b9498b33cf118850c0e7b78dea470500
MD5 d21d49248a8bc1b881ae21e6d78e62ce
SHA1 d797bc15640e5d9dfa3f8b132560097ed47a2c9b
SHA512 73e2d89d8d9c0c39b1d33c2700d0e20564a9cb532156c96c0a5514e6e03b6691bc08f060b4364b7a6f29421f098b33ed7aadd22164c96431162ab7928794c522
SSDEEP 98304:i1Xtu2mhrI+wKURZmFLBc0oir3jh+6H4C15FI2AeSF:Otu2mxcjR+1boW86Hb1PI2e
TLSH
T14A0633AECD8CA56BE603777450DEE994AD39333FF94F03C8DC54A6681A18B805619F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!ui.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\osu!ui.dll
Size 24.8MB
SHA256 22e041674931161e2c2c15241fb6c5f3125f8d57e4660ef7c0b7fb64449253c7
MD5 6448b4b0a3ec3a875f850a502fd29213
SHA1 ef5e46ac0947f815802cc6601ab1c4a344f8db19
SHA512 629397961e97e8bf68dcabfa768ce658769310415f1c2f9a3687882cdc978ab746c7477deb80d95675020cfea243b5b8a81f919c048d8a53bbfbeda201d0a534
SSDEEP 393216:+weL9xcZy55AfilHOSrGRWPxe/WGfvWJmaHQILW6UFoMMoGHTkuBZOq5OmlRkkf:6rZSfKOZRWPs/WG3V5IS6UFFtIgi5
TLSH
T130472247B30A96D9F1521A360866C656C720BD0C6F1207DFFA6EBF28E5732851F2371A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pthreadGC2.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\pthreadGC2.dll
Size 75KB
SHA256 b18c8437663002e4a4f06c4c1b7bec71fe13e5e6bbb927c68a273de02a5c690f
MD5 00678eb6be3b52d562b66218c93e21a8
SHA1 ba583d1520da22f3d3b89196c981279ecda58648
SHA512 58d9ffa0f569ba7b1aaea62b49f5bfa18bf23c54d2487eb9e4da984469236c2d4baabeeeac7e4b71d66b8c30f7fff4890fee5ee25e00369fc4afce053cbeb048
SSDEEP 1536:foAm0g76WsZmEZDIMiH3YNK4ajT+Aa5QEajQi1vWXiujQiaODWXiO:Qh62MiH3YN8T+Aaba9vgpDDg/
TLSH
T18B73C9D13AA95CE7E5601A38D5E6D362793BF1E017138B13E334D4360E9AB81FAD421B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!.cfg

Path C:\Users\Admin\AppData\Local\osu!\osu!.cfg
Size 856B
SHA256 d037fe50380998945e319279b06903c9336c304c0b9b47e8e89d3292c76fb6b4
MD5 c558fadcd41d7ef64919fce4be7aed30
SHA1 9b6dac5d6332cdb84f48a2ed53d3ac17d7cdc0a7
SHA512 78784121fe238db9599f4d34fae15ed5a88b37fa6328180499c573b5a879241da7ea602a83399a7ce52fb0c51ccffa2d370de635d0cc7c686dfc6d5f467b17c0
TLSH
T118115E1C611CE3823D6C21684B2E897E30B8C4D3B2BEEAFEC5E0439978472CC8002D08
MD5 SHA1 SHA512 TLSH

Submit Download

osu!.exe

Path C:\Users\Admin\AppData\Local\osu!\osu!.exe
Size 4.3MB
SHA256 3adc2d001aacced5f92ba8ae24121980d5e23f5653f37d14cf4765bca1abd9f9
MD5 f845ef10bf97c3260b818fc02e73e196
SHA1 ac17e56fd28d86ff0b5f7d520e17d7237fde3163
SHA512 814372403fb942ba63c44ce1e223ed7fb7c54b136bb3b81b377457da6195c638738c9446d675070b9613ede66fde7cb95caedd36af13315370ebc892d42fc0d4
SSDEEP 49152:UvmS8LTfZMBXdUxmZ0ixDej4V1/i5g+7Z16rPZrpzRXJJA+xaQRfvWtxRxpDOhG:Uvl8LwRZjJV1eFH6lbctxRxpDOhG
TLSH
T1BC268C6067E48E3ED56E87BAE495190663F5CC88B7C77BCF6829B97028B7345180334B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!auth.dll

Path C:\Users\Admin\AppData\Local\osu!\osu!auth.dll
Size 11.3MB
SHA256 d1ce5937f2edfd416437dcd7f2832ab8520fdbca1b1619b85b6c6893183da5ac
MD5 e9550d61114d5682a3481393ed89b0c8
SHA1 3e5e218bfcc99330607612943e66551e0d3ebc28
SHA512 78bc27b1ff29a2d64eb0a03a07435e2b64d9a47c40157978221484324476264a85362926121018e5644b51ec5b0125148353ac25f0c9d649de5d841a241a339a
SSDEEP 196608:AUpUpSGKY1fQkBUmiY99mp/EFnbMFZWeSsShR/4nFzkhKTrm:AQK1BzBRiIaENirFSr6p3Hm
TLSH
T13BC602E13A0DE2FFD00F1A798516CF11E96C53B045118E57FE9A353E6A42F830696E3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!gameplay.dll

Path C:\Users\Admin\AppData\Local\osu!\osu!gameplay.dll
Size 17.3MB
SHA256 8b9a1c3257d805af5f28e72ba497842c4e3513b7ee469f4507582126c8f62168
MD5 1c91ff10616267164bdb293be7b78adc
SHA1 d42df5ecada6f6d1c2a137e928684a1853c177a0
SHA512 4ffb81eb9f9acf11366dba33c1d7843dc467ba61a56dedad4ccbe1185c24ff7785f56645d93bbd122fffed7376ec26e22440011d380ef424698038f26414ad11
SSDEEP 393216:P06KhRGlMtoB2F8uDdXGWZlaGCECLTYByjKy8x2obSZ:zKhRG6tozgdXGWZlwECKH22SZ
TLSH
T1F1073362F10395A4DA4B25328DA2A6805B223DA97E22051F754CF305ADF331A7F57EFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!ui.dll

Path C:\Users\Admin\AppData\Local\osu!\osu!ui.dll
Size 18.1MB
SHA256 d12c2c7722b7c25faf797b4a55796ad1484a942539173a1778435d1f26745a6b
MD5 eb6e3be838af0682d9e6da57a2705ede
SHA1 cbcc8260b0aeb9fd6347701d5d2d4dcd78d044bd
SHA512 6b2f6057a27baf8e3c0520fe65dc4bb99c5d68f431916d0d959980df75e006451da682b3ebd829e8fdbf267116ccd1ed0948b7e7252346733fe37bb2ecc20ffc
SSDEEP 393216:+weL9xcZy55AfilHOSrGRWPxe/WGfvWJmaHQILW6UFoMMoGG:6rZSfKOZRWPs/WG3V5IS6UFFL
TLSH
T187172252F3428B1AF2520E395D21D771D765BE04BF164BCFB1A4BB2CB8732861F6061A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/344-60-0x000000000A0A0000-0x000000000A5CC000-memory.dmp

Download

memory/344-61-0x000000000A000000-0x000000000A022000-memory.dmp

Download

memory/344-62-0x000000000A680000-0x000000000A9D4000-memory.dmp

Download

memory/3064-360-0x000000000D4F0000-0x000000000D844000-memory.dmp

Download

memory/3064-359-0x000000000D880000-0x000000000DCAC000-memory.dmp

Download

memory/3064-356-0x000000006F650000-0x000000007058C000-memory.dmp

Download

memory/3064-344-0x0000000006B90000-0x0000000006BE6000-memory.dmp

Download

memory/3192-0-0x0000000000330000-0x0000000000786000-memory.dmp

Download

memory/3192-15-0x0000000006430000-0x000000000646C000-memory.dmp

Download

memory/3192-16-0x0000000006950000-0x000000000695A000-memory.dmp

Download

memory/3192-14-0x00000000051D0000-0x00000000051E0000-memory.dmp

Download

memory/3192-17-0x00000000051D0000-0x00000000051E0000-memory.dmp

Download

memory/3192-32-0x00000000051D0000-0x00000000051E0000-memory.dmp

Download

memory/3192-2-0x0000000005280000-0x0000000005312000-memory.dmp

Download

memory/3192-1-0x0000000005790000-0x0000000005D34000-memory.dmp

Download

memory/3192-33-0x00000000051D0000-0x00000000051E0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads