1ee9e71732eadce3675ffbba954021bdd5ebe141252ceed4183ff382d132616b

Analysis

user interaction
yes
max time kernel
132s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
revival-client.exe
Size 10.9MB
Sample260930-e6lemsxdqd
SHA256 1ee9e71732eadce3675ffbba954021bdd5ebe141252ceed4183ff382d132616b
MD5 142e2c8e992c0f6e5f51e06923a31e2e
SHA1 b5085ba0c70a0eae2439054bb7522db19957eac4
SHA512 8d6a6625ffacd6b8a3e47a7e6fcf75f4b1c7931d2600d3d5cf3569e8d24b49cd4d725dd429a98441550d7af36c3a088d7b8ec43da9e72c0f5133b73ab575d3b8
SSDEEP 98304:neKJNipThYiolJHJoxCt2Zaefk0lfMJ0ULrnZXDVWljGLUWSOWI637hwqB6+Zm+o:6o2xCAZ1M1nZX5eqGOfUJgwm
TLSH
T1FDB66B53F66280E8C16AC175D31A6232FA72BC4A47353AEB5BE04B213E55FE06B3D744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\Revival Client = "C:\\Users\\Admin\\AppData\\Local\\Temp\\revival-client.exe"	revival-client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\Revival Client = "C:\\Users\\Admin\\AppData\\Local\\Temp\\revival-client.exe"	revival-client.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	revival-client.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	revival-client.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_72492078\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_72492078\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_72492078\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_72492078\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_72492078\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1051951065\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1051951065\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1051951065\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_72492078\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_72492078\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_72492078\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_72492078\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_72492078\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_72492078\surnames.txt	msedgewebview2.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	revival-client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	revival-client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	revival-client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	revival-client.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3220	revival-client.exe
3220	revival-client.exe
3220	revival-client.exe
3220	revival-client.exe
3220	revival-client.exe
3220	revival-client.exe
5700	revival-client.exe
5700	revival-client.exe
5700	revival-client.exe
5700	revival-client.exe
5700	revival-client.exe
5700	revival-client.exe
3220	revival-client.exe
3220	revival-client.exe
5700	revival-client.exe
5700	revival-client.exe
3220	revival-client.exe
3220	revival-client.exe
5700	revival-client.exe
5700	revival-client.exe
3220	revival-client.exe
3220	revival-client.exe
3220	revival-client.exe
3220	revival-client.exe
5700	revival-client.exe
5700	revival-client.exe
5700	revival-client.exe
5700	revival-client.exe
3220	revival-client.exe
3220	revival-client.exe
5700	revival-client.exe
5700	revival-client.exe
3220	revival-client.exe
3220	revival-client.exe
5700	revival-client.exe
5700	revival-client.exe
3220	revival-client.exe
3220	revival-client.exe
5700	revival-client.exe
5700	revival-client.exe
3220	revival-client.exe
3220	revival-client.exe
3220	revival-client.exe
3220	revival-client.exe
5700	revival-client.exe
5700	revival-client.exe
5700	revival-client.exe
5700	revival-client.exe
3220	revival-client.exe
3220	revival-client.exe
5700	revival-client.exe
5700	revival-client.exe
3220	revival-client.exe
3220	revival-client.exe
5700	revival-client.exe
5700	revival-client.exe
3220	revival-client.exe
3220	revival-client.exe
3220	revival-client.exe
3220	revival-client.exe
5700	revival-client.exe
5700	revival-client.exe
5700	revival-client.exe
5700	revival-client.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1004	msedgewebview2.exe
1004	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3220	revival-client.exe
5700	revival-client.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3220 wrote to memory of 1004	3220	revival-client.exe	89
PID 1004 wrote to memory of 4552	1004	msedgewebview2.exe	90
PID 1004 wrote to memory of 2788	1004	msedgewebview2.exe	91
PID 1004 wrote to memory of 2788	1004	msedgewebview2.exe	91
PID 1004 wrote to memory of 2788	1004	msedgewebview2.exe	91
PID 1004 wrote to memory of 2788	1004	msedgewebview2.exe	91
PID 1004 wrote to memory of 4536	1004	msedgewebview2.exe	92
PID 1004 wrote to memory of 4192	1004	msedgewebview2.exe	93
PID 1004 wrote to memory of 4192	1004	msedgewebview2.exe	93
PID 1004 wrote to memory of 4192	1004	msedgewebview2.exe	93
PID 1004 wrote to memory of 5060	1004	msedgewebview2.exe	94
PID 1004 wrote to memory of 5060	1004	msedgewebview2.exe	94
PID 1004 wrote to memory of 5060	1004	msedgewebview2.exe	94
PID 1004 wrote to memory of 5060	1004	msedgewebview2.exe	94
PID 1004 wrote to memory of 5060	1004	msedgewebview2.exe	94
PID 5700 wrote to memory of 5984	5700	revival-client.exe	97
PID 1004 wrote to memory of 1308	1004	msedgewebview2.exe	99
PID 1004 wrote to memory of 1308	1004	msedgewebview2.exe	99
PID 1004 wrote to memory of 1308	1004	msedgewebview2.exe	99
PID 1004 wrote to memory of 1308	1004	msedgewebview2.exe	99
PID 1004 wrote to memory of 1308	1004	msedgewebview2.exe	99
PID 1004 wrote to memory of 2612	1004	msedgewebview2.exe	103
PID 1004 wrote to memory of 2612	1004	msedgewebview2.exe	103
PID 1004 wrote to memory of 2612	1004	msedgewebview2.exe	103
PID 1004 wrote to memory of 6060	1004	msedgewebview2.exe	104
PID 1004 wrote to memory of 6060	1004	msedgewebview2.exe	104
PID 1004 wrote to memory of 6060	1004	msedgewebview2.exe	104
PID 1004 wrote to memory of 1912	1004	msedgewebview2.exe	105

C:\Users\Admin\AppData\Local\Temp\revival-client.exe
"C:\Users\Admin\AppData\Local\Temp\revival-client.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=revival-client.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3220.5732.408868245639762084 /pfhostedapp:467b5fc99f658ff46fbcb9e2f284b9ce5154501d
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView /prefetch:4 /pfhostedapp:467b5fc99f658ff46fbcb9e2f284b9ce5154501d --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x198,0x7ff87e525fd8,0x7ff87e525fe4,0x7ff87e525ff0
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView" --webview-exe-name=revival-client.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1776,i,7290779038476790704,11658123202390672478,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:467b5fc99f658ff46fbcb9e2f284b9ce5154501d
    3⤵
    PID:2788
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView" --webview-exe-name=revival-client.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2056 --field-trial-handle=1776,i,7290779038476790704,11658123202390672478,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:467b5fc99f658ff46fbcb9e2f284b9ce5154501d
    3⤵
    PID:4536
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView" --webview-exe-name=revival-client.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2444 --field-trial-handle=1776,i,7290779038476790704,11658123202390672478,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:467b5fc99f658ff46fbcb9e2f284b9ce5154501d
    3⤵
    PID:4192
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView" --webview-exe-name=revival-client.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3296 --field-trial-handle=1776,i,7290779038476790704,11658123202390672478,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:467b5fc99f658ff46fbcb9e2f284b9ce5154501d /prefetch:1
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView" --webview-exe-name=revival-client.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3808 --field-trial-handle=1776,i,7290779038476790704,11658123202390672478,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:467b5fc99f658ff46fbcb9e2f284b9ce5154501d /prefetch:1
    3⤵
    PID:1308
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView" --webview-exe-name=revival-client.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4712 --field-trial-handle=1776,i,7290779038476790704,11658123202390672478,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:467b5fc99f658ff46fbcb9e2f284b9ce5154501d
    3⤵
    PID:2612
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView" --webview-exe-name=revival-client.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4628 --field-trial-handle=1776,i,7290779038476790704,11658123202390672478,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:467b5fc99f658ff46fbcb9e2f284b9ce5154501d
    3⤵
    PID:6060
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView" --webview-exe-name=revival-client.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4260 --field-trial-handle=1776,i,7290779038476790704,11658123202390672478,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:467b5fc99f658ff46fbcb9e2f284b9ce5154501d
    3⤵
    PID:1912

C:\Users\Admin\AppData\Local\Temp\revival-client.exe
C:\Users\Admin\AppData\Local\Temp\revival-client.exe
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5700
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=revival-client.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5700.1152.17195295415833171492 /pfhostedapp:467b5fc99f658ff46fbcb9e2f284b9ce5154501d
  2⤵
  PID:5984
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView /prefetch:4 /pfhostedapp:467b5fc99f658ff46fbcb9e2f284b9ce5154501d --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x1c0,0x7ff87e525fd8,0x7ff87e525fe4,0x7ff87e525ff0
    3⤵
    PID:4676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EC31DBC808B80B1F8FB609AB54F50420

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EC31DBC808B80B1F8FB609AB54F50420
Size 309B
SHA256 e2fb37c5c6ce4e5b60ad776a7ff7fc288db659d8f7e52bcb633fd6712d89bc7a
MD5 d7cd21cc995c102f34363013506bc1f0
SHA1 5ebdd87bc3b0273340b4faa0afa872bdf0adcb39
SHA512 3865975d6d5e661e2cad90b79700cbcc55a09895109023311ab9e7d3fac9caea03c05e4eae1267a14dbea5fe8df6ba0f6347e387888c937fa267cc5ea9e9892b
TLSH
T1DFE07D90A17D37810674F245D491C8576D7448CD6B8FB0101390CB7600C7A899E901CC
MD5 SHA1 SHA512 TLSH

Submit Download

EC31DBC808B80B1F8FB609AB54F50420

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EC31DBC808B80B1F8FB609AB54F50420
Size 192B
SHA256 7c4972deec64175a007b906900b542e551323139abb405a888e56bfb08f9c80c
MD5 934ddac6f0a6c0b12a804e318ab53825
SHA1 27dc84760f0f7657f2f3febdb06be8c757f82d4f
SHA512 44fdb10d8f7747895b99683a4949f7940066a5b9ef4b5f6dcb38008a25153b01d8c6ff31ff0db9d22f280d7740515f722802ba05d01977db2fdbe0d7ac530157
TLSH
T1F7C08C283665810CF2010A3E0B92732246B8FB14C316839C9F7002148208E4A6D22E90
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f663e456a9fdac37741b125ae6c1fe49975dade8824d831f204617f27e7abfcb
MD5 be6883c71584a573a557081fa902c006
SHA1 b19d4bcc08553326816b79d4a610162dd53d4e5c
SHA512 0a92087dc938cfb35f83d8699d23d89dfdbf11780f899ac6db92f78df2a7abd65b331bec75ce1e83d4397c4e2627e0012dd8e5e13b46473cd874019d58a08a40
TLSH
T1CDD0122673124138C4102033101375481500D22F404B82009428899D1AC80500903A47
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b72fe36f3d35be95f366e904513620e9dd98ea099abfec0f307c42cf0d4ae920
MD5 05bc1962eed45a87324a2f56d276e575
SHA1 9388d0f56a78a1a9d9c20de23fad63c4c2203f2b
SHA512 2a7aeb46d0484fdfeee9d327ebbb2e68445c4a94af90f9631953ba418e97d4dff8badb4ee9062d6be8d600c2deeab23f81c6190bf8d62a4b0f9eaf690f660e0d
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

577e3614-5f46-45c3-9416-7fba48949429.tmp

Path C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView\Default\577e3614-5f46-45c3-9416-7fba48949429.tmp
Size 6KB
SHA256 59a3b3329a7a886beebae9644065a3252794f6bf6787d847e08d3f4a1a4e5a53
MD5 012dd22a81b94f6d7cca511965a3e7b3
SHA1 4b4cb31988886f2b8b116bf09b38de6b5264e838
SHA512 13f6345f628b20ba3b7e9f7282825bc9731ecbe3c0e44a51efbd0793b1252526bf16de7723f1597081b26e533059f5d62058d8b6ce307fd8e6fef462b9e7ee4d
SSDEEP 96:stA/dHsvdb9Bkso5h16Z0Xs7/x+6MhmuecJk7MkkjeOK+g328XM1C7K:st0xAvonXsV+Fdk7wjuhG6K
TLSH
T1C7D196016E64B97B4CC6F249BB297B56E2F9603260D51D58E7F94A2C04DA6CE3317C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 a92e33f387ae872ae39eaab881682fba697bd6ba5fbc9eaa9bf0217a85167486
MD5 78bd689c4b5665af8bf646adf7e1e4a9
SHA1 2b3c1ea3ca1ca4e56a294615fd68a0d6318e6e1d
SHA512 8900ca28a0535b8e5f5abfb6ca45996f158ccee3e6dd49b3812cfbad0abb489c551c1da89acba8b122a121b60264d93bb8da04c14714bb4c7e7980a6fde33299
TLSH
T1F8B0241550700403C740DF741DC051C531341C10070344D3045145FD7C1774313453C0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c6f0.TMP

Path C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59c6f0.TMP
Size 48B
SHA256 ec240bbef51740a75ddd5ddf3646ab0703b2ebc59617724c7cd9bdfb755845d9
MD5 ac59b6b6b659d0ea48d5774639c226dd
SHA1 baa73bc38d403c270182819ea97502ff3f6b4d23
SHA512 64126c2a12a06d73d86dd3f44e782b93b0f0176296649dc79eb052c29729091addece0e39d5544111a3ae3a591237706924b423547b34aac8b7fe016190b582f
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a97cd.TMP

Path C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView\Default\Network\Network Persistent State~RFe5a97cd.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 c0f61fc5e03e8c48d96e8d42d05e58238ab548141dcc449028f178e55ec3f96c
MD5 b5cf2fffd0fd25f90fc5a0c3e8c271b3
SHA1 98a890e552ccd3a24575a0ca86b9981e25130c23
SHA512 d8533543b3a7c3d4a8879ac33f45feca6f51b4165179d7888ce9dba45e7097abbc70c1abc9d5a42c5eea20d0ee229e43b47721d10a7a7e1bb68ae20e6d3e0620
SSDEEP 96:stA/dHsOGdb9Bkso5h16Z0Xs7/x+6MhmuecJk7MkkjeOK+gO28XM1C7K:st0xivonXsV+Fdk7wjusG6K
TLSH
T199D195025E64797B4CC6F209BB297F53E2F9607260D51E58E7F94A2C04DA6CE2317C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView\Local State
Size 15KB
SHA256 d6f53b5c9619c574849a816d5bf7b87a88e18c02da2e5e41ba89271a3af65393
MD5 ecc634e2e098442ca52167ad6acaff8d
SHA1 e46d75139000fb73123a9c45470d41cc3edb9c3f
SHA512 81d5bd6c9534738ba24a48810bfaed94485760199fd069ce1fd9823adbf258c09a99643e938e59d56d00bcbf4df063615bf6d4b8a3e4dba7ea774830fae6075b
SSDEEP 384:U+aQikB+z/xvxjg/qhEgNBSNHTIIV8CWw9zt:z/UxvxjgC+98IVywFt
TLSH
T130729F3765793E3795F7B5407A580B8BCAB8947290C17EB84EAD1F0E06C72D91342C42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView\Local State
Size 2KB
SHA256 60921f307d3ffefe3baaa55939c56f6313b19494bc2c28450fa8758203106916
MD5 7d4ee9ac32ec812f77c9c9cf3e3c9002
SHA1 5d5a70b87e77db52c30e0c359d9c9ec09c5202f4
SHA512 f918b4f7e6d0fdb6b7c7076d1d7515cc68fb59908e1f47ba2a7cd0ff1b535c35c59944ce5b2805277b442a2f877e9a47c828f3265e2547b6a7b3dec345193f38
TLSH
T1A151C573BC146A7B89B25744799A3F73CE785062A9522F249AEE0B0C01DB54E2341C7B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView\Local State
Size 3KB
SHA256 81c15408abe94e956ce0d0aab80dbc95f89b4020767e0aab8392edcbdfde83a8
MD5 07f9460dd9770245bb91ac0e5ffc5741
SHA1 3d96c578b09b2673460b37dff631bc9f00fb983b
SHA512 e114c4debc4c10914ca20d1075779b9f262ddb6f422da5a77c0f7db348e5ed2b46feae7204eb9c52530f28c7236223d819151d355f7edad10c899ebb70d95e82
TLSH
T17D61B673A974A93B4DF39A0079C63B26E7A45023E8813F69DAED0F0C01D72892341C57
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView\Local State
Size 3KB
SHA256 df16f0237c15f9df16b1a7727d1db7f30dbb478ade82186f4d00aa933de313df
MD5 ef90f33099539d3a330cc8312f74ca8e
SHA1 044238e3c3374836cc98a1d23193e87ed0865b45
SHA512 4ced17f73f4c8d3b13c6a2dd3b4a6f5851e4dd3ea969e8cec256af0bd2a489fb9f22c3fd9106dc7663186b1d77f4f3c67a1cdb42db67651b8bcf2f0a91588cd3
TLSH
T1E0817332B974793B4DF2DA44B9863B53A6A45023E4853FA9DAED0F0D01DB28E2342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe597015.TMP

Path C:\Users\Admin\AppData\Local\net.revivalclient.launcher\EBWebView\Local State~RFe597015.TMP
Size 1KB
SHA256 57f09dc9cec202b682efc8a2660e53dfa281f65df4f8a2320c13c20d3213fef3
MD5 5d597e6c1bf7329ee1b1e85e5054e044
SHA1 16b4444f48fd5ffd9ef35a8736604977228264e9
SHA512 fb8ef67381c4cc53b599a46a4cc0ee2845b31805d3ff7f382448978c405dd6c453dbd18d45aef893342ecee7dd7de2c9d623eac9669dad07753730c1c029c0e0
TLSH
T12F2165B3E8A01F379CA6328131A67B679E20416781519F0466EF4B1C06EB18E7765C37
MD5 SHA1 SHA512 TLSH

Submit Download

revival.log

Path C:\Users\Admin\AppData\Roaming\.revival\revival.log
Size 704B
SHA256 6cb847bd2792c9c5ef5d69c87a97a34a5f22aa4b34bdc562115e9996c5429b21
MD5 f443336ee75a1a81915da839e1dd37bc
SHA1 b2642dbcef4e9cdc2b3a899e083b67552d81a2aa
SHA512 41b58490b35da1f4713adfc84a762d8dfe0157e1c72858913ebe4bc3112557364fd63154b02b3b7091cdb03d1ab2af55ee6db8fc11f413af6817481a4ecf08b5
TLSH
T18101DF34684596B3750AC08D82AB3A5C49B43B4135599A50E634759813CDC0E9E4E8B1
MD5 SHA1 SHA512 TLSH

Submit Download

revival.log

Path C:\Users\Admin\AppData\Roaming\.revival\revival.log
Size 352B
SHA256 d2ed570afcdc3a8d671855533b08e8a01e8599c8ab3968b3b2e74f01133f291d
MD5 046af8d1c961ad79e2bce7f137ab147b
SHA1 2cf1f85dccea05c3429c6958b777ddeb7806c343
SHA512 3de42030a8bcbfe5e79070c2fb48c7d674c1c53510b886963245fe522b33ff6684645235d23cc51d383101312a08ceb55947670a8cc9a3f8ab55a6e9a588eb7c
TLSH
T19DE0DF30284192B3350AC08D82AA3A5C49A03E4135595A50D634758813DDC0E9E4E8B1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2612-288-0x00007FF8A01A0000-0x00007FF8A01A1000-memory.dmp

Download

memory/2612-287-0x00007FF89F080000-0x00007FF89F081000-memory.dmp

Download

memory/2788-224-0x00000279A0D80000-0x00000279A0ED9000-memory.dmp

Download

memory/2788-29-0x00007FF8A02C0000-0x00007FF8A02C1000-memory.dmp

Download

memory/5060-70-0x00007FF8A02C0000-0x00007FF8A02C1000-memory.dmp

Download