luminosity | aac0dd298382d968fe884078c1e28bb524eb4a69f445220b4e803bf8eb87a234

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Spy.MSIL.Omaneat.blr.exe
Size 1014KB
Sample261016-e4k14aff54
SHA256 aac0dd298382d968fe884078c1e28bb524eb4a69f445220b4e803bf8eb87a234
MD5 8aa6bb7a2e0b4af0df0d9325a7da389c
SHA1 b0131d2a4fb06350c850218b56684ed0d9908b12
SHA512 bf3c5f1dee70d1afc8226b70abf64438354919e79047db757a28d154a7ba64302f15bd990ed53b172eee3b90fdb7845a24a2b3002512d538279886e00a745c48
SSDEEP 12288:W8kh0mqP7DAA2lNbxx+HOruR7IaXlcWwqynZEmE/FIGUc8ZdTd/nTHMben2VDj6Y:0vl1bxEuruRzkqyERFChbd/TsKmDlv
TLSH
T18925F1143ADCC5D2FA698FB43922EA5600ABDDF852C8570339DF2C9CE7749D0468DB92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution luminosity persistence rat

Malware Config

Signatures

Family: Luminosity 2 IoCs

Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

rat luminosity

description	ioc	pid	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		jaffacakes118_Trojan-Spy.MSIL.Omaneat.blr.exe
		1112	schtasks.exe

Executes dropped EXE 8 IoCs

pid	Process
5708	hswyeww.exe
1540	hswyeww.exe
3832	client.exe
4340	hswyeww.exe
6016	hswyeww.exe
2492	client.exe
5472	hswyeww.exe
1204	client.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 5708 set thread context of 1540	5708	hswyeww.exe	93
PID 5708 set thread context of 4220	5708	hswyeww.exe	94
PID 4340 set thread context of 6016	4340	hswyeww.exe	100
PID 5472 set thread context of 5952	5472	hswyeww.exe	107

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Client\client.exe	hswyeww.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2532	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_Trojan-Spy.MSIL.Omaneat.blr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_Trojan-Spy.MSIL.Omaneat.blr.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msbuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Spy.MSIL.Omaneat.blr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hswyeww.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hswyeww.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msbuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hswyeww.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hswyeww.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hswyeww.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1112	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5708	hswyeww.exe
5708	hswyeww.exe
4220	msbuild.exe
5708	hswyeww.exe
4220	msbuild.exe
5708	hswyeww.exe
5708	hswyeww.exe
4220	msbuild.exe
5708	hswyeww.exe
4220	msbuild.exe
5708	hswyeww.exe
4220	msbuild.exe
1540	hswyeww.exe
5708	hswyeww.exe
1540	hswyeww.exe
1540	hswyeww.exe
1540	hswyeww.exe
5708	hswyeww.exe
4220	msbuild.exe
1540	hswyeww.exe
1540	hswyeww.exe
5708	hswyeww.exe
4220	msbuild.exe
5708	hswyeww.exe
1540	hswyeww.exe
1540	hswyeww.exe
4220	msbuild.exe
1540	hswyeww.exe
1540	hswyeww.exe
5708	hswyeww.exe
1540	hswyeww.exe
1540	hswyeww.exe
1540	hswyeww.exe
1540	hswyeww.exe
1540	hswyeww.exe
1540	hswyeww.exe
1540	hswyeww.exe
1540	hswyeww.exe
1540	hswyeww.exe
1540	hswyeww.exe
1540	hswyeww.exe
1540	hswyeww.exe
4220	msbuild.exe
4220	msbuild.exe
4220	msbuild.exe
4220	msbuild.exe
1540	hswyeww.exe
1540	hswyeww.exe
1540	hswyeww.exe
1540	hswyeww.exe
1540	hswyeww.exe
1540	hswyeww.exe
1540	hswyeww.exe
1540	hswyeww.exe
1540	hswyeww.exe
1540	hswyeww.exe
1540	hswyeww.exe
1540	hswyeww.exe
1540	hswyeww.exe
1540	hswyeww.exe
1540	hswyeww.exe
1540	hswyeww.exe
1540	hswyeww.exe
1540	hswyeww.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5708	hswyeww.exe
Token: SeDebugPrivilege	4220	msbuild.exe
Token: SeDebugPrivilege	1540	hswyeww.exe
Token: SeDebugPrivilege	4340	hswyeww.exe
Token: SeDebugPrivilege	5472	hswyeww.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1540	hswyeww.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 5708	4720	jaffacakes118_Trojan-Spy.MSIL.Omaneat.blr.exe	89
PID 5708 wrote to memory of 2532	5708	hswyeww.exe	90
PID 2532 wrote to memory of 5740	2532	cmd.exe	92
PID 5708 wrote to memory of 1540	5708	hswyeww.exe	93
PID 5708 wrote to memory of 1540	5708	hswyeww.exe	93
PID 5708 wrote to memory of 1540	5708	hswyeww.exe	93
PID 5708 wrote to memory of 1540	5708	hswyeww.exe	93
PID 5708 wrote to memory of 1540	5708	hswyeww.exe	93
PID 5708 wrote to memory of 4220	5708	hswyeww.exe	94
PID 5708 wrote to memory of 4220	5708	hswyeww.exe	94
PID 5708 wrote to memory of 4220	5708	hswyeww.exe	94
PID 5708 wrote to memory of 4220	5708	hswyeww.exe	94
PID 5708 wrote to memory of 4220	5708	hswyeww.exe	94
PID 1540 wrote to memory of 1112	1540	hswyeww.exe	95
PID 1540 wrote to memory of 4220	1540	hswyeww.exe	94
PID 1540 wrote to memory of 4220	1540	hswyeww.exe	94
PID 1540 wrote to memory of 4220	1540	hswyeww.exe	94
PID 1540 wrote to memory of 4220	1540	hswyeww.exe	94
PID 4220 wrote to memory of 4340	4220	msbuild.exe	99
PID 4340 wrote to memory of 6016	4340	hswyeww.exe	100
PID 4340 wrote to memory of 6016	4340	hswyeww.exe	100
PID 4340 wrote to memory of 6016	4340	hswyeww.exe	100
PID 4340 wrote to memory of 6016	4340	hswyeww.exe	100
PID 4340 wrote to memory of 6016	4340	hswyeww.exe	100
PID 1540 wrote to memory of 4468	1540	hswyeww.exe	102
PID 1540 wrote to memory of 2492	1540	hswyeww.exe	104
PID 1540 wrote to memory of 2492	1540	hswyeww.exe	104
PID 1540 wrote to memory of 2492	1540	hswyeww.exe	104
PID 1540 wrote to memory of 2492	1540	hswyeww.exe	104
PID 4220 wrote to memory of 5472	4220	msbuild.exe	105
PID 5472 wrote to memory of 4828	5472	hswyeww.exe	106
PID 5472 wrote to memory of 5952	5472	hswyeww.exe	107
PID 5472 wrote to memory of 5952	5472	hswyeww.exe	107
PID 5472 wrote to memory of 5952	5472	hswyeww.exe	107
PID 5472 wrote to memory of 5952	5472	hswyeww.exe	107
PID 5472 wrote to memory of 5952	5472	hswyeww.exe	107
PID 1540 wrote to memory of 1204	1540	hswyeww.exe	108
PID 1540 wrote to memory of 1204	1540	hswyeww.exe	108
PID 1540 wrote to memory of 1204	1540	hswyeww.exe	108
PID 1540 wrote to memory of 1204	1540	hswyeww.exe	108

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.MSIL.Omaneat.blr.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.MSIL.Omaneat.blr.exe"
1⤵
- Family: Luminosity
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\hswyeww.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\hswyeww.exe" -n
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5708
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\hswyeww.lnk" /f
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2532
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v "Load" /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\hswyeww.lnk" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:5740
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\hswyeww.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\hswyeww.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1540
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /sc MINUTE /f /rl highest
      4⤵
      Family: Luminosity
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1112
  - - C:\Windows\SysWOW64\REG.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
      4⤵
      System Location Discovery: System Language Discovery
      PID:4468
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\msbuild.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\msbuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4220
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\hswyeww.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\hswyeww.exe" -n
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4340
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\hswyeww.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\hswyeww.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6016
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\hswyeww.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\hswyeww.exe" -n
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5472
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\hswyeww.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\hswyeww.exe"
        5⤵
        
        PID:4828
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\msbuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\msbuild.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5952

C:\Program Files (x86)\Client\client.exe
"C:\Program Files (x86)\Client\client.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3832

C:\Program Files (x86)\Client\client.exe
"C:\Program Files (x86)\Client\client.exe" /startup
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2492

C:\Program Files (x86)\Client\client.exe
"C:\Program Files (x86)\Client\client.exe" /startup
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

62B5AF9BE9ADC1085C3C56EC07A82BF6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\62B5AF9BE9ADC1085C3C56EC07A82BF6
Size 26KB
SHA256 0795f8f0e616d33050adb4bae2c724ba3f8007a5998826f1200d27cef3a13a6c
MD5 ff690102c64e4baa8bad0c6a7a0fcac2
SHA1 b540a742f34bca1ad6b1541a7fd372025389a138
SHA512 36f8fc1fdacb07bc06bb32a8562663eb035d665e04cd0124b9abd3d55d6313adc48b7c0eaf335814a8996fae47a04eee24ab12ea5168a2acc55404084194f2ee
SSDEEP 384:zUkQFwszgMxAXQjBnzqzx80qLnv3B9xKjtB1WGTz02kq/9w9HvDdWBtudAJLqE5I:zgbEMxASm98vnvR9rg02ku+xRgL5I
TLSH
T12EC2FADCAC5539D7A045E2B2C98B9EA7DDB4B58437C2D00B96644F454822FCEDEE80E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7B8944BA8AD0EFDF0E01A43EF62BECD0_665DAF103B1E80D6E6D4DA6D9DF12E6B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B8944BA8AD0EFDF0E01A43EF62BECD0_665DAF103B1E80D6E6D4DA6D9DF12E6B
Size 5B
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
MD5 SHA1 SHA512

Submit Download

8DFDF057024880D7A081AFBF6D26B92F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F
Size 834B
SHA256 f64b94c786a213df5f80716f98b2e4f90edb77609b43dce1c788792f460a53dd
MD5 6e7576248913afc6faab4229d85e3fcf
SHA1 143ad96b5dbb9c61c0fd5c61c91ca2f60c171624
SHA512 3481f48d977635f480beace91a79752fbc22377239d722cfc6921c63d9cc2ae3bf899c810d37d2939370867c8e323997ddd63a13aa823a6036e5ea332bed0c5c
TLSH
T1E4011E9644083012A4806B24C948ED5FCEB8A39D4FEC9802A0E48D8F5E53FF86B5216A
MD5 SHA1 SHA512 TLSH

Submit Download

62B5AF9BE9ADC1085C3C56EC07A82BF6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\62B5AF9BE9ADC1085C3C56EC07A82BF6
Size 212B
SHA256 5a09cc2b06d1a7f0ccb8208639ecea96f8fc56111a8e7f4d9f363d804095ce3a
MD5 5a3e3a5ec6baa626743ff3866bfd902a
SHA1 68261165526d56138e143fece5f34e752e34d53b
SHA512 767796cfb002835c2991c288073cdeef43052e2a57712313a913f9097908319374088a670eee22ce630b97a1208c20b1d6cbb194976261e3409cfc572097c329
TLSH
T193D08C02072A4143F0A64B3E2AD217276F27EFB28541CB081B7013094A38E22AC78D26
MD5 SHA1 SHA512 TLSH

Submit Download

7B8944BA8AD0EFDF0E01A43EF62BECD0_665DAF103B1E80D6E6D4DA6D9DF12E6B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B8944BA8AD0EFDF0E01A43EF62BECD0_665DAF103B1E80D6E6D4DA6D9DF12E6B
Size 404B
SHA256 fb9af276d9fbb23ccaa41b6e6dab8f82c310e484b79bdb34e6724560fee99ae8
MD5 de1ecdf2951c6c527073efdb3fb4ca2e
SHA1 d7417b5dbb1738563804f9b74bb319fb7692447c
SHA512 b97f751c05f4743e6b1f95ce72bfeaad6c0f751d3e1ff221296e51d71d4093842281a2f977b47de629d3a888dd25e7097d20f0e26895e0be4bc8479adaaaff1d
TLSH
T1C2E07D14167DC23CF175DE7847DDB263948FFF52549042B54555168A7902D009CA253A
MD5 SHA1 SHA512 TLSH

Submit Download

7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6
Size 404B
SHA256 8e17e08abbc966d89aef3b926a4dcfdf11f1a0aeddf9134e1b1457cfb4c9b4c1
MD5 0f8180bfa3c38c063668c9bf478e3d7b
SHA1 33840301875baeafda064b07bfefc6175ee7007d
SHA512 4cb1baa7adb8beef2fc8d8f2724ea6b46f5acce86758e62e42f9d891280ddb0b039e74f6074b494fef11c69399bac3afb68a729a50844524db1d0f0781022df2
TLSH
T14AE07D0819FE51ADF1B48D7A9BD255176917F901046043B982C022029633E000CF1A31
MD5 SHA1 SHA512 TLSH

Submit Download

8DFDF057024880D7A081AFBF6D26B92F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F
Size 188B
SHA256 bc8ec14df838a8a0dec77e6b7eb9eda977a19a62b3a12a559ed54d5f8508b3bc
MD5 60f8df17c92837cbaa168f87880fadd1
SHA1 561603ed0073d88f2bb9eca5158dbbe551828d6d
SHA512 a0391022c764c0d2681678e997457efc350c06f6f2f7929208d0b4116897078a31885e43a1c465fc40fc00bdba369eabeae965fcedb97b1c4e0cc81ee7156b6a
TLSH
T10DC08C0427948501F6E20ABE086942045F30BE159751C3194B3923289838A000D77E01
MD5 SHA1 SHA512 TLSH

Submit Download

fl.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\fl.txt
Size 11B
SHA256 56c3f4973f1ab88b6ac45e02ced5105658ce67b0149a7449e1dc0254f27fff1f
MD5 04b8c05c4b038dd0c3f8d303b3efb467
SHA1 1aa93f3e4e3d107df7a65379fecc2c9a199d9548
SHA512 42e76de0cdf6d089953ad0a9211c5f84c456ccb510fc367293b898958675e72bfd865b687b7e4028038a0acf602efb06498071d75cfe591296577170e1ee8e4e
MD5 SHA1 SHA512

Submit Download

hswyeww.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ScreenToGif\hswyeww.exe
Size 1014KB
SHA256 aac0dd298382d968fe884078c1e28bb524eb4a69f445220b4e803bf8eb87a234
MD5 8aa6bb7a2e0b4af0df0d9325a7da389c
SHA1 b0131d2a4fb06350c850218b56684ed0d9908b12
SHA512 bf3c5f1dee70d1afc8226b70abf64438354919e79047db757a28d154a7ba64302f15bd990ed53b172eee3b90fdb7845a24a2b3002512d538279886e00a745c48
SSDEEP 12288:W8kh0mqP7DAA2lNbxx+HOruR7IaXlcWwqynZEmE/FIGUc8ZdTd/nTHMben2VDj6Y:0vl1bxEuruRzkqyERFChbd/TsKmDlv
TLSH
T18925F1143ADCC5D2FA698FB43922EA5600ABDDF852C8570339DF2C9CE7749D0468DB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1204-76-0x00000000049F0000-0x0000000004A07000-memory.dmp

Download

memory/1204-75-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/1204-78-0x00000000049F0000-0x0000000004A07000-memory.dmp

Download

memory/1204-74-0x00000000049F0000-0x0000000004A07000-memory.dmp

Download

memory/1204-72-0x00000000049F0000-0x0000000004A07000-memory.dmp

Download

memory/1204-73-0x00000000049F0000-0x0000000004A07000-memory.dmp

Download

memory/1540-50-0x0000000074460000-0x0000000074A81000-memory.dmp

Download

memory/1540-45-0x0000000074460000-0x0000000074A81000-memory.dmp

Download

memory/1540-43-0x0000000000400000-0x00000000004DC000-memory.dmp

Download

memory/2492-68-0x0000000006130000-0x0000000006147000-memory.dmp

Download

memory/2492-66-0x0000000006130000-0x0000000006147000-memory.dmp

Download

memory/2492-62-0x0000000006130000-0x0000000006147000-memory.dmp

Download

memory/2492-63-0x0000000006130000-0x0000000006147000-memory.dmp

Download

memory/2492-64-0x0000000006130000-0x0000000006147000-memory.dmp

Download

memory/2492-65-0x0000000006150000-0x0000000006151000-memory.dmp

Download

memory/4220-55-0x00000000056F0000-0x0000000005707000-memory.dmp

Download

memory/4220-54-0x0000000005710000-0x0000000005711000-memory.dmp

Download

memory/4220-52-0x00000000056F0000-0x0000000005707000-memory.dmp

Download

memory/4220-46-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4220-53-0x00000000056F0000-0x0000000005707000-memory.dmp

Download

memory/4220-51-0x00000000056F0000-0x0000000005707000-memory.dmp

Download

memory/4720-0-0x00000000015E0000-0x00000000015F0000-memory.dmp

Download

memory/4720-1-0x0000000074462000-0x0000000074464000-memory.dmp

Download

memory/5708-57-0x0000000074460000-0x0000000074A81000-memory.dmp

Download

memory/5708-48-0x0000000074460000-0x0000000074A81000-memory.dmp

Download

memory/5708-32-0x0000000074460000-0x0000000074A81000-memory.dmp

Download