Overview

overview

8

Static

static

3

RealSetup_...b7.exe

windows10-2004-x64

8

RealSetup_...b7.exe

windows11-ltsc_2024-x64

8

Resubmissions

22/06/2026, 10:57

260622-m18xrabw6y

22/06/2026, 10:54

260622-mz23tabw5v8

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/06/2026, 10:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RealSetup_a5faf8fbd321c2894114fc0db2b16d1b8cdbcb78e19a5e0fb91366cc3f64bab7.exe
  • Size 14.7MB
  • Sample260622-mz23tabw5v
  • SHA256 915da1ec4b7576f74e364f100587667a9e1627aa48276342ed13460a277d8897
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoverypersistenceransomwarespywaretrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in Windows directory 15 IoCs
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\RealSetup_a5faf8fbd321c2894114fc0db2b16d1b8cdbcb78e19a5e0fb91366cc3f64bab7.exe
    "C:\Users\Admin\AppData\Local\Temp\RealSetup_a5faf8fbd321c2894114fc0db2b16d1b8cdbcb78e19a5e0fb91366cc3f64bab7.exe"
    1⤵
    • Checks whether UAC is enabled
    • Suspicious use of WriteProcessMemory
    PID:5848
    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RealSetup_a5faf8fbd321c2894114fc0db2b16d1b8cdbcb78e19a5e0fb91366cc3f64bab7.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D15CBC5-3FD3-4B14-84BB-C926A6F1EE48}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5848.1324.15569483409567746377 /pfhostedapp:dac0206d19894eeb20d6c31684d6aefccdb82dd5
      2⤵
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of WriteProcessMemory
      PID:5408
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D15CBC5-3FD3-4B14-84BB-C926A6F1EE48}\wv2\EBWebView /prefetch:4 /pfhostedapp:dac0206d19894eeb20d6c31684d6aefccdb82dd5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D15CBC5-3FD3-4B14-84BB-C926A6F1EE48}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7ffe39815fd8,0x7ffe39815fe4,0x7ffe39815ff0
        3⤵
          PID:5648
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D15CBC5-3FD3-4B14-84BB-C926A6F1EE48}\wv2\EBWebView" --webview-exe-name=RealSetup_a5faf8fbd321c2894114fc0db2b16d1b8cdbcb78e19a5e0fb91366cc3f64bab7.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1752 --field-trial-handle=1756,i,14035499431762356760,13315366948878815479,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:dac0206d19894eeb20d6c31684d6aefccdb82dd5
          3⤵
            PID:6016
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D15CBC5-3FD3-4B14-84BB-C926A6F1EE48}\wv2\EBWebView" --webview-exe-name=RealSetup_a5faf8fbd321c2894114fc0db2b16d1b8cdbcb78e19a5e0fb91366cc3f64bab7.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2236 --field-trial-handle=1756,i,14035499431762356760,13315366948878815479,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:dac0206d19894eeb20d6c31684d6aefccdb82dd5
            3⤵
              PID:5092
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D15CBC5-3FD3-4B14-84BB-C926A6F1EE48}\wv2\EBWebView" --webview-exe-name=RealSetup_a5faf8fbd321c2894114fc0db2b16d1b8cdbcb78e19a5e0fb91366cc3f64bab7.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2336 --field-trial-handle=1756,i,14035499431762356760,13315366948878815479,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:dac0206d19894eeb20d6c31684d6aefccdb82dd5
              3⤵
                PID:4872
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D15CBC5-3FD3-4B14-84BB-C926A6F1EE48}\wv2\EBWebView" --webview-exe-name=RealSetup_a5faf8fbd321c2894114fc0db2b16d1b8cdbcb78e19a5e0fb91366cc3f64bab7.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3508 --field-trial-handle=1756,i,14035499431762356760,13315366948878815479,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:dac0206d19894eeb20d6c31684d6aefccdb82dd5 /prefetch:1
                3⤵
                  PID:3924
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D15CBC5-3FD3-4B14-84BB-C926A6F1EE48}\wv2\EBWebView" --webview-exe-name=RealSetup_a5faf8fbd321c2894114fc0db2b16d1b8cdbcb78e19a5e0fb91366cc3f64bab7.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4132 --field-trial-handle=1756,i,14035499431762356760,13315366948878815479,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:dac0206d19894eeb20d6c31684d6aefccdb82dd5
                  3⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2812
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D15CBC5-3FD3-4B14-84BB-C926A6F1EE48}\wv2\EBWebView" --webview-exe-name=RealSetup_a5faf8fbd321c2894114fc0db2b16d1b8cdbcb78e19a5e0fb91366cc3f64bab7.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4516 --field-trial-handle=1756,i,14035499431762356760,13315366948878815479,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:dac0206d19894eeb20d6c31684d6aefccdb82dd5
                  3⤵
                    PID:2208
              • C:\Windows\system32\sihost.exe
                sihost.exe
                1⤵
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of WriteProcessMemory
                PID:5860
                • C:\Windows\explorer.exe
                  explorer.exe /LOADSAVEDWINDOWS
                  2⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Enumerates connected drives
                  • Checks SCSI registry key(s)
                  • Modifies Internet Explorer settings
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of SetWindowsHookEx
                  PID:4712
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:552
              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                1⤵
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:5668

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    prep_Activatable Class_Hermes_perf.cache
                    • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                    • Size 599B
                    • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    settings.dat
                    • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D15CBC5-3FD3-4B14-84BB-C926A6F1EE48}\wv2\EBWebView\Crashpad\settings.dat
                    • Size 280B
                    • SHA256 cde8eeaccfa8772669a7addd6e0eef34f228ff6c989973e1be7e3b4c02715590
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    settings.dat
                    • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D15CBC5-3FD3-4B14-84BB-C926A6F1EE48}\wv2\EBWebView\Crashpad\settings.dat
                    • Size 280B
                    • SHA256 e535b85ac9f9ca034ec4a153ae0b5de3c1490c27c215638d82eec477b4718de4
                    • MD5 SHA1 SHA512
                    Submit Download

                    throttle_store.dat
                    • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D15CBC5-3FD3-4B14-84BB-C926A6F1EE48}\wv2\EBWebView\Crashpad\throttle_store.dat
                    • Size 20B
                    • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                    • MD5 SHA1 SHA512
                    Submit Download

                    9e0fbb22-61ee-43b5-80ad-bc4aa61183b5.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D15CBC5-3FD3-4B14-84BB-C926A6F1EE48}\wv2\EBWebView\Default\9e0fbb22-61ee-43b5-80ad-bc4aa61183b5.tmp
                    • Size 5KB
                    • SHA256 8fa522eeeaa6e66ae9c37e33a914b8decf7925254f8ee20eaeec1c1dc9e9aeed
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MANIFEST-000001
                    • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D15CBC5-3FD3-4B14-84BB-C926A6F1EE48}\wv2\EBWebView\Default\Extension Rules\MANIFEST-000001
                    • Size 41B
                    • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                    • MD5 SHA1 SHA512
                    Submit Download

                    Network Persistent State
                    • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D15CBC5-3FD3-4B14-84BB-C926A6F1EE48}\wv2\EBWebView\Default\Network\Network Persistent State
                    • Size 111B
                    • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Network Persistent State~RFe5a8389.TMP
                    • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D15CBC5-3FD3-4B14-84BB-C926A6F1EE48}\wv2\EBWebView\Default\Network\Network Persistent State~RFe5a8389.TMP
                    • Size 59B
                    • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    SCT Auditing Pending Reports
                    • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D15CBC5-3FD3-4B14-84BB-C926A6F1EE48}\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
                    • Size 2B
                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                    • MD5 SHA1 SHA512
                    Submit Download

                    Preferences
                    • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D15CBC5-3FD3-4B14-84BB-C926A6F1EE48}\wv2\EBWebView\Default\Preferences
                    • Size 5KB
                    • SHA256 70b6c6c0543fe1c467144a90092eb180829ae249d97ead33ca068b1a1589ec79
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Preferences
                    • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D15CBC5-3FD3-4B14-84BB-C926A6F1EE48}\wv2\EBWebView\Default\Preferences
                    • Size 5KB
                    • SHA256 4eb431d7e280171884ca551836cf3340315228b7e192baa37661bb5ba6bebadf
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    CURRENT
                    • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D15CBC5-3FD3-4B14-84BB-C926A6F1EE48}\wv2\EBWebView\Default\Site Characteristics Database\CURRENT
                    • Size 16B
                    • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                    • MD5 SHA1 SHA512
                    Submit Download

                    data_0
                    • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D15CBC5-3FD3-4B14-84BB-C926A6F1EE48}\wv2\EBWebView\GraphiteDawnCache\data_0
                    • Size 8KB
                    • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    data_1
                    • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D15CBC5-3FD3-4B14-84BB-C926A6F1EE48}\wv2\EBWebView\GraphiteDawnCache\data_1
                    • Size 264KB
                    • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    data_2
                    • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D15CBC5-3FD3-4B14-84BB-C926A6F1EE48}\wv2\EBWebView\GraphiteDawnCache\data_2
                    • Size 8KB
                    • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    data_3
                    • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D15CBC5-3FD3-4B14-84BB-C926A6F1EE48}\wv2\EBWebView\GraphiteDawnCache\data_3
                    • Size 8KB
                    • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    Local State
                    • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D15CBC5-3FD3-4B14-84BB-C926A6F1EE48}\wv2\EBWebView\Local State
                    • Size 3KB
                    • SHA256 ef5eeb6514db786d717b6d865b56d71f72e4eca5aa811093c80f4fd78a0f8cdb
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Local State
                    • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D15CBC5-3FD3-4B14-84BB-C926A6F1EE48}\wv2\EBWebView\Local State
                    • Size 2KB
                    • SHA256 5058f29c4988beca9e93740e170639c3f50978909d36d5f442b3e0f829761f30
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Local State
                    • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D15CBC5-3FD3-4B14-84BB-C926A6F1EE48}\wv2\EBWebView\Local State
                    • Size 3KB
                    • SHA256 0c1b633123146b1a8ab647c7b44fd34c4581b353b9d1974a5d3c0e14136139b6
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Local State
                    • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D15CBC5-3FD3-4B14-84BB-C926A6F1EE48}\wv2\EBWebView\Local State
                    • Size 16KB
                    • SHA256 0db1c83fa83ab9a53eee9e412863ae95588445bc3593c933a1a7c1f9cba00ea1
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Local State~RFe595c20.TMP
                    • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{3D15CBC5-3FD3-4B14-84BB-C926A6F1EE48}\wv2\EBWebView\Local State~RFe595c20.TMP
                    • Size 1KB
                    • SHA256 3c58984112d218836412b5c93c23679ea173f9f49ffc823442d353d9baa79719
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    memory/552-361-0x0000017BF5710000-0x0000017BF5DA1000-memory.dmp
                    Download

                    memory/2208-442-0x00007FFE5B0C0000-0x00007FFE5B0C1000-memory.dmp
                    Download

                    memory/2208-443-0x00007FFE5B480000-0x00007FFE5B481000-memory.dmp
                    Download

                    memory/2812-419-0x0000024C57450000-0x0000024C57451000-memory.dmp
                    Download

                    memory/2812-428-0x0000024C57450000-0x0000024C57451000-memory.dmp
                    Download

                    memory/2812-430-0x0000024C57450000-0x0000024C57451000-memory.dmp
                    Download

                    memory/2812-426-0x0000024C57450000-0x0000024C57451000-memory.dmp
                    Download

                    memory/2812-429-0x0000024C57450000-0x0000024C57451000-memory.dmp
                    Download

                    memory/2812-427-0x0000024C57450000-0x0000024C57451000-memory.dmp
                    Download

                    memory/2812-421-0x0000024C57450000-0x0000024C57451000-memory.dmp
                    Download

                    memory/2812-425-0x0000024C57450000-0x0000024C57451000-memory.dmp
                    Download

                    memory/3924-98-0x00007FFE5A140000-0x00007FFE5A141000-memory.dmp
                    Download

                    memory/5668-189-0x00000186001E0000-0x00000186002E0000-memory.dmp
                    Download

                    memory/5668-235-0x0000018604290000-0x00000186042B0000-memory.dmp
                    Download

                    memory/5668-204-0x0000018604000000-0x0000018604100000-memory.dmp
                    Download

                    memory/5668-221-0x0000018601E00000-0x0000018601E20000-memory.dmp
                    Download

                    memory/5668-203-0x0000018601CD0000-0x0000018601CF0000-memory.dmp
                    Download

                    memory/6016-161-0x000001DDDCED0000-0x000001DDDCFA3000-memory.dmp
                    Download

                    memory/6016-26-0x00007FFE5A140000-0x00007FFE5A141000-memory.dmp
                    Download