cfa36c1edd4421353a9541fecb7394769f613669ce603bbbabd63cb3916f9700

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/10/2026, 23:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 754KB
Sample261013-29f1navxcs
SHA256 cfa36c1edd4421353a9541fecb7394769f613669ce603bbbabd63cb3916f9700
MD5 18e2a6948a858aeda246cef1419ad330
SHA1 cabeae362e77ec45896aed7206869bbf5a76a1f0
SHA512 01920d008c55e3f162d1cbe52c7ba5d6bf5c3566db0f630a93f473452fc6ca2fd11c420cd48e2c9b8d8af391ebc7828cabfcc012d3663f6c821b2abbc941c515
SSDEEP 12288:vlC5lkhH04RuaBSgbzYGci+Oer5y5Fzyi6RxHANUzIky3DBkO:vukhHRuaBSgbf65yrzyzUNvzOO
TLSH
T1D9F4124123D428B5F8A1167389EFA81A46B1FC345847C059D0C06E4ABF77FD4EA7A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4680	netsh.exe
4576	netsh.exe
1804	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
1760	container32.exe
2580	Windows32.exe

Loads dropped DLL 3 IoCs

pid	Process
2900	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
1760	container32.exe
2580	Windows32.exe

Installs/modifies Browser Helper Object 2 TTPs 5 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{180A7E63-6CFD-412F-9119-08F4A285E635}	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	container32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F6190A04-28F5-B32C-16F7-6A3904F0776C}	container32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F6190A04-28F5-B32C-16F7-6A3904F0776C}\NoExplorer = "1"	container32.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\1536809890	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File created	C:\Windows\SysWOW64\container32.exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\1536809890	container32.exe
File opened for modification	C:\Windows\SysWOW64\2137ccd51270P.manifest	container32.exe
File opened for modification	C:\Windows\SysWOW64\2137ccd51270C.manifest	container32.exe
File created	C:\Windows\SysWOW64\agentactivationruntime32.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\2137ccd51270O.manifest	container32.exe
File opened for modification	C:\Windows\SysWOW64\2137ccd51270S.manifest	container32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	container32.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	container32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\XMLHTTP_UUID_Default = 637e0a18fd6c2f41911908f4a285e635	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\Software\Wbumjjhbkw	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer\Main\XMLHTTP_UUID_Default = 637e0a18fd6c2f41911908f4a285e635	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer\Main\XMLHTTP_UUID_Default = 637e0a18fd6c2f41911908f4a285e635	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Wbumjjhbkw\CLSID\ = "{78a45573-a56b-4519-9e9f-a6a0a05598e6}"	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\2137ccd5 = " "	container32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	container32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	container32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	container32.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Wbumjjhbkw	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Wbumjjhbkw\CLSID\ = "{78a45573-a56b-4519-9e9f-a6a0a05598e6}"	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key created	\REGISTRY\USER\S-1-5-20	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\XMLHTTP_UUID_Default = 637e0a18fd6c2f41911908f4a285e635	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	container32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	container32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Wbumjjhbkw	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Wbumjjhbkw\CLSID	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key created	\REGISTRY\USER\S-1-5-19	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Wbumjjhbkw\CLSID	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Wbumjjhbkw\CLSID	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key created	\REGISTRY\USER\.DEFAULT	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Wbumjjhbkw\CLSID\ = "{78a45573-a56b-4519-9e9f-a6a0a05598e6}"	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key created	\REGISTRY\USER\S-1-5-19\Software	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key created	\REGISTRY\USER\S-1-5-20\Software	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Modifies registry class 20 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wbumjjhbkw\CLSID\ = "{78a45573-a56b-4519-9e9f-a6a0a05598e6}"	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{78a45573-a56b-4519-9e9f-a6a0a05598e6}	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.fsharproj	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.fsharproj\PersistentHandler\ = "{c6f66119-7556-4c63-9c77-c13848f75d3b}"	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6190A04-28F5-B32C-16F7-6A3904F0776C}\ = "51449c80"	container32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6190A04-28F5-B32C-16F7-6A3904F0776C}\InProcServer32\ThreadingModel = "Apartment"	container32.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Wbumjjhbkw	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.fsharproj\PersistentHandler	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{180A7E63-6CFD-412F-9119-08F4A285E635}\InprocServer32	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{180A7E63-6CFD-412F-9119-08F4A285E635}\InprocServer32\ = "C:\\Windows\\SysWow64\\agentactivationruntime32.dll"	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Wbumjjhbkw\CLSID	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software\Wbumjjhbkw\CLSID\ = "{78a45573-a56b-4519-9e9f-a6a0a05598e6}"	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6190A04-28F5-B32C-16F7-6A3904F0776C}	container32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6190A04-28F5-B32C-16F7-6A3904F0776C}\InProcServer32	container32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wbumjjhbkw\CLSID	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wbumjjhbkw	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Software	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{180A7E63-6CFD-412F-9119-08F4A285E635}	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{180A7E63-6CFD-412F-9119-08F4A285E635}\InprocServer32\ThreadingModel = "Both"	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6190A04-28F5-B32C-16F7-6A3904F0776C}\InProcServer32\ = "C:\\ProgramData\\agentactivationruntime32.dll"	container32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2900	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
2900	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 4680	2900	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	88
PID 2900 wrote to memory of 4576	2900	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	90
PID 2900 wrote to memory of 1804	2900	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	92
PID 1760 wrote to memory of 2580	1760	container32.exe	96

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="Windows Update Service" dir=in action=allow program="c:\windows\syswow64\container32.exe" enable=yes profile=domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4680
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="Windows Update Service" dir=in action=allow program="c:\windows\syswow64\container32.exe" enable=yes profile=private
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4576
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="Windows Update Service" dir=in action=allow program="c:\windows\syswow64\container32.exe" enable=yes profile=public
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1804

\??\c:\windows\SysWOW64\container32.exe
c:\windows\SysWOW64\container32.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1760
- C:\ProgramData\Windows32.exe
  schutz
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

agentactivationruntime32.dll

Path C:\ProgramData\agentactivationruntime32.dll
Size 167KB
SHA256 e0936310cf5266aefaac2d782c9ee78cd0c5a8c46971fc3f8591c2645d7177c8
MD5 c78afd409555e5f547cc9162dcfb2471
SHA1 6420546f7c1a2cb429554f3c8bd4815b97d3c42d
SHA512 d93e03e40e8d8c79e13b6429c0f55937d7dc78c085e21d46bdb082bd6079e42801642dff70b71390211aba76a2c3e6b6167bec836c0afcda22096aa38449df24
SSDEEP 3072:Ih9n4LWOCydszbxAQ8UZZsomGagt4Ng3AaW8ctAMtPl94:+OzUxAQDZsomBxg3AxDOM
TLSH
T11DF3AED1331741B5E4E111764AFFA49AE73885B08026ECA5B240BE63DFB7EE86718707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1536809890

Path C:\Windows\SysWOW64\1536809890
Size 78B
SHA256 7e8893273f58c5af6b829a69696f3c73d940c4cb9aeffe995efe6b0a526cb36e
MD5 ac47b9ea1a676bbed7c1b73c8364eed1
SHA1 a7bca73f0c0c735571c091218c8797a459499c13
SHA512 ae8b3ca3e62e6fec7d4c6dd6dd5261fd09237b99335c4f33159910df7ba2fac1b8f36e2b115d2cea975e2abba117edbdd68842b3b1c8f8ba9f0c37ee0238e1ea
TLSH
T12DA012025447045411308A50C541381808A08900AD2C56C145E210808110888C884401
MD5 SHA1 SHA512 TLSH

Submit Download

1536809890

Path C:\Windows\SysWOW64\1536809890
Size 106B
SHA256 e73a47d3b257633da77376c3cf0c013270439672166e9dbb5cc6aa305697a44f
MD5 d7081ce39d00b3c29dff1ebbdb0d09ec
SHA1 adbdefe22ea65c1ed668cde07d8e45299a7535be
SHA512 cee328bbfe758e529e4a1da271bf634a5f11623cf3e32203eb60b3d4f0d1c1e517f0e82ea34e8707728bbf6bf3c1b53da3fee8ef71c5fcb3fb1475fe24d0766e
TLSH
T1AEB0120AB0CB04781E70CEB4C7833C5C0CF09D04EE2C7FC284E635849250A99C84D411
MD5 SHA1 SHA512 TLSH

Submit Download

agentactivationruntime32.dll

Path C:\Windows\SysWOW64\agentactivationruntime32.dll
Size 349KB
SHA256 379edfb3dd04c4165e55062ca2b4ce14d689f11d2311257f8b165e1f3329debc
MD5 268f1772ea33994919af65a0942154c4
SHA1 78d6b3b4866c200a0ae8471bc6ab85fddaa72b51
SHA512 7dd47d89763ba4e8451e8c042d754fcbc76614231ea7aa3f6d6cb117e2e7d24f6a69323c894eb303239842c28bd551fbee6f519ba5be0ae65dceb565842dc85a
SSDEEP 6144:MpyzofRthLzmUDrb7BpQpXfqxWYS7aWU+thbzXtb:s//rb7BpQfqxYmWU+tZXN
TLSH
T11A74E09123B411B8F4F106B685FFAD6A8B3498E00812E5685154BDB7EF77FC8AB54383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

container32.exe

Path C:\Windows\SysWOW64\container32.exe
Size 754KB
SHA256 cfa36c1edd4421353a9541fecb7394769f613669ce603bbbabd63cb3916f9700
MD5 18e2a6948a858aeda246cef1419ad330
SHA1 cabeae362e77ec45896aed7206869bbf5a76a1f0
SHA512 01920d008c55e3f162d1cbe52c7ba5d6bf5c3566db0f630a93f473452fc6ca2fd11c420cd48e2c9b8d8af391ebc7828cabfcc012d3663f6c821b2abbc941c515
SSDEEP 12288:vlC5lkhH04RuaBSgbzYGci+Oer5y5Fzyi6RxHANUzIky3DBkO:vukhHRuaBSgbf65yrzyzUNvzOO
TLSH
T1D9F4124123D428B5F8A1167389EFA81A46B1FC345847C059D0C06E4ABF77FD4EA7A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1760-25-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/1760-54-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/1760-67-0x0000000010000000-0x0000000010032000-memory.dmp

Download

memory/1760-61-0x0000000010000000-0x0000000010032000-memory.dmp

Download

memory/1760-58-0x0000000010000000-0x0000000010032000-memory.dmp

Download

memory/1760-34-0x0000000010000000-0x0000000010032000-memory.dmp

Download

memory/1760-55-0x0000000010000000-0x0000000010032000-memory.dmp

Download

memory/2580-56-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/2900-30-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/2900-0-0x00000000004C0000-0x00000000004C1000-memory.dmp

Download

memory/2900-2-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/2900-8-0x0000000010000000-0x000000001008C000-memory.dmp

Download

memory/2900-1-0x0000000000400000-0x00000000004C3000-memory.dmp

Download

memory/2900-7-0x0000000000400000-0x00000000004C3000-memory.dmp

Download