369e5f4d60dda23b62aabe953ef5b648a5ed4525b1d4b0f33b61775591b55f3d

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 04:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Lagswitch_2.0.3_x86_en-US.msi
Size 2.7MB
Sample260717-etfnmaev2x
SHA256 369e5f4d60dda23b62aabe953ef5b648a5ed4525b1d4b0f33b61775591b55f3d
MD5 33af88413ee14b6f1ebb21646290bc1a
SHA1 cc801c4645abbeb14f426c55bfd25b0a31f154da
SHA512 1130a2e020f3a5ec0a4ecc9c195f8a2bb3bc9546fbe392ec8d586a6b24805f07386f7980d4d52a08047659cb5d06c070f18e703994fea42c155e8d3c75c494e8
SSDEEP 49152:l8n4+gE1XqribpSzTyXCfccx+yE4OlHhlbqLR7oWOGWvZgkj4m:l84+Xary0zGXCfTE46BcL9oWO5v8m
TLSH
T1E6D512373E409836D5BA0C32447ADB609E2DBC280A40C9BB53C5795DDDF39C0DA6AAD6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4756	Lagswitch.exe
4236	WinDivert64.sys

Loads dropped DLL 4 IoCs

pid	Process
3316	MsiExec.exe
3316	MsiExec.exe
4756	Lagswitch.exe
4756	Lagswitch.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Lagswitch.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Lagswitch\WinDivert.lib	msiexec.exe
File created	C:\Program Files (x86)\Lagswitch\Lag Switch.dll	msiexec.exe
File created	C:\Program Files (x86)\Lagswitch\WinDivert.dll	msiexec.exe
File created	C:\Program Files (x86)\Lagswitch\Uninstall Lagswitch.lnk	msiexec.exe
File created	C:\Program Files (x86)\Lagswitch\Lagswitch.exe	msiexec.exe
File created	C:\Program Files (x86)\Lagswitch\WinDivert32.sys	msiexec.exe
File created	C:\Program Files (x86)\Lagswitch\WinDivert64.sys	msiexec.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{AD5D55E5-88B6-41D8-AB4F-5733C8D78A1F}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8477A6C198F51ACA.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6076_258453155\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6076_258453155\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\~DF8CEB3666C777D961.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCD9A4956FAF6481B.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9611370041C210F0.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6076_258453155\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6076_258453155\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6076_258453155\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6076_258453155\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6076_258453155\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\Installer\e59de14.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE267.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6076_258453155\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6076_258453155\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\Installer\{AD5D55E5-88B6-41D8-AB4F-5733C8D78A1F}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{AD5D55E5-88B6-41D8-AB4F-5733C8D78A1F}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6076_258453155\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6076_258453155\male_names.txt	msedgewebview2.exe
File created	C:\Windows\Installer\e59de12.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59de12.msi	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4572	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lagswitch.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000067831fc6f5c7bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380167831fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410167831fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e367831fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e667831fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 26 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5E55D5DA6B888D14BAF475338C7DA8F1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5E55D5DA6B888D14BAF475338C7DA8F1\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5E55D5DA6B888D14BAF475338C7DA8F1\Environment = "MainProgram"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E55D5DA6B888D14BAF475338C7DA8F1\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E55D5DA6B888D14BAF475338C7DA8F1\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E55D5DA6B888D14BAF475338C7DA8F1\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E55D5DA6B888D14BAF475338C7DA8F1\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E55D5DA6B888D14BAF475338C7DA8F1\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E55D5DA6B888D14BAF475338C7DA8F1\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\71C388FC42905D351AB32BFFB7A0BA94	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E55D5DA6B888D14BAF475338C7DA8F1\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E55D5DA6B888D14BAF475338C7DA8F1\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E55D5DA6B888D14BAF475338C7DA8F1	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E55D5DA6B888D14BAF475338C7DA8F1\Version = "33554435"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E55D5DA6B888D14BAF475338C7DA8F1\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E55D5DA6B888D14BAF475338C7DA8F1\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E55D5DA6B888D14BAF475338C7DA8F1\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E55D5DA6B888D14BAF475338C7DA8F1\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5E55D5DA6B888D14BAF475338C7DA8F1\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5E55D5DA6B888D14BAF475338C7DA8F1\External	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E55D5DA6B888D14BAF475338C7DA8F1\ProductName = "Lagswitch"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E55D5DA6B888D14BAF475338C7DA8F1\PackageCode = "5484F10984740D64C8A28FBE23C292E7"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E55D5DA6B888D14BAF475338C7DA8F1\ProductIcon = "C:\\Windows\\Installer\\{AD5D55E5-88B6-41D8-AB4F-5733C8D78A1F}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E55D5DA6B888D14BAF475338C7DA8F1\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\71C388FC42905D351AB32BFFB7A0BA94\5E55D5DA6B888D14BAF475338C7DA8F1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E55D5DA6B888D14BAF475338C7DA8F1\SourceList\PackageName = "Lagswitch_2.0.3_x86_en-US.msi"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4432	msiexec.exe
4432	msiexec.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
6076	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4572	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4572	msiexec.exe
Token: SeSecurityPrivilege	4432	msiexec.exe
Token: SeCreateTokenPrivilege	4572	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4572	msiexec.exe
Token: SeLockMemoryPrivilege	4572	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4572	msiexec.exe
Token: SeMachineAccountPrivilege	4572	msiexec.exe
Token: SeTcbPrivilege	4572	msiexec.exe
Token: SeSecurityPrivilege	4572	msiexec.exe
Token: SeTakeOwnershipPrivilege	4572	msiexec.exe
Token: SeLoadDriverPrivilege	4572	msiexec.exe
Token: SeSystemProfilePrivilege	4572	msiexec.exe
Token: SeSystemtimePrivilege	4572	msiexec.exe
Token: SeProfSingleProcessPrivilege	4572	msiexec.exe
Token: SeIncBasePriorityPrivilege	4572	msiexec.exe
Token: SeCreatePagefilePrivilege	4572	msiexec.exe
Token: SeCreatePermanentPrivilege	4572	msiexec.exe
Token: SeBackupPrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeShutdownPrivilege	4572	msiexec.exe
Token: SeDebugPrivilege	4572	msiexec.exe
Token: SeAuditPrivilege	4572	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4572	msiexec.exe
Token: SeChangeNotifyPrivilege	4572	msiexec.exe
Token: SeRemoteShutdownPrivilege	4572	msiexec.exe
Token: SeUndockPrivilege	4572	msiexec.exe
Token: SeSyncAgentPrivilege	4572	msiexec.exe
Token: SeEnableDelegationPrivilege	4572	msiexec.exe
Token: SeManageVolumePrivilege	4572	msiexec.exe
Token: SeImpersonatePrivilege	4572	msiexec.exe
Token: SeCreateGlobalPrivilege	4572	msiexec.exe
Token: SeCreateTokenPrivilege	4572	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4572	msiexec.exe
Token: SeLockMemoryPrivilege	4572	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4572	msiexec.exe
Token: SeMachineAccountPrivilege	4572	msiexec.exe
Token: SeTcbPrivilege	4572	msiexec.exe
Token: SeSecurityPrivilege	4572	msiexec.exe
Token: SeTakeOwnershipPrivilege	4572	msiexec.exe
Token: SeLoadDriverPrivilege	4572	msiexec.exe
Token: SeSystemProfilePrivilege	4572	msiexec.exe
Token: SeSystemtimePrivilege	4572	msiexec.exe
Token: SeProfSingleProcessPrivilege	4572	msiexec.exe
Token: SeIncBasePriorityPrivilege	4572	msiexec.exe
Token: SeCreatePagefilePrivilege	4572	msiexec.exe
Token: SeCreatePermanentPrivilege	4572	msiexec.exe
Token: SeBackupPrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeShutdownPrivilege	4572	msiexec.exe
Token: SeDebugPrivilege	4572	msiexec.exe
Token: SeAuditPrivilege	4572	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4572	msiexec.exe
Token: SeChangeNotifyPrivilege	4572	msiexec.exe
Token: SeRemoteShutdownPrivilege	4572	msiexec.exe
Token: SeUndockPrivilege	4572	msiexec.exe
Token: SeSyncAgentPrivilege	4572	msiexec.exe
Token: SeEnableDelegationPrivilege	4572	msiexec.exe
Token: SeManageVolumePrivilege	4572	msiexec.exe
Token: SeImpersonatePrivilege	4572	msiexec.exe
Token: SeCreateGlobalPrivilege	4572	msiexec.exe
Token: SeCreateTokenPrivilege	4572	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4572	msiexec.exe
Token: SeLockMemoryPrivilege	4572	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4572	msiexec.exe
4572	msiexec.exe
4756	Lagswitch.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4572	msiexec.exe
4432	msiexec.exe
3316	MsiExec.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 3316	4432	msiexec.exe	90
PID 4432 wrote to memory of 5716	4432	msiexec.exe	96
PID 3316 wrote to memory of 4756	3316	MsiExec.exe	99
PID 4756 wrote to memory of 6076	4756	Lagswitch.exe	100
PID 6076 wrote to memory of 4324	6076	msedgewebview2.exe	101
PID 6076 wrote to memory of 4944	6076	msedgewebview2.exe	104
PID 6076 wrote to memory of 4944	6076	msedgewebview2.exe	104
PID 6076 wrote to memory of 4944	6076	msedgewebview2.exe	104
PID 6076 wrote to memory of 4944	6076	msedgewebview2.exe	104
PID 6076 wrote to memory of 2100	6076	msedgewebview2.exe	105
PID 6076 wrote to memory of 4924	6076	msedgewebview2.exe	106
PID 6076 wrote to memory of 4924	6076	msedgewebview2.exe	106
PID 6076 wrote to memory of 4924	6076	msedgewebview2.exe	106
PID 6076 wrote to memory of 2904	6076	msedgewebview2.exe	107
PID 6076 wrote to memory of 2904	6076	msedgewebview2.exe	107
PID 6076 wrote to memory of 2904	6076	msedgewebview2.exe	107
PID 6076 wrote to memory of 2904	6076	msedgewebview2.exe	107
PID 6076 wrote to memory of 2904	6076	msedgewebview2.exe	107
PID 6076 wrote to memory of 1196	6076	msedgewebview2.exe	108
PID 6076 wrote to memory of 1196	6076	msedgewebview2.exe	108
PID 6076 wrote to memory of 1196	6076	msedgewebview2.exe	108
PID 6076 wrote to memory of 4332	6076	msedgewebview2.exe	111
PID 6076 wrote to memory of 4332	6076	msedgewebview2.exe	111
PID 6076 wrote to memory of 4332	6076	msedgewebview2.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Lagswitch_2.0.3_x86_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4572

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 73BB18BF0A91AAC9BE087768B3C3065C C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Program Files (x86)\Lagswitch\Lagswitch.exe
    "C:\Program Files (x86)\Lagswitch\Lagswitch.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4756
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Lagswitch.exe --webview-exe-version=2.0.3 --user-data-dir="C:\Users\Admin\AppData\Local\io.lagswitch\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4756.4628.10928198857808099131 /pfhostedapp:d85632e4584459111e59028b0bbd20ed30b9da32
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:6076
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\io.lagswitch\EBWebView /prefetch:4 /pfhostedapp:d85632e4584459111e59028b0bbd20ed30b9da32 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\io.lagswitch\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7ffee3915fd8,0x7ffee3915fe4,0x7ffee3915ff0
        5⤵
        
        PID:4324
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.lagswitch\EBWebView" --webview-exe-name=Lagswitch.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1780 --field-trial-handle=1784,i,4430560159648730960,10059251726654748380,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:d85632e4584459111e59028b0bbd20ed30b9da32
        5⤵
        
        PID:4944
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.lagswitch\EBWebView" --webview-exe-name=Lagswitch.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2200 --field-trial-handle=1784,i,4430560159648730960,10059251726654748380,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:d85632e4584459111e59028b0bbd20ed30b9da32
        5⤵
        
        PID:2100
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.lagswitch\EBWebView" --webview-exe-name=Lagswitch.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2232 --field-trial-handle=1784,i,4430560159648730960,10059251726654748380,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d85632e4584459111e59028b0bbd20ed30b9da32
        5⤵
        
        PID:4924
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.lagswitch\EBWebView" --webview-exe-name=Lagswitch.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3296 --field-trial-handle=1784,i,4430560159648730960,10059251726654748380,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:d85632e4584459111e59028b0bbd20ed30b9da32 /prefetch:1
        5⤵
        
        PID:2904
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.lagswitch\EBWebView" --webview-exe-name=Lagswitch.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=3688 --field-trial-handle=1784,i,4430560159648730960,10059251726654748380,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d85632e4584459111e59028b0bbd20ed30b9da32
        5⤵
        
        PID:1196
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.lagswitch\EBWebView" --webview-exe-name=Lagswitch.exe --webview-exe-version=2.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=816 --field-trial-handle=1784,i,4430560159648730960,10059251726654748380,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d85632e4584459111e59028b0bbd20ed30b9da32
        5⤵
        
        PID:4332
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5716

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4428

C:\Program Files (x86)\Lagswitch\WinDivert64.sys
"C:\Program Files (x86)\Lagswitch\WinDivert64.sys"
1⤵
- Executes dropped EXE
PID:4236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59de13.rbs

Path C:\Config.Msi\e59de13.rbs
Size 12KB
SHA256 ee274b5392bbf619adf71d7e2ffac07ba5b2bbe4fc4e2a7814f2fd9b89baff38
MD5 42d2a6c505f1cb27822df3da1a5fc590
SHA1 da2760b041fc470ba5be5738d43d343651eac267
SHA512 7fceed461c2377ba56a171e7de83804211521c3f5535724fae8ae6b296d0e73ada443da911b3959de6dd139b95c556b04b9748848fd8168eb36121dd0c7744d8
SSDEEP 192:CpRHX6tBtBtBtAN1NCcSMGqGCMGqXlMILppoWyibE1p1:Cph6tBtBtBt1MGMMGNAlIV
TLSH
T1E342FD82A61083C3E5579735DB5307283BB2CAE8A345534B15EE5574EF823842FB939E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lag Switch.dll

Path C:\Program Files (x86)\Lagswitch\Lag Switch.dll
Size 198KB
SHA256 809168173520ebf654e0aef39d82212c845c1b44e21740361e23aeadc4c29b7a
MD5 2be514748d335bb3def615d7ab94fe10
SHA1 45a1e6189c469ec91b357203402ffbea77aca480
SHA512 a72deee0c9d8e0c2cebbd4d7061a86a7bb65d578e6927f74e378d62f18114a0453ce8179a8bed28fed6f703d882ce70030dccd153a2208f052b35a415cd2be40
SSDEEP 3072:nPoB+leFYRgC3Tb3E6Lnei9FhQJUJsAspj0638HsE6TNkfgyTj0xM3P:nQB+FgH6rX9F2EJ8j0ELkDTImf
TLSH
T162146D51B981C037DA6F19308835DB655E3EFCA14FA0FDCBA7841DBA8E706C09B3561A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lagswitch.exe

Path C:\Program Files (x86)\Lagswitch\Lagswitch.exe
Size 4.7MB
SHA256 11872b79f502d1190adf65fea28989bd752d07460970604375fe86297a428e29
MD5 a97e423226918a60a7679c5aeb690230
SHA1 b3e0fdcbc678523a4bdc6b918e875dc4269a051f
SHA512 fbd2c79595339aae1c98e59c3e75d798f89a06af65ba16426e12d4ecdb97620ee38275b2e414d4b1bb4895fd9e2dbf873ae3e73da5c9f8e6687fb5f0bcb16503
SSDEEP 49152:QeFXJW/S78Om5IQotABG8LveBpRskcPHfqiaNF3K56YuzVDngeh789dwdYyj0HF2:QeDXEIQIABlITzpP8fwwN4O3B4Mc
TLSH
T1A4367D037A42A2FBC44B4270A00EA33C5AB3A55867058EE396C8EDB859F63D15D7773D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinDivert.dll

Path C:\Program Files (x86)\Lagswitch\WinDivert.dll
Size 42KB
SHA256 a321649090c21aaa7529ce5d019d242b1d5f2a2aff04bc3224db409641604a83
MD5 387b5f1334fe717221295b18203cd70c
SHA1 0d0683bb05a94bfa0eaf98bc7e6f8d7b4f98502c
SHA512 8e5bacf9450b34af08dda9be3795c164f9f126280de22fd86333e054ebc98c0cdb1e3f2b41a28078ef724e8829ac47179f141c6a7d02f2ec3aecd1a6c9100c2c
SSDEEP 768:+m+fLaa+rRDCykwVeNhHW68R9c581oWXGEwcmC1zUtTwekTqkimOc4b:+m+fLaxrYh268R9c5lWXGEzmqTqk6d
TLSH
T14B134B49E787D073CC3D46F0204FF7E628740670B8458DCBE6C41DAE6C66AA7187AA47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinDivert64.sys

Path C:\Program Files (x86)\Lagswitch\WinDivert64.sys
Size 91KB
SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
MD5 89ed5be7ea83c01d0de33d3519944aa5
SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
TLSH
T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lagswitch.lnk~RFe59e3de.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lagswitch\Lagswitch.lnk~RFe59e3de.TMP
Size 1KB
SHA256 ee91269b1dd5793011a7a5eac005ef589ca338f6cb5e104159b850494130d2d4
MD5 c475ebab1f061cf77a78743ffc779baa
SHA1 938d832e4b165b27697d90cabe0cb1708a31c3a1
SHA512 e9016a003fbc6f53d3a5cc1cd6d4cdb317cdd6f4520e4b950c85018ce17a56f5b5edafe79e0eef2fb3cb28665f7079624c39afccae84e61b3524be16e98376f8
TLSH
T18941D520C6E9239EE3735935EB615523DE73FD01E6A48F6B005141484872C01E9F9F1D
MD5 SHA1 SHA512 TLSH

Submit Download

~agswitch.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lagswitch\~agswitch.tmp
Size 2KB
SHA256 1b133fa8fe2993a2891985966f33090a059a457e34012ce868dc9185b2ff285b
MD5 c20687e4a737e5e72f0885b88e6f4ef7
SHA1 059381f10d1138886bb7c94c4a331fe8ff5c069e
SHA512 21c9d4c25c213df556104b9477600b39746e66df66c90243930fff596fb9d7d0f39488c8db09c72bcc08ea27ad391e1528f0b296020a9583bf19a6980bf7aeeb
TLSH
T15741B121D6E9239EE3765931EB615523DA73FD02E6A48B6B005541484872C01E9F9F1E
MD5 SHA1 SHA512 TLSH

Submit Download

MSI85FF.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI85FF.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIEC2C.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIEC2C.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\io.lagswitch\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e54c6457657f078c237f5673d7a75b73391dd74dd3f1f6639ea1f28668a22014
MD5 a65b4957bf4a080990464beed1662665
SHA1 79687e52cc7bb24d0a4a20bea8c31a483fdbf5e0
SHA512 21da2d7518cb62c852253fd0eb77980b6528976c62521b65d93cb40b3388e7ebb9237b0e74aff0f07c3b156a969731a1c7a6d773f65e73c6ae7c346bb391d34e
TLSH
T1ECD0041CD54C0C14C44051370133D55001044C014D5731401110100514544710501055
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\io.lagswitch\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3bb72b8947f6ef673ea394d3153a37504354d729b41acf7dcf4026178cbf4810
MD5 3506e553ed5f43e4db8c868b59056bed
SHA1 440546c8e3e1691ad852eebfcd92175ac5e39161
SHA512 0cd5f1f3cfa1a738d87a6c4bcca64c40c0b332b690a4b38011833bf462c1c1ca5c13cc90f5127d9d8899544da78dd3899c75f3dcceda9f66e53af887c2ac4430
TLSH
T10FD0121A76450938C41021330113B5480400C90B854A60406428951E2A184B00E02492
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\io.lagswitch\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\io.lagswitch\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 b27ef0cd85e77b2550cbe96c556fb4450916923af60398cd95e663fc07202642
MD5 f38530dc513c6481f02f8762ee328532
SHA1 426938b759ab2ca08836d5e4234871fc3b74db7e
SHA512 4a95f2ee5cb66f87af00c608ecadd7dbe4030b88cacc450827fd9f3a429768f107c34b6616fadb3e3c619e9a0338b9df1cfc911ccc7c352445741f373b371e0e
TLSH
T1BDA0027043840352C9011B7117C1018D33B198715303275161ED10A48AF5B808181784
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a4613.TMP

Path C:\Users\Admin\AppData\Local\io.lagswitch\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a4613.TMP
Size 48B
SHA256 d40c096bd8d9a9bfa66c9740093dbded51addb379c614b892a701f8967ef691e
MD5 5f967b36829c2666d51be5586406e663
SHA1 b56a6391713de68db8bd8f5dbbbe116b016b9408
SHA512 b2f080398c99a26bdccd81b4b6c2ae0d1db50ac6365521f34e883797a205650e9da23b84c0fbde85b12a041b81ca37313679ae6af85d198d0c2d60d08e6c7417
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\io.lagswitch\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\io.lagswitch\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\io.lagswitch\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\io.lagswitch\EBWebView\Default\Network\Network Persistent State
Size 362B
SHA256 30118c9ce435af122ef4a44507ea71ee48cb0373cbb7fad3617db42ca75751af
MD5 e694c512b739681ba582cd1825f44abb
SHA1 2b3a480789eeed2490a196f6f98ec717e6f82dfb
SHA512 13466faa6c25fe24ee696fb615a2ef15f453a6ed54ffdc3d3527031f064d1ce360adec34654ebecae4d140b35bd07f4c60e1f6eb7c3ebda35eecccb2ebe43b56
TLSH
T11DE068A6C2D499EE465052E426242C07CF6E081902286D69CDE4AB5B93A1478811044B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b0924.TMP

Path C:\Users\Admin\AppData\Local\io.lagswitch\EBWebView\Default\Network\Network Persistent State~RFe5b0924.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\io.lagswitch\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d59aec0e-528a-42d6-8a4a-d6a288f5a912.tmp

Path C:\Users\Admin\AppData\Local\io.lagswitch\EBWebView\Default\d59aec0e-528a-42d6-8a4a-d6a288f5a912.tmp
Size 6KB
SHA256 a69aecefa51bd1f8a0a47a337d3b37df69dc6f11825095e26438ef9a374eeb0d
MD5 d83f5fe4a2cbc5e75b32e9c0eb8ad68e
SHA1 6d41b9c9913fb002098e47f320d508819e71fff6
SHA512 f9bbe5d112baea9c976c6f0250eed4a8f29e9009728b3ba960e60110f65724ed70f41dd5bdf05a8fe0292c2d4cf888c52e2d7b2b209b98885a116e8b892b5dc5
SSDEEP 96:st2/dnK1Mib9MkHo5h16ZPJs7/x+6MhmuecpBh1ejeuK+gsP+28XM1C7K:stupb8o+JsV+FNBhQj6iP+G6K
TLSH
T121D1B6125E28797B4CC6E149BE297B5BD3F9543265D51D58EBF84B1C08DA6CC2307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\io.lagswitch\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\io.lagswitch\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\io.lagswitch\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.lagswitch\EBWebView\Local State
Size 3KB
SHA256 e7196356357540afa6db6cb5cbc3bf864fbe1efc0980c9d801c6d22b9810e2a9
MD5 3e54d4e6acd8c8f39170f1413b5bf3e5
SHA1 cbcf55ae3ebd9afab62d5dd0121ecf1f83f9bac0
SHA512 e931fe9e0aa63c4adee485537c4843271cc6b4656810c641180ff2900691c89d24a86fb8a27d7e9be2b1abae8459053f23c3497b3bfdf94fe5fddee1af2a862c
TLSH
T1D581A57669A4A9775DE2D9857C863F47A7A54067E9C13F95E6EC0F0C01DB28C1343C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.lagswitch\EBWebView\Local State
Size 2KB
SHA256 31cdf340e862e20b1ef97912e75c08b655f9297c709b13c41fd5d2fc07ea4c50
MD5 c7aa92adbfca00ec12786324a52e9b0b
SHA1 d704909223c80c020e99a714d99035a86c79daa0
SHA512 ed5b92ef71251515b605ffcce537234bafdce17d9707647aafe485c3166ec7ec126931230db6ca5a3700b0c71044ae82a9e001efb3c60c155adf0d2b723cc2a1
TLSH
T17B51A57369546A37AAE29A857D463F67CF7540A6AB922F51A6DC0B0C00DB54D2B03C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.lagswitch\EBWebView\Local State
Size 14KB
SHA256 d8b0d193c0ea9effc27c2581ab226783d022a946194736d36930f648ffaf5c50
MD5 47c55ae3063531b7360a1af60ca1f084
SHA1 e356ea4a1c3f94a8d6fa62b4ff73570311148abb
SHA512 8a3352161966a80606348daa3ad9abba8faceb4e399503546aeec6753e70a5c1a99a645fb66146fadb7f9dad11860bddecffdc375b18bec0fe4b4497fa77f9c2
SSDEEP 192:xsrSABD6KZenoX+pshLTGbdna37W6h6DWYP9E4Y53yJGPa/a7vnNBSx/cfeoDUhz:xsrv+89zHqlDNP9oid6NBSx/mMuPogNk
TLSH
T1C8629E33A57CA2375EF29845B8867F077BB860A7A5C21BA0E5D80B8D41CB0CA2317D53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.lagswitch\EBWebView\Local State
Size 3KB
SHA256 ee3846fcdbdf2c29505ddcadbfc5cbcf64a0b040293dbb8367e0bfa983b20d9f
MD5 46e1eb3c693c1e28a9d0258706cd632c
SHA1 2da12e6de3a4e98d94c756c6d13927cc8d4a19f8
SHA512 541bbe2f307129fec3a18191bb3717cf9d054eba2003ee92e5c7b5f0c9f3f3eb79dda583f4162c85c9a7884807c7f4a03e3937f544eb2352335e1767730e028f
TLSH
T12971947769A4A9375EE29A857C863F5BA7A54067EAC23F91E6EC0F0C01D728C1713C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59f543.TMP

Path C:\Users\Admin\AppData\Local\io.lagswitch\EBWebView\Local State~RFe59f543.TMP
Size 1KB
SHA256 1b5e4059b41e5271ad32360a44098ee8438059fa01dc88d0c7dd24d1934e163a
MD5 f80e1649898cc3eaa2f0d28b7b0f1996
SHA1 4a4797e44ac415a4b4cb82350aa710687c753f5e
SHA512 67c16855b5e050feb0828372df5431b53b47ecc218f7e0b412acc02d6239ef555951507965d27314bd0982bd46ce9f683729e0b073774c3936126a04d480e901
TLSH
T1A33154B285941B327E92A5D635517F9B4F6100BB97921F4072DD8B0911DB14C5A2BC33
MD5 SHA1 SHA512 TLSH

Submit Download

e59de12.msi

Path C:\Windows\Installer\e59de12.msi
Size 2.7MB
SHA256 369e5f4d60dda23b62aabe953ef5b648a5ed4525b1d4b0f33b61775591b55f3d
MD5 33af88413ee14b6f1ebb21646290bc1a
SHA1 cc801c4645abbeb14f426c55bfd25b0a31f154da
SHA512 1130a2e020f3a5ec0a4ecc9c195f8a2bb3bc9546fbe392ec8d586a6b24805f07386f7980d4d52a08047659cb5d06c070f18e703994fea42c155e8d3c75c494e8
SSDEEP 49152:l8n4+gE1XqribpSzTyXCfccx+yE4OlHhlbqLR7oWOGWvZgkj4m:l84+Xary0zGXCfTE46BcL9oWO5v8m
TLSH
T1E6D512373E409836D5BA0C32447ADB609E2DBC280A40C9BB53C5795DDDF39C0DA6AAD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 7256173ca70206e5a00f97288f0633a76462bb82def0e8d30126d0b2177e68db
MD5 ab810a5b12087a91265f21e0aa13583e
SHA1 25a2eb31ddc18c71667fd7b9b6777209490bf561
SHA512 25cf7a4e28711d33c9098c45ffb2b7f3696037d00ce4ac67fc75672bec6001e806b27230efcbfc3c34552c16a10cb20fb955aeb4956973b3396de16a8eb761aa
SSDEEP 24576:MFo3DMPndoO/vvTL/SwyiCFAvre45LFB0vkwN/8qUn8aZ1jS8Ih2ibYDGuo:yHE
TLSH
T1F057B42436F92100EBF7AE3CA8F06A274D397D57AC16DE8D45511B4D0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{ac9cb1e9-cf15-4059-b81e-b9f013163a20}_OnDiskSnapshotProp

Path \??\Volume{c61f8367-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{ac9cb1e9-cf15-4059-b81e-b9f013163a20}_OnDiskSnapshotProp
Size 6KB
SHA256 338b3769f08137d72c80551b47cd1dadc8c49e5a5ea2ed4e50ff8778f5151730
MD5 8d77b3f7f1e1a757c29b4cdad6f04932
SHA1 386c00232b7555f2b0150476680527e83b7ceb3e
SHA512 9319de6f9447eedf52c44bdff4720911485a81aecab2264147d11308e4c1561290f517ede4ccef7ae4d2cedd92d3005e6f09cb156a5b8b5bd601cc21a217d4ef
SSDEEP 96:FnIFlgvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:lIUb++uVmN
TLSH
T1A1D187184AE54711E2B3AB3169F14557A837B811EF33CB8E0198238E2631A10F976F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2904-93-0x00007FFF06930000-0x00007FFF06931000-memory.dmp

Download

memory/4332-343-0x00007FFF06930000-0x00007FFF06931000-memory.dmp

Download

memory/4332-342-0x00007FFF07D60000-0x00007FFF07D61000-memory.dmp

Download

memory/4756-240-0x0000000063D40000-0x0000000063D50000-memory.dmp

Download

memory/4944-257-0x0000014E025A0000-0x0000014E026F9000-memory.dmp

Download

memory/4944-82-0x00007FFF06930000-0x00007FFF06931000-memory.dmp

Download