donutloader | c9f5e83f21a532812d0dcf900788fe838146e0c005b4405be7c399065292b142

Analysis

max time kernel
120s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Installer.msi
Size 2.5MB
Sample260804-ttxpgavbrf
SHA256 c9f5e83f21a532812d0dcf900788fe838146e0c005b4405be7c399065292b142
MD5 93768149bc8d5e10f231007f233d7796
SHA1 37449f695ba8ead12a01008d41f1608d39d1f70a
SHA512 557e760e909235520183cb47a0a8bfdda194dd095affd927dff3b609d86a8259e4bd076adace958d97666f5619fd1185e0bf337d7ddb3226172f85a38c6f89a5
SSDEEP 49152:PYJ4eJkQU9iW3N0XLaD3tK2OXUgtLJWMRr8nAOGJ9TR9QCJn3hiSF+wyvfcV:PYJ4jQU9iWdRw2OXxtQMBoAOW9TRC60C
TLSH
T147C533CEB1B05531DA14DF33931A461E5FA1CC49A202A5BA1170FEFF90BABD2623F549
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery donutloader loader persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/3280-67-0x0000000004580000-0x00000000045ED000-memory.dmp	family_donutloader

Executes dropped EXE 3 IoCs

pid	Process
4196	WinHelper.exe
3464	MicrosoftEdge.exe
3280	GoogleCrashHandler.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\EdgeBrowser = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Edge\\Core\\GoogleCrashHandler.exe"	MicrosoftEdge.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5953c3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5953c3.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C9A0CD43-D706-4C30-97C8-1F86EF4FC2EA}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF66B41B0E61994606.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5A1C.tmp	msiexec.exe
File created	C:\Windows\Installer\e5953c5.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE093B5ADCCEA0748.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF68E9F996704CE6E0.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0CB889F40F60C492.TMP	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2820	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleCrashHandler.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3280	GoogleCrashHandler.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4716	msiexec.exe
4716	msiexec.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3280	GoogleCrashHandler.exe
3464	MicrosoftEdge.exe
3464	MicrosoftEdge.exe
3464	MicrosoftEdge.exe
3464	MicrosoftEdge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2820	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2820	msiexec.exe
Token: SeSecurityPrivilege	4716	msiexec.exe
Token: SeCreateTokenPrivilege	2820	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2820	msiexec.exe
Token: SeLockMemoryPrivilege	2820	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2820	msiexec.exe
Token: SeMachineAccountPrivilege	2820	msiexec.exe
Token: SeTcbPrivilege	2820	msiexec.exe
Token: SeSecurityPrivilege	2820	msiexec.exe
Token: SeTakeOwnershipPrivilege	2820	msiexec.exe
Token: SeLoadDriverPrivilege	2820	msiexec.exe
Token: SeSystemProfilePrivilege	2820	msiexec.exe
Token: SeSystemtimePrivilege	2820	msiexec.exe
Token: SeProfSingleProcessPrivilege	2820	msiexec.exe
Token: SeIncBasePriorityPrivilege	2820	msiexec.exe
Token: SeCreatePagefilePrivilege	2820	msiexec.exe
Token: SeCreatePermanentPrivilege	2820	msiexec.exe
Token: SeBackupPrivilege	2820	msiexec.exe
Token: SeRestorePrivilege	2820	msiexec.exe
Token: SeShutdownPrivilege	2820	msiexec.exe
Token: SeDebugPrivilege	2820	msiexec.exe
Token: SeAuditPrivilege	2820	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2820	msiexec.exe
Token: SeChangeNotifyPrivilege	2820	msiexec.exe
Token: SeRemoteShutdownPrivilege	2820	msiexec.exe
Token: SeUndockPrivilege	2820	msiexec.exe
Token: SeSyncAgentPrivilege	2820	msiexec.exe
Token: SeEnableDelegationPrivilege	2820	msiexec.exe
Token: SeManageVolumePrivilege	2820	msiexec.exe
Token: SeImpersonatePrivilege	2820	msiexec.exe
Token: SeCreateGlobalPrivilege	2820	msiexec.exe
Token: SeBackupPrivilege	5316	vssvc.exe
Token: SeRestorePrivilege	5316	vssvc.exe
Token: SeAuditPrivilege	5316	vssvc.exe
Token: SeBackupPrivilege	4716	msiexec.exe
Token: SeRestorePrivilege	4716	msiexec.exe
Token: SeRestorePrivilege	4716	msiexec.exe
Token: SeTakeOwnershipPrivilege	4716	msiexec.exe
Token: SeRestorePrivilege	4716	msiexec.exe
Token: SeTakeOwnershipPrivilege	4716	msiexec.exe
Token: SeRestorePrivilege	4716	msiexec.exe
Token: SeTakeOwnershipPrivilege	4716	msiexec.exe
Token: SeRestorePrivilege	4716	msiexec.exe
Token: SeTakeOwnershipPrivilege	4716	msiexec.exe
Token: SeRestorePrivilege	4716	msiexec.exe
Token: SeTakeOwnershipPrivilege	4716	msiexec.exe
Token: SeRestorePrivilege	4716	msiexec.exe
Token: SeTakeOwnershipPrivilege	4716	msiexec.exe
Token: SeRestorePrivilege	4716	msiexec.exe
Token: SeTakeOwnershipPrivilege	4716	msiexec.exe
Token: SeRestorePrivilege	4716	msiexec.exe
Token: SeTakeOwnershipPrivilege	4716	msiexec.exe
Token: SeRestorePrivilege	4716	msiexec.exe
Token: SeTakeOwnershipPrivilege	4716	msiexec.exe
Token: SeRestorePrivilege	4716	msiexec.exe
Token: SeTakeOwnershipPrivilege	4716	msiexec.exe
Token: SeRestorePrivilege	4716	msiexec.exe
Token: SeTakeOwnershipPrivilege	4716	msiexec.exe
Token: SeRestorePrivilege	4716	msiexec.exe
Token: SeTakeOwnershipPrivilege	4716	msiexec.exe
Token: SeRestorePrivilege	4716	msiexec.exe
Token: SeTakeOwnershipPrivilege	4716	msiexec.exe
Token: SeRestorePrivilege	4716	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2820	msiexec.exe
2820	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2820	msiexec.exe
4716	msiexec.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 244	4716	msiexec.exe	94
PID 4716 wrote to memory of 4196	4716	msiexec.exe	96
PID 4716 wrote to memory of 3464	4716	msiexec.exe	97

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Installer.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2820

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:244
- C:\Users\Admin\AppData\Local\Programs\Microsoft\WinHelper.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft\WinHelper.exe"
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Users\Admin\AppData\Local\Programs\Microsoft\MicrosoftEdge.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft\MicrosoftEdge.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3464

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5316

C:\Users\Admin\AppData\Roaming\Microsoft\Edge\Core\GoogleCrashHandler.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Edge\Core\GoogleCrashHandler.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
PID:3280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5953c4.rbs

Path C:\Config.Msi\e5953c4.rbs
Size 8KB
SHA256 ee722a3422d9cb867a1b488de27b8a4fd1f151d5c2352b0944b751debde86737
MD5 e6bc8a8894b4133feb67acb6f4988b7e
SHA1 e49af4e9f3c866050797ba550b9ad43c7a48f017
SHA512 5467a911bc52024e5037da5b18aa176a588337e51a6ea027f1ee7b5a487bcb167023e20ba4d8cf4772d35ae97e16628b0a1933d8d77c02b345b5cc834a9694dd
SSDEEP 192:wY3pSCI4COJgNOGJOJgNOWkLJg0ylqv3fmX1pFwfzyBulnJ:wY3pBJgN7OJgNqor6
TLSH
T16C021241B21580F6F5D61B36E32757103BB6D3FBA261331F459A8A389E53F888E491C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdge.exe

Path C:\Users\Admin\AppData\Local\Programs\Microsoft\MicrosoftEdge.exe
Size 2.6MB
SHA256 a40089ce1b46ea1f4e2dde23e6090986febe027792c4e4575165d10baca19739
MD5 ae6520b80b37bbdd23af88d4b8aeea25
SHA1 c20b4bea2e51f97d713a8d04a0880c39f9e6f4dc
SHA512 4ca5b04f824a702fb485689390fad50c416a3334e3918ee5e0fc38b055088b96ff6119062c6e5629b01c3af25e874b929ab274bf7370dcc004b4ef82beeaef7a
SSDEEP 49152:M60M6hS26ecLiCrjdtrKHjbtP3wYU80UKWXUQ8CW:M6N12xWzKHjbtP3wYv0mXH
TLSH
T106D55810FDE745F2E803153185ABA2BF63344D464F39CBABEA147A6AF9B72D14837205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinHelper.exe

Path C:\Users\Admin\AppData\Local\Programs\Microsoft\WinHelper.exe
Size 2.6MB
SHA256 cd11a98edb08d5d4673f0534bd5e5cbd150248364c64582fd7f2091b69e82f4f
MD5 e4a433581ed8b75e8b3411655d2da000
SHA1 5a0c74d7ad5f6a65927b74c1f1253ffcc7443643
SHA512 1245d753338cc9f770acf6d8497bf032deeba8d836b776d157e647369b7cc2a8c2fa25b4f7260663e6aef44b00217c3c06f9f3dca1e69b6c099e2110924f5f6d
SSDEEP 49152:g3Z+ymdmVn925xKOr2m67wcu/Jj7Pl0f:g3oJkBvQc
TLSH
T1CBC54907FCA418FAC0AE92718962955A7B71BC481F3523DB2F50B6B82FB6BD05D78704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5953c3.msi

Path C:\Windows\Installer\e5953c3.msi
Size 2.5MB
SHA256 c9f5e83f21a532812d0dcf900788fe838146e0c005b4405be7c399065292b142
MD5 93768149bc8d5e10f231007f233d7796
SHA1 37449f695ba8ead12a01008d41f1608d39d1f70a
SHA512 557e760e909235520183cb47a0a8bfdda194dd095affd927dff3b609d86a8259e4bd076adace958d97666f5619fd1185e0bf337d7ddb3226172f85a38c6f89a5
SSDEEP 49152:PYJ4eJkQU9iW3N0XLaD3tK2OXUgtLJWMRr8nAOGJ9TR9QCJn3hiSF+wyvfcV:PYJ4jQU9iWdRw2OXxtQMBoAOW9TRC60C
TLSH
T147C533CEB1B05531DA14DF33931A461E5FA1CC49A202A5BA1170FEFF90BABD2623F549
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 4f082c5b319bb3f4d0f8052817a2cf21cc092a95bd80161de8d7c34320e71c5a
MD5 2636b2b5d4cb8f89d00d88c3793f6230
SHA1 cc2388ab2c0491c673fa5191c722ac9e80294d57
SHA512 be508d34a2516edb3cd4734cf1849d0473374672827d779be0b95e9fccf2f9e10f82041cf329f244cddc85889eb3f120a964199578532f6e0c10ec431d664e6b
SSDEEP 24576:wFo3DMPAdoO/vvTL/Sg88iFQvrumHb7P0BKudxSUKpyKpb9cMoRWclmd4+2:9HY
TLSH
T11857B42436F92200E7F79E3DA8F06A234D397D5BAC15DE8D45511B4E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{29f55823-4d30-470d-84bd-91a5bf78563b}_OnDiskSnapshotProp

Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{29f55823-4d30-470d-84bd-91a5bf78563b}_OnDiskSnapshotProp
Size 6KB
SHA256 f410d66e575748c1def1e701755dd8b06005abc0f612deecc7305da38bdbf446
MD5 51b954652595649b5aafa9313e345059
SHA1 e296357a7a6b3a72faf2338fae61b6eaec06d88e
SHA512 c2ed863f6e916d50b562164110e9f2db3404da13bb8f834910e8b6bb6a4197ac9e4a31614245a510cccdf51b23a2eb71af24a0d098c114b8f7c5375b96d26e2a
SSDEEP 96:FHSJ71Cvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:tSTeb++uVmN
TLSH
T1F5D179085AF54711E2B3AB3129F14557A877B911EF33CB8E0198638E6631A10F936F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3280-67-0x0000000004580000-0x00000000045ED000-memory.dmp

Download

memory/3280-70-0x0000000028C90000-0x0000000028CFE000-memory.dmp

Download

memory/3280-71-0x0000000028D60000-0x0000000028D7A000-memory.dmp

Download

memory/3280-72-0x000000002BC50000-0x000000002BC7C000-memory.dmp

Download

memory/3280-76-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-82-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-194-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-192-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-190-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-188-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-186-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-184-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-182-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-180-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-178-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-176-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-174-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-170-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-169-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-166-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-164-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-162-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-160-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-158-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-156-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-154-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-152-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-148-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-146-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-144-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-142-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-140-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-138-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-136-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-134-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-130-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-128-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-126-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-124-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-122-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-120-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-118-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-116-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-114-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-112-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-110-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-108-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-105-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-102-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-100-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-98-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-97-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-94-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-92-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-90-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-86-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-84-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-80-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-78-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-74-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-172-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-150-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-132-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-106-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-88-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-73-0x000000002BC50000-0x000000002BC76000-memory.dmp

Download

memory/3280-701-0x000000002C020000-0x000000002C086000-memory.dmp

Download

memory/3280-705-0x000000002F130000-0x000000002F1C2000-memory.dmp

Download

memory/3280-706-0x000000002F790000-0x000000002FD4A000-memory.dmp

Download

memory/3280-1335-0x000000002F380000-0x000000002F452000-memory.dmp

Download

memory/3280-4445-0x000000002F680000-0x000000002F68A000-memory.dmp

Download

memory/4716-28-0x000002E457920000-0x000002E4582C4000-memory.dmp

Download