GatherOsState.exe

Named by 2 kept items in this workspace.

1 items name it under affected products and 1 under classification.key entities.

Search every workspace for GatherOsState.exe. It matches the name as written, so it can find other things that share it.

The items that name it 2

China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor
writeupas classification.key entities2026-09-30
Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign
articleas affected products
Legitimate Microsoft-signed binary abused for DLL sideloading to launch the Antino implant ('slc.dll').

All technologies in this workspace.