Analysis
- max time kernel
57s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
14/10/2026, 12:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Virus.Win32.VB.gh.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Virus.Win32.VB.gh.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target jaffacakes118_Virus.Win32.VB.gh.exe
- Size 3.4MB
- Sample261014-p5dnhsds2l
- SHA256 2c229b853ac8928a6c1bb03bed89ff3063b064d78be1d6b232c9620c08735a21
- MD5 b6840cbe3c61169706e528b85812a3e4
- SHA1 7fffc9523062ab0c80bd16f9edbfdc9aa2b62b0b
- SHA512 6528d989052ccd4d82589956187a4b3482b03e222577b0be387756c1e97700b10aed7e5b7f5a785a81eff1e030b2987f310c5081c6ef8d288afbfa41e46357f9
- SSDEEP 49152:FHAHAHAHAH0butmkO+wAOInO4XrztygxLHkJE4VBWgfnneq4egP3l7p/tjaMGYSg:Ds+wE9XD8VBW8nh0kuIDQci
- TLSH T1B9F54A02935200B7D2522571C82A7B5457647FB82EF3D62BBE1075D6FA32BC2793237A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 4180 patcher.exe 1264 514.#.exe 3740 727.#.exe 3876 788.#.exe 2476 922.#.exe 3948 816.#.exe 876 210.#.exe 2760 329.#.exe 5008 406.#.exe 4184 202.#.exe 2332 789.#.exe - Adds Run key to start application 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" jaffacakes118_Virus.Win32.VB.gh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 514.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 727.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 788.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 816.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 329.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 789.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 922.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 210.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 406.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 202.#.exe - Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 922.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 210.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 406.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 789.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak patcher.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 727.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\ jaffacakes118_Virus.Win32.VB.gh.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\ jaffacakes118_Virus.Win32.VB.gh.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\zh-TW\ 922.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\es-ES\ jaffacakes118_Virus.Win32.VB.gh.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\ 788.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\ 727.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\zh-CN\ 922.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lt-LT\ 922.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\zh-TW\ 788.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 922.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\da-DK\ 816.#.exe File opened for modification C:\Program Files\dotnet\host\fxr\6.0.27\ patcher.exe File opened for modification C:\Program Files\dotnet\host\fxr\8.0.15\ jaffacakes118_Virus.Win32.VB.gh.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ 922.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$ 727.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\ 816.#.exe File opened for modification C:\Program Files\Common Files\System\es-ES\ 922.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\zh-CN\ 210.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\da-DK\ 788.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\et-EE\ 727.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fi-FI\ 727.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\ 210.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-GB\ 727.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\ jaffacakes118_Virus.Win32.VB.gh.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\ 514.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\ jaffacakes118_Virus.Win32.VB.gh.exe File opened for modification C:\Program Files\Common Files\System\msadc\es-ES\ 788.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\ 788.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\ 210.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lv-LV\ 210.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 514.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\ 922.#.exe File opened for modification C:\Program Files\Common Files\System\ado\fr-FR\ jaffacakes118_Virus.Win32.VB.gh.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 816.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nb-NO\ 727.#.exe File opened for modification C:\Program Files\Common Files\Services\ 922.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ru-RU\ 210.#.exe File opened for modification C:\Program Files\Common Files\System\ jaffacakes118_Virus.Win32.VB.gh.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sv-SE\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\ 816.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\ 210.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ 788.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ 727.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\ 727.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\ 514.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\ jaffacakes118_Virus.Win32.VB.gh.exe File opened for modification C:\Program Files\Common Files\DESIGNER\ 922.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ 788.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe jaffacakes118_Virus.Win32.VB.gh.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 922.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\ 514.#.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 727.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\ jaffacakes118_Virus.Win32.VB.gh.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lt-LT\ 816.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\ patcher.exe File opened for modification C:\Program Files\7-Zip\ 922.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\ 922.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hu-HU\ 788.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pt-BR\ 514.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Triedit\en-US\ 727.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\it-IT\ 727.#.exe File opened for modification C:\Program Files\7-Zip\ 727.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\ 922.#.exe - System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 727.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 922.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 406.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 202.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 789.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 788.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 816.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 210.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 329.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Virus.Win32.VB.gh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 514.#.exe - NTFS ADS 6 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak jaffacakes118_Virus.Win32.VB.gh.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 514.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 788.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 816.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 329.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 202.#.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4928 jaffacakes118_Virus.Win32.VB.gh.exe 4180 patcher.exe 1264 514.#.exe 3740 727.#.exe 3876 788.#.exe 2476 922.#.exe 3948 816.#.exe 876 210.#.exe 2760 329.#.exe 5008 406.#.exe 4184 202.#.exe 2332 789.#.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4928 wrote to memory of 1264 4928 jaffacakes118_Virus.Win32.VB.gh.exe 92 PID 4180 wrote to memory of 3740 4180 patcher.exe 94 PID 1264 wrote to memory of 3876 1264 514.#.exe 95 PID 3740 wrote to memory of 2476 3740 727.#.exe 96 PID 3876 wrote to memory of 3948 3876 788.#.exe 97 PID 2476 wrote to memory of 876 2476 922.#.exe 98 PID 3948 wrote to memory of 2760 3948 816.#.exe 103 PID 876 wrote to memory of 5008 876 210.#.exe 104 PID 2760 wrote to memory of 4184 2760 329.#.exe 109 PID 5008 wrote to memory of 2332 5008 406.#.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Virus.Win32.VB.gh.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Virus.Win32.VB.gh.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\514.#.exeC:\Users\Admin\AppData\Local\Temp\514.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\788.#.exeC:\Users\Admin\AppData\Local\Temp\788.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\816.#.exeC:\Users\Admin\AppData\Local\Temp\816.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\329.#.exeC:\Users\Admin\AppData\Local\Temp\329.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\202.#.exeC:\Users\Admin\AppData\Local\Temp\202.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\231.#.exeC:\Users\Admin\AppData\Local\Temp\231.#.exe7⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\216.#.exeC:\Users\Admin\AppData\Local\Temp\216.#.exe8⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\253.#.exeC:\Users\Admin\AppData\Local\Temp\253.#.exe9⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\782.#.exeC:\Users\Admin\AppData\Local\Temp\782.#.exe10⤵PID:4396
-
-
-
-
-
-
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\905c0769f9a06c95a24ddf945\727.#.exeC:\905c0769f9a06c95a24ddf945\727.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\905c0769f9a06c95a24ddf945\922.#.exeC:\905c0769f9a06c95a24ddf945\922.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\905c0769f9a06c95a24ddf945\210.#.exeC:\905c0769f9a06c95a24ddf945\210.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:876 -
C:\905c0769f9a06c95a24ddf945\406.#.exeC:\905c0769f9a06c95a24ddf945\406.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\905c0769f9a06c95a24ddf945\789.#.exeC:\905c0769f9a06c95a24ddf945\789.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2332 -
C:\905c0769f9a06c95a24ddf945\319.#.exeC:\905c0769f9a06c95a24ddf945\319.#.exe7⤵PID:4888
-
C:\905c0769f9a06c95a24ddf945\22.#.exeC:\905c0769f9a06c95a24ddf945\22.#.exe8⤵PID:4892
-
C:\905c0769f9a06c95a24ddf945\855.#.exeC:\905c0769f9a06c95a24ddf945\855.#.exe9⤵PID:432
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.4MB
- SHA256 2c229b853ac8928a6c1bb03bed89ff3063b064d78be1d6b232c9620c08735a21
- MD5 b6840cbe3c61169706e528b85812a3e4
- SHA1 7fffc9523062ab0c80bd16f9edbfdc9aa2b62b0b
- SHA512 6528d989052ccd4d82589956187a4b3482b03e222577b0be387756c1e97700b10aed7e5b7f5a785a81eff1e030b2987f310c5081c6ef8d288afbfa41e46357f9
- SSDEEP 49152:FHAHAHAHAH0butmkO+wAOInO4XrztygxLHkJE4VBWgfnneq4egP3l7p/tjaMGYSg:Ds+wE9XD8VBW8nh0kuIDQci
- TLSH T1B9F54A02935200B7D2522571C82A7B5457647FB82EF3D62BBE1075D6FA32BC2793237A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$
- Size 4.2MB
- SHA256 aa023a8b4365358124e647de4c6ce5f09ff58b3474d9cb80500ad619e1cc1d9e
- MD5 4bc5b128f28ae2497ad3bd01e337f453
- SHA1 441fbe30690e216b2751632508fd7cb7692b69f7
- SHA512 ec880ba8a6c8a7ca5efc80433cb8c494faeb0e8107c06106dcbc4dac41477db6a3426f9b7a2e3fc3354c9c2d7028a9b1cbb179eb066dbee4944c2790c3366822
- SSDEEP 98304:Ds+wE9XD8VBW8nh0kuIDQciOMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNs:DV9z88tuQs
- TLSH T11D166C02A35140A7D2622530C826B75447657FB42EF3D62BBE5036DABE327C2793277B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$
- Size 3.4MB
- SHA256 1b9c3a27677a3eacd831a15fc97defb6161eb29a0d51759c05a8072d94961511
- MD5 0b9326528ae7348e47fcf3f3217d8b85
- SHA1 3524ecb5066aa1fc9d14aa9d99d8607835061ffb
- SHA512 fa0323da798a493ffd22ba7ecb2a44f81f10d8529a83dc6d19cc70b0b887e85860e4293babf1f12515d8391897c68a7867abf82914eb2e0fe5644ec3f8c05b71
- SSDEEP 49152:FHAHAHAHAH0butmkO+wAOInO4XrztygxLHkJE4VBWgfnneq4egP3l7p/tjaMGYSq:Ds+wE9XD8VBW8nh0kuIDQciP
- TLSH T194F54A02935200B7D2522571C82A7B5457647FB82EF3D62BBE1075D6FA32BC2793237A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$
- Size 3.4MB
- SHA256 2ffea0b16bfa7235cde1c2ec60d240651bf1fd8fc925463e0732bde5b5337fe4
- MD5 55f74a35df9f4a33c441f50531f4eee5
- SHA1 f19f3ddd1d62afbf0a96aeed19a723f5a3474f2e
- SHA512 9684a01bd2f44b771aed96770861e385fa30951d8c613784c64d7e482385a3690c30005d6b7f8547ab9c6408be354c07a41e62b44ef9e4be6e96690c56808dda
- SSDEEP 49152:FHAHAHAHAH0butmkO+wAOInO4XrztygxLHkJE4VBWgfnneq4egP3l7p/tjaMGYS6:Ds+wE9XD8VBW8nh0kuIDQcij
- TLSH T1A3F55A02935200B7D2522571C82A7B5457647FB82EF3D62BBE1075D6FA32BC2793237A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe$
- Size 3.4MB
- SHA256 bc18df7012a8b5f3a2181562833fd05a56abb1820346198b6164c5625dbca568
- MD5 01ac81056d027221915b5f9594d2d884
- SHA1 9bd03672a9139889759f1ff806cdf581d0d6fd7f
- SHA512 78ab1487872b91d69b31a46ceee190c7d95775b3c1d30f0ea9c7dcb0c478a9d3dcadecdb06fdcd52b2aee7cee68ebf0788ff6b9d6d669f493d7f1148aa756729
- SSDEEP 49152:FHAHAHAHAH0butmkO+wAOInO4XrztygxLHkJE4VBWgfnneq4egP3l7p/tjaMGYS8:Ds+wE9XD8VBW8nh0kuIDQciJ
- TLSH T1BCF55A02935200B7D2522571C82A7B5457647FB82EF3D62BBE1075D6FA32BC2793237A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 3.4MB
- SHA256 2c3bf0ae07fb342dd5797d0f19292cfed07d53d289c1d7602b0454090498775a
- MD5 0e88ea191da34993e4aba7f616db13e0
- SHA1 e0f7a1a2ae28b68bf90a54994bb9779651629ded
- SHA512 97927c94e3a199fb483357902d5f352e925d7a8dc98ca46870b7e99f833d10d9ae5405e76004fc4345551020f58bfdd13e44d346347681f613f955801b08228d
- SSDEEP 49152:FHAHAHAHAH0butmkO+wAOInO4XrztygxLHkJE4VBWgfnneq4egP3l7p/tjaMGYSH:Ds+wE9XD8VBW8nh0kuIDQcim
- TLSH T1BCF55A02935200B7D2522571C82A7B5457647FB82EF3D62BBE1075D6FA32BC2793237A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\orbd.exe$
- Size 3.4MB
- SHA256 7e9a31d23ecdb3896ab8b26bb52fd42bf212017e7399945a0e0e843e849e49ab
- MD5 4f47dc116a6ccb7e858f95fc314f3dd9
- SHA1 6eb444b959543c1001370541153abb85bcd7099c
- SHA512 cecf638f0d458028b867e7ce2ab8c78e1938d40350a44f60f729a3eb247fcce60049824a32a7d742cbf770d1195d5a40378913282a249dd3bb983167d4dc5fb3
- SSDEEP 49152:FHAHAHAHAH0butmkO+wAOInO4XrztygxLHkJE4VBWgfnneq4egP3l7p/tjaMGYS6:Ds+wE9XD8VBW8nh0kuIDQcin
- TLSH T107F55A02935200B7D2522571C82A7B5457647FB82EF3D62BBE1075D6FA32BC2793237A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\rmid.exe$
- Size 3.4MB
- SHA256 a747a9e4065831c2da42905ad4b62c6fddd755e38136c84a9052a5c003ab34b1
- MD5 93c4c05fa7cc9f0f444c72e2ab591f35
- SHA1 8886255ccba456075d27fe483e2cd780cd8e0f17
- SHA512 eae91a53f924e3b28b58cd34679c73653f68cfd1a003d7b9ab4bc19eb2dbf5545877ee59267449a8163a01463b4a271c909cc3303847b5f387a06f75f3d73494
- SSDEEP 49152:FHAHAHAHAH0butmkO+wAOInO4XrztygxLHkJE4VBWgfnneq4egP3l7p/tjaMGYS4:Ds+wE9XD8VBW8nh0kuIDQci5
- TLSH T163F55A02935200B7D2522571C82A7B5457647FB82EF3D62BBE1075D6FA32BC2793237A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\782.#.exe
- Size 1.4MB
- SHA256 f41d654d615c6487ec8d53d18912ce9569e9e8a13b7ea489b5305c834920776a
- MD5 8d609eeaa2ff97739e248edc023b8487
- SHA1 ead25cc6c96d17072240d43d56d01482121c5a9a
- SHA512 85b75e26ef6a071744e36892f7b648cc70711b5d4116f5da61aebf6427308281de9f3a3878ce895d9d5922d7fdc56516c7575044c9fd3f84309fe290b692803e
- SSDEEP 24576:o96H0+96H0+96H0+96H0+96H0P3LutmkEz+PAVV/OOInO4Xs2ztR4iegxLHgZpJB:FHAHAHAHAH0butmkO+wAOInO4XrztygI
- TLSH T11765AE13F7E09077F6A346B25979A235BB7B7E300921CA0F17540F592E357D2AA2432B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\782.#.exe
- Size 2.6MB
- SHA256 a29cf193c2f09974199588e1681d7bf44d582ee491586860e9b53883dd4e0904
- MD5 64fc505e7ff7b396d055c6e40a27daed
- SHA1 171a126a27c306fdcaf92be7c6b1049b716abb08
- SHA512 e6855be96b82235a2a99a622cd2949cc38ac94b06ae35781549c6a8f29d2b231040c571b4ac72a9253fbd15f41ce9262a0012366aa2f0f9d8b8a654b2a3fcc63
- SSDEEP 49152:FHAHAHAHAH0butmkO+wAOInO4XrztygxLHkJE4VBWgfnneq4egP3l7p/tjaMGYSf:Ds+wE9XD8VBW8nh0kuID/
- TLSH T1E1D58D12E3E044B6E2A34631CD75A631677A7D350BF2866F33505AE93E31792BE24327
- MD5 SHA1 SHA512 SSDEEP TLSH