3adc2d001aacced5f92ba8ae24121980d5e23f5653f37d14cf4765bca1abd9f9

Analysis

max time kernel
24s
max time network
40s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 22:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
osu_.exe
Size 4.3MB
Sample261020-2xshxsys4k
SHA256 3adc2d001aacced5f92ba8ae24121980d5e23f5653f37d14cf4765bca1abd9f9
MD5 f845ef10bf97c3260b818fc02e73e196
SHA1 ac17e56fd28d86ff0b5f7d520e17d7237fde3163
SHA512 814372403fb942ba63c44ce1e223ed7fb7c54b136bb3b81b377457da6195c638738c9446d675070b9613ede66fde7cb95caedd36af13315370ebc892d42fc0d4
SSDEEP 49152:UvmS8LTfZMBXdUxmZ0ixDej4V1/i5g+7Z16rPZrpzRXJJA+xaQRfvWtxRxpDOhG:Uvl8LwRZjJV1eFH6lbctxRxpDOhG
TLSH
T1BC268C6067E48E3ED56E87BAE495190663F5CC88B7C77BCF6829B97028B7345180334B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
5564	GameBarPresenceWriter.exe

Executes dropped EXE 1 IoCs

pid	Process
2656	osu!.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	osu_.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	osu_.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	osu!.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	osu!.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	osu_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	osu!.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{C7E6E176-B5AC-4B51-81B8-F11DD884B24F}	svchost.exe

Modifies system certificate store 2 TTPs 13 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 6b0000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd20f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	osu!.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254836b0000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd22000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	osu!.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	osu!.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	osu!.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	osu!.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 6b0000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	osu!.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112866b0000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef4200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	osu!.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2	osu_.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 6b00000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12700f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e0b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000006200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	osu_.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c0000000100000004000000001000001900000001000000100000009f687581f7ef744ecfc12b9cee6238f1030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2090000000100000016000000301406082b0601050507030306082b060105050703086200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12700b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000000f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e6b00000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12702000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	osu_.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B	osu!.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B\Blob = 0300000001000000140000008d4c4a23ba9ee84ea7348fa98cc6e65fbb69de7b140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d46b000000010000002000000038392f17ce7b682c198d29c6e71d2740964a2074c8d2558e6cff64c27823f1290f0000000100000030000000a768343c4aeaced5c72f3571938864983a67ed49031c1da2495863caf65fe507011f7f0e70b6cb40e5631c07721be03419000000010000001000000082218ffb91733e64136be5719f57c3a15c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000820500003082057e30820466a003020102021067def43ef17bdae24ff5940606d2c084300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c050003820101007ff25635b06d954a4e74af3ae26f018b87d33297edf840d2775311d7c7162ec69de64856be80a9f8bc78d2c86317ae8ced1631fa1f18c90ec7ee48799fc7c9b9bccc8815e36861d19f1d4b6181d7560463c2086926f0f0e52fdfc00a2ba905f4025a6a89d7b4844295e3ebf776205e35d9c0cd2508134c71388e87b0338491991e91f1ac9e3fa71d60812c364154a0e246060bac1bc799368c5ea10ba49ed9424624c5c55b81aeada0a0dc9f36b88dc21d15fa88ad8110391f44f02b9fdd10540c0734b136d114fd07023dff7255ab27d62c814171298d41f450571a7e6560afcbc5287698aeb3a853768be621526bea21d0840e494e8853da922ee71d0866d7	osu!.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	osu!.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	960	osu_.exe
Token: SeDebugPrivilege	2656	osu!.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2708	OpenWith.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 2656	960	osu_.exe	93

C:\Users\Admin\AppData\Local\Temp\osu_.exe
"C:\Users\Admin\AppData\Local\Temp\osu_.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:960
- C:\Users\Admin\AppData\Local\osu!\osu!.exe
  "C:\Users\Admin\AppData\Local\osu!\osu!.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of AdjustPrivilegeToken
  PID:2656
- - C:\Users\Admin\AppData\Local\osu!\osu!.exe
    "C:\Users\Admin\AppData\Local\osu!\osu!.exe"
    3⤵
    PID:2608

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:5564

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:5976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5080DC7A65DB6A5960ECD874088F3328_BC00434159DAE8351451CCE9C748F5D7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_BC00434159DAE8351451CCE9C748F5D7
Size 2KB
SHA256 9b2b6af033da236284fef4378ed8fa264cd9b2895ce6e71c0f3c0fc57bd89110
MD5 040aff508398d598e4a4087d0c3906ba
SHA1 e0b778d96b08a2f5ab785b528179a33e6ff01849
SHA512 60b70bcf0cba40b4a4a8738651ca4ae6da133429493df111164a15d643835723f5fa293215dbbab1b67d309ad185e0c7193f1f847c53b5fd43a325a456abd482
TLSH
T1F341E85289B43440B662DF056FECC63B3CB49DB125A206E134E6C95A9C5CFAA8A8006D
MD5 SHA1 SHA512 TLSH

Submit Download

515195B826B230146D00BC66A056A7F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\515195B826B230146D00BC66A056A7F8
Size 20KB
SHA256 0d95e1960a487f4b2c3a45be8e811f8c7b9488610a0932b59d552a9cded9ede3
MD5 25466e045724b4faafd2466e19e2be1f
SHA1 1e3b2b3b0c4e1b550128841e8098e9b4297f02cf
SHA512 19529aa7bd2111401dff378a1b28b8679c6304e1645e8d72ec63755bb2e155e1891b25c52c79c3f5e1f95fdae036acee956c7e96a83c93cd478ee4c03c61a317
SSDEEP 384:NhLwqdD5rtNYHH8vZprwyVRC3onACwX0WJw8:/ndTNFBp/Vk3onArX0Wi8
TLSH
T103A2E9FC6A1CA6A750C5AA31CACB9FD3D8F551A53BD1E11F05B55EC80424EC3CE97282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5A6896595A9B5FF7A8254147F2B2367B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5A6896595A9B5FF7A8254147F2B2367B
Size 22KB
SHA256 c7fdecc636e57a8b57fedf225172d6b59bc3e4ecc38c03bc9f1e0dde35960c59
MD5 7baceef700d25bd78cbcc7d01c03b0fa
SHA1 5aeb8b738bbd5a1ee1bebc17a736d4a27bea6e40
SHA512 06addedba45980afd0b21a4c3be7a1c1e7669804add1a445d86cd393ec0e0037a0ae7c8baeffc36448d4585b7ca670d679a4c2c9f6ed33af2b399529683fdee9
SSDEEP 384:Xpmu9beJjn2FN/vNoNyO+w6R60Qlx08Vzktp0:XpbfN9osR/QQ8F0p0
TLSH
T111A2FBBCA95CAAD741C66A71CACB9FE3D8F511A53B91E01F41756E880420FC3CE97782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
Size 1KB
SHA256 b8d6feb626b1acfdf5fbf1eb274e89ce97734e0b4f182c7b3451042561a31dab
MD5 0f798982b8d63b038dd7fc49402b67db
SHA1 fdb00b20c4e14753b6a8dd83c66e9b5ac1590c31
SHA512 e5a16440d5c7d9c2ec10bf14cd3c99f60857d2425d6a0db19cac349f706a45998b7a42fcb1ba5cada63679cd611e242a8e95bf32a1e42ec50111775648003613
TLSH
T16031C9CA889528893E0F549203C0CEAA3C74DE925D44435D28AF43AE0E863F76612749
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691
Size 1KB
SHA256 be4c6d71ff28f6c17839dbdd5d6cf62b55601ef205a82b4e398d42db2c35c6d5
MD5 198f44cc36948c339e5c9705f9d1e21c
SHA1 3572da87dc05ae075d113a43b7e212cdeffb65ce
SHA512 54f48f4d3cb5e374554d3bc44e374cc721f4346a7a556fd4c9bc2f35e887851560223d3327edafd101167a8805906ae67507616d132aa89d28353f16be751620
TLSH
T1B131E6E3ABB87E01ED095CC0AC5F4F62ACF070B6B52158BC38A9811AE013FA4588C90D
MD5 SHA1 SHA512 TLSH

Submit Download

D2B5168CDD0EBF4C0C8EA1C3A1FAE07F_69320653974E97D8129B19E9D4DB56AA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D2B5168CDD0EBF4C0C8EA1C3A1FAE07F_69320653974E97D8129B19E9D4DB56AA
Size 509B
SHA256 e787d8097fe0e18cffd17b9e5cb311629bc63203554127c35f85ff6eb06aac0f
MD5 e356c47de4a48513048bcf09ed1e3714
SHA1 05d4c3a02473a30a8ec3786ac816c32c6ee26c67
SHA512 470ca0fe89a94d7ab2aec87ff72c6ec4c102606216078b9e29ae98e275803b009403d81cc2584d4f3326beaaa8f86b28008022923b05dc88a97df8b96fc0ef1e
TLSH
T171F0C0665D752480E852DB881A7DB1062C41B8E057D04846994C64AD4D4D3E6AB50C1D
MD5 SHA1 SHA512 TLSH

Submit Download

EF7234CDBB1649702229F955C785C39F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EF7234CDBB1649702229F955C785C39F
Size 785B
SHA256 9e153cc9331fb887cacd6f08cfa3dc5aac7b9b26b4b9cfa75d2ac57288e9142a
MD5 13c624bbd9ad9ff627a68b5ced19b228
SHA1 ff158247f5c6bf41d5fed9f3d756b82f735a24f6
SHA512 62251f6fd12706cc3b90b738523a3a32c34b104ed967b0f42da80596fe0a3b03a27dbbbab144afff619c4a910558b2f8f6f6f223f4cc65bb288f7516bfdb7068
TLSH
T14A017561A8BCF3844DA11BD603F4ADA559B407F6294CB2672437A1560562B53EF28129
MD5 SHA1 SHA512 TLSH

Submit Download

5080DC7A65DB6A5960ECD874088F3328_BC00434159DAE8351451CCE9C748F5D7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_BC00434159DAE8351451CCE9C748F5D7
Size 490B
SHA256 c599a7143875b2e4ad3f9cc3b081a3c11b01ed5335c559668ad024809a7cccbf
MD5 7d9c281c2a1d52e68b2a695709c9dc24
SHA1 862df746c82106c372490267fda6023c2adcf5be
SHA512 73c3a002198490c98bf3404556a1065f41b8274a9bc9cf72009db0aa8be612dcb047f943c5f5c705d188bfa8662605bd424cfcd62f21ded273234bf160358fdf
TLSH
T158F0AB3025F6046CD833D0BACBD662EAD8BDB326742216BE45A20B0E26079430F43218
MD5 SHA1 SHA512 TLSH

Submit Download

515195B826B230146D00BC66A056A7F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\515195B826B230146D00BC66A056A7F8
Size 290B
SHA256 656d2a3285d0c35093f0cf047854470330f9c69806b45228571148b4084f73a2
MD5 b93be132d38ac1d579334abe26cf0a8d
SHA1 a61277004b74afc3844c6ae88d820a0ff70e24c7
SHA512 b59edc830e6c43b9b020af6de7451a287e43c6306d1bbc8366da869bbef0a505d43f3d870cbc2db9e589510191739e04901f0e16a39aaa24c8e36229bcb910df
TLSH
T19ED05E18E3F50611E090857E9AE019A7B979792A860583480BF2830C3538E5AAA71B13
MD5 SHA1 SHA512 TLSH

Submit Download

5A6896595A9B5FF7A8254147F2B2367B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5A6896595A9B5FF7A8254147F2B2367B
Size 290B
SHA256 7bad92873540de707f20cbf68f0108725526f58481c05ad0305f8654916b2f64
MD5 dd98d07b05d3ed4e3f5e419f43363bc8
SHA1 0c0f9be35db322e9e9327bf91c0b720e77d5fefa
SHA512 1083f3d17389f2219f878584830d1cab56cf979d870b35e31a54a8d5bfeafebd128995dc3b4c9cdf644bb3e9bf795b29c0c8bec03342569fd6e0c83dbea2eb62
TLSH
T1F2D05E1D97B50711F84086BE5DE01917A9767C29951283491BF2C30C7428E49EAB1713
MD5 SHA1 SHA512 TLSH

Submit Download

77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
Size 422B
SHA256 66703cb9a4eb4bfeb3b13112e9a0f3812c366325983aab1574ac7c3e96aba039
MD5 0f2179bb3e9ac387bf14d4b52ef7c8ac
SHA1 80029c029a207e7b0cc644c8c669266dadc2f443
SHA512 21897a6d2547a3e22889c74ef12bce9856e9f3c80d42a034b7ffde7059dc3e9142e2e53aa283f46d4787763c947e6ca9c99841fbe60c2ea6456e30b9742c2c0d
TLSH
T1EEE0681024FEC118E7326D390B9F963F493BF313180C5BA66B600067680AD01CD34B22
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691
Size 486B
SHA256 2632c560df7323ab8101f87c498c6fa5b066638c823492f484198e1e0637e0c4
MD5 3dee87c64d4eb5463af643e35998cbda
SHA1 f661b05212dd81f71577f6a727056df9fc43a029
SHA512 f4dfd51eb0a3662ad9b75722b892e352a2b44cac00277e437964b4c8ad59f73452d3ff72b271264e32229fb2e3b966335dbdc1262891806d8c4e03fda46149de
TLSH
T137F0232811F9203CF07BA9340FF4B575CD78F200200151EA11635A086A02F410CD0C2E
MD5 SHA1 SHA512 TLSH

Submit Download

D2B5168CDD0EBF4C0C8EA1C3A1FAE07F_69320653974E97D8129B19E9D4DB56AA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D2B5168CDD0EBF4C0C8EA1C3A1FAE07F_69320653974E97D8129B19E9D4DB56AA
Size 498B
SHA256 ec660fb6e8a3363ceb190f754d683cfe883e2ac1df0fce8919ba7fd2e9250ded
MD5 a9e876c19fcf473cefbaa493bd02f4ce
SHA1 80c098dfa854a8a1723a2520bf64e5e23219fd13
SHA512 1533f10f020db8f5ea4c1484ddab002d0d00d6a9dd23ea14c7a7e90b57cc2d39da0e9ef3e9fb25eacf0315784cc2d64393e8851d63dd25894e712cf3dd0da127
TLSH
T1F2F0AB283DFF109EF536CEBD05C9F167DD64B20320005A751A912B056A4AFD47E83A25
MD5 SHA1 SHA512 TLSH

Submit Download

EF7234CDBB1649702229F955C785C39F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EF7234CDBB1649702229F955C785C39F
Size 308B
SHA256 e4905b267e34706a1d47f036e2b9b886941ed45e2cafd2e19d7cbf21e016c756
MD5 1fc025116aeaefa810645260e2393edb
SHA1 e861d786b0e58fda4e7e4f30dca2d209de712aa2
SHA512 424bd2637f8155461523d8622925eec205258b7b91ba2bb7d41a11c68381e5efb1f1ba217313a0a97b863569bc8b320d3c1880cbcc1428d673eddc509926c460
TLSH
T19EE05E1CA3F90723F4D0C93D25E424177A35AE548A04C3490FF1871E787CE81B920B13
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\osu!\Logs\update.log
Size 4KB
SHA256 7f6183b9f7152856c63524779adabf9619bc9384fc6df3534f59f72e141fa45f
MD5 b5a58daf91e516f4401af3c25d70442f
SHA1 de0b9a6517c534da863a398c6c4d2309a0ea4fbb
SHA512 c2affd8d8fa1e759753376fa4018799def6c08bd5beb2aaff41c488fdfe86fd0c79c506786ee8b63b6d5220666476ef09d473150c645898b969d07a1df1d20e7
SSDEEP 48:36vJAP+wpRHLDXP5HBgAOtBP3WNXFtdIDxYyErZfSnapGlZt+o1LSma1pfjp:36v++w7hFtsaLfjp
TLSH
T10B8127294529D16F3ED41717A3683B0D4FBF20E37A6CB1DDBB74E2AC2A08440DE6D562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\osu!\Logs\update.log
Size 370B
SHA256 44d5a392ae5431abd4e98989a7d8e7d6012c8515c4fae5c8323f41ece814a7b8
MD5 d0a38bb06a7ec96121350c7d577ca8dd
SHA1 c537c3ca59eb8abe9bdc01414b7f834655cefc51
SHA512 d5fd0990a04e57f22ed5c9f9ee516dd2276d286b47e1d22c287fc84f5f41c73dd92943bb4f48c2e45e895b9223e27f8ce8a5e30b9f1bbcd48a8df753bfa2a1f8
TLSH
T12BE0E5118161E0AE7EA1439282887B2C4FBFB4F7B60D30DC7365F2E812090048E2D934
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\osu!\Logs\update.log
Size 616B
SHA256 de9ddb234c295258e38c9dd7dff7fc0a697dd789951686927a66deb86cb4f419
MD5 4473396f979fd61e67332b2d1a7eccf6
SHA1 ce1a2426a0ee17814db3d9f3624fafed924d2684
SHA512 facf6c8e40ea314b714c60c2ae0660fa67f34131aa7fdc96f49e32fa16a6871c36bcd09e633bcac7d29b7e5d06980a81eea052d8bcebf3e3cbcfc1399af4751e
TLSH
T1D4F05F15916AD06E7E62438242487B5C5FBFB4F7B54C35E87339B2AC2209054CF2D978
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\osu!\Logs\update.log
Size 3KB
SHA256 38b6af1e5c7cb98f0c584c04d3dc76ea9314be30b64ec44ac97b622f5f51426d
MD5 a0eed0fdc1c4e8fcc9cfc4972ce2da07
SHA1 dc674ddd2a37eb6e2f686a5d036b9a7c463d367f
SHA512 bdde63be430e153c0c17e1f4f010e7372a0e0d3efe404a42f6b5da2f48ad26bdbbdb2d1a1b371a54d0352b7087b1612f0efe99aecc7247d99bd7cfbb5324a3d9
TLSH
T156711A694529D06F3ED81713A2683B0D4FBF20E37E5CB2DDBB70E2AD2A09440DE2D561
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\osu!\Logs\update.log
Size 325B
SHA256 5c53084c43b39e0e2a5f38ce6dffdbb74bc11b545d5b7ef90d2520daf39e853a
MD5 af6e485b6e5cca2a38e84e97ec1225df
SHA1 6e3d364a0e248a150bf5c12763a4f40b41e4fe9e
SHA512 610942d6c1259ee9d2e09453881ab3b4cd7cd385ed5c9e2b1d2fdb5a44cb279bd60fc1d75c5cb94adeda297517d7e33179e90ccb4e0e750f7c149b33ab32ebec
TLSH
T1B6E09229A160A0AE5AA24A5540887B28CF7F34F3220CB49E77659AE0020E1048E3E534
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\osu!\Logs\update.log
Size 583B
SHA256 4d7e2cbc3ec6400dc9b47b041e7468e47306f57f1b8b7199f133d00bb706c18c
MD5 41fd6383cc5020e6ab63153befd2966c
SHA1 20b84673adc106f86ba098399a2b5f34795508ba
SHA512 a767ceed6d5040c88e657018bd43df13408a7c13870b00bd460fe592f88421eae8bd15c1379eee46aac648b1d8184b18ce89794e5973c411215b8e6f83a68810
TLSH
T149F0C4696064E1AA19A30B94804ABB28CE7F24F3230CB4DEB369A7E4121E0148E3E134
MD5 SHA1 SHA512 TLSH

Submit Download

update_success.log

Path C:\Users\Admin\AppData\Local\osu!\Logs\update_success.log
Size 6KB
SHA256 523f2f35062569030fdbd8dd513ae4338c9099251e894e0c71af8922cd9139f5
MD5 eb52145a15801511a4ba4ea16fcc7e97
SHA1 cfa3d7218445919bc13d2330459ca2340743a5ec
SHA512 b247373af148b8611b9f792665faf8f577e8a679977c1a51f6714eb568af44d76ccd2e7f2416ac3a3a6673bc830df4f2e0dbd2d98466e101f506f5e21ab47d06
SSDEEP 96:36v++w7hFtsaLfjnhL2TO6kzIONtIBq02ymch:c5aLfjnhKTO6kzIOMRh
TLSH
T1F9E135294029E06F3E852346E3193B0D5F7F20E33A2CB1DDBB34A2AD260D454DE6E466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Ink.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\Microsoft.Ink.dll
Size 456KB
SHA256 1081255de41aafd51bc8f4e4404ef02209e59625ae65fa926657df5690716c5d
MD5 82d4ee89f4a39c764fa6297a95ebb10e
SHA1 87b1f581ad017bf62604d8071a23fde8b81550e1
SHA512 904fd99f7d5951a23af202fceeade044b6d4f40c75db09d0237618ff80b90934ca4ad3210751f6e5bcad71b3a4131e24d420e94292bcfb7acbc3490ebc844382
SSDEEP 12288:X2LyFEvOpwDK9MHGBYbCV0/e5gTaN8XWRIrhGrQFaeyK7+ZkH61Qz2h8fSdILuph:X2LyFEvOpwDK9MHGBYbCV0/e5gTaN8XG
TLSH
T154A42801379C2235E56E97BBD2E62675C3B1E5162916FF4978CC22E60D237528B033BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenTK.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\OpenTK.dll
Size 4.2MB
SHA256 b415f3e061d9758316074dcbf31d6dba48cb0b89405254db94ead0e43ed88511
MD5 b4d949571134fc3ec6c28f1af7a75e49
SHA1 07eb5685ff4f19ff8ed466c68c2426e2ead69241
SHA512 7abb1128d4f9312ec714f7d3f4e1d1ce12a6f93235d6382cf25c39dae0d7d88b5ad5141f512659c33cf57a762e14711b6b690b33da7d16c7d7be35c8b292131b
SSDEEP 24576:gGg1QKR0dSMIK0v6FMF2Y9JhGtZuD1/TMvXgZ2j41WEfyj+jNhlxZ:UQ1d0K0jT4L4htPlb
TLSH
T18B160759EAD6087BCA972E7E906304433136966B5B57EB3BA047D37C3CC6F642C1A1C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avcodec-51.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\avcodec-51.dll
Size 4.2MB
SHA256 e512fe71775f767285cfb3310d8f1ac042639ab3d1a02ca3675b82cfd3cbc702
MD5 b66478cc0f9ec50810489a039ced642b
SHA1 992ede70f0fee5cb323b4b810cc960bf2531875e
SHA512 ed07e71fd6bc2bd9f2ada8b8d6aa80662d6ffadce7d692f078e9ccd8ada2ba47b0e25967809f567fb93ffc96271037f010a0038bb78301812a75e30eee9b2645
SSDEEP 98304:UyIwuFFZZqniDGDHt+elelHjzMvIOFXEkGP0P7g+r0ZpSHA23yQ7D9cpTZY:UyIwuFFZZqniDGDHt+elelHjzMvIOFN1
TLSH
T11C265C85F6A380F6D8470C71902FF37F96392A08C525DFA5EFC02F59F9A2B529856306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avformat-52.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\avformat-52.dll
Size 711KB
SHA256 b155e2bfce3adbbc45d01ec991160ab4fab7e8d33a0ab835463da860d3693867
MD5 c00b30289cc427caff97af5aa3d43e03
SHA1 8e70885a62b0fe510422c2367b1f6de489b67e6c
SHA512 3a70161a5adaba0101f2d2ca1522b1e71d04079ad15cc87a030b00c14b45df9545d5cba55101e25d9bd101769edb87a8e4d893125780e86fa2551290ab720860
SSDEEP 12288:AHi4xW+FLd874nWqfUMSEEmjjUy/M0gDJdvm0yfwea:AHi4AQd8sWCUNEEmjd/M0g1d+0yHa
TLSH
T161F45B85EACB60F5DE0B0C31829BF33F9B259702D420DE95DF986986FA33E62541E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avutil-49.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\avutil-49.dll
Size 77KB
SHA256 e51523f179a8ab8101eaa3e587c5e1dfe6c19636ecfa582896833f06d2e79064
MD5 47c83b958951331ba409d6b80316250c
SHA1 ce14566676a27a0899079781a41888a2f1303127
SHA512 58408238279126e2b478a2f7cda513e5b5908140cc615f271e2baea7a2fe59046f51040406adb86194cc168ff4bc9ea2ca92834b9d90116f9ceb2384a4325896
SSDEEP 1536:qVNjo4PqJXpzUv8e8wyqQwFBo2xDCkCj7TjQiK1WXiHjQi+WXiU:qVpo4PqJNUvIYDBo2xZCL2g4mgV
TLSH
T112737C89FADB10F9E9174E3081ABB33F9F3163018420DDA6FF90D406ED67B52A62554E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bass.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\bass.dll
Size 125KB
SHA256 67766e574baa86eb8317623acc2957e8e28944bb801a8c10a0fa9d29fdb4cfd3
MD5 7623474a8b9bec1e3ffca813cdf93bc3
SHA1 4a1c0ecf8cbed18d0472136a7096ee8c3c2fa774
SHA512 b7e7205e48eade918d63b483fb500867cc8196496fe9136f0177481d654a67af8319b6823fb04787e4bd6ee46c031c2b6fea57f0bf12b8a58cf8e0003834bd7b
SSDEEP 3072:er+5IHiXfBXJ2omnEAOUqXfOq5Nny8+qvUFjuvQniIGwFE:A+5IHiPBJsnyUqvXNZjvKC2Gv
TLSH
T1F4C312B5CDFA60E7C28F45361071E05407F4FA649E428EE16ED9B508C9FE2F1AC1879A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bass_fx.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\bass_fx.dll
Size 50KB
SHA256 81111a1cb6f8f362cf232e21098c563fe1409160300f2a254f2a1762e5d4db04
MD5 3ad3c0fd4dca001a2f9e707b74544919
SHA1 c6176415ecd3e8f38f976e4234325452fe1fd2a0
SHA512 436dac92e4a60dfc02c8c7a7ae496df7199c3fd15ef668bff2565f428f25be9c3ae1d0e120d64767eda1a9d4afa2e8bfeb6d047745440c3fce854080c44f42c5
SSDEEP 1536:Exe5ceArKXVX7XDZjQi5IWXiYjQizUWXiO:E05i4XrDZxIg/bUgX
TLSH
T12333CFF56D786554DDA24E70D4D98A23FEB032914FA808EB2498C0571ECABE1BF2D11F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\d3dcompiler_47.dll
Size 3.3MB
SHA256 efbdbbcd0d954f8fdc53467de5d89ad525e4e4a9cfff8a15d07c6fdb350c407f
MD5 c5b362bce86bb0ad3149c4540201331d
SHA1 91bc4989345a4e26f06c0c781a21a27d4ee9bacd
SHA512 82fa22f6509334a6a481b0731de1898aa70d2cf3a35f81c4a91fffe0f4c4dd727c8d6a238c778adc7678dfcf1bc81011a9eff2dee912e6b14f93ca3600d62ddd
SSDEEP 49152:PyZ9lnpmVm/w+EwVOmufvkQS8MH2J9CqS5Sqr88pPWW5KhQYPsXqUiQ6:E9fWAwVBC8MH2JNSF8+YPsXqUT6
TLSH
T1DFF59F21F701C077C8CA01F0666E7BA6257C9B75033945C762947DA9EC702E32F3AA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\libEGL.dll
Size 146KB
SHA256 041a631d114e45a11c43efe3b7712a10ce8052cf4b313c7f4577a5b9adb78072
MD5 9f7f22cef980ec272a9b73bf317500e4
SHA1 ae11d7cdfa84a242e31efd6f03b0ef764d5f900c
SHA512 19e432313c1e28fc076fb9e9c3884c3c97cc2d05b6d1aecf429180a6f5cc407734fe758bcc63936d5fe7ef8ac01abdf5ec4b17bb08b26c5cc87c560f4b89c5bc
SSDEEP 3072:AQpSfKDSjkC6G3a3xX4k6es65psG6gX6gr:AQpSfKWkCDeizA
TLSH
T1C4E35A0175E84030E4FB427A8565AA120BBE7D66DF268EDE3BDC4D4D06785C1BB39B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\libGLESv2.dll
Size 3.2MB
SHA256 cbfc536b80405da7b5c37c97fceaf2310daf58d78c806140367b8f513352342f
MD5 a4dfddff62d1e917ebb0688cf8d96be7
SHA1 9376bfa069a72da76733cc72cf90386920815142
SHA512 97de24a94f7aaaf3035853c0eb93f44c5c2cdfad99b563fef225d9f2b6f4fa3fe8f89850895d286322191cf8b372aa87da6620796cd32fe368f75b6722b556c3
SSDEEP 49152:lnXliT77777777E377777SaTm7NCO7777ovwwz7777777y0pIyRTNEClTRyAlllD:Eg9TOW05n16Entwr
TLSH
T1EAF55C11BC408275FFDA01FBDAFC3E645A5C8664032E61D7D69C0C996BA07E32B71A87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!auth.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\osu!auth.dll
Size 15.2MB
SHA256 d30b1d334a8b2d9e833e48a657ff1647a74f96b49d296522a4979428db1bdc22
MD5 c2d76f1da2e31b6c39b22625482800e1
SHA1 a3e6a0210091d43a3c1f811a2801b228467302b7
SHA512 8731d03dfaf0766d8fc960e2a8fdb58865dbdc775d5a12095b1b227f5c7319e74cdd7965858ae1e7c31502d1017a34c145420adfd7a4b1a91818110e04a97a30
SSDEEP 196608:AUpUpSGKY1fQkBUmiY99mp/EFnbMFZWeSsShR/4nFzkhKTre0JefDxIbtu70lPuY:AQK1BzBRiIaENirFSr6p3HoSEYlPuLU
TLSH
T1BBF612E13A0DE1FFD00F1A798516CF11E96C53F045118A57FE9A353E6A43F82069AE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!gameplay.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\osu!gameplay.dll
Size 30.4MB
SHA256 ba3467a8db908d81a0729f78fdc5c8f1d1595d3da4e5a9a34be9a16e06da9f87
MD5 4cb98d63f1b2b9dc38e10e9901ec52d8
SHA1 42c0e8b8e5c7a4113e38a977221f845ef8406722
SHA512 d351b9ff851490187b003c675047b6a20a2519df3818bcd18a674d6edab1d211c9661acc98403b562ff3268576ea203b4e0f10e962467b9849b72431c92735a4
SSDEEP 786432:zKhRG6tozgdXGWZlwECKH22SkMu/7WHV0g5QQw:zKhRGSIgDVW2hfK195Bw
TLSH
T13E673352F0039694C96F09368CA2D5805B223AAEEE52052F706CF715B4F32177F67ABD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!seasonal.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\osu!seasonal.dll
Size 3.5MB
SHA256 27decc7e0c959078325eb800b04626d6b9498b33cf118850c0e7b78dea470500
MD5 d21d49248a8bc1b881ae21e6d78e62ce
SHA1 d797bc15640e5d9dfa3f8b132560097ed47a2c9b
SHA512 73e2d89d8d9c0c39b1d33c2700d0e20564a9cb532156c96c0a5514e6e03b6691bc08f060b4364b7a6f29421f098b33ed7aadd22164c96431162ab7928794c522
SSDEEP 98304:i1Xtu2mhrI+wKURZmFLBc0oir3jh+6H4C15FI2AeSF:Otu2mxcjR+1boW86Hb1PI2e
TLSH
T14A0633AECD8CA56BE603777450DEE994AD39333FF94F03C8DC54A6681A18B805619F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!ui.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\osu!ui.dll
Size 24.8MB
SHA256 22e041674931161e2c2c15241fb6c5f3125f8d57e4660ef7c0b7fb64449253c7
MD5 6448b4b0a3ec3a875f850a502fd29213
SHA1 ef5e46ac0947f815802cc6601ab1c4a344f8db19
SHA512 629397961e97e8bf68dcabfa768ce658769310415f1c2f9a3687882cdc978ab746c7477deb80d95675020cfea243b5b8a81f919c048d8a53bbfbeda201d0a534
SSDEEP 393216:+weL9xcZy55AfilHOSrGRWPxe/WGfvWJmaHQILW6UFoMMoGHTkuBZOq5OmlRkkf:6rZSfKOZRWPs/WG3V5IS6UFFtIgi5
TLSH
T130472247B30A96D9F1521A360866C656C720BD0C6F1207DFFA6EBF28E5732851F2371A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pthreadGC2.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\pthreadGC2.dll
Size 75KB
SHA256 b18c8437663002e4a4f06c4c1b7bec71fe13e5e6bbb927c68a273de02a5c690f
MD5 00678eb6be3b52d562b66218c93e21a8
SHA1 ba583d1520da22f3d3b89196c981279ecda58648
SHA512 58d9ffa0f569ba7b1aaea62b49f5bfa18bf23c54d2487eb9e4da984469236c2d4baabeeeac7e4b71d66b8c30f7fff4890fee5ee25e00369fc4afce053cbeb048
SSDEEP 1536:foAm0g76WsZmEZDIMiH3YNK4ajT+Aa5QEajQi1vWXiujQiaODWXiO:Qh62MiH3YN8T+Aaba9vgpDDg/
TLSH
T18B73C9D13AA95CE7E5601A38D5E6D362793BF1E017138B13E334D4360E9AB81FAD421B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!.cfg

Path C:\Users\Admin\AppData\Local\osu!\osu!.cfg
Size 856B
SHA256 d037fe50380998945e319279b06903c9336c304c0b9b47e8e89d3292c76fb6b4
MD5 c558fadcd41d7ef64919fce4be7aed30
SHA1 9b6dac5d6332cdb84f48a2ed53d3ac17d7cdc0a7
SHA512 78784121fe238db9599f4d34fae15ed5a88b37fa6328180499c573b5a879241da7ea602a83399a7ce52fb0c51ccffa2d370de635d0cc7c686dfc6d5f467b17c0
TLSH
T118115E1C611CE3823D6C21684B2E897E30B8C4D3B2BEEAFEC5E0439978472CC8002D08
MD5 SHA1 SHA512 TLSH

Submit Download

osu!.exe

Path C:\Users\Admin\AppData\Local\osu!\osu!.exe
Size 4.3MB
SHA256 3adc2d001aacced5f92ba8ae24121980d5e23f5653f37d14cf4765bca1abd9f9
MD5 f845ef10bf97c3260b818fc02e73e196
SHA1 ac17e56fd28d86ff0b5f7d520e17d7237fde3163
SHA512 814372403fb942ba63c44ce1e223ed7fb7c54b136bb3b81b377457da6195c638738c9446d675070b9613ede66fde7cb95caedd36af13315370ebc892d42fc0d4
SSDEEP 49152:UvmS8LTfZMBXdUxmZ0ixDej4V1/i5g+7Z16rPZrpzRXJJA+xaQRfvWtxRxpDOhG:Uvl8LwRZjJV1eFH6lbctxRxpDOhG
TLSH
T1BC268C6067E48E3ED56E87BAE495190663F5CC88B7C77BCF6829B97028B7345180334B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/960-33-0x0000000074B12000-0x0000000074B13000-memory.dmp

Download

memory/960-18-0x0000000074B00000-0x00000000752BC000-memory.dmp

Download

memory/960-0-0x0000000074B12000-0x0000000074B13000-memory.dmp

Download

memory/960-1-0x00000000007D0000-0x0000000000C26000-memory.dmp

Download

memory/960-2-0x0000000005D50000-0x000000000630A000-memory.dmp

Download

memory/960-35-0x0000000074B00000-0x00000000752BC000-memory.dmp

Download

memory/960-34-0x0000000074B00000-0x00000000752BC000-memory.dmp

Download

memory/960-45-0x0000000074B00000-0x00000000752BC000-memory.dmp

Download

memory/960-3-0x0000000005830000-0x00000000058C2000-memory.dmp

Download

memory/960-15-0x00000000064B0000-0x00000000064EC000-memory.dmp

Download

memory/960-16-0x0000000074B00000-0x00000000752BC000-memory.dmp

Download

memory/960-17-0x0000000006F80000-0x0000000006F8A000-memory.dmp

Download

memory/2608-367-0x000000006FAA0000-0x00000000709DC000-memory.dmp

Download

memory/2608-356-0x000000000DB30000-0x000000000DE8B000-memory.dmp

Download

memory/2608-382-0x000000000AE70000-0x000000000AEE4000-memory.dmp

Download

memory/2608-408-0x000000000ADC0000-0x000000000ADD0000-memory.dmp

Download

memory/2608-375-0x000000000ACB0000-0x000000000ACC3000-memory.dmp

Download

memory/2608-371-0x000000000EDF0000-0x000000000F000000-memory.dmp

Download

memory/2608-370-0x000000000E5C0000-0x000000000E9EC000-memory.dmp

Download

memory/2608-377-0x000000006E9B0000-0x000000006EA07000-memory.dmp

Download

memory/2608-416-0x0000000074B00000-0x00000000752BC000-memory.dmp

Download

memory/2608-391-0x000000000ACB0000-0x000000000ACC3000-memory.dmp

Download

memory/2608-344-0x0000000006D40000-0x0000000006D96000-memory.dmp

Download

memory/2656-61-0x000000000AF00000-0x000000000B42C000-memory.dmp

Download

memory/2656-63-0x000000000B430000-0x000000000B78B000-memory.dmp

Download

memory/2656-62-0x000000000AAA0000-0x000000000AAC2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads