luminosity | a53ce60e4dd1d6652d3a54e840ead24943d9f3a98f5c301b5ac78f342a11dc4d

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 08:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Spy.MSIL.Omaneat.amu.exe
Size 1.2MB
Sample261012-j167daaa57
SHA256 a53ce60e4dd1d6652d3a54e840ead24943d9f3a98f5c301b5ac78f342a11dc4d
MD5 a2fd7c398d683a907272a7c4350e6673
SHA1 b8839215f812eea973cf4d5a2f8d9082e046e17e
SHA512 c74503ff9e6d6ff9c7434e1a4aed4d1f3876ae09068c0684322a82eab27a7388640a2dadd6a5295ee96369ce8b43561f9095acf4472fdd6fc55a643a7c188969
SSDEEP 24576:Y3nZqfbvhfHA3J4wCm8ciSrzLKDbHggUyH8ouacu0Z/skv4TBM:YOEJ4wF8GGDbHPUJbacu0FsU4tM
TLSH
T1654523023BDB503EE5B1E6306DB25A31E534FD3A1A7CE90EA750498E2E978D2C115B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution luminosity persistence rat

Malware Config

Signatures

Family: Luminosity 2 IoCs

Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

rat luminosity

description	ioc	pid	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		jaffacakes118_Trojan-Spy.MSIL.Omaneat.amu.exe
		1364	schtasks.exe

Loads dropped DLL 1 IoCs

pid	Process
2704	rundll32.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2104	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2704 set thread context of 4728	2704	rundll32.exe	93

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\explorer\explorer.exe.config	regasm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	regasm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	regasm.exe

System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Spy.MSIL.Omaneat.amu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regasm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Local Settings	jaffacakes118_Trojan-Spy.MSIL.Omaneat.amu.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1364	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2704	rundll32.exe
2704	rundll32.exe
2704	rundll32.exe
2704	rundll32.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe
4728	regasm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4728	regasm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4728	regasm.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 2104	4884	jaffacakes118_Trojan-Spy.MSIL.Omaneat.amu.exe	90
PID 2104 wrote to memory of 2704	2104	WScript.exe	91
PID 2704 wrote to memory of 2232	2704	rundll32.exe	92
PID 2704 wrote to memory of 4728	2704	rundll32.exe	93
PID 2704 wrote to memory of 4728	2704	rundll32.exe	93
PID 4728 wrote to memory of 3920	4728	regasm.exe	94
PID 4728 wrote to memory of 1364	4728	regasm.exe	97
PID 4728 wrote to memory of 5408	4728	regasm.exe	101
PID 4728 wrote to memory of 2656	4728	regasm.exe	103
PID 4728 wrote to memory of 1000	4728	regasm.exe	105
PID 4728 wrote to memory of 1596	4728	regasm.exe	107
PID 4728 wrote to memory of 3872	4728	regasm.exe	109
PID 4728 wrote to memory of 464	4728	regasm.exe	111
PID 4728 wrote to memory of 4880	4728	regasm.exe	113
PID 4728 wrote to memory of 4136	4728	regasm.exe	115
PID 4728 wrote to memory of 1340	4728	regasm.exe	117
PID 4728 wrote to memory of 1736	4728	regasm.exe	119
PID 4728 wrote to memory of 2840	4728	regasm.exe	121
PID 4728 wrote to memory of 1172	4728	regasm.exe	123
PID 4728 wrote to memory of 1908	4728	regasm.exe	125
PID 4728 wrote to memory of 1780	4728	regasm.exe	127
PID 4728 wrote to memory of 3020	4728	regasm.exe	129
PID 4728 wrote to memory of 3248	4728	regasm.exe	131
PID 4728 wrote to memory of 4624	4728	regasm.exe	133
PID 4728 wrote to memory of 1760	4728	regasm.exe	135
PID 4728 wrote to memory of 1896	4728	regasm.exe	137
PID 4728 wrote to memory of 4696	4728	regasm.exe	139
PID 4728 wrote to memory of 4968	4728	regasm.exe	141

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.MSIL.Omaneat.amu.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.MSIL.Omaneat.amu.exe"
1⤵
- Family: Luminosity
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\iSZvxDW47g\dTnd6N.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" hxo8.dll sx
    3⤵
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"
      4⤵
      PID:2232
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"
      4⤵
      Drops file in Program Files directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4728
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3920
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /NP /sc onlogon /tn "explorer" /rl highest /tr "'C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe' /startup" /f
        5⤵
        Family: Luminosity
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1364
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5408
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2656
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1000
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1596
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3872
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:464
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4880
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4136
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1340
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1736
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2840
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1172
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1908
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1780
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3020
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3248
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4624
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1760
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1896
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4696
    - - C:\Windows\SysWOW64\REG.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "explorer" /d "cmd /c """start """explorer""" """C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"""" /f /reg:64
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4968

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dTnd6N.vbs

Path C:\Users\Admin\iSZvxDW47g\dTnd6N.vbs
Size 101B
SHA256 05ba06503aee3294ae83a3b5068e6ee763b83a1ae45ba871030b1f792634e4eb
MD5 ff468e437c198350f3b1c8b2eccf986f
SHA1 b83de70a05dcfcb60947c2a2059b6221c181a23b
SHA512 1a40081e00502f4baa705127981130ca1f689391de6709a827523aaf89ad2378db603c078795c2bce18bb942fd89fc7cca69eb1056aa776702b77743c7fe4646
TLSH
T13FB01261041442C24E8A62F8005083A7883B9BD40C7098929B8FC064B160164834128D
MD5 SHA1 SHA512 TLSH

Submit Download

hxo8.dll

Path C:\Users\Admin\iSZvxDW47g\hxo8.dll
Size 10.6MB
SHA256 b6dead9c38a7bed05882a33d00a1706c1fd706737b47573754038ac8edeaae53
MD5 618d1f141ff68013a61061551d8e1764
SHA1 f3d776c17c40350bce1b25f1d1b0ce5947eaf36e
SHA512 2a09acb408b4271f56548783751c43cecff9c6767de25b44d237d14ca0976d1a609ad474fa97bbabb3743843decbf20ac95769d4458dd32df26137b4bcda6d80
SSDEEP 3072:DLaiqtsxZ3fBG6zV6ei8L9c+Tu9FrZD1gSdXk8MVBoLD7EHZHt9:DL9iI7GF4u9zD30tVBT5
TLSH
T11AB67E67F0A18871D27706BCBD06A319B93F7D202E15159A73F80D0A5BF91DC689C2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\iSZvxDW47g\x
Size 1.4MB
SHA256 eb2c2da7e153a02ff6131525592b3252a07f0ac7321e5efe7a471b266b8ba51d
MD5 771540923ebcf925dfa5c7ba991f83f1
SHA1 40cce4e21475ab432e0d43be3ff773b117f8d050
SHA512 64631d54c7047f66e3ded71dec34ed0ea0f390c58656742bd69f577865871c89e535c64f06664a5d50594a61c0638f8ab42efdb89e8ea7ceae5bdf8f3bd0e21c
SSDEEP 24576:TzRLS5YXNgfAZdfoqYTYCCYcjq2pnkX7gm0C9lb7:TzRLWYkEdfoqYMhjq2pnSh0Ulb7
TLSH
T1896533B1E665D8E4CB35B115C97BDCCEA0C20C93AD3EA6633724B76F99F0601781829D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2704-16-0x0000000002B40000-0x0000000002B57000-memory.dmp

Download

memory/2704-15-0x00000000011F0000-0x00000000011F1000-memory.dmp

Download

memory/2704-19-0x0000000002B40000-0x0000000002B57000-memory.dmp

Download

memory/2704-18-0x0000000000400000-0x0000000000427000-memory.dmp

Download

memory/4728-17-0x0000000000400000-0x00000000004DC000-memory.dmp

Download