revengerat | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Analysis

max time kernel
97s
max time network
101s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
07/04/2025, 06:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

10^/10

revengerat guest defense_evasion discovery stealer trojan

Malware Config

Extracted

Family

revengerat

Botnet

Guest

0.tcp.ngrok.io:19521

Mutex

RV_MUTEX

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Revengerat family
revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral1/files/0x001600000002b1ea-854.dat	revengerat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
108	2408	msedge.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	RegSvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\:Zone.Identifier:$DATA	RegSvcs.exe

Executes dropped EXE 3 IoCs

pid	Process
5820	RevengeRAT.exe
4040	RevengeRAT.exe
1396	svchost.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
76	0.tcp.ngrok.io
78	0.tcp.ngrok.io
106	raw.githubusercontent.com
107	raw.githubusercontent.com
108	raw.githubusercontent.com

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 5820 set thread context of 5952	5820	RevengeRAT.exe	119
PID 5952 set thread context of 5992	5952	RegSvcs.exe	120
PID 4040 set thread context of 1164	4040	RevengeRAT.exe	123
PID 1164 set thread context of 2784	1164	RegSvcs.exe	124
PID 1396 set thread context of 2448	1396	svchost.exe	153
PID 2448 set thread context of 3500	2448	RegSvcs.exe	154

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4376_1608240160\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4376_1608240160\manifest.fingerprint	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4376_689018085\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4376_689018085\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4376_1608240160\manifest.json	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\RevengeRAT.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133884826007667265"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1136229799-3442283115-138161576-1000\{D7E45860-E32E-46EA-8C71-820C93490D3F}	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\RevengeRAT.exe:Zone.Identifier	msedge.exe
File created	C:\svchost\svchost.exe\:Zone.Identifier:$DATA	RegSvcs.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	5820	RevengeRAT.exe
Token: SeDebugPrivilege	5952	RegSvcs.exe
Token: SeDebugPrivilege	4040	RevengeRAT.exe
Token: SeDebugPrivilege	1164	RegSvcs.exe
Token: SeDebugPrivilege	1396	svchost.exe
Token: SeDebugPrivilege	2448	RegSvcs.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 4880	4376	msedge.exe	81
PID 4376 wrote to memory of 4880	4376	msedge.exe	81
PID 4376 wrote to memory of 2408	4376	msedge.exe	82
PID 4376 wrote to memory of 2408	4376	msedge.exe	82
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 2004	4376	msedge.exe	83
PID 4376 wrote to memory of 4804	4376	msedge.exe	84
PID 4376 wrote to memory of 4804	4376	msedge.exe	84
PID 4376 wrote to memory of 4804	4376	msedge.exe	84
PID 4376 wrote to memory of 4804	4376	msedge.exe	84
PID 4376 wrote to memory of 4804	4376	msedge.exe	84
PID 4376 wrote to memory of 4804	4376	msedge.exe	84
PID 4376 wrote to memory of 4804	4376	msedge.exe	84
PID 4376 wrote to memory of 4804	4376	msedge.exe	84
PID 4376 wrote to memory of 4804	4376	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x2ac,0x7ffafb49f208,0x7ffafb49f214,0x7ffafb49f220
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1892,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2052,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1984,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:13
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3452,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3468,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2508,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4092,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:9
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4280,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=4420,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:9
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5272,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1656,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:14
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4204,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:14
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4164,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5940,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5940,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6172,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
  2⤵
  PID:5484
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1100
    3⤵
    PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6184,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6488,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6504,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6608,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6532,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:14
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6792,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6796,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5348,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4560,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:14
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4548,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4412,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5532,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:14
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=5508,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6276,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4732
- C:\Users\Admin\Downloads\RevengeRAT.exe
  "C:\Users\Admin\Downloads\RevengeRAT.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  PID:5820
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    - Drops startup file
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    - Suspicious use of AdjustPrivilegeToken
    PID:5952
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5992
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\svdnxslp.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3752
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA013.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1E3232ED1E6E47E78ADD3AAFF6AA76AE.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:432
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cmpsk3b0.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4836
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA0A0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc15EE6196B25D45679CA8D8EFECD70BA.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5308
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tw2zyg-a.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5216
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA12D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6471C939844F4331825A48B7C8C357.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5156
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zqqkegua.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5444
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA1F8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3C2D545B3D784547BA3BE6FD405A5CE7.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5480
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jiyghmi8.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5556
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA294.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF1E84D5945BB42D19DDEED4554BECF3.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4732
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\y2ls7apf.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5636
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA321.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc70B620FE9C64F89965C47E3D30F439.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4996
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qiv4-_-0.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5816
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA3CD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc30116ABA692D47BCA95CF1B881D19239.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2556
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      PID:1396
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2448
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3500
- C:\Users\Admin\Downloads\RevengeRAT.exe
  "C:\Users\Admin\Downloads\RevengeRAT.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  PID:4040
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1164
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6800,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:14
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6508,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:14
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5392,i,8395328297631422934,8582485942376090948,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
  2⤵
  PID:5340

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\svchost\XjtnxDp.ico

Filesize
1KB

MD5
1e6c4b32205b72a32786ffcf143ffaed

SHA1
7a99df34d2d7d17e2e01272cd084fdae505bc8b0

SHA256
84a41ba1d0f60c4097dd6921ea73781140c40c14a1872d4aa1872046203e6872

SHA512
49ad851721e811be4b360819eaf55b5a1f572c536fcd86692c05533fa62e91efcf218ad60fa54ce5fc5bc476b04dae78c8ce59c22c7c1448980d430e288ab7f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\RegSvcs.exe.log

Filesize
120B

MD5
50dec1858e13f033e6dca3cbfad5e8de

SHA1
79ae1e9131b0faf215b499d2f7b4c595aa120925

SHA256
14a557e226e3ba8620bb3a70035e1e316f1e9fb5c9e8f74c07110ee90b8d8ae4

SHA512
1bd73338df685a5b57b0546e102ecfdee65800410d6f77845e50456ac70de72929088af19b59647f01cba7a5acfb399c52d9ef2402a9451366586862ef88e7bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist

Filesize
105KB

MD5
6e82345aefe362b4c5071e7df6c07407

SHA1
44176a6b5c2722280699b8cc9a174d168fd4c161

SHA256
ee1ec48b6b166582c51a4141a84f48731ce18a62e4b7faeb9d60560c8f9c382a

SHA512
20c0f5862226a3eb17832e7c793f809f2333e0e0068dbe61b5865517fdd9f84bb5ca8d97bdb19a005a25b789ac75a09067350940f042fb5123cdb682ce2c98d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

Filesize
3KB

MD5
f9fd82b572ef4ce41a3d1075acc52d22

SHA1
fdded5eef95391be440cc15f84ded0480c0141e3

SHA256
5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

SHA512
17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
046b1cdbd636e82e7711ea1fde31d7e3

SHA1
f5fa4183cb259a99b4148ee957a5f76e80a77ada

SHA256
40328502d95af4c1db45d98abe8c4e9214d80a8df7f0b8f19f81edd5e121f90a

SHA512
460ba5792f0df64289ff4057d04615973a7844b2fd2c14df554600c141d720fcf13d9e9c8449ac57e50fa074a81887437918970881b4d48f7a7ee3521bac8eb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
cbc9fc2d9ad2df85283109b48c8e6db0

SHA1
721ea0dfafd882d6354f8b0a35560425a60a8819

SHA256
7c21b286b304b2b42ab3502158aef04892b60c63007b8ed7172dad86a4bcebbe

SHA512
09594b5f33704cf367960376e5abc8cbfa7baead59c3f199ffd365a9a9c2159b45f6596d597ebdd033db5436c000faac3c5b2fb39e97fc17b102d03831265609

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\412f5571-78db-4ff0-8573-ee3887b00180.tmp

Filesize
14KB

MD5
e8c000d1d9f270b8bc443b41cf87ae14

SHA1
25959e2e7f1d9a9035c402f6503e2c3e0023c7e5

SHA256
65cf29a1bf1f30bdda3475944a72e519661675777e6966d2454181b2bb8d9e36

SHA512
b0329c7f284fb14dc5770677b0bb69a29d953c546448d7b1471f2a9e8980ba256d665cc633fa337593a89d3cd89d693de3b8a639f2c049107e5f88128d6913dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
f9a01b24411b5854293d679a84f4ec1d

SHA1
8da2c58789e14ad56b39186828c90381c26f0276

SHA256
fb71d8c323983426516121da550d035f22557ae88d5631ecb32d7e9efefebb81

SHA512
caca1502f9e1e660ab1347c2ea2fa18083dd9ec10782073eb352d36e469221c34f55099ab7a2f6788b98fb2bb092c95b13dd8e05cc746be62c6548322cc86337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
b80c62b3e9fc3398289d3025f30482b3

SHA1
65920b51d3e686d862b9b36586c297222c904350

SHA256
2ad4318ac5f70b5e77056c6565486cc6d61d6ff0f25cff9b9720f7bfec3898ce

SHA512
74d0bfb1c0d376bc668da1910ac35adc1af2e80e74639b9c643a732fe93f610de71d3599e97c947c0ecdd2b68facc77e43ba11a3c232ce2c041b10225acca383

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
302970fa5ef2fbaac8b659659bde0338

SHA1
ff71fa36772bdbf17cb68f7010adec5d0ec4c2c6

SHA256
59ba0b4895be9763c00e6c1c09b79d87f18c26bed4ae1346f9a8454b359e4b71

SHA512
ef2b886451504f58ce9362c6055475f58583a8a8e83d2353313eac10fc7d9555bf5f0184d3e08244eb8eaa60d0b01333335b01e3977e867ebe892ee278768a36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
c79fb750de248827b7953f861a939001

SHA1
78f9004f6de9cd69791dfb8a67b8be48bf90fd1b

SHA256
964800b927df9fc64e8f89986133445cdd3759ed0254550038b0754ffb68f564

SHA512
a4707df3a66af0d48bd9878d6bf21f5dc44a34ac4047cbf5dc417b6f082333b7642e024ae7d4fddd1b78da9bdb195a9e91292167fb44915418598fba251e8848

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
e09943d2952adf0ee317540c9d9edbe3

SHA1
f682756b33bedfb49b70987fc7b731678b73816d

SHA256
f8c1f27bdc13cff51e383f855ae361bc58edf9a88445bcb656bf893b5c00bda9

SHA512
8c30d39561b2767526fd3ab84ee73e4d433cc6c0345358fbf9f5026a6c0e8c30f0bb776f101bd9b32cbe1738b2db4426990723bab106d924ca870d4556e72123

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
4KB

MD5
3fe877c55934cc478fc1d5e7533ab8ac

SHA1
d154fef12165e22999aa78fd170ff4d3e11a370c

SHA256
d0a52a04a1d6b895e2db7ed540c227dbe0806817309acd8feafc5452d59c5e8f

SHA512
a76a9469d44a847ea408cb9699124801818770310737e19fc16b6b00cbd122e16dcc6a645d38a8c921009efe4e29f6aae1c393fdfe4573a3680fb73e51e70e22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
263d29bbca2a40711c7c203f5fd74231

SHA1
3075850a83a68367aa6dae8f6eaee55942bddf0c

SHA256
71375abf6cf33977400441b3c882538de634ba7782c02aab97c4c105a3a3527d

SHA512
35a3d1ab07bc99e3f8bfdb22db29f32d79bf4513fe1ed734d83c275eb7c63442067537efe08ee027b94509ad09f93674f06d7e4b7a0205c0f160ca6e39849c5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
872B

MD5
d54064f95fcc385ea8793f52574ae45c

SHA1
ebfb58fbb4d0e618a4392681bcda06fd689055cc

SHA256
94697cc360af52db802372813fe149ab063a8a5e7a46344f4b1159e31fe8ac03

SHA512
fdf7d411de705737954b2b57197912e2512c9fc07a2a80b968c73fe65b8434fbf74193fa87c69e0bba158d558ba9046a4ef2342447c93bf94e68bffdae03ceeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe587e24.TMP

Filesize
465B

MD5
2502d0e2d5ee2d07474194c39122bd3d

SHA1
a0db1ed0d97f49017f3138c0969245c8764caa8b

SHA256
132aa8c32b80042c5ac67d337fe5810da841ec719536187636dced6ba9395c18

SHA512
74ab00d6b91aea833f9f907d78d21f992e49da4ab5b22aea5ce7cc7170862e6100ec4d1d4fb442b524811cd2527b3263afcc2d3dbe7310ba63e4b30157fc098f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe587f1e.TMP

Filesize
3KB

MD5
47430e0e9ad4838b6b88191b7966810f

SHA1
8933b4ce19e396751f93687305d3d378c48e2e0f

SHA256
98c1f419b9efe0d2a9f4350442d90916bd07593d9ecde4706030d1502cfb90d2

SHA512
e3a4e44240a11ce2173acfe66f6b52bdae8fc9c97dfdca441700ab47b5c73a46b71405da95a2cc08c34507fddf4349923c33da57da244e45b5019b9898e6b65c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
c4fee02ad5d39b8a442df8f2cdc05826

SHA1
d016a6eac5373c4df8b8bf5490c56977b16dbff1

SHA256
4569c95eff3f91eada92bff106f184b5158ecaea31fdbfefa745879ffcbadfc5

SHA512
64ec936060f8fe72eb829f6d0dd4352ca2ed0b6536670529f5ef3cef39a50fc4bcdf0cced53ca09d324804c47503313c57af7935cf10f3f46958569b767feca8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
4db3cf093b1c63954f6c10314cdff850

SHA1
0ae917095af788e7d09cf1de789938f1db87c9a0

SHA256
9fc7bf988f7e9b78b61e9e6155493f1f5920c47728118e13801ea6d5c144254c

SHA512
5f73caf6145f77392b3662af1545e69dbe22721db1c1f4945d7c564bd982b0406b744f993c69e4680058f796f38fda58f4eb860a020f3c6fa4035c359457257e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
778b2ab68cbcdcf78a75e2c68c77de84

SHA1
ce8b27f569098b8a2e7e5f08dfdd9faabed4a1b3

SHA256
3f1948db9101f83bb84e5b1f26c0b8c46ec9a6edf4affb6fbd99789b52b5aee0

SHA512
f5862276152ca7fde1868f4e1da270635b25163d4940de35f5e64855fd4972bc1da8325df379a2b6c011a788f8e7b953b067d475825e20820e004b0523a73088

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
39KB

MD5
62b2e951b4a5bf14ab8c4852e09ee619

SHA1
01235fa278b6b9d157c3650a343190c9e7c1872d

SHA256
d1de789771c6b215f8b272970fe4add6157abdbf8a1854107aaf8e3e55f01452

SHA512
b54cb8ee6de329ab774b992d550a8fd024671331965e0111024b24c41603246c47459c18a4d91490bcffc7ea834acb24f0d67c9bed8a142781b32bd43ed5a3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
d1307b1b257f2d23e0a70d0e672f4e91

SHA1
e3fed86fe0242a5cdb0054443603300d9688736b

SHA256
061e3fbe49707c71bfa393ec7e12126f9e8684e4cfe6a83af9a7b4931cfd89f9

SHA512
ad895d9ab37fa7006a3eea4917478a55c8df94b914d9a618ef9144e6a463da6c94e9d7a9f33e06fea18715b0c78585013418539a794c7f0ce36143e9fcd96b30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
9b71ec78b2d531425488bc01e9e56f9d

SHA1
bbe5dc01ca80e5d0499ace52df9361e9a97aa9ba

SHA256
f3b2253a074851e15fc5a5b5a3baf79253c33983845198ec7d879e666a41efb8

SHA512
537ac04aef29e14dad30b65ac5f8cc7372d72b506f6032a1094e7f634c5c9ce38a7e58cd2f7cd2a74ef6a364a5a4097905335bf86774e223ae061372677741d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
bf629555b1a13e12b3edb3d065261bc7

SHA1
ef5ec87a61faa734db69ade423a0a2d9c293654d

SHA256
eac8c662372f974d116d8358b33a8bb0ffc783cb236361ebc9ad891a983581f1

SHA512
bcc882afd2f2dbd3f75dbfd94512965d08d042366dfeb5cb74d5b99d5267c770da37d877d9529679a0e50c0556bb8a621ce1835f3fda0ce1b3f227577c937c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58ab7d.TMP

Filesize
392B

MD5
0ff172111a4488d885fef0dcd51232d5

SHA1
5a67a5dc39da43acb9102903be02d923ddd4903f

SHA256
92e6f2bebdbd1731afbc1f09c139ddcf564fd93e1cc2c9dc15bb078ae4bfd349

SHA512
915b5a6c9a1f0cd8f053c2d2d9d1bd64b01d15475e1f4ddc211c85fdd43e07e759d4a22f6654b478647f973cc6dbfd8060fc8544eeb23bf4b319de6ce73d1691

Download Submit
C:\Users\Admin\AppData\Local\Temp\0d365de1-41d9-4ea6-a472-e01c85e4413f.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA013.tmp

Filesize
2KB

MD5
06060bf14e630a99003eae66754a55f7

SHA1
7d6ef5ac6cdeafee35ae1190076149675f9dd239

SHA256
ff7fab89c4a24927009a4fbdcc619d8903d5f3068c1a67524d0fedc96b621bf0

SHA512
c96cf70c38236bdf7ad2f86b3e4f0d5a903871109201672d34b19d977aebbec6f3d64b766aaa783e2f62f6c1f8112ef2a8da05d8b5c0b6b1bae7fb423cec6427

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA0A0.tmp

Filesize
2KB

MD5
fada6646730637ad55791d0fa0fd4e0a

SHA1
ec12d739d909b30cbd5e14ff0b108a250c176e82

SHA256
b004b18912cff8c61222753fab37a8b6385f6fe971294bb8a767c68e6c9fd3d5

SHA512
79fe3aa0f49aa07ffc95fd79e00d3da60420e8b743894d789e0f7d56d7cdfade8eef5bc5814a6ff2794d603a07e5b185e53e4d7303578f858ce5cd0e73999a69

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA12D.tmp

Filesize
2KB

MD5
9bf9567d5c1ee028b6be7cea0fb03c58

SHA1
a5d2bb18b6d29d05ed1124319ca9cc574dc7a84f

SHA256
97db63557510fa3b775b610007f6c394be866aeaa799d57f4a6afb9cdabf5588

SHA512
5cbdb8a54cd135fb2c6e60d12d8b81a4fc6f9529c1d150488d0558021cea2d30b419646b207275fb4818981ce5c0518a81e9ee2381e65fbdb2212752514be556

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA1F8.tmp

Filesize
2KB

MD5
179cdb4fe5f517f42de3e4d08e4edf56

SHA1
180c6e87243f6c1a7a681791777015ada9d4f335

SHA256
8a84e0e00868bf87bdad36ffd24334720932dca40d9353af616a8ba66f3586d1

SHA512
05cfa72b733559a5a94815f4ab9f8932e5fa5e4a72b7cc04eb95d95fe7208f3e460d90b850b20e39bc7431047d2506725326e50a66be3e3b52fbc89974bbefb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA294.tmp

Filesize
2KB

MD5
b23aaf3cda6f646ebb8455953ca3cf35

SHA1
843a1bc1d0e5934347ebfa9ca74417e6a174e244

SHA256
c46aebee67f397b8567f95c3023194d235f26ae357b11ca4cd34662713790c8b

SHA512
6c89ca5198ba2711f833ff5fab0b3ae6c81787f711ffec4651d354b330a7aec4d9d3ff3fc6fec38a349bbbe54f45cfc34abec171e091fbed0bc61a477fddf5e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA321.tmp

Filesize
2KB

MD5
5c3c82d4ed5446bf1733245e19687528

SHA1
a72290d30834066e0413d5cdc138a20948c50143

SHA256
0e6c9b3f33a03e8bd3bbc609ba014dd5ac16146d3eef2ac93965c8a386047473

SHA512
3a67908a39bcf14c0dcb5f9ca0a62fa5839fafd0ac1946361de1af449592b32f99126e1440bc97a646e79615abbbc611ec5c2af4f119d47f08a41f54ce449395

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA3CD.tmp

Filesize
2KB

MD5
89b8131fca66026c82c87502ed131b28

SHA1
016fb0286aabe0943031ffa646de9253aa075902

SHA256
f254b561bc0b92f429b736824145d8ac5462dcc9d5aab8c9b619ae2aab58df0e

SHA512
c33287ab2549b60db27290f9a469062eeda0fc6d030bfb6a25145209946d8081c58bcb3a2654153540a0a23ecf614a142f63545895b1b960795ce67d22dd65b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\cmpsk3b0.0.vb

Filesize
360B

MD5
883ed388b79b4195862c641b28cf40b4

SHA1
f78c40b79db5668787c3921afdff7a4906888014

SHA256
42b72f0da49da60ece028bc1bf252547f5ffe39577cd027d0588de38150e12a4

SHA512
55e6fe2bc4e96fc02aefe39a1df9d244e367baa81667b01fd52b691a9dc226f84cd81ecc9bc625f778e7d793e0e42d1a3f046a2c01dc4e7175b1a31a379fc128

Download Submit
C:\Users\Admin\AppData\Local\Temp\cmpsk3b0.cmdline

Filesize
216B

MD5
cff083e8a13725b7e67d9da6d87992e8

SHA1
a10a407e06218b5f0baa073da623bb561d9fa8b0

SHA256
098c6305ee035d4598b8b15f3d6f60efb1683056cbd8aad056fe3ee836a12670

SHA512
c6c34812f3714a061473cefe79b923f06a9f2df65f5757c0d687760c2979069463e8b8a5eaab519c2ee4ecaf535814cc8d63445e7539d2fe6a12c716510d47a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\dff6050f-f5a1-405b-9203-e34c493b88d3.tmp

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Temp\jiyghmi8.0.vb

Filesize
338B

MD5
7a354b496b9b397ebb14057eafede32f

SHA1
8970ca3895ca9472366e4fecc1f1d79ac1da78b8

SHA256
c12764cfd58a8df36d22008411f5054ab82256473817260f1d55069f04a083f8

SHA512
ccd8ebaf49e1d94610ac85571a5f3eec92eecb4e07f2138804dc4caf49137d03b30d69540c1a9ece6455539423b906a6c3c477b8496e93fbfce8c815836da5f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\jiyghmi8.cmdline

Filesize
194B

MD5
21d1847b93277e61becc5bcbb7607942

SHA1
134e9a906d3c490ad9d6ad60941f94df85b77034

SHA256
3aa82d1fde6ae64877d90b403bd83ac73e08e090f8172b7f5ed75327c68be394

SHA512
c247e0aedf39ae52c9383521eb08c57c3701a9ea11f4fb7ffe50ecd3f7bea57677adb601ab4c07291c7257fed35da8394cc889f43e7f07432c154f81ab3a62ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\qiv4-_-0.0.vb

Filesize
342B

MD5
b8566f5519856f80dec85a1a2729e372

SHA1
ae442bcd0c97fed28f38b2ae224a93bfdf14dd13

SHA256
ec9f3959285c7493041f7cd7008620ba10b6685d670b21a2c31173fe9b215cde

SHA512
3da5378a33b77fae8cab09d72ec4c940e20bb8d736b7a4b91ee45211270719c12afaca3bac39683919e1cd76e80c310fb179a800592807495eac5a6350777d67

Download Submit
C:\Users\Admin\AppData\Local\Temp\qiv4-_-0.cmdline

Filesize
198B

MD5
c159dc20c20613a2815cda632805f17b

SHA1
0623591fdef8985a2f47d33f9b5ef7c1c3888e21

SHA256
6c3f3107e6643f32f8ce733bffb95a8b92eb78be00d04df6ef335f91a52e545d

SHA512
a45c4a908a686008c7fa1b5a6acce4a988d195348caa6c2bf018cdd609a37161b27791ed53cec086021883b8b1b791ded1d4ba4e6e97da4d19217f554fa85620

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4376_1861929552\6e0e80dc-de57-4c6e-ba28-9333f95958bc.tmp

Filesize
10KB

MD5
78e47dda17341bed7be45dccfd89ac87

SHA1
1afde30e46997452d11e4a2adbbf35cce7a1404f

SHA256
67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

SHA512
9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\svdnxslp.0.vb

Filesize
342B

MD5
eb057b2b26beedef7d931bf659fb6f18

SHA1
3136c99b96686db9ded50aa19b55155c752551d5

SHA256
3066d848e6fa1f1a5041286509fe0319b7e5cf96941f2f3914af9873aaeeb414

SHA512
6d40f52117023ea3171c49cb544c13b703c220a49b7f251d9d4d14332ef637d14ca28e425e723d0906ef31ae77335e38a9e7ced009cde90645b31dde4cea8f32

Download Submit
C:\Users\Admin\AppData\Local\Temp\svdnxslp.cmdline

Filesize
198B

MD5
1276e8f0b7dc150bfc6d5fdf34730ab4

SHA1
63c1f55be29d41f652894d2c4dc4c5020f33d271

SHA256
a048f6378c52086f491fdb4d65182727f6364d3411d3fb8c41eddd845c439494

SHA512
f10ad067c1ff3143d55f3b7e657a0a4d86ee64814738ab9f84a69cfc85f0c4fdb8d2fccfe728b1d92d6f6bb2aa339da020d037c8b6442371c1ff3977f4ae33be

Download Submit
C:\Users\Admin\AppData\Local\Temp\tw2zyg-a.0.vb

Filesize
352B

MD5
1830e137566529844ec4176432dbbabd

SHA1
34e0949bb3b0258f4b70cf50a1d78e124e0c62d9

SHA256
57f9e5ea5a7f49bdabb9bc2d1b36588e6a9a004e083a3a70c753cef82d032fcf

SHA512
63080864b35571e333f276865b639f8af805e1d5f6077b899db55b6bcf0f8026027989350d5051523c5cb58c4358a3ce5d7c26e990b08403cca223e41ace8468

Download Submit
C:\Users\Admin\AppData\Local\Temp\tw2zyg-a.cmdline

Filesize
208B

MD5
4b3b21525e1be03ae564958196a4e89d

SHA1
a0c5e98db8f62ccc08511b2e0f5fd34b8235fb46

SHA256
4edd8aac383a260744d921e9d83c4abdddb6cd19048e77a1c6ea80553bd36245

SHA512
4c9d0ae2080cf93d9fbf462e4f59f0c982f1f79c415c2e7ff0d8afaba484f08b493643f483825f3e55f0aa0d407c9d9c9e26cf091a95dcd8deb3588291084738

Download Submit
C:\Users\Admin\AppData\Local\Temp\uRClgZblR.txt

Filesize
39B

MD5
502984a8e7a0925ac8f79ef407382140

SHA1
0e047aa443d2101eb33ac4742720cb528d9d9dba

SHA256
d25b36f2f4f5ec765a39b82f9084a9bde7eb53ac12a001e7f02df9397b83446c

SHA512
6c721b4ae08538c7ec29979da81bc433c59d6d781e0ce68174e2d0ca1abf4dbc1c353510ce65639697380ccd637b9315662d1f686fea634b7e52621590bfef17

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc15EE6196B25D45679CA8D8EFECD70BA.TMP

Filesize
1KB

MD5
2b661cf60fc43dcb6cfb443b32066752

SHA1
dfc415166ccce879763caa9166e9653986edd342

SHA256
37ca0d95a095d3c560f495231cff19066b230cedf2b6deef35375815bb1cbcd6

SHA512
5a12525f5b65df04746cc24f6f5be7614eb91a5614d721768fa2239bcc1bd6e7916430a0587e4861f20c57d448207d6e3c047283ebf89b524b3d8b04a4328728

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc1E3232ED1E6E47E78ADD3AAFF6AA76AE.TMP

Filesize
1KB

MD5
6afd9b01508c9c69a0de03535ad5f530

SHA1
d727f0baf6278a5bfff339fc5b8a8ea9511f42b5

SHA256
6a3c72a45799088fb441484696436b87e6b923ec1a403cbbc2d6cf0273cc9c23

SHA512
0308b417648e44b59bbf1de84c36368d11490faa87f64557dd26189217427e4c73254f96d88ec30430112f70a8e2f3dd346ffe36fcb2d34c529e839d9264fc2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc30116ABA692D47BCA95CF1B881D19239.TMP

Filesize
1KB

MD5
7916feed8bc0e43442862a106b433455

SHA1
7db8350ae1f95109c9ff8facb238fa8cb38e7401

SHA256
e8ed1405f1038ad617655fb2b09b418fe425aa2a3592e8335afabdcad567f6ee

SHA512
b77715558077c168c6208eb608ccaaa8755e5446e406a0032dc3ec5378fa9a067ffeaa99ab80a3d315a9699d323579b411d788044823611517db5c46f2594bb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc3C2D545B3D784547BA3BE6FD405A5CE7.TMP

Filesize
1KB

MD5
3aed372b95367c5917e0d5fe2955cccd

SHA1
0bd7796f77f11e79e23f3266ae3aaa8afa24f50e

SHA256
576965eae67ed9b28cc0f53172add24ade82aff2417b7476c66e5599d29c1925

SHA512
fd4030e8108e5570c1ff86ed9e7a14dac3fde5bb814577d7a414a1af696e7d821fe2ac647ed2e91304b66b793e6ddddef7369de85b9bb085d019353bb4dedc38

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc6471C939844F4331825A48B7C8C357.TMP

Filesize
1KB

MD5
12056ad3066679f5dbd325572fbe2a99

SHA1
53cecfb6b3b612284b4d8b8a9395280d385e6f99

SHA256
a2ceb54f07787150f648d3601443b878113c917b30de88206823c2b1ca36652b

SHA512
f8fbf63c5646ebe7329e33138468fb2459d96cdd8415ed136870c84d6a3ac03e0f2353f359788748b6310b36d097bd4e5bdf4a0843336bce34fb3c2428cfb88a

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc70B620FE9C64F89965C47E3D30F439.TMP

Filesize
1KB

MD5
47ff0e089fa27d610e0b6d32697d66f7

SHA1
aa8f8566d7180d52cabd7dc37437b9a5f093e75c

SHA256
fc0f73bfdc1e71a2f4fba2090d060068333eb23f9fa70fa91591dc688d3b2a26

SHA512
74ceb9114158289ee1ad6fa31f16ebfacf24909976b5750c653446427cdf1d8cc3d88643c39b8b4082e354f86e721f6130e3d675c3cf2f69a57c5725736b22d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcF1E84D5945BB42D19DDEED4554BECF3.TMP

Filesize
1KB

MD5
4a2eacccdb01b01b117216dcde15c8fc

SHA1
b72d017bfd2f6123889b336a4f8c9009efe8dd76

SHA256
54f012b070c3cdf483219dc21fd51fe898a47b23d1fd4a708a071f7eba3d6584

SHA512
520941eafb92ec62ccfb3d1b87222bbaae2b044fb6f89732b2735175f6d12ecbfad111ccf1ad9cbf639925716553129617bebce772c678d70a94dee5ef23acc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\y2ls7apf.0.vb

Filesize
338B

MD5
2de37b6c25304214817c88f9ec6e9847

SHA1
74f77a317b1f9822d11094eb3fe1c71797bb878a

SHA256
a4f127dbaa96ba729d5e754624b76625e5ad68908185b2e1ffaf5c935ba7ce7a

SHA512
a8cd8899cd8498598b992c158bb01850888d86c50fdf754f2223ee27613eda3e9a29aa7530ff60b7156da5d4ab030482aba59413cb5a842e8122c8df679bb954

Download Submit
C:\Users\Admin\AppData\Local\Temp\y2ls7apf.cmdline

Filesize
194B

MD5
3998c373cc22d6109c3f0c05b65e148d

SHA1
d8c12c01d3ce47ccb50c4de289b0c045bd633aef

SHA256
5e4d5dffc975359cabfaea416275b8da9dd8f79f4979def54a65f7c70993bbe1

SHA512
e1f357c4f77c41607f261caf56c816bb3fcde7ec3f9365c43acf839a9560776351bae73bf61f09ceeffc381f081b92b3dc68ea33b7f5b426f41a9ed4b3f7bcb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\zqqkegua.0.vb

Filesize
358B

MD5
6e99d797cd7aab4115157072554323d6

SHA1
364d424c1bf9ce5940f06a0fb41174cc9fd38231

SHA256
3289fc365e8f8ce0a9d23688b0ebd9c5dea3f42103044435fe04e48413357916

SHA512
195cc36ecd636cc364a79c93b81be610bcd4feb8a88f45fdde8c08881706a8cb989403497dccd3cbac45c88bf82b75c0305a662cb9ed79a7d843a5c725f13e45

Download Submit
C:\Users\Admin\AppData\Local\Temp\zqqkegua.cmdline

Filesize
214B

MD5
943066992255d33a870e620c0d062f95

SHA1
5afb05a69ec7920cc8b0e0e77005fc82a8521737

SHA256
5bc8e16cccdbf8b1fa746f693c60de44be6602a42b1e5352c9fc82cc7465efd5

SHA512
c4491156e4a9b044b58a9df0b17794cc3a75c306066d6468547d55e8894bade4e0fe4075fd60019f0cf5c5b639f5c6a7f2063a24baebc4b30bd2b20c7deffc02

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\RevengeRAT.exe.crdownload

Filesize
4.0MB

MD5
1d9045870dbd31e2e399a4e8ecd9302f

SHA1
7857c1ebfd1b37756d106027ed03121d8e7887cf

SHA256
9b4826b8876ca2f1378b1dfe47b0c0d6e972bf9f0b3a36e299b26fbc86283885

SHA512
9419ed0a1c5e43f48a3534e36be9b2b03738e017c327e13586601381a8342c4c9b09aa9b89f80414d0d458284d2d17f48d27934a6b2d6d49450d045f49c10909

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4376_1608240160\manifest.json

Filesize
134B

MD5
049c307f30407da557545d34db8ced16

SHA1
f10b86ebfe8d30d0dc36210939ca7fa7a819d494

SHA256
c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

SHA512
14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4376_689018085\manifest.json

Filesize
43B

MD5
af3a9104ca46f35bb5f6123d89c25966

SHA1
1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8

SHA256
81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea

SHA512
6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1

Download Submit
memory/5820-881-0x000000001BC20000-0x000000001BCC6000-memory.dmp

Filesize
664KB

Download
memory/5820-882-0x000000001BDB0000-0x000000001BE12000-memory.dmp

Filesize
392KB

Download
memory/5820-880-0x000000001B750000-0x000000001BC1E000-memory.dmp

Filesize
4.8MB

Download
memory/5952-884-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5992-885-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download