3adc2d001aacced5f92ba8ae24121980d5e23f5653f37d14cf4765bca1abd9f9

Analysis

user interaction
yes
max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 17:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
osu!install.exe
Size 4.3MB
Sample261024-v1j8dsv1ex
SHA256 3adc2d001aacced5f92ba8ae24121980d5e23f5653f37d14cf4765bca1abd9f9
MD5 f845ef10bf97c3260b818fc02e73e196
SHA1 ac17e56fd28d86ff0b5f7d520e17d7237fde3163
SHA512 814372403fb942ba63c44ce1e223ed7fb7c54b136bb3b81b377457da6195c638738c9446d675070b9613ede66fde7cb95caedd36af13315370ebc892d42fc0d4
SSDEEP 49152:UvmS8LTfZMBXdUxmZ0ixDej4V1/i5g+7Z16rPZrpzRXJJA+xaQRfvWtxRxpDOhG:Uvl8LwRZjJV1eFH6lbctxRxpDOhG
TLSH
T1BC268C6067E48E3ED56E87BAE495190663F5CC88B7C77BCF6829B97028B7345180334B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\Registry\Machine\Software\Wine	osu!.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4432	GameBarPresenceWriter.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	osu!install.exe
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	osu!.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 6 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
3340	osu!.exe
3340	osu!.exe
3340	osu!.exe
3340	osu!.exe
3340	osu!.exe
3340	osu!.exe

Executes dropped EXE 2 IoCs

pid	Process
3376	osu!.exe
3340	osu!.exe

Loads dropped DLL 10 IoCs

pid	Process
3340	osu!.exe
3340	osu!.exe
3340	osu!.exe
3340	osu!.exe
3340	osu!.exe
3340	osu!.exe
3340	osu!.exe
3340	osu!.exe
3340	osu!.exe
3340	osu!.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	osu!install.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	osu!install.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	osu!.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	osu!.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	osu!.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	osu!.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	osu!install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	osu!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	osu!.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{B8177815-4120-4FE3-94BA-1BA35FDAF2C4}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{06ACEF4A-88E4-49F7-BBB7-935418CA0A0B}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{51651F51-6AEA-435F-A933-DB6202DF92E8}	svchost.exe

Modifies system certificate store 2 TTPs 15 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B	osu!.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B\Blob = 0300000001000000140000008d4c4a23ba9ee84ea7348fa98cc6e65fbb69de7b140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d4040000000100000010000000ab9b109ce8934f11e7cd22ed550680da0f0000000100000030000000a768343c4aeaced5c72f3571938864983a67ed49031c1da2495863caf65fe507011f7f0e70b6cb40e5631c07721be03419000000010000001000000082218ffb91733e64136be5719f57c3a15c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000820500003082057e30820466a003020102021067def43ef17bdae24ff5940606d2c084300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c050003820101007ff25635b06d954a4e74af3ae26f018b87d33297edf840d2775311d7c7162ec69de64856be80a9f8bc78d2c86317ae8ced1631fa1f18c90ec7ee48799fc7c9b9bccc8815e36861d19f1d4b6181d7560463c2086926f0f0e52fdfc00a2ba905f4025a6a89d7b4844295e3ebf776205e35d9c0cd2508134c71388e87b0338491991e91f1ac9e3fa71d60812c364154a0e246060bac1bc799368c5ea10ba49ed9424624c5c55b81aeada0a0dc9f36b88dc21d15fa88ad8110391f44f02b9fdd10540c0734b136d114fd07023dff7255ab27d62c814171298d41f450571a7e6560afcbc5287698aeb3a853768be621526bea21d0840e494e8853da922ee71d0866d7	osu!.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	osu!.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	osu!.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	osu!.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	osu!.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	osu!.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	osu!.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	osu!.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c0000000100000004000000001000001900000001000000100000009f687581f7ef744ecfc12b9cee6238f1030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2090000000100000016000000301406082b0601050507030306082b060105050703086200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12700b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000000f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e040000000100000010000000be954f16012122448ca8bc279602acf52000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	osu!install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	osu!.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	osu!.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2	osu!install.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 040000000100000010000000be954f16012122448ca8bc279602acf50f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e0b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000006200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	osu!install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	osu!.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3340	osu!.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1860	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2464	osu!install.exe
Token: SeDebugPrivilege	3376	osu!.exe
Token: SeDebugPrivilege	3340	osu!.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1860	OpenWith.exe
2256	OpenWith.exe
4296	OpenWith.exe
2264	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 3376	2464	osu!install.exe	93
PID 3376 wrote to memory of 3340	3376	osu!.exe	99

C:\Users\Admin\AppData\Local\Temp\osu!install.exe
"C:\Users\Admin\AppData\Local\Temp\osu!install.exe"
1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Users\Admin\AppData\Local\osu!\osu!.exe
  "C:\Users\Admin\AppData\Local\osu!\osu!.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\Users\Admin\AppData\Local\osu!\osu!.exe
    "C:\Users\Admin\AppData\Local\osu!\osu!.exe"
    3⤵
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3340

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:4432

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:1144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:4732

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2256

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:4904

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Debugger Evasion

T1622

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5080DC7A65DB6A5960ECD874088F3328_BC00434159DAE8351451CCE9C748F5D7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_BC00434159DAE8351451CCE9C748F5D7
Size 2KB
SHA256 bc2a68b78dfb66ed39b1aa6dba9cabf2c31b11bee3e7a8f32cfdda7c54740df9
MD5 a727fa08d16210cb230c2de825596d36
SHA1 4b8b6a1cf2d708f9137af6c0fc45c7621cd360e7
SHA512 5f92c98e2ca7e063e0cf0d25d005ec33dcadbfafd648451c3758103dcebb3a8d7f7524896a2889685d82a8068441c93a73e46daaf0c4a84448c2fbf772f50c60
TLSH
T196411953D8B47410BAA2AF193BDCD5373DB6B97135DA02E2207ACC5A540C7D55EC003D
MD5 SHA1 SHA512 TLSH

Submit Download

515195B826B230146D00BC66A056A7F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\515195B826B230146D00BC66A056A7F8
Size 20KB
SHA256 034e94d045144c71a7034e5001f55b054ebade81894a327262dace7fc739aaf6
MD5 43602db3cd794def720b30c4d52b2d2c
SHA1 aaee235263f07be51ea3f03ee6a7d0f26b639059
SHA512 111a0019389dfbc495817db1b0ad7053ad98e2c665ae0b5168803598bafac94a76fd481c33aba2607fd658e1926d7d2656fdfc7eb3d9f9b826f7d3b5c615336f
SSDEEP 384:DhLwqdD5rtNYHH8vZprwyVRC3onACwX0WJwH5Zg:ZndTNFBp/Vk3onArX0WiH5Zg
TLSH
T176A2E9FC6A5CA69750C56A31CACB9FD3D8F651A63BD1E11F01B55E880424EC3CE97382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5A6896595A9B5FF7A8254147F2B2367B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5A6896595A9B5FF7A8254147F2B2367B
Size 22KB
SHA256 e8f98188ac01b7d8032e387c00ddc10c9869b2d1535655dd86032180db4b5acf
MD5 cc81a87fcd05b09fd5a61580a227b238
SHA1 6cfda6d9371c3a74e91b556234599caa2b934147
SHA512 735857a2bae764e1ae4af32695deb0a9e4ad060284a5e89bd1e6141c873222e3529fd806cb4f163d42622d0a774d06773c77449672d799fb83b354ad74027869
SSDEEP 384:4pmu9beJjnTFN/vNoNyO+w6R60Ulx08VzktpUy:4pbaN9osR/UQ8F0p9
TLSH
T185A20BBCA95CAAD741C66A71CACB8FE3D8F511A53B91E01F41756E884420FC3CE97782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
Size 2KB
SHA256 ac810288faef02ade339a717909918aac5cd2a28deedb1f6f5e2be3bf0cbf393
MD5 4b59d9f94e3b958ae5c075e592a0cec7
SHA1 12c315490e0e7c45dcbf0542ead7cb0c17c7b200
SHA512 cd8ae41f5dfc3cd0dcbedea0ba1e26279fb53e980eb377533a0187b574c3f0d8941a6d1790e2193f2319ed67c14941a95daa16191f6514a8d816bcea9149b9b6
TLSH
T176410A07377D9406E926B36097D8CFB3B83CF3604C0A241B344EE2994889F94670411D
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691
Size 1KB
SHA256 17e95d52d772dd9935fe52c59566f8742fdbee09d7c5d06b81e5246a78a226a0
MD5 007a8a4ab2a9e165e834d1cee6c71337
SHA1 a720902a22baf614064f0a23e5b40d5390a7288b
SHA512 8f593b6f242d45316d3a4310079a3a090d4ea4668ea6cd16c2fcfb31902c6a7c3e479f49029abd51647ed105d22455d5f0a290844a17da9c86daef5d39041c1f
TLSH
T1AC31C7E22BBC7821AD09DE84A8ED47B26CF032A2F5A04C78347481178463FA0280980D
MD5 SHA1 SHA512 TLSH

Submit Download

D2B5168CDD0EBF4C0C8EA1C3A1FAE07F_69320653974E97D8129B19E9D4DB56AA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D2B5168CDD0EBF4C0C8EA1C3A1FAE07F_69320653974E97D8129B19E9D4DB56AA
Size 509B
SHA256 173a00021238c14ba740b8f96851ca29d3e78b43ef3487112c1dc4e86e2aafbf
MD5 92271eafd7a86c63d01a09ca05121d69
SHA1 ba921beda4ecf4afcfedced4bb8c8b7ec1115f49
SHA512 46ced370ca185cac0c025e8bb2e18c6e849a66d14bd8007db014deffb9cac72fbe6311d22f9198357c5ca2ceea4a57b550d30ede3767493d34f294fadc5e89b1
TLSH
T124F00E5688303110DEAA9228C8EB671A0402B5350BA744973C4CD3BE987A33BFF1C898
MD5 SHA1 SHA512 TLSH

Submit Download

EF7234CDBB1649702229F955C785C39F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EF7234CDBB1649702229F955C785C39F
Size 785B
SHA256 9e153cc9331fb887cacd6f08cfa3dc5aac7b9b26b4b9cfa75d2ac57288e9142a
MD5 13c624bbd9ad9ff627a68b5ced19b228
SHA1 ff158247f5c6bf41d5fed9f3d756b82f735a24f6
SHA512 62251f6fd12706cc3b90b738523a3a32c34b104ed967b0f42da80596fe0a3b03a27dbbbab144afff619c4a910558b2f8f6f6f223f4cc65bb288f7516bfdb7068
TLSH
T14A017561A8BCF3844DA11BD603F4ADA559B407F6294CB2672437A1560562B53EF28129
MD5 SHA1 SHA512 TLSH

Submit Download

5080DC7A65DB6A5960ECD874088F3328_BC00434159DAE8351451CCE9C748F5D7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_BC00434159DAE8351451CCE9C748F5D7
Size 490B
SHA256 734992d94b73e7fa8a986ae5b50d63693a4deb7d7c595136dacae04502d13c28
MD5 640d00dab4acc0f7699d0d0f21ca2bad
SHA1 2c10f01be937c67ade76e6208110478e9d0162c0
SHA512 1ea93b59e7c13591fb75d377a013c85d232fa888168b4880850f6ea0a508743175511060e47890669868a985971b3e4f5433adf2274f22934194b0a6cee1fd0a
TLSH
T196F02B3436FD016CD477D078CAC975AB7DBDB263384997AA49700B09B50AE830E51229
MD5 SHA1 SHA512 TLSH

Submit Download

515195B826B230146D00BC66A056A7F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\515195B826B230146D00BC66A056A7F8
Size 290B
SHA256 9fd9edf0113e2240d02bee0f9daad4d7a70d7eacece99189725ba493219e284b
MD5 b269b42276ca2f18dbd126224581ee4c
SHA1 6f8b26293b1ca40c831226c5d39154c2c5b1b350
SHA512 271d9db1bd7ba36ee8f8ea0400a0d3802ab715179f42d1da341796cd77cf9b23260ea05cf4f246c5cd946c31a56fce850489db2765afb187c8c2023604cc2926
TLSH
T17ED05E1CD3B60212F091853E59D02A6B6E75B83A950183440BF18318712CE86B9B1713
MD5 SHA1 SHA512 TLSH

Submit Download

5A6896595A9B5FF7A8254147F2B2367B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5A6896595A9B5FF7A8254147F2B2367B
Size 290B
SHA256 a717134133ccef0c14b9e9b40e08e6cd9f2b4f9bdff9a7fdcf4853fdb7bc0869
MD5 d4ca285969d3706ab5b8fc69ae8aac28
SHA1 5c322db945370c20526006428f1eb288c4e0e9ee
SHA512 0064e7e767cb484ad990df74b6bffd0f50fe955559baaa6320c87f2951195036b92832354467a7932e9da3cc540c36dee062f39b73342919c2caeee399a961d1
TLSH
T1AFD05E1CD3BA0612F491C93E59D0262F6A75BD29A60583450FF083087028E85BD71653
MD5 SHA1 SHA512 TLSH

Submit Download

77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
Size 422B
SHA256 60aabe9957634cdf590f301872453deb1d1203bbe4965c7aac8261356d426393
MD5 fae7d0a153bb6b38f5c82c506344b2b3
SHA1 e236825f76e5fc96698761873380152c5a722c8b
SHA512 17a2d372a4c1cde2bdcc2d2b42ca004d90280a39467de54c549adeddf5e7fa20f46372e479a28a6500ce1bca4d852644e31bb7ff340aa62d716f50167fe6d739
TLSH
T112E0D81839FFC11BE3326D3E0B996A3F1A3BF313280866A6F7640175545AD02CD21722
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691
Size 486B
SHA256 ec53a82368416346ea8bf62f47478dd82fb8617a4b5e20b06fc0bf9022e8de13
MD5 72dd0e649ed06c4624e6da281e6ea3c1
SHA1 b6082a1374cf9cf918c0438223fbc91c204b3b1a
SHA512 6eaea1e1a4143e5b28ae323a2b8a7e5c44c259dc9b7a0244f9ac712789deb4993028cebe4438e64c264783874b086261d95d1abdacab73c0ea6e8b75bc236a91
TLSH
T15EF0A32CB7F4913FE033DA7587E9B576546DF204288121BB05E29B04551FA421C919A3
MD5 SHA1 SHA512 TLSH

Submit Download

D2B5168CDD0EBF4C0C8EA1C3A1FAE07F_69320653974E97D8129B19E9D4DB56AA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D2B5168CDD0EBF4C0C8EA1C3A1FAE07F_69320653974E97D8129B19E9D4DB56AA
Size 498B
SHA256 ef3fb5e6fe1d56fc024078ca5f7711bed0824dca56fe54e5811a6e8e8e5fd303
MD5 7cde73ead3b9bf90258b2e01b40dbcfd
SHA1 9eaa1e0b1bd8803ed8ae02c2b6c32882fedc1bc8
SHA512 07009a9761e19f22b1a1bfe2829ee87230fd7a9565be3f4fb26d8357d0c6af6f9c9b05eaad6961d05425882c25522b5228e90697f5d36cb36e7a7a1a918ccf42
TLSH
T15BF0A32529FF102FF232CD3541D8F1F2CDA8B311310801BE09A03707AA46F816D43A69
MD5 SHA1 SHA512 TLSH

Submit Download

EF7234CDBB1649702229F955C785C39F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EF7234CDBB1649702229F955C785C39F
Size 308B
SHA256 cc7cae937075493e2332bed42ef10b13159ce96992faa8617d204243edc573e6
MD5 9b11760cb11736f17fb8ab76d6e7391c
SHA1 d215fcbfe1e40935b04f4c8c999e1abb2c9e80f5
SHA512 6c4b102fbd5bc02dc61a3a4a3aa0a6e51e6bcebbf5f0886c2f3708c2256a17d084e874692d2d6908e9f21dd981a23c1f9acc3acb59fbd8f3a88897b14413ffb0
TLSH
T1AEE05E0CA3F94B23F4D0C93E25E428177A35BE548A04C3491FF08709787CD81B921793
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\osu!\Logs\update.log
Size 325B
SHA256 c171d28dfaa2cb429e04212263a10b91fc4acdb38529d3932f4c0abb0c8761b4
MD5 5bfc9f549f26b30fd909091ade7666af
SHA1 ae4bf5670f0594b25bb88e54d00a271df7bf4c69
SHA512 094fec3951c63f959449fe52ed036b685e94af47e25f7d4b51bbabb46c504632e6be67413219e61ef18c9f6b310c7b679df4d0d7532679b06d56deb9aa0cb8f6
TLSH
T1E4E09A919D6AD0C5D7A14272428C491B8B6224322AAA79FCF7ADF360008C165982F364
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\osu!\Logs\update.log
Size 583B
SHA256 42585c89560b6f89518687e92757b16a8ef9f50735515137024f9b42ce8205d1
MD5 d6bf40b4ad772076eb33140fa27b2209
SHA1 2bea5504aedb633ea1a4a2c557531a43bbbc40bd
SHA512 4107e83a07c385c79f7e5774147c502102cf5897f6d21cb405110e8f45aa561459a59f77c8cc6dddff2ae90eda951442a52f34b640c5f8cb585a6d4a37984e54
TLSH
T12BF0C4A15C6BE1D193A103A7824D896BCB6224322BDE39FCB3EDE364114C036992E324
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\osu!\Logs\update.log
Size 4KB
SHA256 7ca72559fdc6d1f3d467988315f69423bd0a66abbcdb457684f310c685c1f67a
MD5 17068fcfa90b9d73a553c45bca6df408
SHA1 61608da9fd018d976194b95cc98bd282bd33fef0
SHA512 60f0e08c3ae87c9d61ea1874fda8232a6dbe93bdd45c61a75daff734652ee554ed19abbf03824a974de15b3f64c104da050ad4bc600478e323ff0adcd4640a2b
SSDEEP 48:e8kB3kWxC1J2GX6LwXPAbB1RXtYM3W0XO+dtlI+7YuFiGnTRf+ZxkoxLGmbJFphW:e8kaH19kO+abJ7hktAQp
TLSH
T1F6911BA96A3FD0D557A41307A3780A0D573320636ABA62FDFA7CE33C141E864CE2D756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\osu!\Logs\update.log
Size 233B
SHA256 03859bb4ec6d8999a720e14572f231ec8f4cd1b244cb25edd8e46c795923e4b7
MD5 b399f62d37b1b007e39e306ddf38b48d
SHA1 f68a857745e04bdc24644f1b7703212aeb3aaa1f
SHA512 bf7ba7189b192f00cc68762a88da5da6d37d3894d57b1a93277af17a239e20fdde4955f5a4c37384cbab4faee65886cc5778b97261398b3ba1828b712ee306b6
TLSH
T14ED09E916A6BD1C0E7714396A668697457677073668B35FC727DD3A4100E8248F1D324
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\osu!\Logs\update.log
Size 616B
SHA256 e837c1d88312b759195572fa77c372c20084358b9759f99fd63e3df49dd5cd9f
MD5 ae15531ca1ef184e3cb35a5ee104f090
SHA1 eb475ed9b2ea5ed9c7b45a1db8bd21b2a4120d3d
SHA512 501ea1fd6d00f5ca15a58c23734d38f8c19810309dc2f730d2dec7c6a04dd2f46adf7794ac9d1c7a4e88ccbda64ba7e362b62b7208a21f55e0c2a983f46084b2
TLSH
T1F4F0B291AA3FD0C8AB7243466268196C1B777433659A65FCB23DE368010E974CF2D358
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\osu!\Logs\update.log
Size 987B
SHA256 9aacdac63dc5563c1e838d589e8d088090904599521654b3d10c6846d3959a7a
MD5 3e396a49cadbac75bfbac78959418d8a
SHA1 ae2f344ccb0e6e4c70d301c241a6db4b3a2e4df5
SHA512 288b690f1bf935f8b30845ddae9957005a66bf3752e91c399c4cb5422933ba58eb87afbb06a0050d3b1b88a506fe3b692ea1b5a7c0b8fcc1197d6fe019c98b94
TLSH
T1FB11A2E06A3FD0D89B7243425268599C16337033A9EA6AF8B23CE368010F5A4CF1C299
MD5 SHA1 SHA512 TLSH

Submit Download

update.log

Path C:\Users\Admin\AppData\Local\osu!\Logs\update.log
Size 3KB
SHA256 2be630dddc18a7b82962a61252ea5551700ea048a806e1e16ef445a19be276fb
MD5 9bb66015a51a51a6556416537c65351c
SHA1 d8b81644347203a3528a67eb2de61d4ef91a87de
SHA512 676bcbf0f7cd30f81f536a014c515818637168d55f1959114347a0511fef57c501b402829c3ba3152fa63af2ac8024fc6656111dc56337fd8cea797a33056026
TLSH
T1AC71FAE96A3FD0D597F41713A2784A0D5B3320636ABAA2FDF678F328040E460DE2D745
MD5 SHA1 SHA512 TLSH

Submit Download

update_success.log

Path C:\Users\Admin\AppData\Local\osu!\Logs\update_success.log
Size 6KB
SHA256 7c78e1fe4e74260751a4bb077c9523a44d162f55ab2473cd347b2fa08a798510
MD5 51ecd6a6ba81f28d1f2a084c0c667a00
SHA1 a92ba1ed4d87a3adb9bfb74cd55a510c3a90eaa3
SHA512 5fba5ccc6058708da1b4b9011476331ee6e8c01c31484dc89a40f1e43ddc152ead73f365715a07e747fb863d2a754352c3bc07405d65dbcf23beb66d9de8ef2e
SSDEEP 96:e8kaH19kO+abJ7hktAQUKzp2BqNM/qP1bslXnGvmnFS0S8h:9HN7hktAQUKzp2BqW8bslXGoFS0S8h
TLSH
T176E137A96A2FD0D597A41347E3290A1C173320632ABA61FDFA3CE33D101E874DE6D656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Ink.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\Microsoft.Ink.dll
Size 456KB
SHA256 1081255de41aafd51bc8f4e4404ef02209e59625ae65fa926657df5690716c5d
MD5 82d4ee89f4a39c764fa6297a95ebb10e
SHA1 87b1f581ad017bf62604d8071a23fde8b81550e1
SHA512 904fd99f7d5951a23af202fceeade044b6d4f40c75db09d0237618ff80b90934ca4ad3210751f6e5bcad71b3a4131e24d420e94292bcfb7acbc3490ebc844382
SSDEEP 12288:X2LyFEvOpwDK9MHGBYbCV0/e5gTaN8XWRIrhGrQFaeyK7+ZkH61Qz2h8fSdILuph:X2LyFEvOpwDK9MHGBYbCV0/e5gTaN8XG
TLSH
T154A42801379C2235E56E97BBD2E62675C3B1E5162916FF4978CC22E60D237528B033BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenTK.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\OpenTK.dll
Size 4.2MB
SHA256 b415f3e061d9758316074dcbf31d6dba48cb0b89405254db94ead0e43ed88511
MD5 b4d949571134fc3ec6c28f1af7a75e49
SHA1 07eb5685ff4f19ff8ed466c68c2426e2ead69241
SHA512 7abb1128d4f9312ec714f7d3f4e1d1ce12a6f93235d6382cf25c39dae0d7d88b5ad5141f512659c33cf57a762e14711b6b690b33da7d16c7d7be35c8b292131b
SSDEEP 24576:gGg1QKR0dSMIK0v6FMF2Y9JhGtZuD1/TMvXgZ2j41WEfyj+jNhlxZ:UQ1d0K0jT4L4htPlb
TLSH
T18B160759EAD6087BCA972E7E906304433136966B5B57EB3BA047D37C3CC6F642C1A1C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avcodec-51.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\avcodec-51.dll
Size 4.2MB
SHA256 e512fe71775f767285cfb3310d8f1ac042639ab3d1a02ca3675b82cfd3cbc702
MD5 b66478cc0f9ec50810489a039ced642b
SHA1 992ede70f0fee5cb323b4b810cc960bf2531875e
SHA512 ed07e71fd6bc2bd9f2ada8b8d6aa80662d6ffadce7d692f078e9ccd8ada2ba47b0e25967809f567fb93ffc96271037f010a0038bb78301812a75e30eee9b2645
SSDEEP 98304:UyIwuFFZZqniDGDHt+elelHjzMvIOFXEkGP0P7g+r0ZpSHA23yQ7D9cpTZY:UyIwuFFZZqniDGDHt+elelHjzMvIOFN1
TLSH
T11C265C85F6A380F6D8470C71902FF37F96392A08C525DFA5EFC02F59F9A2B529856306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avformat-52.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\avformat-52.dll
Size 711KB
SHA256 b155e2bfce3adbbc45d01ec991160ab4fab7e8d33a0ab835463da860d3693867
MD5 c00b30289cc427caff97af5aa3d43e03
SHA1 8e70885a62b0fe510422c2367b1f6de489b67e6c
SHA512 3a70161a5adaba0101f2d2ca1522b1e71d04079ad15cc87a030b00c14b45df9545d5cba55101e25d9bd101769edb87a8e4d893125780e86fa2551290ab720860
SSDEEP 12288:AHi4xW+FLd874nWqfUMSEEmjjUy/M0gDJdvm0yfwea:AHi4AQd8sWCUNEEmjd/M0g1d+0yHa
TLSH
T161F45B85EACB60F5DE0B0C31829BF33F9B259702D420DE95DF986986FA33E62541E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avutil-49.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\avutil-49.dll
Size 77KB
SHA256 e51523f179a8ab8101eaa3e587c5e1dfe6c19636ecfa582896833f06d2e79064
MD5 47c83b958951331ba409d6b80316250c
SHA1 ce14566676a27a0899079781a41888a2f1303127
SHA512 58408238279126e2b478a2f7cda513e5b5908140cc615f271e2baea7a2fe59046f51040406adb86194cc168ff4bc9ea2ca92834b9d90116f9ceb2384a4325896
SSDEEP 1536:qVNjo4PqJXpzUv8e8wyqQwFBo2xDCkCj7TjQiK1WXiHjQi+WXiU:qVpo4PqJNUvIYDBo2xZCL2g4mgV
TLSH
T112737C89FADB10F9E9174E3081ABB33F9F3163018420DDA6FF90D406ED67B52A62554E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bass.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\bass.dll
Size 125KB
SHA256 67766e574baa86eb8317623acc2957e8e28944bb801a8c10a0fa9d29fdb4cfd3
MD5 7623474a8b9bec1e3ffca813cdf93bc3
SHA1 4a1c0ecf8cbed18d0472136a7096ee8c3c2fa774
SHA512 b7e7205e48eade918d63b483fb500867cc8196496fe9136f0177481d654a67af8319b6823fb04787e4bd6ee46c031c2b6fea57f0bf12b8a58cf8e0003834bd7b
SSDEEP 3072:er+5IHiXfBXJ2omnEAOUqXfOq5Nny8+qvUFjuvQniIGwFE:A+5IHiPBJsnyUqvXNZjvKC2Gv
TLSH
T1F4C312B5CDFA60E7C28F45361071E05407F4FA649E428EE16ED9B508C9FE2F1AC1879A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bass_fx.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\bass_fx.dll
Size 50KB
SHA256 81111a1cb6f8f362cf232e21098c563fe1409160300f2a254f2a1762e5d4db04
MD5 3ad3c0fd4dca001a2f9e707b74544919
SHA1 c6176415ecd3e8f38f976e4234325452fe1fd2a0
SHA512 436dac92e4a60dfc02c8c7a7ae496df7199c3fd15ef668bff2565f428f25be9c3ae1d0e120d64767eda1a9d4afa2e8bfeb6d047745440c3fce854080c44f42c5
SSDEEP 1536:Exe5ceArKXVX7XDZjQi5IWXiYjQizUWXiO:E05i4XrDZxIg/bUgX
TLSH
T12333CFF56D786554DDA24E70D4D98A23FEB032914FA808EB2498C0571ECABE1BF2D11F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\d3dcompiler_47.dll
Size 3.3MB
SHA256 efbdbbcd0d954f8fdc53467de5d89ad525e4e4a9cfff8a15d07c6fdb350c407f
MD5 c5b362bce86bb0ad3149c4540201331d
SHA1 91bc4989345a4e26f06c0c781a21a27d4ee9bacd
SHA512 82fa22f6509334a6a481b0731de1898aa70d2cf3a35f81c4a91fffe0f4c4dd727c8d6a238c778adc7678dfcf1bc81011a9eff2dee912e6b14f93ca3600d62ddd
SSDEEP 49152:PyZ9lnpmVm/w+EwVOmufvkQS8MH2J9CqS5Sqr88pPWW5KhQYPsXqUiQ6:E9fWAwVBC8MH2JNSF8+YPsXqUT6
TLSH
T1DFF59F21F701C077C8CA01F0666E7BA6257C9B75033945C762947DA9EC702E32F3AA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\libEGL.dll
Size 146KB
SHA256 041a631d114e45a11c43efe3b7712a10ce8052cf4b313c7f4577a5b9adb78072
MD5 9f7f22cef980ec272a9b73bf317500e4
SHA1 ae11d7cdfa84a242e31efd6f03b0ef764d5f900c
SHA512 19e432313c1e28fc076fb9e9c3884c3c97cc2d05b6d1aecf429180a6f5cc407734fe758bcc63936d5fe7ef8ac01abdf5ec4b17bb08b26c5cc87c560f4b89c5bc
SSDEEP 3072:AQpSfKDSjkC6G3a3xX4k6es65psG6gX6gr:AQpSfKWkCDeizA
TLSH
T1C4E35A0175E84030E4FB427A8565AA120BBE7D66DF268EDE3BDC4D4D06785C1BB39B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\libGLESv2.dll
Size 3.2MB
SHA256 cbfc536b80405da7b5c37c97fceaf2310daf58d78c806140367b8f513352342f
MD5 a4dfddff62d1e917ebb0688cf8d96be7
SHA1 9376bfa069a72da76733cc72cf90386920815142
SHA512 97de24a94f7aaaf3035853c0eb93f44c5c2cdfad99b563fef225d9f2b6f4fa3fe8f89850895d286322191cf8b372aa87da6620796cd32fe368f75b6722b556c3
SSDEEP 49152:lnXliT77777777E377777SaTm7NCO7777ovwwz7777777y0pIyRTNEClTRyAlllD:Eg9TOW05n16Entwr
TLSH
T1EAF55C11BC408275FFDA01FBDAFC3E645A5C8664032E61D7D69C0C996BA07E32B71A87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!auth.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\osu!auth.dll
Size 15.2MB
SHA256 d30b1d334a8b2d9e833e48a657ff1647a74f96b49d296522a4979428db1bdc22
MD5 c2d76f1da2e31b6c39b22625482800e1
SHA1 a3e6a0210091d43a3c1f811a2801b228467302b7
SHA512 8731d03dfaf0766d8fc960e2a8fdb58865dbdc775d5a12095b1b227f5c7319e74cdd7965858ae1e7c31502d1017a34c145420adfd7a4b1a91818110e04a97a30
SSDEEP 196608:AUpUpSGKY1fQkBUmiY99mp/EFnbMFZWeSsShR/4nFzkhKTre0JefDxIbtu70lPuY:AQK1BzBRiIaENirFSr6p3HoSEYlPuLU
TLSH
T1BBF612E13A0DE1FFD00F1A798516CF11E96C53F045118A57FE9A353E6A43F82069AE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!gameplay.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\osu!gameplay.dll
Size 30.4MB
SHA256 ba3467a8db908d81a0729f78fdc5c8f1d1595d3da4e5a9a34be9a16e06da9f87
MD5 4cb98d63f1b2b9dc38e10e9901ec52d8
SHA1 42c0e8b8e5c7a4113e38a977221f845ef8406722
SHA512 d351b9ff851490187b003c675047b6a20a2519df3818bcd18a674d6edab1d211c9661acc98403b562ff3268576ea203b4e0f10e962467b9849b72431c92735a4
SSDEEP 786432:zKhRG6tozgdXGWZlwECKH22SkMu/7WHV0g5QQw:zKhRGSIgDVW2hfK195Bw
TLSH
T13E673352F0039694C96F09368CA2D5805B223AAEEE52052F706CF715B4F32177F67ABD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!seasonal.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\osu!seasonal.dll
Size 3.5MB
SHA256 27decc7e0c959078325eb800b04626d6b9498b33cf118850c0e7b78dea470500
MD5 d21d49248a8bc1b881ae21e6d78e62ce
SHA1 d797bc15640e5d9dfa3f8b132560097ed47a2c9b
SHA512 73e2d89d8d9c0c39b1d33c2700d0e20564a9cb532156c96c0a5514e6e03b6691bc08f060b4364b7a6f29421f098b33ed7aadd22164c96431162ab7928794c522
SSDEEP 98304:i1Xtu2mhrI+wKURZmFLBc0oir3jh+6H4C15FI2AeSF:Otu2mxcjR+1boW86Hb1PI2e
TLSH
T14A0633AECD8CA56BE603777450DEE994AD39333FF94F03C8DC54A6681A18B805619F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!ui.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\osu!ui.dll
Size 24.8MB
SHA256 22e041674931161e2c2c15241fb6c5f3125f8d57e4660ef7c0b7fb64449253c7
MD5 6448b4b0a3ec3a875f850a502fd29213
SHA1 ef5e46ac0947f815802cc6601ab1c4a344f8db19
SHA512 629397961e97e8bf68dcabfa768ce658769310415f1c2f9a3687882cdc978ab746c7477deb80d95675020cfea243b5b8a81f919c048d8a53bbfbeda201d0a534
SSDEEP 393216:+weL9xcZy55AfilHOSrGRWPxe/WGfvWJmaHQILW6UFoMMoGHTkuBZOq5OmlRkkf:6rZSfKOZRWPs/WG3V5IS6UFFtIgi5
TLSH
T130472247B30A96D9F1521A360866C656C720BD0C6F1207DFFA6EBF28E5732851F2371A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pthreadGC2.dll

Path C:\Users\Admin\AppData\Local\osu!\_pending\pthreadGC2.dll
Size 75KB
SHA256 b18c8437663002e4a4f06c4c1b7bec71fe13e5e6bbb927c68a273de02a5c690f
MD5 00678eb6be3b52d562b66218c93e21a8
SHA1 ba583d1520da22f3d3b89196c981279ecda58648
SHA512 58d9ffa0f569ba7b1aaea62b49f5bfa18bf23c54d2487eb9e4da984469236c2d4baabeeeac7e4b71d66b8c30f7fff4890fee5ee25e00369fc4afce053cbeb048
SSDEEP 1536:foAm0g76WsZmEZDIMiH3YNK4ajT+Aa5QEajQi1vWXiujQiaODWXiO:Qh62MiH3YN8T+Aaba9vgpDDg/
TLSH
T18B73C9D13AA95CE7E5601A38D5E6D362793BF1E017138B13E334D4360E9AB81FAD421B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osu!.cfg

Path C:\Users\Admin\AppData\Local\osu!\osu!.cfg
Size 856B
SHA256 d037fe50380998945e319279b06903c9336c304c0b9b47e8e89d3292c76fb6b4
MD5 c558fadcd41d7ef64919fce4be7aed30
SHA1 9b6dac5d6332cdb84f48a2ed53d3ac17d7cdc0a7
SHA512 78784121fe238db9599f4d34fae15ed5a88b37fa6328180499c573b5a879241da7ea602a83399a7ce52fb0c51ccffa2d370de635d0cc7c686dfc6d5f467b17c0
TLSH
T118115E1C611CE3823D6C21684B2E897E30B8C4D3B2BEEAFEC5E0439978472CC8002D08
MD5 SHA1 SHA512 TLSH

Submit Download

osu!.exe

Path C:\Users\Admin\AppData\Local\osu!\osu!.exe
Size 4.3MB
SHA256 3adc2d001aacced5f92ba8ae24121980d5e23f5653f37d14cf4765bca1abd9f9
MD5 f845ef10bf97c3260b818fc02e73e196
SHA1 ac17e56fd28d86ff0b5f7d520e17d7237fde3163
SHA512 814372403fb942ba63c44ce1e223ed7fb7c54b136bb3b81b377457da6195c638738c9446d675070b9613ede66fde7cb95caedd36af13315370ebc892d42fc0d4
SSDEEP 49152:UvmS8LTfZMBXdUxmZ0ixDej4V1/i5g+7Z16rPZrpzRXJJA+xaQRfvWtxRxpDOhG:Uvl8LwRZjJV1eFH6lbctxRxpDOhG
TLSH
T1BC268C6067E48E3ED56E87BAE495190663F5CC88B7C77BCF6829B97028B7345180334B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2464-15-0x0000000006C80000-0x0000000006CBC000-memory.dmp

Download

memory/2464-17-0x0000000005D60000-0x0000000005D70000-memory.dmp

Download

memory/2464-16-0x0000000007290000-0x000000000729A000-memory.dmp

Download

memory/2464-19-0x0000000005D60000-0x0000000005D70000-memory.dmp

Download

memory/2464-14-0x0000000005D60000-0x0000000005D70000-memory.dmp

Download

memory/2464-18-0x0000000005D60000-0x0000000005D70000-memory.dmp

Download

memory/2464-2-0x0000000005C70000-0x0000000005D02000-memory.dmp

Download

memory/2464-0-0x0000000000D80000-0x00000000011D6000-memory.dmp

Download

memory/2464-1-0x0000000006320000-0x00000000068C4000-memory.dmp

Download

memory/3340-366-0x000000000DCD0000-0x000000000E0FC000-memory.dmp

Download

memory/3340-422-0x0000000074770000-0x0000000074F20000-memory.dmp

Download

memory/3340-367-0x000000000E100000-0x000000000E454000-memory.dmp

Download

memory/3340-378-0x000000000E860000-0x000000000EA70000-memory.dmp

Download

memory/3340-386-0x0000000008860000-0x0000000008873000-memory.dmp

Download

memory/3340-383-0x000000006E280000-0x000000006E2D7000-memory.dmp

Download

memory/3340-389-0x0000000008B20000-0x0000000008B94000-memory.dmp

Download

memory/3340-351-0x0000000007070000-0x00000000070C6000-memory.dmp

Download

memory/3340-435-0x000000006F8A0000-0x00000000707DC000-memory.dmp

Download

memory/3340-363-0x000000006F8A0000-0x00000000707DC000-memory.dmp

Download

memory/3340-431-0x0000000008860000-0x0000000008873000-memory.dmp

Download

memory/3376-285-0x00000000055F0000-0x0000000005600000-memory.dmp

Download

memory/3376-48-0x000000000A530000-0x000000000AA5C000-memory.dmp

Download

memory/3376-39-0x00000000055F0000-0x0000000005600000-memory.dmp

Download

memory/3376-37-0x00000000055F0000-0x0000000005600000-memory.dmp

Download

memory/3376-63-0x000000000A4B0000-0x000000000A4D2000-memory.dmp

Download

memory/3376-64-0x000000000AB30000-0x000000000AE84000-memory.dmp

Download

memory/3376-289-0x00000000055F0000-0x0000000005600000-memory.dmp

Download