82131ae0fb57dbea5ab8d1b67c67408e0fdf6b5b5c9136e7061aebaba7a4bc1b

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/05/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f_00213d.msi
Size 11.2MB
Sample260505-ph7cbafw7v
SHA256 82131ae0fb57dbea5ab8d1b67c67408e0fdf6b5b5c9136e7061aebaba7a4bc1b
MD5 c842dd759142abcf3c70e1c0d3ec78ac
SHA1 9571f3d899e4abb3e4ec9a0d37038f5bcaf456b1
SHA512 221341732424eb756e32c0b20f0255201c88932e7a7b7e7528f351dd0ba14a20086880fe60a9c53465c8f43b77722825ab22f20bd2172badd110a78cf5dc8575
SSDEEP 196608:hK2MDSoZjsdZ+5YocQgoIfVisODIrJmhc8C73ipUfQwA8X/j8+QkFTa1E5a:h1yJjW+5jgoINdOsruc8CDnQ0PA+3IE5
TLSH
T169C63397FE481A22E1380DBE8C7253145379AE889B06145F33D9356DD6F36C42EB2EE4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4328	cc-switch.exe

Loads dropped DLL 1 IoCs

pid	Process
848	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cc-switch.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1717B6FC-E25A-49C8-AF50-B6E661C6A188}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4D6173F717479566.TMP	msiexec.exe
File created	C:\Windows\Installer\e58bf07.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2604_275038775\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2604_1983767803\manifest.json	msedgewebview2.exe
File created	C:\Windows\Installer\e58bf05.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2111BB5AB681DD5F.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2604_275038775\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2604_1983767803\crl-set	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\e58bf05.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBFC1.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF258B6D0E0B2BAC66.TMP	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6DCAF3916C5BC7E6.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2604_275038775\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2604_1983767803\manifest.fingerprint	msedgewebview2.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3828	msiexec.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	cc-switch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	cc-switch.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009f1d998fde3c4bea0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009f1d998f0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809009f1d998f000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a9f1d998f000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d9f1d998f000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134224573271948725"	msedgewebview2.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\ccswitch\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\ccswitch\shell\open	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\ccswitch\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\CCSWIT~1\\CC-SWI~1.EXE\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\ccswitch\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\ccswitch\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\CCSWIT~1\\CC-SWI~1.EXE\",0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\ccswitch	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\ccswitch\ = "URL: protocol"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\ccswitch\DefaultIcon	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\ccswitch\shell\open\command	msiexec.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	cc-switch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	cc-switch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	cc-switch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	cc-switch.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4124	msiexec.exe
4124	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2604	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3828	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3828	msiexec.exe
Token: SeSecurityPrivilege	4124	msiexec.exe
Token: SeCreateTokenPrivilege	3828	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3828	msiexec.exe
Token: SeLockMemoryPrivilege	3828	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3828	msiexec.exe
Token: SeMachineAccountPrivilege	3828	msiexec.exe
Token: SeTcbPrivilege	3828	msiexec.exe
Token: SeSecurityPrivilege	3828	msiexec.exe
Token: SeTakeOwnershipPrivilege	3828	msiexec.exe
Token: SeLoadDriverPrivilege	3828	msiexec.exe
Token: SeSystemProfilePrivilege	3828	msiexec.exe
Token: SeSystemtimePrivilege	3828	msiexec.exe
Token: SeProfSingleProcessPrivilege	3828	msiexec.exe
Token: SeIncBasePriorityPrivilege	3828	msiexec.exe
Token: SeCreatePagefilePrivilege	3828	msiexec.exe
Token: SeCreatePermanentPrivilege	3828	msiexec.exe
Token: SeBackupPrivilege	3828	msiexec.exe
Token: SeRestorePrivilege	3828	msiexec.exe
Token: SeShutdownPrivilege	3828	msiexec.exe
Token: SeDebugPrivilege	3828	msiexec.exe
Token: SeAuditPrivilege	3828	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3828	msiexec.exe
Token: SeChangeNotifyPrivilege	3828	msiexec.exe
Token: SeRemoteShutdownPrivilege	3828	msiexec.exe
Token: SeUndockPrivilege	3828	msiexec.exe
Token: SeSyncAgentPrivilege	3828	msiexec.exe
Token: SeEnableDelegationPrivilege	3828	msiexec.exe
Token: SeManageVolumePrivilege	3828	msiexec.exe
Token: SeImpersonatePrivilege	3828	msiexec.exe
Token: SeCreateGlobalPrivilege	3828	msiexec.exe
Token: SeCreateTokenPrivilege	3828	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3828	msiexec.exe
Token: SeLockMemoryPrivilege	3828	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3828	msiexec.exe
Token: SeMachineAccountPrivilege	3828	msiexec.exe
Token: SeTcbPrivilege	3828	msiexec.exe
Token: SeSecurityPrivilege	3828	msiexec.exe
Token: SeTakeOwnershipPrivilege	3828	msiexec.exe
Token: SeLoadDriverPrivilege	3828	msiexec.exe
Token: SeSystemProfilePrivilege	3828	msiexec.exe
Token: SeSystemtimePrivilege	3828	msiexec.exe
Token: SeProfSingleProcessPrivilege	3828	msiexec.exe
Token: SeIncBasePriorityPrivilege	3828	msiexec.exe
Token: SeCreatePagefilePrivilege	3828	msiexec.exe
Token: SeCreatePermanentPrivilege	3828	msiexec.exe
Token: SeBackupPrivilege	3828	msiexec.exe
Token: SeRestorePrivilege	3828	msiexec.exe
Token: SeShutdownPrivilege	3828	msiexec.exe
Token: SeDebugPrivilege	3828	msiexec.exe
Token: SeAuditPrivilege	3828	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3828	msiexec.exe
Token: SeChangeNotifyPrivilege	3828	msiexec.exe
Token: SeRemoteShutdownPrivilege	3828	msiexec.exe
Token: SeUndockPrivilege	3828	msiexec.exe
Token: SeSyncAgentPrivilege	3828	msiexec.exe
Token: SeEnableDelegationPrivilege	3828	msiexec.exe
Token: SeManageVolumePrivilege	3828	msiexec.exe
Token: SeImpersonatePrivilege	3828	msiexec.exe
Token: SeCreateGlobalPrivilege	3828	msiexec.exe
Token: SeCreateTokenPrivilege	3828	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3828	msiexec.exe
Token: SeLockMemoryPrivilege	3828	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3828	msiexec.exe
3828	msiexec.exe
4328	cc-switch.exe
4328	cc-switch.exe
4328	cc-switch.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4328	cc-switch.exe
4328	cc-switch.exe
4328	cc-switch.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 848	4124	msiexec.exe	81
PID 4124 wrote to memory of 3756	4124	msiexec.exe	85
PID 3828 wrote to memory of 4328	3828	msiexec.exe	88
PID 4328 wrote to memory of 2604	4328	cc-switch.exe	89
PID 2604 wrote to memory of 3136	2604	msedgewebview2.exe	90
PID 2604 wrote to memory of 3016	2604	msedgewebview2.exe	91
PID 2604 wrote to memory of 3016	2604	msedgewebview2.exe	91
PID 2604 wrote to memory of 3016	2604	msedgewebview2.exe	91
PID 2604 wrote to memory of 2584	2604	msedgewebview2.exe	92
PID 2604 wrote to memory of 652	2604	msedgewebview2.exe	93
PID 2604 wrote to memory of 652	2604	msedgewebview2.exe	93
PID 2604 wrote to memory of 4504	2604	msedgewebview2.exe	94
PID 2604 wrote to memory of 4504	2604	msedgewebview2.exe	94
PID 2604 wrote to memory of 4504	2604	msedgewebview2.exe	94
PID 2604 wrote to memory of 4516	2604	msedgewebview2.exe	96
PID 2604 wrote to memory of 4516	2604	msedgewebview2.exe	96
PID 2604 wrote to memory of 5052	2604	msedgewebview2.exe	97
PID 2604 wrote to memory of 5052	2604	msedgewebview2.exe	97

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\f_00213d.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Users\Admin\AppData\Local\Programs\CC Switch\cc-switch.exe
  "C:\Users\Admin\AppData\Local\Programs\CC Switch\cc-switch.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies trusted root certificate store through registry
  - Modifies system certificate store
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=cc-switch.exe --webview-exe-version=3.14.1 --user-data-dir="C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4328.4060.2042251995382917950
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ff8489cb078,0x7ff8489cb084,0x7ff8489cb090
      4⤵
      PID:3136
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView" --webview-exe-name=cc-switch.exe --webview-exe-version=3.14.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1676,i,4277920449265549004,10864526874150240251,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1672 /prefetch:2
      4⤵
      PID:3016
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView" --webview-exe-name=cc-switch.exe --webview-exe-version=3.14.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1996,i,4277920449265549004,10864526874150240251,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:11
      4⤵
      PID:2584
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView" --webview-exe-name=cc-switch.exe --webview-exe-version=3.14.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2024,i,4277920449265549004,10864526874150240251,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:13
      4⤵
      PID:652
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView" --webview-exe-name=cc-switch.exe --webview-exe-version=3.14.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3488,i,4277920449265549004,10864526874150240251,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
      4⤵
      PID:4504
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView" --webview-exe-name=cc-switch.exe --webview-exe-version=3.14.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=812,i,4277920449265549004,10864526874150240251,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:14
      4⤵
      PID:4516
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView" --webview-exe-name=cc-switch.exe --webview-exe-version=3.14.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4512,i,4277920449265549004,10864526874150240251,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:14
      4⤵
      PID:5052

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6E2D20D026C60B8C43206ADABEF33528 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:848
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3756

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58bf06.rbs

Path C:\Config.Msi\e58bf06.rbs
Size 11KB
SHA256 9f4ebefeee5a424c4e576abe5b3f9e709dff52158fe117e94eb73606e7bac037
MD5 c04b17a621a5e4b0ad086db6d5a2e034
SHA1 e8dc3c6a17bd7cb9c529f27227b1af989c61a988
SHA512 eea92302ea4d085f787bb78141eefacac372d56f5a01d67b81855ad8aa966cda740264b3b74768dc4d8dee33da9888a5206d48cfe0d28206e1fbc1e44e31736b
SSDEEP 192:UfOJWJlJ6JzJlslLCafydxZGXCydxZdXF3uV+L4i//kpz:UfOJWJlJ6JzJlsl7ydx8Cydx3F+VGpHo
TLSH
T13A323302B250E5EBED598B35C7071B147363D6AEE38AB30B158EC8142E573985EDB1C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc-switch.exe

Path C:\Users\Admin\AppData\Local\Programs\CC Switch\cc-switch.exe
Size 27.2MB
SHA256 b1e70c7e6ae57c85d6d1687179fdbb5bbaf2a21d709a5288d5f31b6665adba85
MD5 ad86476d253ffcec47aaceca302dc50c
SHA1 22990877b7b8093f688b45e6d77d8b646a33180e
SHA512 9a9d81268d08fe8df4b5e8c5df9a031a125777877e0298e9761ed93bdb47a15e9bd592ad4075bb1914a5f3bdd72c085be6b5b03bd9d11a6a434809acb8ae1252
SSDEEP 196608:wrN8YasH1YC6Aw1NP42dpoOCrBI14f2DO07sM6MA0qjzIeVha:wrpaY1qAw1rdSBI14OPsKA0u0I
TLSH
T1635729017E9A59ADD089C8B0C38B8AB38E7230DF1935B67F55DA11292F7D6B45F2C318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI77FA.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI77FA.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 daf71bbd1e2248e74fbae28e7d79f22080d195caf04b771def328395089a8bb2
MD5 e4eed62cdd86978a6bda1f84f8ed7a73
SHA1 6cefe27f0bba6392941dd7ff6b0cfaa8a8332778
SHA512 3779c6e4ca192a54d60de769b97d4e648826d450c17b9f66c67565fae1dc8ed51c1011740680b0aed43102b3440d352694a19d00e81fdb35c2257799714fbb0c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5e341ea7114be1f66ae5df3306c052bfee4744ce9bf65a7ce956382ba922d01e
MD5 6317a18da0b8815766a62da645b4a880
SHA1 a675e4115045210855048cfc3588b81dc8d66876
SHA512 e0cd0f2d1787789af0ffab50dbbafb17e27abbd098562efba3fbb5bc2d832954306f8f30d7a91d93da46774b7a695f484ab9f93c3e86e3bef6ca9889e372ca0d
TLSH
T15DD0123633424634C01028330512670A0C00C20B40494000E428E53E5B440900D07452
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 96B
SHA256 dd407648ccf7d143f6f139896de0e7617ae617b820abce56b9eb5799653be26c
MD5 1732bd8bf3c54eb4295d2551dbfdf698
SHA1 01d33236646a59c05028bc1fe10be3b2e467bcb3
SHA512 3ce0ded7eca7e2888fe62af745c372579c7f8e4fadb2067f932880728b1c97b0236b9caabd5ac9a2a1d251599822df14d5a7eeb521136bcf06f85280807bff88
TLSH
T19FB002E093187543C71143B961DBB6AD77794D5083272FC658B49276E4D8382D2465C5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 dd1cfed2a80e33586e5c5d92ec2ca21d5ffb2020000045cdab62f33cf18b9e20
MD5 6fb67aa3cf49432307e808186cfa22d6
SHA1 efdb81c35401af83f4b8ad795155e91e4e395a18
SHA512 d0682b40bbd12b1ee11db0cc8dc7e230235e68e6f80daf2eaea0bf8ea653a7b18869d8d874fcb618a844e154e8cc39851c83401799dd984e3a6cc17208f6fc59
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59f13c.TMP

Path C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView\Default\Network\Network Persistent State~RFe59f13c.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView\Default\Preferences
Size 6KB
SHA256 7066178430f242530fad19aa90b092d0ec40ad0f043751ee1c47713de2609a33
MD5 b8f94cab70de2317b041f3d3521b9638
SHA1 6bc049b9150fb81019f4bc7c1e81d234642d9b24
SHA512 370039b9cc5a901143540f5b4c86b81cb3e144b4e9a154d2c028e9f3278da3da50985385f060545d1084f9b16fb3bcae72a5a5351bcd3d39df388b683e242f17
SSDEEP 192:stt50RMJVKg5f8Z8paBU/S+WiTwHwdEP6CMC:sttqRMJcm7B/Vow9C
TLSH
T153D1B9435E686A778CC7F6197A35BF52E2F6606262C50D58EBFC860C04D66CC630B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5969ad.TMP

Path C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView\Default\Preferences~RFe5969ad.TMP
Size 6KB
SHA256 3114de6ecceeccc5bf34b9f2c29b435f1b69a5e228659e4539214001f19ce12d
MD5 55d89e809d23fb4e605db6aaa1078d63
SHA1 ff172cb50ccc5b31492da2a3e581e8c74e52897a
SHA512 9f2481d6b827793c34c5324f9fa109424d2ca7e1a0ab024f3e3061a036f7535c21658ab64f67dbf88092c9ede84d27a5fa3bac76d20e616c2fc80af7c457040f
SSDEEP 192:stt50RMJVOf8Z8paBU/S+WiTwHwdEPICM8:sttqRMJU7B/VowF8
TLSH
T145D1A7435E68AA774CC7E2197A35FF42D2FA206172D40D99EBFC861C08D66DC630B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView\Local State
Size 1KB
SHA256 45993ce4c94ba89c03ac8aab05949b66b2520c1606c2d00e403e8a252e760c1f
MD5 5bc1ba6fced5ad97d4541c3bcba5f0be
SHA1 71a5e15fbe8af7f6831b6a8fff62cc7e81c07489
SHA512 352d2f12553ba7ac04c97b3abebabc137d2ff8fbc36456684fa03fcbf7f811f0a9b3f69d00687e0e513609aea02417aff5ea770da492e6b0f5db7b57e8eec081
TLSH
T1333162B3DCA0AB3B4DE29659B802FACB1E715176E2514E40A6EF0B1C01D76CC572BC36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView\Local State
Size 2KB
SHA256 1b126ba9ad18316f564183de3bf3d8ccd0c6bf30967fa78467e7c1c9f1c0b84f
MD5 cc3a2153933e84e3a73ce3a47a72c7fa
SHA1 702a9f9a5c15bc9f35e59c889c50eea05a7dd411
SHA512 68521756a43f501b5579025aba5aed9ee51f9d50329b49c278a30718a2d167ec479e547782df521ae2fe89bf1ccbc05632496577dba0c8ed05e85ee562d64465
TLSH
T1C551AA73AC54AB3B89F38614BC06BF535A7152A5E6512F5195FD0B0C01D769C2306C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView\Local State
Size 3KB
SHA256 0b33e0f6a9b4601488ea2acb44cdf17f5420c9ee41f6db3bfdc85e8f4f7e9439
MD5 09f5a206d0559ae28f5f948c73d14644
SHA1 3dd7faceff8915cbe8b1e722985c126ddbef4db3
SHA512 7a99c7e0089f0acbba6d6e412915d56b8b87449dbf97cb1e0ee70b2bee13de371245d8562525380ea8a054a40a690c3a7347b08fe2614e022357db0b11fb58fa
TLSH
T1BC717276A8A4EA2B4EF29A04B8866B4666A15277E5913F95DAFD0F0C01DB7881302C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView\Local State
Size 16KB
SHA256 68add8321735ee97a04b1553bedcd71cde1fd0359992005647ee894d4220848e
MD5 add95ec2d3676a49d25fa83d3f1f2292
SHA1 020952d87ba098768d6988e1bf2299a60f87118a
SHA512 ac05388eb24defa2d59c1935a87b111f78f4166b9261f1f4a4735df917ee3870d5e33b1eb7e783ede8d85b1901f99436ee7b9e8b195d89228ffcd57305cba69e
SSDEEP 384:zSfTPLdSWCUkEaV8DNYi0qnSXaqZvONbDTui2612:+TRMUVai1SKqvm112
TLSH
T18C72BEB3AC74EA2B08BEC91AEA07764B89B4D160D1D52F9EDDFD1F0D06C66880325D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58cadd.TMP

Path C:\Users\Admin\AppData\Local\com.ccswitch.desktop\EBWebView\Local State~RFe58cadd.TMP
Size 1KB
SHA256 7e040e7097781006053bc194fe3c0db7d71606d4ed7b2de8c2c0961fce544f5c
MD5 46356139b586580ff68b9059bdb40764
SHA1 bdb51820f3effa3cd19fc18aaea97ee1aa1b5aee
SHA512 c3cf6892fe35520a8f5dc5a9aa70d1e606471dea942641aeca9112a3fb3778f5cc0fb8623b8027703411c11ed336654a1c1758304c3ebdcf689822db46b2e87c
TLSH
T15D2150B3C8A0AB3B49D14519B802FACA1E6092B6A2104E04E1EF071801CB6CC572BC36
MD5 SHA1 SHA512 TLSH

Submit Download

CC Switch.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CC Switch\CC Switch.lnk
Size 2KB
SHA256 e0f1c8968dfb0abce690fce330c1aa30d685d9f225a8a15200867afe757094d0
MD5 46441acbaa2642ffe145170d4b7ede4c
SHA1 98f598a30d9154c81f034dab6b8224c1a59ff167
SHA512 99416df419e873a9625830b69cc8f671ba29ce44681d4efc8a947528c1a844570c33462aa275596b281bfc94771e84d3e00963488336470b2760d1599d95b376
TLSH
T192411E04D9E82771E3B9C8B657D72A23B575F872AB589E46021183090D35E42DCB5F2F
MD5 SHA1 SHA512 TLSH

Submit Download

CC Switch.lnk~RFe58c1e4.TMP

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CC Switch\CC Switch.lnk~RFe58c1e4.TMP
Size 2KB
SHA256 e6bf071bea92237959e89389bd16629d4601ce16d74500f704b8ca550fd296bb
MD5 4004d8afa162a8c6357760c230e5bc90
SHA1 8064e9b3054024a04a73d0d9f09477c77a8ef9e3
SHA512 be9716da02cd5ee3bb62fdb0da1f1fc17b5a5e8e2271829e5f178d5d75ef9eb86fcf221beeec14354af0665bbab0787de68760f20cd3495c0b4d89cf317444ff
TLSH
T13F414F04CAE81735E3F9C4B657D72B32B572F831AB594E060211830A0D36E52ECA5F2F
MD5 SHA1 SHA512 TLSH

Submit Download

e58bf05.msi

Path C:\Windows\Installer\e58bf05.msi
Size 11.2MB
SHA256 82131ae0fb57dbea5ab8d1b67c67408e0fdf6b5b5c9136e7061aebaba7a4bc1b
MD5 c842dd759142abcf3c70e1c0d3ec78ac
SHA1 9571f3d899e4abb3e4ec9a0d37038f5bcaf456b1
SHA512 221341732424eb756e32c0b20f0255201c88932e7a7b7e7528f351dd0ba14a20086880fe60a9c53465c8f43b77722825ab22f20bd2172badd110a78cf5dc8575
SSDEEP 196608:hK2MDSoZjsdZ+5YocQgoIfVisODIrJmhc8C73ipUfQwA8X/j8+QkFTa1E5a:h1yJjW+5jgoINdOsruc8CDnQ0PA+3IE5
TLSH
T169C63397FE481A22E1380DBE8C7253145379AE889B06145F33D9356DD6F36C42EB2EE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2604_1983767803\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2604_275038775\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
TLSH
T169A022F3F000F02030022F8A80203C00C8A23BA80C8020808000BEE0200322A3A0C820
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2604_275038775\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 85ace5ef1a47ce9c876e80243e9b684d8c48ab267449615f3ae5d6ec06ea13d5
MD5 ebba9250a796ff9faba5f263edb6a81b
SHA1 ac9ea646464474e08fbbac6a00780e33b42e6ff4
SHA512 e467c5a551f59bc99d9663d762375f45c358dc21b6f7bdd41ea625a89523613b13d0ec351dd297cdd3f712fe7260b1eab2802c2ef4bde5e47a8a910d96522bec
SSDEEP 24576:D2gmSp1fdoO/vvTLh2q+REnKfqJBg4eAWWp93Jkqzx6Ik2uv4Rb9bngNh:5
TLSH
T19547A4243AF92120E7F79E3CACF06A23493A7D5B9C15DE8D45411B4E0921BB1E872F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{0dabdd75-f898-4dbf-bc9c-5bda7cf0a5b5}_OnDiskSnapshotProp

Path \??\Volume{8f991d9f-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{0dabdd75-f898-4dbf-bc9c-5bda7cf0a5b5}_OnDiskSnapshotProp
Size 6KB
SHA256 faf8f4158a1f55046ad2fea4c564ddf13d098d5e705491c46d9c59dff10dfb83
MD5 8fc9e1c8e6696700c54ab16b875d23fe
SHA1 2469424c430a5ac50666d3212edb99ff5c4a1842
SHA512 80204c349160e53594be85bfd96a1745f74177db5e40f53de196cc434d12e25e5e294d7fb515a1542c97f91356fa9635900797e4ec774669ba1cfbb36ea48369
SSDEEP 96:FrkOVhrvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:FZhBb++ZVmN
TLSH
T1AAD19A085AF54711E2B3AB7128F14557A877B811EF33CB8E0298238E2670910F975F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1552-308-0x0000025D85E80000-0x0000025D85F56000-memory.dmp

Download

memory/1552-12-0x0000025D85E80000-0x0000025D85F56000-memory.dmp

Download

memory/2584-334-0x000002096C100000-0x000002096C1AF000-memory.dmp

Download

memory/2604-313-0x00000295E4800000-0x00000295E48AF000-memory.dmp

Download

memory/3016-333-0x0000024C33000000-0x0000024C330AF000-memory.dmp

Download

memory/3016-73-0x00007FF867E70000-0x00007FF867E71000-memory.dmp

Download

memory/3016-332-0x0000024C30470000-0x0000024C3055A000-memory.dmp

Download

memory/3756-328-0x0000012D81260000-0x0000012D81336000-memory.dmp

Download

memory/3756-311-0x0000012D81260000-0x0000012D81336000-memory.dmp

Download

memory/3828-50-0x00000253F7190000-0x00000253F7266000-memory.dmp

Download

memory/3828-0-0x00000253F7190000-0x00000253F7266000-memory.dmp

Download

memory/4124-8-0x00000295B2940000-0x00000295B2A16000-memory.dmp

Download

memory/4328-312-0x000001F3FB310000-0x000001F3FB3BF000-memory.dmp

Download

memory/4504-191-0x00007FF867E70000-0x00007FF867E71000-memory.dmp

Download