f1265f44fde306800bc82414f71d636400e24c63edd5c00c564e375951c6bb59

Analysis

max time kernel
150s
max time network
158s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 18:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RevolutionMacro (1).exe
Size 80.7MB
Sample261107-w9c14set4s
SHA256 f1265f44fde306800bc82414f71d636400e24c63edd5c00c564e375951c6bb59
MD5 2599d3375b1836e947c28207dc294d01
SHA1 0b8b33afcc9c2f29cf217a28311c403f1b46145b
SHA512 38bb245e936ba79bf2e70c7c3e374ec2661dfe4d9a598e2393c2ed72c98b4c58b0f5c1377ff8e19b4e93dfa6bd0707085e1f2cc1f3d1eef1f074be219856c04a
SSDEEP 786432:KKNda1oMJEw0R8H/isdNaG8vyy2o56xro86VM2oBIzGSHNQ7:zNdEr5n8vyypxRoBI3H+7
TLSH
T1B6085B93E59A60E9C4AFD6358672A563BE223C4D472023E76F90F7202F76BD065BD700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
6032	RevolutionMacro (1).exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RevolutionMacro (1).exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
20	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 23 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_811369887\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_811369887\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_811369887\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_1346504052\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_508906410\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_1346504052\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_508906410\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_1994744601\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_811369887\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_811369887\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_811369887\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_811369887\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_811369887\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_508906410\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_1994744601\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_811369887\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_811369887\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_811369887\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_811369887\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_811369887\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_1994744601\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_1994744601\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_811369887\LICENSE	msedgewebview2.exe

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
3172	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 3 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RevolutionMacro (1).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RevolutionMacro (1).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RevolutionMacro (1).exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	RevolutionMacro (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	RevolutionMacro (1).exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	RevolutionMacro (1).exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	RevolutionMacro (1).exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	RevolutionMacro (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	RevolutionMacro (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	RevolutionMacro (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	RevolutionMacro (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	RevolutionMacro (1).exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings	RevolutionMacro (1).exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	RevolutionMacro (1).exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe
2336	msedgewebview2.exe
2336	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
6120	msedgewebview2.exe
4252	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	4024	RevolutionMacro (1).exe
Token: SeDebugPrivilege	6032	RevolutionMacro (1).exe
Token: SeDebugPrivilege	3172	powershell.exe
Token: SeIncreaseQuotaPrivilege	3172	powershell.exe
Token: SeSecurityPrivilege	3172	powershell.exe
Token: SeTakeOwnershipPrivilege	3172	powershell.exe
Token: SeLoadDriverPrivilege	3172	powershell.exe
Token: SeSystemProfilePrivilege	3172	powershell.exe
Token: SeSystemtimePrivilege	3172	powershell.exe
Token: SeProfSingleProcessPrivilege	3172	powershell.exe
Token: SeIncBasePriorityPrivilege	3172	powershell.exe
Token: SeCreatePagefilePrivilege	3172	powershell.exe
Token: SeBackupPrivilege	3172	powershell.exe
Token: SeRestorePrivilege	3172	powershell.exe
Token: SeShutdownPrivilege	3172	powershell.exe
Token: SeDebugPrivilege	3172	powershell.exe
Token: SeSystemEnvironmentPrivilege	3172	powershell.exe
Token: SeRemoteShutdownPrivilege	3172	powershell.exe
Token: SeUndockPrivilege	3172	powershell.exe
Token: SeManageVolumePrivilege	3172	powershell.exe
Token: 33	3172	powershell.exe
Token: 34	3172	powershell.exe
Token: 35	3172	powershell.exe
Token: 36	3172	powershell.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
6032	RevolutionMacro (1).exe
6032	RevolutionMacro (1).exe
6032	RevolutionMacro (1).exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 6032	4024	RevolutionMacro (1).exe	88
PID 6032 wrote to memory of 6120	6032	RevolutionMacro (1).exe	89
PID 6120 wrote to memory of 948	6120	msedgewebview2.exe	90
PID 6120 wrote to memory of 6024	6120	msedgewebview2.exe	91
PID 6120 wrote to memory of 6024	6120	msedgewebview2.exe	91
PID 6120 wrote to memory of 6024	6120	msedgewebview2.exe	91
PID 6120 wrote to memory of 6024	6120	msedgewebview2.exe	91
PID 6120 wrote to memory of 2172	6120	msedgewebview2.exe	92
PID 6120 wrote to memory of 2436	6120	msedgewebview2.exe	93
PID 6120 wrote to memory of 2436	6120	msedgewebview2.exe	93
PID 6120 wrote to memory of 2436	6120	msedgewebview2.exe	93
PID 6120 wrote to memory of 2216	6120	msedgewebview2.exe	94
PID 6120 wrote to memory of 2216	6120	msedgewebview2.exe	94
PID 6120 wrote to memory of 2216	6120	msedgewebview2.exe	94
PID 6120 wrote to memory of 2216	6120	msedgewebview2.exe	94
PID 6120 wrote to memory of 2216	6120	msedgewebview2.exe	94
PID 6032 wrote to memory of 3172	6032	RevolutionMacro (1).exe	95
PID 6032 wrote to memory of 4252	6032	RevolutionMacro (1).exe	98
PID 4252 wrote to memory of 5344	4252	msedgewebview2.exe	99
PID 4252 wrote to memory of 2024	4252	msedgewebview2.exe	100
PID 4252 wrote to memory of 2024	4252	msedgewebview2.exe	100
PID 4252 wrote to memory of 2024	4252	msedgewebview2.exe	100
PID 4252 wrote to memory of 2024	4252	msedgewebview2.exe	100
PID 4252 wrote to memory of 5904	4252	msedgewebview2.exe	101
PID 4252 wrote to memory of 3696	4252	msedgewebview2.exe	102
PID 4252 wrote to memory of 3696	4252	msedgewebview2.exe	102
PID 4252 wrote to memory of 3696	4252	msedgewebview2.exe	102
PID 4252 wrote to memory of 1980	4252	msedgewebview2.exe	103
PID 4252 wrote to memory of 1980	4252	msedgewebview2.exe	103
PID 4252 wrote to memory of 1980	4252	msedgewebview2.exe	103
PID 4252 wrote to memory of 1980	4252	msedgewebview2.exe	103
PID 4252 wrote to memory of 1980	4252	msedgewebview2.exe	103
PID 6120 wrote to memory of 4572	6120	msedgewebview2.exe	109
PID 6120 wrote to memory of 4572	6120	msedgewebview2.exe	109
PID 6120 wrote to memory of 4572	6120	msedgewebview2.exe	109
PID 6120 wrote to memory of 2720	6120	msedgewebview2.exe	110
PID 6120 wrote to memory of 2720	6120	msedgewebview2.exe	110
PID 6120 wrote to memory of 2720	6120	msedgewebview2.exe	110
PID 6120 wrote to memory of 3716	6120	msedgewebview2.exe	111
PID 6120 wrote to memory of 3716	6120	msedgewebview2.exe	111
PID 6120 wrote to memory of 3716	6120	msedgewebview2.exe	111
PID 6120 wrote to memory of 2336	6120	msedgewebview2.exe	112
PID 6120 wrote to memory of 4440	6120	msedgewebview2.exe	113
PID 6120 wrote to memory of 4440	6120	msedgewebview2.exe	113
PID 6120 wrote to memory of 4440	6120	msedgewebview2.exe	113

C:\Users\Admin\AppData\Local\Temp\RevolutionMacro (1).exe
"C:\Users\Admin\AppData\Local\Temp\RevolutionMacro (1).exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Users\Admin\AppData\Local\Temp\RevolutionMacro (1).exe
  "C:\Users\Admin\AppData\Local\Temp\RevolutionMacro (1).exe"
  2⤵
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Reads the TCP/IP host and domain name from the registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6032
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="RevolutionMacro (1).exe" --webview-exe-version=0.9d-hotfix1 --user-data-dir="C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=6032.752.2760456073969899567 /pfhostedapp:7ca15b9a454a836b16426c387b0fea99b01d3dfb
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:6120
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView /prefetch:4 /pfhostedapp:7ca15b9a454a836b16426c387b0fea99b01d3dfb --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x104,0x7ffafdbe5fd8,0x7ffafdbe5fe4,0x7ffafdbe5ff0
      4⤵
      PID:948
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView" --webview-exe-name="RevolutionMacro (1).exe" --webview-exe-version=0.9d-hotfix1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1740 --field-trial-handle=1732,i,11815922922151292057,7785892622008966219,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:7ca15b9a454a836b16426c387b0fea99b01d3dfb
      4⤵
      PID:6024
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView" --webview-exe-name="RevolutionMacro (1).exe" --webview-exe-version=0.9d-hotfix1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2188 --field-trial-handle=1732,i,11815922922151292057,7785892622008966219,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:7ca15b9a454a836b16426c387b0fea99b01d3dfb
      4⤵
      PID:2172
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView" --webview-exe-name="RevolutionMacro (1).exe" --webview-exe-version=0.9d-hotfix1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2388 --field-trial-handle=1732,i,11815922922151292057,7785892622008966219,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:7ca15b9a454a836b16426c387b0fea99b01d3dfb
      4⤵
      PID:2436
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView" --webview-exe-name="RevolutionMacro (1).exe" --webview-exe-version=0.9d-hotfix1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3432 --field-trial-handle=1732,i,11815922922151292057,7785892622008966219,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:7ca15b9a454a836b16426c387b0fea99b01d3dfb /prefetch:1
      4⤵
      PID:2216
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView" --webview-exe-name="RevolutionMacro (1).exe" --webview-exe-version=0.9d-hotfix1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4528 --field-trial-handle=1732,i,11815922922151292057,7785892622008966219,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:7ca15b9a454a836b16426c387b0fea99b01d3dfb
      4⤵
      PID:4572
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView" --webview-exe-name="RevolutionMacro (1).exe" --webview-exe-version=0.9d-hotfix1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4640 --field-trial-handle=1732,i,11815922922151292057,7785892622008966219,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:7ca15b9a454a836b16426c387b0fea99b01d3dfb
      4⤵
      PID:2720
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView" --webview-exe-name="RevolutionMacro (1).exe" --webview-exe-version=0.9d-hotfix1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4532 --field-trial-handle=1732,i,11815922922151292057,7785892622008966219,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:7ca15b9a454a836b16426c387b0fea99b01d3dfb
      4⤵
      PID:3716
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView" --webview-exe-name="RevolutionMacro (1).exe" --webview-exe-version=0.9d-hotfix1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4548 --field-trial-handle=1732,i,11815922922151292057,7785892622008966219,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:7ca15b9a454a836b16426c387b0fea99b01d3dfb
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2336
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView" --webview-exe-name="RevolutionMacro (1).exe" --webview-exe-version=0.9d-hotfix1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4500 --field-trial-handle=1732,i,11815922922151292057,7785892622008966219,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:7ca15b9a454a836b16426c387b0fea99b01d3dfb
      4⤵
      PID:4440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3172
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="RevolutionMacro (1).exe" --webview-exe-version=0.9d-hotfix1 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RevolutionMacro (1).exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=6032.752.11507810140832656723 /pfhostedapp:c694eac914e9f4a814cff0b0ae00599d10b323ea
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4252
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Temp\RevolutionMacro (1).exe.WebView2\EBWebView" /prefetch:4 /pfhostedapp:c694eac914e9f4a814cff0b0ae00599d10b323ea --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Temp\RevolutionMacro (1).exe.WebView2\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x168,0x19c,0x7ffafdbe5fd8,0x7ffafdbe5fe4,0x7ffafdbe5ff0
      4⤵
      PID:5344
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RevolutionMacro (1).exe.WebView2\EBWebView" --webview-exe-name="RevolutionMacro (1).exe" --webview-exe-version=0.9d-hotfix1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1732 --field-trial-handle=1736,i,3912105534498440351,17262879878001221047,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:c694eac914e9f4a814cff0b0ae00599d10b323ea
      4⤵
      PID:2024
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RevolutionMacro (1).exe.WebView2\EBWebView" --webview-exe-name="RevolutionMacro (1).exe" --webview-exe-version=0.9d-hotfix1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2028 --field-trial-handle=1736,i,3912105534498440351,17262879878001221047,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:c694eac914e9f4a814cff0b0ae00599d10b323ea
      4⤵
      PID:5904
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RevolutionMacro (1).exe.WebView2\EBWebView" --webview-exe-name="RevolutionMacro (1).exe" --webview-exe-version=0.9d-hotfix1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2476 --field-trial-handle=1736,i,3912105534498440351,17262879878001221047,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:c694eac914e9f4a814cff0b0ae00599d10b323ea
      4⤵
      PID:3696
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RevolutionMacro (1).exe.WebView2\EBWebView" --webview-exe-name="RevolutionMacro (1).exe" --webview-exe-version=0.9d-hotfix1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3520 --field-trial-handle=1736,i,3912105534498440351,17262879878001221047,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:c694eac914e9f4a814cff0b0ae00599d10b323ea /prefetch:1
      4⤵
      PID:1980

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

04f7303e-fd61-4fdb-a08f-e42ab4ef35a0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RevolutionMacro (1).exe.WebView2\EBWebView\04f7303e-fd61-4fdb-a08f-e42ab4ef35a0.tmp
Size 15KB
SHA256 0e69d675da07fa628a4c8dbe40c7b223720e2c390b478a8d63c7f836f3e0de1f
MD5 a62fdbe4fcaa676f283f678474071758
SHA1 7ae30f8707d0e848ee284e460c95524c920732db
SHA512 b4e332e54dc90cf78f176baf87967fab2c23e7932602bcbfe6902fb3188f63bca67a0ea5443a52311112df1d4be5e8acdcc77b0dbb18cc5590fce8d0d8fabb5f
SSDEEP 384:x+OBqImmJvGBLx3NaFMJFK3NBS3FIhThg6rO:8cvGtlNKQeljS
TLSH
T1EC72AE7B286A5E233CF7890DBAC9234BCB64A253C0D57BD8DEECAF0E016E0441341D11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

078a7234-9c60-44c6-a857-1796d3f10957.tmp

Path C:\Users\Admin\AppData\Local\Temp\RevolutionMacro (1).exe.WebView2\EBWebView\078a7234-9c60-44c6-a857-1796d3f10957.tmp
Size 3KB
SHA256 3a29a9c0128b501b4e882d43dd7ac1ab295b69ac9226125f967df25532463106
MD5 35bc4c58b22de896bba8365a1cba86af
SHA1 ae21c49e04693f0ab93f4e98fed9cc073225b4ad
SHA512 bb617ef8d85aa9152a323064874aa088dd7761d829861bada9a2e974ccefb356be7a0d2530d22433b1abc3a6aa50fb14d43fef71f8b99418b5cbc4df27a57ff6
TLSH
T1886196376965A9379DF39A09B8863B06E7A5D027E5913F94D7EC0F0C01D729C1381C27
MD5 SHA1 SHA512 TLSH

Submit Download

3242e925-2099-4e50-88be-4a9df0cfd006.tmp

Path C:\Users\Admin\AppData\Local\Temp\RevolutionMacro (1).exe.WebView2\EBWebView\3242e925-2099-4e50-88be-4a9df0cfd006.tmp
Size 2KB
SHA256 78024f1d09f51382453e55a273287a6ecc68b401bd7c168b8cf050478d95606d
MD5 60132431a8fe4976a7bb4fcf16c21805
SHA1 6bac2541ee8563647fbdda54342aa59120cccae5
SHA512 b9400ca15403abdeb4ff198861d4861e15d5781d1935d869d125198bb6a408ff07199101edf4debe2922ea440e85a5c2c9bdf8a228134f24bb4d0ad5b5372ea5
TLSH
T13B51A4336815AB37DDF24A58BD4A3B03CA79E0A69A522F5097DC1F1801C715C2386C37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RevolutionMacro (1).exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8ae39e8f7a5c57750abe125e5693bab22b5c45d63b6f86c2a8381ea47c84131a
MD5 feb1d25d2425933ef6436367b66fe3b5
SHA1 7edb1be0c533d149e294c13881fcbf02a4fe9b03
SHA512 4b94f494fe00ef58fb4b9848ce2fbf81cac4e40f254a75424a277a54828912e9ef4c019e37fac56e976004b49e6b6d383fc9733cf6a02c8a85c19cff5c57ecdc
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RevolutionMacro (1).exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 038d7e7bf6474ec3381e6cc174380b899a4cd38c43f183a94f16c6e0899193dc
MD5 e884c9e2acb1c1897d6e47a006dcef0f
SHA1 cac4f481c5c42f8a4796e56b52dd57988be848b1
SHA512 84b17cbfbd4cab932e37c544ca8b1393d24b130df40e13bd8b8641e8a6a22148a5b66a5cbb55262e538f122a33834bf4c3c43e452b9c08ecf63546c0e1b50c4c
TLSH
T1C2D0121272414134D41039730203B10C3441C22B414940045928855F9A440600A03451
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RevolutionMacro (1).exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 44c0baac44971e0e50bcb32e9ca5471e1d13c2b266fb1c92a6326073ee4df3a9
MD5 ca877d1d7d7c1801cc279adbf311df78
SHA1 af9dcb10126397785868bf14bb5f454332dd1cf4
SHA512 dedb0d45f2c17fae7116160de8db938d4b8ae714ba593259a11c7c779a4973e3d62c4b140ab1b8799575f3a6be4e4ae68baa730319326ad50fe9091374a42d2c
TLSH
T115D02B1123004A74E5203D330343E10939D1F22B8105D01CA918C46E5D040E00F034D2
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RevolutionMacro (1).exe.WebView2\EBWebView\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RevolutionMacro (1).exe.WebView2\EBWebView\Local State
Size 1KB
SHA256 466b4050b30082414d606a66e8c83b97ff631009c86beca756c3d98ba22ee543
MD5 80d31b94d83b8048de312566cd97a40b
SHA1 ecce91b447e4b23010b32cab8fe1bcdc432e6a5e
SHA512 e047dc4fc375f2f2fbe186e2558f4b71e6d61d5648c8941e35109db6251c8347ef63f22ce624345ceb4cd2e8ace3648f2b03a7d597bdd4310c4acbe947173760
TLSH
T18B2162B394599F33ECE2169E71427B4B9E35E06B86514E4463ED8F1C02DB04C575EC32
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_mq0w4gyf.g11.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mq0w4gyf.g11.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

patterns.bin

Path C:\Users\Admin\AppData\Local\Temp\patterns\patterns.bin
Size 170KB
SHA256 9ba1b67fa8f31b61049626914db1bb9df1cc41142af6c1f92136b4568ed0bd4b
MD5 5c6c085577d1e4660d7b19ce1bef34c5
SHA1 25716bddbc0f0435dca5efa2c92aa2d3c3322a79
SHA512 49ebe1c8834ebf384509caf9426d05be24d4e42dab557bcd03ff4aa3c636eea23ed29941d784d09162536f8f0b61fcb3a75afc715f107694aabeb8ef4bcd8190
SSDEEP 3072:+1NgpLF5ONt4llTl8UB4i1JA5r+gGBumue+S5xJj6QmET9NVMFwGGVJs:C4uUBn1Jcr+gGBum5ZNTJs
TLSH
T15E04127C08C76A8CF4B43254B7953A5916A23DFFB73E9D4F180353B8293BAB116D0989
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.crash

Path C:\Users\Admin\AppData\Roaming\RevolutionMacro\.crash
Size 55B
SHA256 054959ff4f20390ea9eaf8e9b4343924c84613eccf525b48fb5fe4316c2c354b
MD5 9c1c1136c8eaf5208c577fcd32ac5124
SHA1 5a6caabd271be22a11f9f807df275d9694a8ee74
SHA512 82e1d675a1b3a2e8411979cf71250d55621c415af9893841b9b489b65ac9233c0fa6434a4da418030af8a66c515043c5d00aabda4b78a6c5c9f0f563fb900475
TLSH
T1FD90025D0069047E570181118C0640F7537806221E42D21AD5140D1975C245107915A2
MD5 SHA1 SHA512 TLSH

Submit Download

.state

Path C:\Users\Admin\AppData\Roaming\RevolutionMacro\.state
Size 26B
SHA256 3c1084125387e67520e7d83f428e6281ffb5db8bdb5ea447989faa2a5a0ca465
MD5 747c8dbe7d44c61f8d94808017711a2b
SHA1 ebc96ab8e1346cd1d8312e10a229ab0c2c6e3c6d
SHA512 a01b076cbe4d9c1d5de381df936e301850b0835c21a9bc1af5eaf6b1b1d45e94547a1d6481ebc70533da20ccc51cc136493d4e060741d95457b6eb5d119b4eb3
MD5 SHA1 SHA512

Submit Download

27336d1e-d0f4-4fc4-aa77-060f96dad0f5.tmp

Path C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView\27336d1e-d0f4-4fc4-aa77-060f96dad0f5.tmp
Size 15KB
SHA256 da086cf1abade3469fdb82a1ea719ab2095415b0934d32e964fe8f20417edfbb
MD5 537797a1bab76da49d4fbe08bd1b1ec2
SHA1 540b5b2d1d9137be79216b7516f1cf15fae73567
SHA512 b826fa7fc1565770e986c576b60d37f54c8ef916b84172dff5670322dc1dc84d9e5e1921a689e4c6c9e2d4b787a6fb4f349a740ee149a2fb21da1c1281e089f0
SSDEEP 384:L+OBqImmJvGBLx3NaFMJFNNBS41JTdUg6r4:ycvGtlNPxqE
TLSH
T13172AE771D2A5F673CE78A09BA8E2347C761A253C0D53BD8DDECAF0F416B1441352A12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2cd7991e-0057-4b27-ac28-f9d0d207c3d0.tmp

Path C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView\2cd7991e-0057-4b27-ac28-f9d0d207c3d0.tmp
Size 3KB
SHA256 b6d48bb158bf477b0f33a03b1e2e3f8c6b7669d0f19d54c92e81e9ab78708b1e
MD5 d9d2392858f062cd856d00afec75f564
SHA1 bd3c0b975bd50ebe6175be72d31608d29a87790b
SHA512 8d8227d7d60bd290bb377fe4c411d8b2119758e0f9d024f92f6dff5074d7745a55c1f8d4e3e3e9716c00d7816f0b110200f0f9320b8b992cbaafa1afdebe3f5f
TLSH
T1F861A7336975AA3B9DF39A14B8863B06F7A29137D4953F94DAEC1E1C01D73881342D17
MD5 SHA1 SHA512 TLSH

Submit Download

7dc9353a-3d18-4382-879b-a4a1cad0919e.tmp

Path C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView\7dc9353a-3d18-4382-879b-a4a1cad0919e.tmp
Size 15KB
SHA256 1f6e6e0bccaffd535b636fd09f4fd61e9d8f34b2004be9afd9a2e282c009602d
MD5 160d8e31523a5830e3220dbd064699e3
SHA1 3da7a63a60d981148c7c719fdc4892279552c3a5
SHA512 199e8704b4ecf746cf32f0667176f2bb1d7b325d48668438cd2452eb86e34b384ab48eb9fb1426ef249dfe61c466a644104803ce6a8c001845108262943a80b3
SSDEEP 384:7+OBqImmJvGBLx3NaFMJFXNBS47dTdUg6r4:icvGtlNbxqE
TLSH
T18272AE772D266F373CF78509BE8A2347C762A253C0D93BD8D9ECAF0F416A1841352916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b73aa43fb8cf6965250b7861533a945f66e5414fb8f51a7fe2238a7daa2af6b9
MD5 559528073606d1f396f7b7780324d01c
SHA1 f8f958bf4de25113462839654e1424fa0fe9848a
SHA512 ebdc3a9317f2e03b13efa6a0bedc33c7e56134aca5c2870cfea291325390d0016e0cbee4e9ec383fe9eb766e5a7f2f56bf4e21fda036926ecb82161d99b0aaeb
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c63272f3decbdace881883147e3911197fc8809ffc0bb4e5a6973ce5fe47379f
MD5 5ecc0e26080df8f8872b9d5e3fa8ee93
SHA1 10d2b00694098824fe82766700e1dc2940338d89
SHA512 d4b7832663cd83802cd9ff807329146947652c5404bd1a445df21ea1ab423f2413d6bfa81d7f0ae1a95575f024e61cb4d053a029931c71b2d03a64a34f059275
TLSH
T1C0D0112332220B38E0A032330802A2080800CA0B830E8280ACACAA2E2A080A00E0A883
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

9d0dc619-d5c8-41d2-a1c5-54f75313fa4d.tmp

Path C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView\Default\9d0dc619-d5c8-41d2-a1c5-54f75313fa4d.tmp
Size 6KB
SHA256 f12b385a0038aa36b0f8827ff6a3c1d095b0daf55c75c0c2865c3fdc03a06ead
MD5 e0fdec4ed49384e16a11c2aaabeaf780
SHA1 e541011b74af0ef0655398fcb3b339742681d3a9
SHA512 cf6cfd28cf8937efdca0a4a0e488b27bf5b817053bb0f51bd2492682e1021b39bb3bb89117372f5319f8332a58875969bb63e1825abf16f9ceed918f3fc4116c
SSDEEP 96:stL/dET85tb9wukqo5h16Z58s7/x+6MhmuecSIO1ejeOK+gAh28XM1C7K:stTmT0poK8sV+F2IOQjaWG6K
TLSH
T1C7D184025E24797B4CC6E119FA39BB17E2F9A07261951E58E7F8452C08D76DC6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 492c77340e0145e281b522eaf346c9517556d50e067e57f66b91a65042193d18
MD5 9f4811c5be6dbc2e57a4050eeecbae57
SHA1 2f5a6971a96b96d60b3e6b67734a9a66a96fcfcd
SHA512 0561ef36fd911a24e4f0efc7f0ead7a30978aa8237fcd3cd551a498e5d02c0df362ade68cde6ebfa913924c176b7567b2876e45cf565f5a90f8ffdb39603341f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 6f1a488b701c8fb16d9faff8a2c17c1cd644bbd468a6b069628d9c9b9f85abd4
MD5 730103bb3c55e27e799599c018f19f26
SHA1 3ac3b13e87a695bf6176cead932b8d18eb0ac07a
SHA512 0818d0648859a13e268c3afe27ee3a5d1b161af647cb22e90800cc9d8af56d10b8903fe4ab37525300a1dec07f28785e55d3a9914bba4ed372252e70d3cbefb0
TLSH
T13EC02B089D4E3101C3800031C3E971B0F1346C0B0073CF40C3E190308E1534811030CC
MD5 SHA1 SHA512 TLSH

Submit Download

Network Action Predictor

Path C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView\Default\Network Action Predictor
Size 4KB
SHA256 9827429749037198cb3d19a851ccff2adafad344fbade7220aa022d3c9e2fa85
MD5 9088df5de5b8306c52e744141a100532
SHA1 0aea85a36ef3ddc53df198227fcaf212139ae1db
SHA512 96c0c8ee90bd8aec34ea905f48e76ed7dc370d24f64efaeadf36e9b59b9ff01856ed837b5169241ef2bd4a6b8fe2ee77de443b09b9ee604e39f9ba57929859e8
TLSH
T15C819285F7C02420DA346EF3A4824BBD5E72CA82A5124B93097002D0FCA74ECCC796AA
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

fc85b948-baca-4d1f-8508-39c52bb57958.tmp

Path C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView\Default\Network\fc85b948-baca-4d1f-8508-39c52bb57958.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

b46b77b8-fcc3-4879-8803-cff6c9551527.tmp

Path C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView\Default\b46b77b8-fcc3-4879-8803-cff6c9551527.tmp
Size 6KB
SHA256 2219a39a0532d1c78cba21905460e296c37b4cff58772f9ba426ec50bad9e3e5
MD5 f434b068f00ae6fbfefe0a37c9924fa5
SHA1 d8cd588e67b641e2075b1e622898ceb7acd39148
SHA512 2878a130f74b39bae9c6cc70c2ea73d8f695e8f2c358ea59160c8bb17e1cb53150caced464ae3cf6e771a7b6d54a9d92c673abe1f017c0ac5b70e2408cad6b95
SSDEEP 96:stL/dET8QGtb9wukqo5h16Z58s7/x+6MhmuecSIO1ejeOK+gRI28XM1C7K:stTmT2poK8sV+F2IOQja8G6K
TLSH
T1E1D1A5025E24797B8CC6E119FA39BB17E2F5A07261941E48E7FC4A2C08DB6DC6303D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView\Local State
Size 1KB
SHA256 854e418b2603a611fc912cce2f1afe702f6b219ccc4a71ae0d42564e50306a0f
MD5 bdcc021a56db46b36e9907845486855d
SHA1 7804106a215b8ba0eb5e58cb4a1438d87331596f
SHA512 7d7dafd20cb5d8b8ac3b2c83f12f97b79d2ffba20551a736f0991f02fa74bef4bfaee45156473d3fa86926d4e2a359f1916077ca23bd5f6a66f681ef45ff2046
TLSH
T1F2218473E9721B37FC8266596106BB47AEA2407BC1514E00A5ED4E2D03E214DE17EE33
MD5 SHA1 SHA512 TLSH

Submit Download

b4d9cde4-c281-4f1e-91a1-e48a5153da68.tmp

Path C:\Users\Admin\AppData\Roaming\RevolutionMacro\WebView2\EBWebView\b4d9cde4-c281-4f1e-91a1-e48a5153da68.tmp
Size 2KB
SHA256 a2e67b955df7ae170a501f0dddf2e0c4204966507e7b2300f410fcc5c1e6e5d8
MD5 9684bbca57f39f9816f4f50f3255e9f3
SHA1 7dec649d9119449ea4e61dc318290b9ea45050ab
SHA512 264a9ee3c41db42339b8c2abb3be2549a96b8e5cd3b0c579607f5774004058d0be9b67aa89e4ccb05be434a09b8dc95abe8e538c16f187cf1a46275326592c71
TLSH
T11D51C5336921AB3BD8E34618B9077F13DE62906699522F509AEC1B1C01D724C5346C37
MD5 SHA1 SHA512 TLSH

Submit Download

WinSparkle.dll

Path C:\Users\Admin\AppData\Roaming\RevolutionMacro\dlls\WinSparkle.dll
Size 2.7MB
SHA256 377bcb46d002229dd42a063b6e967f6bdb40c05eb5c24b93a83af34c79c6a994
MD5 a78b016406fffaaa6049a6868fc5090d
SHA1 b378d00b22df65d5a76a051796381ddc4fde1d48
SHA512 206e92ba6d9c60d7b2802c6b52ea734977e83316bdffe3869aafada97626b7fae89bef23e4e10faeeacb5897da1f4a7d8ccf6b9f08de0459653be94d592660b2
SSDEEP 49152:O5pzjGFCO53dqxT2fPR9NE+xiYMyqj+rMU/y3MlFO5YTw:O59j8n9ivA6PYT
TLSH
T1D4D58D17BEB401BED4BBC278CD179A06E3F1F8561270A74F16E0069E1FA77614EAA311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_1346504052\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_1994744601\manifest.json
Size 108B
SHA256 8d58f4f4ef20dff6cd1c27243ddbe12d50713f2cf8bb22ba73696bbb04b36f4c
MD5 8e9357dbfee2ec0378af047a76d0b453
SHA1 794f8cce8fbea87b2b62162769bee35c319ebfa0
SHA512 85b5f52013803198e6af0ba37c9c3c66ce4bed4df5a7ee86ca1fc7c3658e2c973e92eed88fd36864d4743db44ad81fda7b24e70ef7530212e85b12c13d5db29d
TLSH
T1E2B012A13C007DBB1DCD03760060E3D783B63E0A1659190006DB6D422A4C9FB137253F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_508906410\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6120_811369887\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2216-234-0x00007FFB20040000-0x00007FFB20041000-memory.dmp

Download

memory/2336-920-0x000001D7C5080000-0x000001D7C5081000-memory.dmp

Download

memory/2336-918-0x000001D7C5080000-0x000001D7C5081000-memory.dmp

Download

memory/2336-925-0x000001D7C5080000-0x000001D7C5081000-memory.dmp

Download

memory/2336-927-0x000001D7C5080000-0x000001D7C5081000-memory.dmp

Download

memory/2336-928-0x000001D7C5080000-0x000001D7C5081000-memory.dmp

Download

memory/2336-929-0x000001D7C5080000-0x000001D7C5081000-memory.dmp

Download

memory/2336-926-0x000001D7C5080000-0x000001D7C5081000-memory.dmp

Download

memory/2336-924-0x000001D7C5080000-0x000001D7C5081000-memory.dmp

Download

memory/3172-373-0x0000019130370000-0x000001913039A000-memory.dmp

Download

memory/3172-371-0x00000191305F0000-0x00000191306A2000-memory.dmp

Download

memory/3172-370-0x0000019130320000-0x000001913033E000-memory.dmp

Download

memory/3172-363-0x00000191182A0000-0x00000191182C2000-memory.dmp

Download

memory/3172-372-0x0000019118290000-0x000001911829A000-memory.dmp

Download

memory/3172-374-0x0000019130370000-0x0000019130394000-memory.dmp

Download

memory/4024-594-0x00007FF603B90000-0x00007FF604B90000-memory.dmp

Download

memory/4572-836-0x00007FFB1EBC0000-0x00007FFB1EBC1000-memory.dmp

Download

memory/4572-835-0x00007FFB1EB10000-0x00007FFB1EB11000-memory.dmp

Download

memory/6024-173-0x00007FFB20040000-0x00007FFB20041000-memory.dmp

Download