hxxp://drive[.]usercontent[.]google[.]com/download?id=1ObfSMcX1FUQJzbyPVXV2bLg87IuNcXdB&export=download

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 01:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://drive.usercontent.google.com/download?id=1ObfSMcX1FUQJzbyPVXV2bLg87IuNcXdB&export=download
Sample260813-b9ybtshp21

Score

3^/10

discovery ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1668	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310594870991702"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{5B4EC0C6-289E-44F4-B547-04E9E51349AA}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4328	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3948	msedge.exe
3948	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe

Suspicious use of FindShellTrayWindow 57 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
1692	VDISwitch_v1.1.exe
1692	VDISwitch_v1.1.exe
1696	VDISwitch_v1.1.exe
1696	VDISwitch_v1.1.exe
4608	VDISwitch_v1.1.exe
4608	VDISwitch_v1.1.exe
2468	VDISwitch_v1.1.exe
2468	VDISwitch_v1.1.exe
5008	VDISwitch_v1.1.exe
5008	VDISwitch_v1.1.exe
5008	VDISwitch_v1.1.exe
5008	VDISwitch_v1.1.exe
5008	VDISwitch_v1.1.exe
5008	VDISwitch_v1.1.exe
1092	VDISwitch_v1.1.exe

Suspicious use of SendNotifyMessage 45 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
1692	VDISwitch_v1.1.exe
1692	VDISwitch_v1.1.exe
1696	VDISwitch_v1.1.exe
1696	VDISwitch_v1.1.exe
4608	VDISwitch_v1.1.exe
4608	VDISwitch_v1.1.exe
2468	VDISwitch_v1.1.exe
2468	VDISwitch_v1.1.exe
5008	VDISwitch_v1.1.exe
5008	VDISwitch_v1.1.exe
5008	VDISwitch_v1.1.exe
5008	VDISwitch_v1.1.exe
1092	VDISwitch_v1.1.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 1536	4220	msedge.exe	85
PID 4220 wrote to memory of 1668	4220	msedge.exe	87
PID 4220 wrote to memory of 2032	4220	msedge.exe	88
PID 4220 wrote to memory of 2032	4220	msedge.exe	88
PID 4220 wrote to memory of 2032	4220	msedge.exe	88
PID 4220 wrote to memory of 4396	4220	msedge.exe	89
PID 4220 wrote to memory of 4396	4220	msedge.exe	89
PID 4220 wrote to memory of 3084	4220	msedge.exe	90
PID 4220 wrote to memory of 3760	4220	msedge.exe	91
PID 4220 wrote to memory of 3084	4220	msedge.exe	90
PID 4220 wrote to memory of 3084	4220	msedge.exe	90
PID 4220 wrote to memory of 3760	4220	msedge.exe	91
PID 4220 wrote to memory of 3760	4220	msedge.exe	91
PID 4220 wrote to memory of 4928	4220	msedge.exe	92
PID 4220 wrote to memory of 4928	4220	msedge.exe	92
PID 4220 wrote to memory of 4928	4220	msedge.exe	92
PID 4220 wrote to memory of 2396	4220	msedge.exe	93
PID 4220 wrote to memory of 2396	4220	msedge.exe	93
PID 4220 wrote to memory of 2396	4220	msedge.exe	93
PID 4220 wrote to memory of 2140	4220	msedge.exe	97
PID 4220 wrote to memory of 2140	4220	msedge.exe	97
PID 4220 wrote to memory of 4176	4220	msedge.exe	98
PID 4220 wrote to memory of 4176	4220	msedge.exe	98
PID 4220 wrote to memory of 4916	4220	msedge.exe	99
PID 4220 wrote to memory of 4960	4220	msedge.exe	100
PID 4220 wrote to memory of 4916	4220	msedge.exe	99
PID 4220 wrote to memory of 4960	4220	msedge.exe	100
PID 4220 wrote to memory of 4960	4220	msedge.exe	100
PID 4220 wrote to memory of 3700	4220	msedge.exe	101
PID 4220 wrote to memory of 1940	4220	msedge.exe	103
PID 4220 wrote to memory of 1308	4220	msedge.exe	110
PID 4220 wrote to memory of 4256	4220	msedge.exe	111
PID 4220 wrote to memory of 3024	4220	msedge.exe	112
PID 4220 wrote to memory of 2780	4220	msedge.exe	119
PID 4220 wrote to memory of 2780	4220	msedge.exe	119
PID 4220 wrote to memory of 3948	4220	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://drive.usercontent.google.com/download?id=1ObfSMcX1FUQJzbyPVXV2bLg87IuNcXdB&export=download
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffb1433c188,0x7ffb1433c194,0x7ffb1433c1a0
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,8118607235865160760,3986936467109451887,524288 --field-trial-handle=2892,i,3898211806745362917,13611184730433981448,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1776,i,2898303711876017167,16730219851861325782,262144 --field-trial-handle=2892,i,3898211806745362917,13611184730433981448,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:2
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,9850493830078939547,4637143187967620133,524288 --field-trial-handle=2892,i,3898211806745362917,13611184730433981448,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,9354270704279272991,10384416201126816578,2097152 --field-trial-handle=2892,i,3898211806745362917,13611184730433981448,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,14062917062331752840,11718515769767467856,2097152 --field-trial-handle=2892,i,3898211806745362917,13611184730433981448,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4108,i,5007244379548993571,15769491847530965676,2097152 --field-trial-handle=2892,i,3898211806745362917,13611184730433981448,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,11077546250628784941,14558922484398170001,2097152 --field-trial-handle=2892,i,3898211806745362917,13611184730433981448,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:2
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,16716916756446747556,16799547180216319728,524288 --field-trial-handle=2892,i,3898211806745362917,13611184730433981448,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,6925067946541935501,12823907733776109502,524288 --field-trial-handle=2892,i,3898211806745362917,13611184730433981448,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,7279937588072425147,14105504958475229912,524288 --field-trial-handle=2892,i,3898211806745362917,13611184730433981448,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5656,i,10104482229953109216,12827079530436573638,2097152 --field-trial-handle=2892,i,3898211806745362917,13611184730433981448,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,5473583701750571870,9401675566229830534,524288 --field-trial-handle=2892,i,3898211806745362917,13611184730433981448,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,8265411743055973578,6260259842976435,524288 --field-trial-handle=2892,i,3898211806745362917,13611184730433981448,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,8265411743055973578,6260259842976435,524288 --field-trial-handle=2892,i,3898211806745362917,13611184730433981448,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,5329277234642797443,261629926293638300,524288 --field-trial-handle=2892,i,3898211806745362917,13611184730433981448,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,6975632793628280403,13496736382344020450,524288 --field-trial-handle=2892,i,3898211806745362917,13611184730433981448,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,11944119476941095717,11464418487772442424,524288 --field-trial-handle=2892,i,3898211806745362917,13611184730433981448,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,10286668038591179885,11065954319240658789,524288 --field-trial-handle=2892,i,3898211806745362917,13611184730433981448,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5052,i,3946393398523437377,14913162073625919539,262144 --field-trial-handle=2892,i,3898211806745362917,13611184730433981448,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5040

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3968

C:\Users\Admin\AppData\Local\Temp\Temp1_VDISwitch_v1.1.zip\VDISwitch_v1.1.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_VDISwitch_v1.1.zip\VDISwitch_v1.1.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1692

C:\Users\Admin\Downloads\VDISwitch_v1.1\VDISwitch_v1.1.exe
"C:\Users\Admin\Downloads\VDISwitch_v1.1\VDISwitch_v1.1.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1696

C:\Users\Admin\Downloads\VDISwitch_v1.1\VDISwitch_v1.1.exe
"C:\Users\Admin\Downloads\VDISwitch_v1.1\VDISwitch_v1.1.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4608

C:\Users\Admin\Downloads\VDISwitch_v1.1\VDISwitch_v1.1.exe
"C:\Users\Admin\Downloads\VDISwitch_v1.1\VDISwitch_v1.1.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2468

C:\Users\Admin\Downloads\VDISwitch_v1.1\VDISwitch_v1.1.exe
"C:\Users\Admin\Downloads\VDISwitch_v1.1\VDISwitch_v1.1.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5008

C:\Users\Admin\Downloads\VDISwitch_v1.1\VDISwitch_v1.1.exe
"C:\Users\Admin\Downloads\VDISwitch_v1.1\VDISwitch_v1.1.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1092

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\VDISwitch_v1.1\Config\Setting.ini
1⤵
- Opens file in notepad (likely ransom note)
PID:4328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 991008b9b0595d73a834485ea29586af44591a386941c327848eaa62bdda1d31
MD5 361e52e3af42b9ecd11b87e3113f10ec
SHA1 317337f4abf4ee15758d7ffaf16d705572917ecd
SHA512 176061638831bb89d64d18adaba36e7e65a39b64768b1d30891a8116bd979cdb3c938e30394f379c786c984d6a7590d1d7d0b299de23e12b878648fc110b41a7
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T1ACB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7a644f492c5465c1d979ac371a23f16bbc45d636c42c2a6abb7329a16daba1fd
MD5 9560ab3163c48d3472afd3ce1b801152
SHA1 2f18dc85ab006bdb93281c10aabb7bc0039022c8
SHA512 d10e5c4860b4f3e24bb9a1c3e48319a33fd6aa07709622d9c3a1bf252bcbace198428a86884d98ab4029e99763b179da9842956e5267ff611a82b2ea58bbc6fa
TLSH
T1DD610B380262C85CD3AC153CF1D15234743F859A9A1B6E652E10BFFDE9C9B31A1D6C0B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58681b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58681b.TMP
Size 3KB
SHA256 20ca6c8e32a8f9232cc73361958a6fd434b9731f57bebde65c0dc352e9397cfe
MD5 458d70c11ffd43ebf9b45c591e9f4ac4
SHA1 afc32fcc221d6ca86c246e85515bf56524a7d82b
SHA512 70ed2f765a5bf05c34d4bbf4b2887cc03641d21bea655f8e7053db1dd36d695cd5464127c1f82f120176583e1b92c29fc7c007d92bf68ce63f0cb2aa755e0316
TLSH
T1AE610B380262C84CD36C153DF1D11234743F868A9A1B6E662E14BFFDE5C9B31A1D6C0B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 de7575759abc265518887db8705598227325111559751dae4354bb6025809662
MD5 17f65175a5830ef4568be6c077815bc1
SHA1 1ffb18dd2a4c94fb72e689df1b90604270606b4e
SHA512 54c0c0b0e808b0d8668b0a94f91d11fd9109a0b56c6c96ccf625d59c01998ccb5e0ec7cef24a530211833a13278fbe22ea3d7841554c49124abe8c6c0f716057
TLSH
T188216AB3C7E5966E891156F05B24AE2BCE2D0609421C3C1AC9D4AF2BD3E3475E10199F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 42d469ed05f891cd5b87d580a9e818c971ce6580be54a64a1738afae1697e7c4
MD5 f909c8c651ee72e7ba87f2a73e9e4a8f
SHA1 3add2d3f4e152fca0ebd3acea8bcd6682cf24504
SHA512 ca72f72e4d2f568d925d1afdd0c257df27ca7d57d815153f8bc19fd0d69c660477e87bceb77f9477ce562f7e1e29072934f4f4100b4ba947b6722f9bbd8a9126
SSDEEP 192:sxZ2bRayM/jK1Ml8M94/frs5qnxIdpJHW6+WNGYHlHNDyEIgrJ:sxZ2g14/frs5qn6JHbGAR9
TLSH
T15342D7116A34A977CCCBD20DFA45BF53D6F90432A2900E44ADFC9A1C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 146a53ab35127d1f44c5f6d3a6897305f80892e82e929204c81c2e64cb9cf9b0
MD5 559e164266e4cfb6e048eab6437ce6d2
SHA1 d7ef60bcf8dc61a42f12543f24828fce66fd0e4a
SHA512 968bb9301786e021c56b6b7a1a76d271640bcd1b002a3ce0b8654b095b97e5963d8e9ac39ef538ce607888f8d6639bca0af73260174c4fb6744611f986d2ce2d
SSDEEP 192:sxZ2bRayM/jK1Ml8UQ+94/frsrqbxIdpLHW6+WNGYHHMODyEIg59J:sxZ2gqY4/frsrqb6LHbGkRt
TLSH
T1F652C6166A346977CCDBE20EB951BF53D6F84472A1900E44ADFCDA1C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 8213609f3ad5f6d84a5de6afcac858387b7e7f2e860103a3923399c9f1594216
MD5 0e80bbcf38bdc038c2ec5f7d9ecc8dbc
SHA1 50baa55e317c9f9f0eb2d2c3c3dcd6394cc4ff90
SHA512 b346cc05bf81affed358f4e43dfff3b858971273ba7cad6c36c871b78f761f7b566727d7f977dedf6cacbf67eec35bf1bc67356fbc0fb13f70cd588df7a380c7
SSDEEP 768:buUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RQroVS0S:buUZYTMWvg0Pou1ja7eLZmR7fS
TLSH
T1FED21B2B280CCB7E4F844E5DEC266F967ED801CB5A584D544BEA884C03CB7EF512B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 cab654ed41831951e2f2c9959be55ebc276a6ec1f61df21ca18f8c17eafd2f6d
MD5 7fb99d62a225cdda347bb797cfa3ec82
SHA1 2d7db33cb9c2388f444e599270c61dca84cd6c4d
SHA512 e73caeaaad255c22d79fff555685b063a9da373b52b11c5bae479e9371fd98a5913cd1116437957eaed9c4e041a86e2ac2a08336ef28ad90797f4e196d2352e4
SSDEEP 96:KA1eK2AAv+KAgmiSgKXq8OgKXqSeGbg0GwQxFU1sDsxKr4DmxH+2Ns3:EU1HQHeGbg0GwQHU1gsK4Dm9+2Ns3
TLSH
T1E1D1F36271BB02422D3E6B5893D5871BCE4272633018E52F3BAC41B18D67E629CFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d933720b-2f6e-44b2-9afe-38ec6a1ae520.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d933720b-2f6e-44b2-9afe-38ec6a1ae520.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 8a9b80bc3f870082721c47b88b139e6d1605d431f1ba5347c59b9acf7d0c8668
MD5 4d919ca5d8d872e28b35447d6ac5e56a
SHA1 6c590121092885b53472dea909c24a2dc729e853
SHA512 06cbb59e9f7e4bb7e6c05f3599a6a0f946cea97a496c34ec96244143f5cb2e654a68c57444aec4c25b5d87fa38063b47e29064b21d3b86912d8f7518630a59d7
SSDEEP 192:upVsNNYJQe/TUtiYZQmiU1v3Y4zX5Obd+jFO/aouJFd+2e4QUqK4U8:EsNNih/TazdnzX5od+hO/VuXd+2iFU8
TLSH
T1DE421B366968AC364EE3A695F4873553DFB8006BD6842FC4D6EC2B1C01DB6EC230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7d65797e528c65a974b4eb66d61ba16c6d96cc3258a88a1cbeaccd443d9b7de3
MD5 7ef164c4e477b93727ffc8188c8d8610
SHA1 dbe8210679925e7ee77fe4208811426ff895988c
SHA512 fdb2b19344f53e4ce6de6306f66d883faf7a2b83305f11ca408b7fc650fc43643fc785bf1f4358c20ec2b4bfb6f52ed6da9ccf455243673f66aa3280cb932bb1
SSDEEP 192:yONw61VWQmiUyBhgGX5Obd+jFO/aob/a+36iU6:yONw6WagGX5od+hO/V+7iU6
TLSH
T10F02D83569686C778EF2BE49F48777139F99206BEA542F84DAEC1B1C00D769C2307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c78c99d7a884632d924444db42c6f8465fce20d99e7543cd5e35641de1ccbf63
MD5 05b593f22d4a9ef09df77b2ccc4edead
SHA1 0a074420047779f283d6898c0b6a4ddef1b45096
SHA512 e1091a41c635cb49f8bf90c489b5e82b8cff0074f589087cab7e93ff11fdfc907824de8684cf6e269c95c80c27ddf6406da8212d9f1cafdac47835393464302c
SSDEEP 384:kZcIisNNzh/TazdnzX5od+hO/VuXd+2iFOOPrXLpe8C/pyu:CinbOgO9utliFOi9Payu
TLSH
T170927D7165786C626DF6F696F58636138FFC4067E6C42FC4A1ECAB1C01DA5AC130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c37fa0d09a8c91f8118fd9ad338542e6c56b0d7df5a9c3b156c4870017716159
MD5 e9e2ce9ce143f7b41941fbfa29cea00d
SHA1 2d9d547e02493bf2cc8c9cdd25707dd594d2a88a
SHA512 343162810b1dcef106993642bdaddcbaf4a259bb0d799e572c006f84695595a610dcca090fe69d57a35e131c0bb19a00a52cdba27afc512ebe61874194f7d810
SSDEEP 192:KONw61sWQmiUybhVGX5Obd+jFO/aouJFd+2PjJUqK4U6:KONw6xKVGX5od+hO/VuXd+2tFU6
TLSH
T1CA123B326468AC378EE2B595F48735538FA95067EA887FC0D5EC2B1C01DF5AC230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 0186bbe7a4356a515528ddae200b5b5fcfcf7d02f8dba9656c337432e04e48d5
MD5 91553f4d2b60acd12bfc0ce61f99fea0
SHA1 ca2becba00ed70d0d15980a128ecd5a8429205a0
SHA512 098bcbeefa511ee1d6db60af19d393dc3761343d01c1d9bbfea959594068d19b487ac9bc873fa69b8388b788b37e52448a04781c4123899787320401917d30be
SSDEEP 192:u1LsNNpQe/TUtiYUQmiU1v3Y4zX5Obd+jFO/aouJFd+2e4QUqK4U8:YsNNph/Ta4dnzX5od+hO/VuXd+2iFU8
TLSH
T1A5322B366968AC365EE3A295F48735539FB8006BD6842FC4D6EC2B1C01DF6EC230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 d574cb7b32b3b55dbde45cfc6b543c6a8be2aa81639b1f18d20d7549dcc318f7
MD5 603b798b054e686ac5fd6f15db3f84d6
SHA1 396c4857758e73711a1a4fd5054e2c38f177aa09
SHA512 9d52391fb03af1d397fb81cd1fac8d407bc5a60e99374e20cda22ac7014bc87a59fa2e5e79b3e58da726553b3de7aa3fb355a63099cc9945c5c2849cb48ed275
SSDEEP 384:AiFVZcIDsNX8TUNTUlIlzh/TazdnzX5od+hO/VuXd+2KFOOPrXLpe8C/pyu:bFtDGwgIbOgO9utlKFOi9Payu
TLSH
T1D1B26D7259A89877ADF6AF85F9863613CFF840B7D5C46A84E2DC9A0C01DB1DC130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a582d277-128e-4830-ab40-d6ac258f0e82.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a582d277-128e-4830-ab40-d6ac258f0e82.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7f09c03d136d946923f0e5b609f5b93ad9a7a887195fed69de2bc58ab99a79aa
MD5 dac54d17f6f524449006fb6036e1a50a
SHA1 e53231ee0d53e5e525ab980a80b16b680eb468b0
SHA512 f35b91c4b56ea5c13c07e8bc4a60f2a61e580002648ee6e5d125e1e0ddad36f27e9014c25d1b865aad37b43c292162cf61b9681eeea6c01cf40c76b3a1ce3760
TLSH
T15C410A58B6FA1148B3F67F5A6FF6A46E447FBD772E06946D10110E4F0A62B00C8A1B33
MD5 SHA1 SHA512 TLSH

Submit Download

VDISwitch_v1.1.zip.crdownload

Path C:\Users\Admin\Downloads\VDISwitch_v1.1.zip.crdownload
Size 618KB
SHA256 cd5e23ecf071b8c5fd2434e465af349bab35db1ba27db83678d514e117c3c244
MD5 502eebcc420ff5f51874f7c834da56cd
SHA1 7479e09ddbc9c7afb3dc928eebd0279d35815c60
SHA512 1daaa1cb3b982796f94a70087a46f08250c7ddc7200415c63c7c7dff1f4cfd89135f29f18bf18aa8814ac257a8ddbb19c8c80c23225d32714f2f48ee66b4ce6f
SSDEEP 12288:sjED311q/jMfffvqg8HIPdqUPoTVsu73IIZRDCIjOBbWWRLv:sjyujyvT88xoTVsSFD9OIWhv
TLSH
T13FD433147932B3FBCC79844392AF7998AF5BE9E6E033459BA0434DD21EF4E481353226
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download