915da1ec4b7576f74e364f100587667a9e1627aa48276342ed13460a277d8897

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
38s
max time network
46s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/06/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RealSetup_4d8e2316ee88413daf9a3336251a2b663a3b711c987220577b8bddb1ea0d7cd4.exe
Size 14.7MB
Sample260623-tsbevaet4s
SHA256 915da1ec4b7576f74e364f100587667a9e1627aa48276342ed13460a277d8897
MD5 93a8c2871f53931d7fe9ffeafe7bf79d
SHA1 46fdbcc7752b3be937b5af017c934907847f6cbb
SHA512 903c7dcb69f26db4f4188a83025867f19efdea94af542c5a98b16650a86218a793c9dba4e55ab7b6b3516ea8927f29e27274534f1adc4cc4f803517006aaab8c
SSDEEP 393216:BwGBpLFgDSn0fGwn+z1SHq01S/kyU0LLM4P/OUY:qtn+z1SABH
TLSH
T15CF6BF69A6BC00D9E466C1BCC2869223E772B45527B057CF5A649AFE0F63BD01E7F340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3636	powershell.exe
4012	powershell.exe
2356	powershell.exe
2356	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
2440	Update.exe
908	Update.exe
4328	Real.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RealSetup_4d8e2316ee88413daf9a3336251a2b663a3b711c987220577b8bddb1ea0d7cd4.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Update.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Update.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Real.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1772	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Real.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Real.exe

Enumerates system info in registry 2 TTPs 15 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134267051903921845"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\projectreal	RealSetup_4d8e2316ee88413daf9a3336251a2b663a3b711c987220577b8bddb1ea0d7cd4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\projectreal\URL Protocol	RealSetup_4d8e2316ee88413daf9a3336251a2b663a3b711c987220577b8bddb1ea0d7cd4.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\projectreal\shell\open\command	RealSetup_4d8e2316ee88413daf9a3336251a2b663a3b711c987220577b8bddb1ea0d7cd4.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\projectreal\shell	RealSetup_4d8e2316ee88413daf9a3336251a2b663a3b711c987220577b8bddb1ea0d7cd4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\projectreal\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Real\\Update.exe\" --write-deep-link \"%1\""	RealSetup_4d8e2316ee88413daf9a3336251a2b663a3b711c987220577b8bddb1ea0d7cd4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-125073035-2952146151-721812867-1000\{B170337F-0468-4691-9FFD-12E64C262649}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\projectreal\ = "URL:Real Protocol"	RealSetup_4d8e2316ee88413daf9a3336251a2b663a3b711c987220577b8bddb1ea0d7cd4.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\projectreal\shell\open	RealSetup_4d8e2316ee88413daf9a3336251a2b663a3b711c987220577b8bddb1ea0d7cd4.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1940	schtasks.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
3636	powershell.exe
3636	powershell.exe
4012	powershell.exe
4012	powershell.exe
2356	powershell.exe
2356	powershell.exe
2440	Update.exe
2440	Update.exe
4328	Real.exe
4328	Real.exe
908	Update.exe
908	Update.exe
4328	Real.exe
4328	Real.exe
4328	Real.exe
4328	Real.exe
4328	Real.exe
4328	Real.exe
4328	Real.exe
4328	Real.exe
4328	Real.exe
4328	Real.exe
4328	Real.exe
4328	Real.exe
4328	Real.exe
4328	Real.exe
4328	Real.exe
4328	Real.exe
4328	Real.exe
4328	Real.exe
4328	Real.exe
4328	Real.exe
4328	Real.exe
4328	Real.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3140	msedgewebview2.exe
892	msedgewebview2.exe
3252	msedgewebview2.exe
2720	msedgewebview2.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe
6116	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3636	powershell.exe
Token: SeDebugPrivilege	4012	powershell.exe
Token: SeDebugPrivilege	2356	powershell.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4328	Real.exe
4328	Real.exe
4328	Real.exe
6116	msedge.exe
6116	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4328	Real.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 3140	4444	RealSetup_4d8e2316ee88413daf9a3336251a2b663a3b711c987220577b8bddb1ea0d7cd4.exe	81
PID 3140 wrote to memory of 2396	3140	msedgewebview2.exe	82
PID 3140 wrote to memory of 2072	3140	msedgewebview2.exe	84
PID 3140 wrote to memory of 2072	3140	msedgewebview2.exe	84
PID 3140 wrote to memory of 2072	3140	msedgewebview2.exe	84
PID 3140 wrote to memory of 888	3140	msedgewebview2.exe	85
PID 3140 wrote to memory of 1020	3140	msedgewebview2.exe	86
PID 3140 wrote to memory of 1020	3140	msedgewebview2.exe	86
PID 3140 wrote to memory of 1544	3140	msedgewebview2.exe	87
PID 3140 wrote to memory of 1544	3140	msedgewebview2.exe	87
PID 3140 wrote to memory of 1544	3140	msedgewebview2.exe	87
PID 4444 wrote to memory of 3636	4444	RealSetup_4d8e2316ee88413daf9a3336251a2b663a3b711c987220577b8bddb1ea0d7cd4.exe	89
PID 4444 wrote to memory of 1940	4444	RealSetup_4d8e2316ee88413daf9a3336251a2b663a3b711c987220577b8bddb1ea0d7cd4.exe	91
PID 4444 wrote to memory of 4012	4444	RealSetup_4d8e2316ee88413daf9a3336251a2b663a3b711c987220577b8bddb1ea0d7cd4.exe	93
PID 4444 wrote to memory of 2356	4444	RealSetup_4d8e2316ee88413daf9a3336251a2b663a3b711c987220577b8bddb1ea0d7cd4.exe	96
PID 4444 wrote to memory of 2440	4444	RealSetup_4d8e2316ee88413daf9a3336251a2b663a3b711c987220577b8bddb1ea0d7cd4.exe	98
PID 2440 wrote to memory of 892	2440	Update.exe	99
PID 892 wrote to memory of 1684	892	msedgewebview2.exe	100
PID 892 wrote to memory of 1108	892	msedgewebview2.exe	101
PID 892 wrote to memory of 1108	892	msedgewebview2.exe	101
PID 892 wrote to memory of 1108	892	msedgewebview2.exe	101
PID 892 wrote to memory of 2692	892	msedgewebview2.exe	102
PID 892 wrote to memory of 4848	892	msedgewebview2.exe	103
PID 892 wrote to memory of 4848	892	msedgewebview2.exe	103
PID 892 wrote to memory of 3636	892	msedgewebview2.exe	104
PID 892 wrote to memory of 3636	892	msedgewebview2.exe	104
PID 892 wrote to memory of 3636	892	msedgewebview2.exe	104
PID 908 wrote to memory of 3252	908	Update.exe	106
PID 3252 wrote to memory of 4072	3252	msedgewebview2.exe	107
PID 3252 wrote to memory of 4824	3252	msedgewebview2.exe	108
PID 3252 wrote to memory of 4824	3252	msedgewebview2.exe	108
PID 3252 wrote to memory of 4824	3252	msedgewebview2.exe	108
PID 3252 wrote to memory of 244	3252	msedgewebview2.exe	109
PID 3252 wrote to memory of 1124	3252	msedgewebview2.exe	110
PID 3252 wrote to memory of 1124	3252	msedgewebview2.exe	110
PID 3252 wrote to memory of 1088	3252	msedgewebview2.exe	111
PID 3252 wrote to memory of 1088	3252	msedgewebview2.exe	111
PID 3252 wrote to memory of 1088	3252	msedgewebview2.exe	111
PID 2440 wrote to memory of 4328	2440	Update.exe	112
PID 4328 wrote to memory of 2720	4328	Real.exe	113
PID 2720 wrote to memory of 1196	2720	msedgewebview2.exe	114
PID 2720 wrote to memory of 2856	2720	msedgewebview2.exe	115
PID 2720 wrote to memory of 2856	2720	msedgewebview2.exe	115
PID 2720 wrote to memory of 2856	2720	msedgewebview2.exe	115
PID 2720 wrote to memory of 1884	2720	msedgewebview2.exe	116
PID 2720 wrote to memory of 4300	2720	msedgewebview2.exe	117
PID 2720 wrote to memory of 4300	2720	msedgewebview2.exe	117
PID 2720 wrote to memory of 4784	2720	msedgewebview2.exe	118
PID 2720 wrote to memory of 4784	2720	msedgewebview2.exe	118
PID 2720 wrote to memory of 4784	2720	msedgewebview2.exe	118
PID 4328 wrote to memory of 6116	4328	Real.exe	119
PID 6116 wrote to memory of 3588	6116	msedge.exe	120
PID 6116 wrote to memory of 1772	6116	msedge.exe	121
PID 6116 wrote to memory of 660	6116	msedge.exe	122
PID 6116 wrote to memory of 660	6116	msedge.exe	122
PID 6116 wrote to memory of 660	6116	msedge.exe	122
PID 6116 wrote to memory of 4472	6116	msedge.exe	124
PID 6116 wrote to memory of 4472	6116	msedge.exe	124
PID 6116 wrote to memory of 5532	6116	msedge.exe	125
PID 6116 wrote to memory of 5532	6116	msedge.exe	125
PID 6116 wrote to memory of 5532	6116	msedge.exe	125
PID 6116 wrote to memory of 4960	6116	msedge.exe	126
PID 6116 wrote to memory of 4960	6116	msedge.exe	126
PID 6116 wrote to memory of 4960	6116	msedge.exe	126

C:\Users\Admin\AppData\Local\Temp\RealSetup_4d8e2316ee88413daf9a3336251a2b663a3b711c987220577b8bddb1ea0d7cd4.exe
"C:\Users\Admin\AppData\Local\Temp\RealSetup_4d8e2316ee88413daf9a3336251a2b663a3b711c987220577b8bddb1ea0d7cd4.exe"
1⤵
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RealSetup_4d8e2316ee88413daf9a3336251a2b663a3b711c987220577b8bddb1ea0d7cd4.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{2E113568-6C6B-4542-8ED3-B876F878CC02}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=4444.3168.1169686340077944015
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\RealLottie-{2E113568-6C6B-4542-8ED3-B876F878CC02}\wv2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\RealLottie-{2E113568-6C6B-4542-8ED3-B876F878CC02}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffa5780b078,0x7ffa5780b084,0x7ffa5780b090
    3⤵
    PID:2396
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{2E113568-6C6B-4542-8ED3-B876F878CC02}\wv2\EBWebView" --webview-exe-name=RealSetup_4d8e2316ee88413daf9a3336251a2b663a3b711c987220577b8bddb1ea0d7cd4.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1688,i,485668040249066519,6309473223361992647,262144 --variations-seed-version --mojo-platform-channel-handle=1700 /prefetch:2
    3⤵
    PID:2072
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{2E113568-6C6B-4542-8ED3-B876F878CC02}\wv2\EBWebView" --webview-exe-name=RealSetup_4d8e2316ee88413daf9a3336251a2b663a3b711c987220577b8bddb1ea0d7cd4.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2008,i,485668040249066519,6309473223361992647,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:11
    3⤵
    PID:888
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{2E113568-6C6B-4542-8ED3-B876F878CC02}\wv2\EBWebView" --webview-exe-name=RealSetup_4d8e2316ee88413daf9a3336251a2b663a3b711c987220577b8bddb1ea0d7cd4.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2284,i,485668040249066519,6309473223361992647,262144 --variations-seed-version --mojo-platform-channel-handle=1704 /prefetch:13
    3⤵
    PID:1020
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{2E113568-6C6B-4542-8ED3-B876F878CC02}\wv2\EBWebView" --webview-exe-name=RealSetup_4d8e2316ee88413daf9a3336251a2b663a3b711c987220577b8bddb1ea0d7cd4.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3544,i,485668040249066519,6309473223361992647,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:1544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAIABFAHgAcABhAG4AZAAtAEEAcgBjAGgAaQB2AGUAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAByAGUAYQBsAC0AbAB1AGEAdQAtAGwAcwBwAC4AegBpAHAAJwAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcgBlAGEAbAAtAGwAdQBhAHUALQBsAHMAcAAtAGUAeAB0AHIAYQBjAHQAJwAgAC0ARgBvAHIAYwBlAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3636
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "Real\Launch" /tr "\"C:\Users\Admin\AppData\Local\Real\Update.exe\" --via-task" /sc ONDEMAND /rl HIGHEST /ru "" /it /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "try{ if((Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Real'){exit 0}else{exit 1} }catch{exit 1}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$p='C:\Users\Admin\AppData\Local\Real';$ex=@((Get-MpPreference).ExclusionPath);if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2356
- C:\Users\Admin\AppData\Local\Real\Update.exe
  "C:\Users\Admin\AppData\Local\Real\Update.exe" --processStart Real.exe
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Update.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{BDC085FE-6E10-4FAA-AC83-B9411D354183}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=2440.2856.12043145284640673516
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:892
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\RealLottie-{BDC085FE-6E10-4FAA-AC83-B9411D354183}\wv2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\RealLottie-{BDC085FE-6E10-4FAA-AC83-B9411D354183}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x240,0x7ffa5780b078,0x7ffa5780b084,0x7ffa5780b090
      4⤵
      PID:1684
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{BDC085FE-6E10-4FAA-AC83-B9411D354183}\wv2\EBWebView" --webview-exe-name=Update.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1916,i,9772647392479703882,12700190817026540320,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
      4⤵
      PID:1108
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{BDC085FE-6E10-4FAA-AC83-B9411D354183}\wv2\EBWebView" --webview-exe-name=Update.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1720,i,9772647392479703882,12700190817026540320,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:11
      4⤵
      PID:2692
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{BDC085FE-6E10-4FAA-AC83-B9411D354183}\wv2\EBWebView" --webview-exe-name=Update.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2240,i,9772647392479703882,12700190817026540320,262144 --variations-seed-version --mojo-platform-channel-handle=1796 /prefetch:13
      4⤵
      PID:4848
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{BDC085FE-6E10-4FAA-AC83-B9411D354183}\wv2\EBWebView" --webview-exe-name=Update.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3536,i,9772647392479703882,12700190817026540320,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
      4⤵
      PID:3636
- - C:\Users\Admin\AppData\Local\Real\real-0.4.85\Real.exe
    "C:\Users\Admin\AppData\Local\Real\real-0.4.85\Real.exe" --real-launched-by-updater
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4328
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Real.exe --webview-exe-version=0.4.6 --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4328.1728.1728424557517302618
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:2720
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x1a0,0x7ffa5780b078,0x7ffa5780b084,0x7ffa5780b090
        5⤵
        
        PID:1196
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=0.4.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1792,i,5956343489907161626,2896461112189773916,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1788 /prefetch:2
        5⤵
        
        PID:2856
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=0.4.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1796,i,5956343489907161626,2896461112189773916,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:11
        5⤵
        
        PID:1884
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=0.4.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1900,i,5956343489907161626,2896461112189773916,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:13
        5⤵
        
        PID:4300
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=0.4.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3324,i,5956343489907161626,2896461112189773916,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:1
        5⤵
        
        PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://projectreal.gg/register?app_auth=1&state=t3cvN3RJq--c2l6xk91nllXNHNww92KR9WwVYdgPE3Q&loopback_port=58600&hwid=HWIDv4_7d0a73614f7ef6a21c67f0be3c15c7b5571da1dda4b7cf9a59929e62329493c4
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:6116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x324,0x7ffa5534c188,0x7ffa5534c194,0x7ffa5534c1a0
        5⤵
        
        PID:3588
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,3791382909865235813,6712694592906167249,524288 --field-trial-handle=2356,i,3828254769072954080,15692135039559550616,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:1772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,18240107488133631765,6520057813002339445,262144 --field-trial-handle=2356,i,3828254769072954080,15692135039559550616,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
        5⤵
        
        PID:660
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2092,i,13598795010179935889,14891392181131214422,524288 --field-trial-handle=2356,i,3828254769072954080,15692135039559550616,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:13
        5⤵
        
        PID:4472
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,13338447699206022791,731290631563210844,2097152 --field-trial-handle=2356,i,3828254769072954080,15692135039559550616,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
        5⤵
        
        PID:5532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,6710751802612739781,11211099727804429229,2097152 --field-trial-handle=2356,i,3828254769072954080,15692135039559550616,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
        5⤵
        
        PID:4960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,18197288024816067906,6533059998897272845,2097152 --field-trial-handle=2356,i,3828254769072954080,15692135039559550616,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:9
        5⤵
        
        PID:5680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4360,i,7483246298103053842,10960925643050509131,2097152 --field-trial-handle=2356,i,3828254769072954080,15692135039559550616,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
        5⤵
        
        PID:5632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,1576546523335714440,1067685837952094650,2097152 --field-trial-handle=2356,i,3828254769072954080,15692135039559550616,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
        5⤵
        
        PID:6004
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4380,i,12930039961566628215,13098154071338301266,2097152 --field-trial-handle=2356,i,3828254769072954080,15692135039559550616,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:9
        5⤵
        
        PID:5652
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,12840778734230948730,13303642158401133959,524288 --field-trial-handle=2356,i,3828254769072954080,15692135039559550616,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
        5⤵
        
        PID:1740
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,14130408685711591951,10600210707808879513,524288 --field-trial-handle=2356,i,3828254769072954080,15692135039559550616,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
        5⤵
        
        PID:1124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,6257084039025358487,16253416650826766753,524288 --field-trial-handle=2356,i,3828254769072954080,15692135039559550616,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
        5⤵
        
        PID:5860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,13986013127480720292,3376961091327091920,524288 --field-trial-handle=2356,i,3828254769072954080,15692135039559550616,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
        5⤵
        
        PID:5948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,1051662619161186372,7071032133849873008,524288 --field-trial-handle=2356,i,3828254769072954080,15692135039559550616,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
        5⤵
        
        PID:5360
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,1051662619161186372,7071032133849873008,524288 --field-trial-handle=2356,i,3828254769072954080,15692135039559550616,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
        5⤵
        
        PID:5452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,3962998046273096695,8909863495633891064,524288 --field-trial-handle=2356,i,3828254769072954080,15692135039559550616,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
        5⤵
        
        PID:2080
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        6⤵
        
        PID:1388
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,2546512948724157834,1566834178108768312,524288 --field-trial-handle=2356,i,3828254769072954080,15692135039559550616,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
        5⤵
        
        PID:5240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,118865132496131895,11219698544628164807,524288 --field-trial-handle=2356,i,3828254769072954080,15692135039559550616,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14
        5⤵
        
        PID:3916
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,1145495548543359216,7330913112548061941,524288 --field-trial-handle=2356,i,3828254769072954080,15692135039559550616,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:14
        5⤵
        
        PID:6036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,12811356100251766168,4244934459123159021,524288 --field-trial-handle=2356,i,3828254769072954080,15692135039559550616,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:14
        5⤵
        
        PID:1808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,11949715575006223282,12789067160213552219,524288 --field-trial-handle=2356,i,3828254769072954080,15692135039559550616,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:14
        5⤵
        
        PID:3916

C:\Users\Admin\AppData\Local\Real\Update.exe
"C:\Users\Admin\AppData\Local\Real\Update.exe" --processStart Real.exe
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:908
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Update.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{081B85BB-9DDB-4AF3-B13E-73DC4B97D86F}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=908.3008.12934505108282817009
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\RealLottie-{081B85BB-9DDB-4AF3-B13E-73DC4B97D86F}\wv2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\RealLottie-{081B85BB-9DDB-4AF3-B13E-73DC4B97D86F}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x198,0x7ffa5780b078,0x7ffa5780b084,0x7ffa5780b090
    3⤵
    PID:4072
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{081B85BB-9DDB-4AF3-B13E-73DC4B97D86F}\wv2\EBWebView" --webview-exe-name=Update.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1920,i,6189152544638833089,16508611658017023081,262144 --variations-seed-version --mojo-platform-channel-handle=1728 /prefetch:2
    3⤵
    PID:4824
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{081B85BB-9DDB-4AF3-B13E-73DC4B97D86F}\wv2\EBWebView" --webview-exe-name=Update.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1732,i,6189152544638833089,16508611658017023081,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:11
    3⤵
    PID:244
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{081B85BB-9DDB-4AF3-B13E-73DC4B97D86F}\wv2\EBWebView" --webview-exe-name=Update.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2300,i,6189152544638833089,16508611658017023081,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:13
    3⤵
    PID:1124
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{081B85BB-9DDB-4AF3-B13E-73DC4B97D86F}\wv2\EBWebView" --webview-exe-name=Update.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3420,i,6189152544638833089,16508611658017023081,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
    3⤵
    PID:1088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 a7059c8eedc4eb9ffce04c56f454fddc4c8827fa544f266109b29eb09bfe1571
MD5 67cf288a9a05c74ce94002437cbc43e9
SHA1 8937a6610bc73623a69aaefe69021905916615ab
SHA512 7e4ddf5ca0355b5eabcff2e51aa921f834d8642cf87c24bf1c81aac1cc31100dc7a0e7cdaa935cc2c9bc79d5ae4711c1b181884a61164c3a6c1370e0be683839
TLSH
T1B281BC313375A0D489563F07192C19C463BF8356FA68AF4CB65C620EE92B54BDB222F7
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 0181141062da123c48165df0d093a0e55afca3eea8ad027fb9481928caca78a0
MD5 7f70ecf3403463cf7c2454474fd1c5d7
SHA1 685610646b0cc829a4afa1a27aeea2d7570f020b
SHA512 463f9dce8208a06625744baca2901f95c2cc5b3660de1e9403e02c31d9dfd4907be356493577fa99579f2df1107603dca61930833d91b8dec3af77fdbf2b29c9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7r:fwUQC5VwBIiElEd2K57P7r
TLSH
T167B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 940cbc9ecbe8080b4f78231e8ea559e5f25ba4586d9b9c7484580010ea141f8b
MD5 7b136c46d44a9c4f8f42a3893196bfa2
SHA1 65e92a8f631d018328a7c2cd1ea9b52d24fb05ed
SHA512 06b71e8d2ad9deb7c9ad47e7b7fc808b8513e4cd6ba4c5e561fab3aec9e937d3990c50625c22f7f7a281e06579a42d4a615f255576af4efa3a9daab503cc1a59
TLSH
T1E7D022233A8CA800D2A78130C016C30002A900E068178A01F2A4C82C442B0E063CD183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3d6022b8b09d410224e6f49ce6c5693abe531fcaf66bb13ef03126afd2691fe0
MD5 57d5bda89a3ce0cec5e5ba7de9f0b14b
SHA1 f3acef3d86afcfd0b7d491c8c55dd0679342b314
SHA512 b3100104fdba74d8ec0cde3847c8629b3f4d7d2f4eb07a7e44b61ece266b201daf1b4c4f2922da6731aa7e1518a90a163383bcb9d2738a6f78d052f8141237c8
TLSH
T1D4D012237A9CA410D2A78131D017D71556A910E468575A45F2A4C86D556B0A467CD187
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4192894e5b6f8ed1ee1f185dcbf33b6966d4b45b43a31ced5c710274f068a264
MD5 8271ae20f36fd2a1aa32299a5840e09f
SHA1 b9e0cf858cdddc524a2295d6d0bdd3e45de943a1
SHA512 fbd1863dc29d3db8730cdfe4c26b9327e1a9c8a9c55db7a99dbd62bb7a2f52022ba0bab3d0ed340fce817e41ec4f5a5ad4e75d18839ceb24077e3288f1ca528a
SSDEEP 192:sxZMReyM/jK1Ml8McI/f7sSt17JZFDIdpBK/W6+WN3no/zF0Yxg9W/zIg4J:sxZMM0I/f7s41lc4/b4/6poc
TLSH
T1E052FB16AA385977CCDBD309B955BF53D6F91433A2900E44A9FCCA1C01E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 3a534624bfed1c171649615f21eb5f61df9971a7201ffe946c18bc16c743a476
MD5 c31956fb67b9782526fbd00bfa5931b5
SHA1 e7b50e9a39d4cb54bf6cb2f99eff7ec8659df521
SHA512 521f207709b30f924fecd4f5de2b215b1cd26e6b89688cc8ebc5ee5374f53c2e02d461b05bfb7345c29bc3c0daa4ed4d32685beefe2afc9058634adef419de8c
SSDEEP 768:xKl1j83r2Uv7pLuL7emWRmeKQBC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3TgfR4RN:xKl1j83r2UpE7emWRmeKQBCu1jaKTgfa
TLSH
T1DF032C3B780CCB7E4F844E9CEC267E8B6DE8018BAA98899447F9444C03C67EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 877dc4939be65f9d59ca7d2e5cae84832a52536ea7859e5b94cd4fdd62422511
MD5 94f8e0289fd98742778aa459074194dd
SHA1 4ab6106b67e586e989bf87b96a1a5d7fde9fbe16
SHA512 1f1265ab7de70eceb3ee043fa8d1f9c598dcbffa749f0358a3c9cb357849f023c86f0f4e5e43333e1ab831e26adf9ddc9abee0e8219889fecd8f2e79b1e6f476
SSDEEP 48:KkUIHKtecXypgIjKl6s7yBjGPztR9gxJAzIkLgKz1L1g/bwKwVG:KkUgKtemKgAKl6KKAQKhiH
TLSH
T13391445230B712423C3F6519A295C71A474271B3346975AB3BE841B34E67E340EFE9EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c1333011259e4ebe1fdc62025c2771dc8fe653c73b69c79208c6b2385c407650
MD5 2fa5400675e643afa63661c777f81d4f
SHA1 cf1ca34b9396a475db9690f9ef4c701472173ba8
SHA512 c882bc1881eab57f524ab1709021578b2100d0976348c288b388f9aa2d69bd61a9c64f36c170ed29d0c983f40cf2e0c63d55fa74c95db7d5542ff82dfb64c51f
SSDEEP 384:nAtNn/s3n9Sa8N/LT5RFb3MgX532Z8mZX5zS+2gVTjhvbe2UBl/MgATw:Aj+9pm53zY5WlgtUxg8
TLSH
T139926B7168B9EC635CE6D685F55B36431FF824A79AC42E84E6EC5B0C00C769D230AD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f32ffed54494b6d813d8d09b4695eddd95480d39a111776053b6ef7e51097956
MD5 460dd1a5f18c06102120a70e8dab7370
SHA1 6fb203c055636f7dceee9d09485bd8508741bf44
SHA512 be159803f2b95cae6a860079063125d3fbfa752caeb35ec61c30ed7c831ee9f7435a1e2bccb1cea5256184e0547498b0864c947ff8e66bc7ee1588f544f33f17
SSDEEP 192:6GNA6i5fQmiUyJdWO7X5zPr2Fjzorm3msajvbMU6:6GNA62hmoO7X532Z8muzMU6
TLSH
T1C902E935A9687C7B8EE39E85B58737135FE8102BDA956F40DAE81B1C00C769C1316D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1efde02b2976744c796e488fd59b120fd2ae4af76a88f46d0df9152faf6f21a5
MD5 e543554af0959daecb9e555661e4e12b
SHA1 cb70219199a319347d27062078d82d430fc83300
SHA512 6e766bea49b577a7cd656057e808f06dc7e5f49237dbb212967a69bee24446fe772801cd46d4d51b3ce6cc9cd37aaf5a5a2d5ae4ff55df1a5aeba81f85eaf92f
SSDEEP 192:NGNvi6i5bQmiUy5Wc7X5zPr2Fjzorm3mYX5M+S+2IGQSqQETU6:NGNa62NZc7X532Z8mZX5zS+26VTU6
TLSH
T17312F871B868EC275DD3E585B59736535FA92077DE886F84E6E80B1C0087B8C274EC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b00e33e0-2bf1-40cd-883b-7f7e6f0095e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b00e33e0-2bf1-40cd-883b-7f7e6f0095e9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 19701460f53c81bec6673052302e11a9d341f3562fc8ee8e8d5c1410397d938d
MD5 0c7891f404b37dc2f36320815768eb0a
SHA1 39f4379abf63fefad36c05af173cdb3fd3e3a9dd
SHA512 184e4244ea8b515610935c4916fcf1957f97012909fb43fbbaebdba66560a312fd29158882e64e40423eee098b73ad58a3c4fa2730e503903b6a04045a88d501
TLSH
T11A318733B39CC1F8C49A017A1089AD10B6B5C2C344DA8EDB6B84C109A63F699DB645E0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 667af089c33395a78f2e6c001117939f195a9b5894ff932f91abd60d9edc0a34
MD5 2331cb349dd75989990af081e202a2fb
SHA1 65ebb24612ec694933d3fdf114f28c5fdcda5fdd
SHA512 855858dd6c644a834743a2d15a17c3b9d378cc51a6db23c305768f29723287a5f34e8743d7739fb38417ba17bf83272e14231cff5797644214666454292c670d
TLSH
T1FC218933B3ACD134C8DA117A1088ED01B2B5C7C7449ECE9F7784C418A57F89ADB641A4
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\Real\Update.exe
Size 6.6MB
SHA256 cb516f7c3235b26474f7901e0787c83f293b0792c35a25d9e021f461c5f95143
MD5 d1510f507f2c5e95c6b3f59b95abd07e
SHA1 59d6fe5d7671967f2d5a67665011962e7564d078
SHA512 452f72064663b681a1c947e00d99ca3eb08c04a7348a120b6e34d9f685cad053fcd76e110c0d5078604e26e9bd8e858b989e9b2d3bef47c59fb9d4a95d83190b
SSDEEP 98304:0KyBNsc+01S/kyU0L+UM8V+iqEcLMriF4y0:Vkq01S/kyU0LLM49qga
TLSH
T11E66AE69A6BC00D9E466C1BCC2869223E772B45527B057CF5A649AFE0F63BD01E7F340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6ac871c2896c63badf0f8fa7462c55baab560c18ae9bee9fd122fa475dd3c902
MD5 854b177c70057b2aceafe2d77cc85fbc
SHA1 cd8eb7458566000b4f2d26b150e5907b83f4b2cc
SHA512 b5125721c9b12059a14ff6ee157d4c22ae6432e1e7520328a76c5a50c5c0c4e4a39c61bc3b16d70359d7dc51f745cac1d9f0c52daa02e6685a5ba163385af32c
TLSH
T192D01252360103B8C41021771102A2090400C57F8085810A587C952D1A154900D16C41
MD5 SHA1 SHA512 TLSH

Submit Download

68bce5d2-a0b4-44af-a5d0-2d00ab30d421.tmp

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Network\68bce5d2-a0b4-44af-a5d0-2d00ab30d421.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 16KB
SHA256 d72bb6ec132f8b1dd6b2735cd62efa331728c5beb41c85289087d9af170c466e
MD5 80a286c6eff83657b5f4fc0a39aaa886
SHA1 6cfacc7678039e3b963ff8aadf84be0a9dfc8dab
SHA512 ff692483097407a24b363fce084dafcd1f89769f8afad0a696c987c3cbffc61ec0e6f4af041e4dec09498ff8310ec749e552c065af5f6919dede3ceb7414463b
SSDEEP 384:ziOjae3af7pOMe4tyUOh8iqLyWpMmGmNbuinS8e0pZ4FK:ljaeqD4MlshiLdMmrS8eWOFK
TLSH
T1C072AF6B997C286B8C77A84A7A896B4B5B3055DDC2D17F5DDCC91F0E02E72CD1201C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 1KB
SHA256 b83cd538473cb2a6bff0c1e2ecef691dcb93352ef33d131c46460e7f27ff0899
MD5 27901ef787b5f6ad10cb6d77e21e33ec
SHA1 37a168ede4b897fcf3bec85a9d90074ca7e14cb6
SHA512 c60fa268e6827c11f7939d408963dab09c53eeedc9f84f07a38f1904568ef283559803f6c77ac94e5d273778e317ceacbef6af3d77b706093cc2f5ab9ba2c4f0
TLSH
T17031A9B2D0941F3BA9525A897745FB4F0D70782ED3604F0456ED0B0C12D7ADC9526D37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 3KB
SHA256 49f7f54faee1a132c2d76bc95bd0c46820f3a33ac886efac433b5f0aa0d1b9b0
MD5 ed472e1913bcd31e2391154f0c2dd36d
SHA1 39245860080ddf21ac150eae685aae5136dfb5eb
SHA512 c8bd7f21fab159456a139ff2c39cce6c3f511fdb36adbf82b8b363e5d91891280a184f1de4ad0413f700fe1ed04bb6d2742aa5aeb0c931344cd76180a29985c0
TLSH
T1BF71A772A4A4992B4DF39E44BA897B0B66A16137E6D43F54C9ED0F0C01DB7D81301C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 2KB
SHA256 ea82aa13e22dcce6526cf14bed499e8b0288d9d6315f0413af09e59085a15c4f
MD5 fcdca5a2256ec2a86383df48f44f273b
SHA1 7146d1bb7c625016471c91c2d3de4de2983b4ed2
SHA512 498955cf5b129a7eb832f7815663e4f1e983a3f0568d31954c11e3f17bdf9bbffa5f02654bd09f9555ad7f7bf1747ce1295b8da1883bc910660464f2d9c8857e
TLSH
T10051A573B8589A3B85A35A887E897F0759756565E7E12F508AED0B0C01DBA9C2302C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5892b6.TMP

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State~RFe5892b6.TMP
Size 1KB
SHA256 151f58937e54ed5bcc7e9184edcbb0fa42057a4f721e7b2129e0fd5169ba8900
MD5 5525954cefb02d01b9753481f9d6121c
SHA1 2561c35e72e22af57fa553f369d0ceae2992e49f
SHA512 0316fde3915c35598cada37001944b5ccdfac1d52e35f1ca43067993f424ad23a8fa81b01b63e39155dbd1c5e57a7b919bd97bda0a84ecb5f36aed17b5953e41
TLSH
T1AD21B4B2C0941E7FA5520899B746FB8F0D60692AD3644F088AEE030C12DB9DC9626C37
MD5 SHA1 SHA512 TLSH

Submit Download

current-version.txt

Path C:\Users\Admin\AppData\Local\Real\data\meta\current-version.txt
Size 6B
SHA256 b43670c41c19bce94839d5bae3f8b5d85bb9ed1ad7ed0fb8c0ab52f38254f20e
MD5 b2da458d8ef4794993b96d53e5585e20
SHA1 bf4c49104d5e8c5075a4b05571b56dfea33c4279
SHA512 1e749d824015b27eb75e9d3a44e17728c52e0881fe86b7c2c830aca087a36ffa19de00563b4e9a0ea3d8c700b395bd9730d0fa438da3f168212b0bd6d7558602
MD5 SHA1 SHA512

Submit Download

luau-lsp-version.txt

Path C:\Users\Admin\AppData\Local\Real\data\meta\luau-lsp-version.txt
Size 6B
SHA256 a05b8f505a7ae3fa34e22d97ade349a7b3e7828a7d98d987e0a312eae5c59113
MD5 a22cce4bee21191d79a932d7df4a9b7f
SHA1 f91d4c1844ac055a09c2568a391e0bb490dcbad4
SHA512 3ef0596f273b290e1efeb4dba24745365c14c13f6c38b36bf238f9e65e38835b076e576dd5b34077ea06a1c505b1ecdb52e6e7b2873044bbd5a25bd21ce3f351
MD5 SHA1 SHA512

Submit Download

Real.exe

Path C:\Users\Admin\AppData\Local\Real\real-0.4.85\Real.exe
Size 9.7MB
SHA256 3c7be2ee47ad0060a09c53397287b6a5a16c323bb778d224ab66ffb81fcf9e34
MD5 2b833d781691129bf1995ec85dfdd759
SHA1 12fa104f5c73ec53235ad5990a65121715daecbf
SHA512 d98e95d9a89a9d010e2d0d0d04563bf7de40ed4fac125ddb3d33072a1b2452bb608123e1245e5bb4130aa3a15acb8b6c9ab0b8fec9d29048d84e66208fbfa76d
SSDEEP 196608:915yutic9t1bmFgU3vW6LKwKZE14JJBcVZ:zhb+ukt1C8VZ
TLSH
T1E3A6BE07E25481E9C0ADC0B8C35BA637EA32B889473571DF6BE44B112E1AFD06B3D759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.dll

Path C:\Users\Admin\AppData\Local\Real\real-0.4.85\bin\Real.dll
Size 2.1MB
SHA256 f03a331895424b7c7ec65cc73bc95ffc39910d36a276a73eab5915f58b9c470b
MD5 9a76e9d53ef3e5d3e65c56b71128dde9
SHA1 bcab55fcd0bc48b0151ebed4fd62017300ab9389
SHA512 f9f8c83a0a3a8748456fe2c711fc59a77335f38f5a0e7a70ebfb31f1071b1960a0d3b1f9df1bcccd957c55f8c6beb1fa148cfc43a0cc52622a05ec2d10019acb
SSDEEP 49152:zMJ86vPvGmq8+QpA8SdhzoYXPnpVUwR+OAQd54:zMJl48QL1xVUsYc54
TLSH
T157A5AEB234F5A215C97AAA4355F41535FE9013088A4E8EB11C79179CE32B62E0F7B39F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.exe

Path C:\Users\Admin\AppData\Local\Real\real-0.4.85\bin\Real.exe
Size 4.0MB
SHA256 eef609a68da822d351c255f5b67ca46cc194ab7be00ea5616f51624c4bcea490
MD5 0379bb1e5b86acd5d72fd8c4eb19b4c3
SHA1 5745ecff2d7128244ee16125bc761a13c230a4d4
SHA512 43f90636a9c04973eba36b9c3e5a489f5e9abd926b927a3fca69db8893baa9380ed70bda6f3458b9fbc975759321b70c0d7242d85d6da71f38d6a3dde092680f
SSDEEP 98304:YyVAKi1y1QoUBF/vB+VQJA7O6rNO1Scf2iYimFSsHr:Y8AKqBtBdJA7O6rNtcf266nL
TLSH
T13C1623A1EEA698BED40BA6F4C309C1A3CA5B7C9A1F3361DF5E480A512D335C51F34297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8309f2a9-ea04-4067-bc84-802b1a2b1e54.tmp

Path C:\Users\Admin\AppData\Local\Temp\8309f2a9-ea04-4067-bc84-802b1a2b1e54.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

97e83de6-11b4-43c7-b12d-f85b5fe9073b.tmp

Path C:\Users\Admin\AppData\Local\Temp\97e83de6-11b4-43c7-b12d-f85b5fe9073b.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{081B85BB-9DDB-4AF3-B13E-73DC4B97D86F}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9e5ebbc1848e724088a66606220e0e1927c28b4e3ebe59af315e27690a1bccf6
MD5 29202f454b764d852064ef5c0fe7e0b4
SHA1 ef087a2a1000c75dfeae2b6df75157124803d86c
SHA512 624cc909144ab11f57793ec15629e2bc24d203392f9d991a296ffdd3bb2d106ca12036b0aee117bfeb2e83e476456a87c85e2fac83384f3fa1089e922c02e0f5
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{081B85BB-9DDB-4AF3-B13E-73DC4B97D86F}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9259450d2af356b69eb603887fca758c5ca4faaec22be5cbbde09fdacd2aff1c
MD5 19331d7c7f198b8214c7a50fad10830e
SHA1 0453d1f0cebb5212d1eaad15df4af5352088d765
SHA512 20d6bcdf07275af2f837a8fbf8e0ead298053d14ea3f6dc6122896f41df865f7fef0661b2476ff562ebdd4d6b9e739d7ba48de4625fa343b0db7f0fc1bb46859
TLSH
T142D0121732410638C41020B31003720904C1C61F400D4004982CE57D5A844D0090A445
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{081B85BB-9DDB-4AF3-B13E-73DC4B97D86F}\wv2\EBWebView\Default\Extension Scripts\000003.log
Size 38B
SHA256 1c43a1bda1e458863c46dfae7fb43bfb3e27802169f37320399b1dd799a819ac
MD5 51a2cbb807f5085530dec18e45cb8569
SHA1 7ad88cd3de5844c7fc269c4500228a630016ab5b
SHA512 b643a8fa75eda90c89ab98f79d4d022bb81f1f62f50ed4e5440f487f22d1163671ec3ae73c4742c11830214173ff2935c785018318f4a4cad413ae4eeef985df
MD5 SHA1 SHA512

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{081B85BB-9DDB-4AF3-B13E-73DC4B97D86F}\wv2\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 e87b3d155c7582d4c1d889308b58f84e8fe90a1581014b21b785d6694bd156cc
MD5 a156bfab7f06800d5287d4616d6f8733
SHA1 8f365ec4db582dc519774dcbbfcc8001dd37b512
SHA512 6c8eeab3ae6fb0d5be7758cca521665b216f31aed1aeeeaf121c99dc9f0192b385de0da36e94f90dd4a9bbbac6be2c5a55d2f284a24ccb7dec2c5302fb9b027c
SSDEEP 24:TLekLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T66LopFMatSaw/auUOt8B
TLSH
T101928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE929ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{081B85BB-9DDB-4AF3-B13E-73DC4B97D86F}\wv2\EBWebView\Local State
Size 1KB
SHA256 9ebbc4d881577c4f3e3311c723348853a93d511ecddc8c18044f2ac830ffb7e8
MD5 6ec499a7bc7a9d37726e361e3b77bd34
SHA1 0ab7c03b28c8d90e62afa80f6e58018259cd7bbd
SHA512 4bfe8e30e2c6a03d6228aa7469eb8c32e8cd6a9ce4b7bcf1762e2aed47c3f229138dc60686a561655cf3dacaef0424e6ca7d95bde3fed9281e448ca8b37ec68e
TLSH
T170317773E4981F32DC959B8176866F4F1E30B136D2928E08B2EE4B0C42DB9DD9225D33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{081B85BB-9DDB-4AF3-B13E-73DC4B97D86F}\wv2\EBWebView\Local State
Size 2KB
SHA256 705e922c0b62d7e17b3873b2a82b05afb80197154df33dd293278092db6428d0
MD5 48ba9b7ddeb1bad6f447d03f5e30538d
SHA1 d840be2d9f66ba0114b1477f818422f1fdff8393
SHA512 5ad50a8e9be114753be8e151050068d64687a170399afed7db4e428673828abe76fe97686db08fca4368d8a97afdceba454c131782dc633958c4e987df3a33e0
TLSH
T103517873B8585A37C9F29E84798A3F175A35B175E7922F50A6DD0B0C41DB5AC1301C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{081B85BB-9DDB-4AF3-B13E-73DC4B97D86F}\wv2\EBWebView\Local State
Size 4KB
SHA256 5ac878e07ba09773ddfa4b2e614a62419aa648362f52e5467b2152c4af377e39
MD5 94fb1c2ecbe9a25afd861ecb624c6d89
SHA1 f046267b905f3734e0d9bc0f67b09ee8b9d24bbc
SHA512 2e6985b2d993ecc88afde06ad489950d4adbc92ea83eb29a8bae0b20093ad381e21e31b73b98f41540d5b06392f01700bd2bae442cdcc1196309c355a7dcd6b5
SSDEEP 96:zugkF3NkCE6f8Q8cyRjx58Frh/cInURoDotoTIarDI/iBKzZgM6Y1ZnjeTamSlea:zPkF3Nb6QqjYooDU4IWI6KzZgYWri
TLSH
T11E91B623686499238DF2DA84B98A3F076674A136E2D17F99D9ED0F0C41DB6D91301C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{081B85BB-9DDB-4AF3-B13E-73DC4B97D86F}\wv2\EBWebView\Local State
Size 3KB
SHA256 f427970d2f370e501e0c74b0b3a0655a7486f3214ee00d70889b1d7615afab64
MD5 8d341b4c5de035f1047c9b6ad03ca4e0
SHA1 cb6b36ebd2e3d373630fc7a0f16c5aa22f998c53
SHA512 93f2c60e3301dd7ae380cbcc41e9b520262e6085c905f83885cad9545448ca8c3c84a696ef563a58574eb968cce367693c44c7b8e0205dab2f3a0e65f89eab2a
TLSH
T10B718537A96899278DF29E40B9C62F067675A137E2C13F64E6ED0F0C41DB6D81301C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5888b3.TMP

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{081B85BB-9DDB-4AF3-B13E-73DC4B97D86F}\wv2\EBWebView\Local State~RFe5888b3.TMP
Size 1KB
SHA256 e292300209e12ea5ab837d3143e6c2c37691b25b17dd1c4441a79718afee8e66
MD5 ff11c05f291a5127ee3a0f7e3e07330d
SHA1 220f0c8745b68b0456b73e46e897bfffdaa180cd
SHA512 96dda2a6394c59fca465ee1f24586fe099127eeb2008b4d6a707cac4aa8fe7b1055ffb1b7ade108dc511202895b75703a49a3c8c2e072da4f6146fc7888c2acb
TLSH
T1F8213273D4981A36E9955E80B686AF4F1E70B136E2919E18B2DE470C12DF9E98325C33
MD5 SHA1 SHA512 TLSH

Submit Download

341b457f-dad2-46d5-b5e5-97cdd1bddeab.tmp

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2E113568-6C6B-4542-8ED3-B876F878CC02}\wv2\EBWebView\341b457f-dad2-46d5-b5e5-97cdd1bddeab.tmp
Size 1KB
SHA256 e6c64701507e5d0b68c25bc2aadfbe539ad97f59853dd932a80a3d6f3d0bb88d
MD5 36000782708dce6b40f53fcac9b75b0d
SHA1 21fcb1498b989d4905b7c01bc76a459b45ba2597
SHA512 159b609598ba86ef72363e9da769a33ec0185b46789a01bbb745379a4349c19d3032f91e7a211d2880d0f46bf343e3a358a9513f50683bf5958abe6ba30b9856
TLSH
T13D316573E4842F336C455A56B2866F5B2D205436E2500E5495DE470C02FBDDCD626C33
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2E113568-6C6B-4542-8ED3-B876F878CC02}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 bf06a70283bc2e4d1ddcbbebbe3ff93fb9eed217d41de6eebfeaae92d7668e05
MD5 37f5227cab1fdc88923725d55c6c7595
SHA1 852959deb079aaf7bf9a27ee0b0788c2d58530ec
SHA512 60c4713de19a3f9cddc5523c7618fea42774418f5f1e02938abfd9a701fcb1bcd2ff32e4a99888196a4b491916603fdd57f9ed4803e5cd4de2b1f1d9ea84d8fc
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2E113568-6C6B-4542-8ED3-B876F878CC02}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 379b469055bf5685e24d2735112b1136e1d401eaf4654796eb6d5e8a4a337c00
MD5 b3e7e7360786401600e570e322e17235
SHA1 872cf0e90329a5675c684fb16ce7a8b70127182f
SHA512 3b3aca49dc5dae08b21c77357983de06b5d1c4f749e9c172fcec305ba0679887710bc1235d52475e937a98f5f03f4bb47638b1e55e3b9eab15cc55a25b5145cb
TLSH
T19FD0121676421134C0212073025662090400C61B41054004543A955D6F448601D26491
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2E113568-6C6B-4542-8ED3-B876F878CC02}\wv2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2E113568-6C6B-4542-8ED3-B876F878CC02}\wv2\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 44a1cac07ce172d45c3d850b2baaaa7cd6b77615e0ef9a8bf6655d102075dc27
MD5 b425b17884b16b777d758f93d5516108
SHA1 140a21cd11baf28533a371effbfb5e8be4ad70bb
SHA512 a6a0b35651bd75c87643470d21ae14e815e6ce1a29febda84323da6216313ecb264aca37843293585667067e94d81517fa61f941ebe8cf704f076315771d9741
SSDEEP 3:LstlNllklkXl46K:LsX3lP4
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2E113568-6C6B-4542-8ED3-B876F878CC02}\wv2\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2E113568-6C6B-4542-8ED3-B876F878CC02}\wv2\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 7a1c590d0c1bde9364eef5526e9f29fa71d0b0f1d49ff6bd855dc4aad0a7ef1b
MD5 865f24ede42900d1e626241db625d84d
SHA1 f1d651c7cdd94ef38eeae729a568c86ba1567620
SHA512 5bf0815be8d4f49a0db1f7ab0e67fe978d2cedc2091abdb3e18056d2a860d8a5bb6d173939276fe2a000c01840040ffef3370d8258c47fe779545179ea683423
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2E113568-6C6B-4542-8ED3-B876F878CC02}\wv2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2E113568-6C6B-4542-8ED3-B876F878CC02}\wv2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2E113568-6C6B-4542-8ED3-B876F878CC02}\wv2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2E113568-6C6B-4542-8ED3-B876F878CC02}\wv2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2E113568-6C6B-4542-8ED3-B876F878CC02}\wv2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2E113568-6C6B-4542-8ED3-B876F878CC02}\wv2\EBWebView\Default\DawnWebGPUCache\index
Size 256KB
SHA256 e464cb503b9cefe675c13eebbc82d6c2b05cba17ef32ca5b5d8a7df01c399006
MD5 ddd3350ca9656aa97a0cd994bed3d888
SHA1 a7487948fc90b256b677d275c2967b7c0b118cff
SHA512 0c07f162f575389f0dd13728169c82b0ed54bb823b83b3ea91375fa7659e20a3451c02c2b1d840b99972cf92277ebfa94daff5b0f416cc09324bad140a0cb429
SSDEEP 3:LstlNllkll/lA4:LsX3lEtA
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2E113568-6C6B-4542-8ED3-B876F878CC02}\wv2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2E113568-6C6B-4542-8ED3-B876F878CC02}\wv2\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5881cd.TMP

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2E113568-6C6B-4542-8ED3-B876F878CC02}\wv2\EBWebView\Default\Network\Network Persistent State~RFe5881cd.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2E113568-6C6B-4542-8ED3-B876F878CC02}\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences~RFe588102.TMP

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2E113568-6C6B-4542-8ED3-B876F878CC02}\wv2\EBWebView\Default\Preferences~RFe588102.TMP
Size 5KB
SHA256 9d135ef064c14bf1db5c60cc2510d66cb365f0e1025b9baec5924583a44a31f1
MD5 39195ee431b4101af453cf54312d8f3d
SHA1 22324f9c53f8a09efd9b0f46439f3af9afd19eae
SHA512 cf0e678516a41d4e0374021f3b045edfbf9e9e858a280d09542bb93079399e9261fd1d7bf11129d4c31c81de93b100d9271e4e008aa7bc67e5fb0080f16a4d76
SSDEEP 96:ry05kBscwb9sLffadZ8i0oE8klm/7qx+WVHMSm+uecadQjr+g4NMEB:ry0CpLfEZ8pFO/S+Wi8dCONM8
TLSH
T1ADC1B7035F68697B4CC7F65D7A35BB02D2FA606176D41E58EBF8861C09D69CC130B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2E113568-6C6B-4542-8ED3-B876F878CC02}\wv2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2E113568-6C6B-4542-8ED3-B876F878CC02}\wv2\EBWebView\Local State
Size 2KB
SHA256 f161f8f16ec87f1c67780c179541c72a766bbce01bc15e08bbb562051fe5a404
MD5 9132bc8714045e77f07d5f19643e7dee
SHA1 fdbaa48c06414be44a4c47f7c1ba2225eed54f8e
SHA512 6256285e104ed9f3dae737b00ac446f7f06ebb6f1c646345e9052a1b0474168c11729b1c5027b68fd32e071406310dbb8537c4f9325d2d2c76d0ce5b0c6714ed
TLSH
T1E9519673B8489B779D934E55BA8A3F17A935A061E2912F6089DD0B0C01EBDEC6312C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2E113568-6C6B-4542-8ED3-B876F878CC02}\wv2\EBWebView\Local State
Size 3KB
SHA256 2d463330392fd2bfb2be7990b34f9d416bb5f1828b2527fa769e8672e2e25929
MD5 3b9d91ed0dd9d7161fc6766a49c9403a
SHA1 86a7e431f0e34d6919d4f88b3b3c142979bb7e90
SHA512 6c3e11d8681823a03b7965a7633e6514cef6d3b56c23f12e29041bfc1184571729f81cb2d551ad8964338f3b4481fc49eee5df47afdd4797a2e224c886ccae6d
TLSH
T1E871A737A8A8AA275DE39E55B9C62F0776615133E1D53FA4C9ED0F0C01EBAD81352C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2E113568-6C6B-4542-8ED3-B876F878CC02}\wv2\EBWebView\Local State
Size 4KB
SHA256 0c1d09b9a1bf99939f92b7bd839ccc65c4708001a00f41366fac75b6aa02cb85
MD5 c8b073bfc00554714c639ed5822d7c4e
SHA1 ee0e944ff9ec0521f202fde179b87a80cd14b00e
SHA512 fc5db4ac9c0dc5b12456776d13f51becded11f4c7d42976b61125264b5f22328061afeeac4bb296b69027e11756d0f45049a7a5bdef0065691225752a86af440
SSDEEP 96:zusbNkCEff8tbS4D58Frh/cInURoDotoiFuGDjB8Zyc6NZZgoZTyl0a:zhbNbDtm4uooDUDsg98ZyvlM
TLSH
T155817533A4A4AA275DA7DE45B98A2F0776619037E5D53FA8C9ED0F0C01EB6D81352C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2E113568-6C6B-4542-8ED3-B876F878CC02}\wv2\EBWebView\Local State
Size 4KB
SHA256 5c251fcc500c6917043893e339412a61266493be27d74381388a5ca2a7d510cc
MD5 53fb49d1012a507938cd790f3d019859
SHA1 0d75868f3c7a69c48ea77bf005436e1836cd593e
SHA512 d78a94f94fbc7db37d0e5722a333e727aceea850b465613a1716e22dbf79608cb153276d720e61e0b09dc77871c7e2342190055048f76b53657d5f265f35813d
SSDEEP 96:zusF3NkCEff8tbS4D58Frh/cInURoDotoTFuGDzKB8Zyc6NZZgoZTvtl0a:zhF3NbDtm4uooDU4sgza8Zyvlv7
TLSH
T132918423A4A4A9239DA7DE45B98A3F0776645033E6D52FA8C9EC0F0C01AB6D81342C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe583023.TMP

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2E113568-6C6B-4542-8ED3-B876F878CC02}\wv2\EBWebView\Local State~RFe583023.TMP
Size 1KB
SHA256 c5f5f4a02c58d7315a4e7d6b8f6da4c21d097ea50846fdd137807f2f7b22b04f
MD5 96e97843e340ab2213eed959616b6f35
SHA1 a4fd6713606506d856d21fe75ac73cc3b9a67ca9
SHA512 ca73a25ca16249748076f07dcde2c11f91318bc54c0e0831c0b48203baf683d457b305c737e2ad57e4194f87de25fdd8cecdcd6ffee8d15b12a01fa4c3c8cfa2
TLSH
T1CE214273D4C86F73A9490E66B2466F4B2C109436E2540F1495CE471C02FBCED9636C33
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{BDC085FE-6E10-4FAA-AC83-B9411D354183}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 424a2d41bde25a84fb4ef4415e76a314a0aa71ea940f8a0c8429af0c22033a1a
MD5 9a760e9ce9f735e405782d84e3cc7b26
SHA1 b97e48d1b9cc573cdfd21db3fc10659f5f2f3b62
SHA512 24ae860b27a2cc16acb1c14004c9e571b6d0ad41f376a052f8a7acc08f6eaee2c6b4e0a68b766ba4f2dda1385c48e0ac423de70f043375acfee1498f53203783
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{BDC085FE-6E10-4FAA-AC83-B9411D354183}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 db231499a7888460fbcbb2be7beb8d68466c5c56fe02d34399913e54ee2c8b80
MD5 6e75d15b2e5ebed9c3b849b00eb11dc6
SHA1 f58a2d361af321a220ff9f472599b4d39c6b276c
SHA512 e702324cc8ae50a2e503202357d260c98f7b7efd560734c898320fd6f9861e2e18b87c38f0097fa8aebbe68ace8c687bf766c771f38755d261617c1783b5b576
TLSH
T123D0121672024278D0102073051269083901C10B80494084742C865D1E484500D0A841
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{BDC085FE-6E10-4FAA-AC83-B9411D354183}\wv2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 892127ef17cd311bb45434ead135c8de0cf3b2de489c20084c74238f53d40ad9
MD5 1c050d208ce8dab092b7b2aaf9566cf6
SHA1 8689e34152bed0f00112cd364b3e1ec3380bd504
SHA512 84eb5ea06507f0c27932a854429a90900e4745b447f272595d9b65e62ab418484ce95699de27abeb5cbe5eaa3728a2370339fb60a9771fc47c4abe699a97bf9b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{BDC085FE-6E10-4FAA-AC83-B9411D354183}\wv2\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 104abedc38cc06776eb7a97dea23067c22596e1fca750f4ab2eca9ae7df55cbd
MD5 49b2b36556fe57cccc91b61982cafb3e
SHA1 4af032c4500b2e562ebf0febb8c7f5ddc397918e
SHA512 56a2a90e68305e19c747743a3ae1a703d12ab903a11ff27fd1def1a330258bfb770053d843af819a6c4bb5931e547695ca7732e8b859c3f864072fcdc0bd2e0f
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{BDC085FE-6E10-4FAA-AC83-B9411D354183}\wv2\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 168ad1763579a2e572fa98e8fe98ab89f9f269efbf130fdaba014a0ddb5db5a0
MD5 145dfc190a37c99d09cf9607fbe6e0f9
SHA1 1f7264c9c173f4cad01aec815867c7120b542f1e
SHA512 37dfccd8ccde4cdc065d00490daaa2eeee174e32391852ae287069d68e9e847238f44172ff61b8927e27fcf33a6bd12d2432fb895720fa898b6a6153719b5c12
SSDEEP 3:LstlNllkll/lp3:LsX3lEtF
MD5 SHA1 SHA512 SSDEEP

Submit Download

ExtensionActivityComp

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{BDC085FE-6E10-4FAA-AC83-B9411D354183}\wv2\EBWebView\Default\ExtensionActivityComp
Size 4KB
SHA256 8c471cab38a1696289186d01b06ff6af2a888852dc18d6fb8d2a0e54898104ed
MD5 d25d5e1dc1d93430e64ee17e48ce442e
SHA1 d5c7ca9a57e6cc68927a249fe8e601d52680ac7a
SHA512 f4cff7510b4ad81090e0b1842652f8eb7995f7aefd0ce651151bc24ca3a4305d34ecae41cf193d9b846e8f6359ccf545e5d05e63e6e766fa9761ccebce620f6c
TLSH
T154819284F7C02420DA306EF7A5024BB85E62CA82A5124F93487002D0FCA78ECDC75AAA
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{BDC085FE-6E10-4FAA-AC83-B9411D354183}\wv2\EBWebView\Default\History
Size 184KB
SHA256 7ac0739f534f89ae63c46cd41f0cffaf0335fe348933e3e3d660044351f2a746
MD5 c77e3d0b59e286bc3b50eff7cb8f464c
SHA1 b260bf6f86fb9aff5b2396bfb49dea658a6f05e5
SHA512 e9d95b19019dda281d5cdc16315ae5368b3bab7786955354de93dabe5885c958c556a09e4b57a707244e0052cbabb00029619deba1810677bf9ea06e7287e8fb
SSDEEP 96:xhBttejzH+bF+UIYysX0fxQp97fEHt/DfLjLqL/hbgI4VgNr2jWRk/E0:xhBqH+bF+UI3iWGVfWN3qL/8VgZQW3
TLSH
T1AA04EC1E5F743612CDBD513668E745B3597CF03F8B636AC62CA114B1CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{BDC085FE-6E10-4FAA-AC83-B9411D354183}\wv2\EBWebView\Local State
Size 2KB
SHA256 8bbf47b1823f5e861a567497e68b2cecf6f1d9420373774ce77e95b3b83dd8c4
MD5 ba1fcff648fc008594fde2bf3326c738
SHA1 fe648d6a757cd09d77b919aeaf0e9c2d8580da1a
SHA512 3550cb4bcff5be94dde0826e5bd9ca3f812ae3477e811909f4621173e91db9d2ec7c15e58151b1989dea85e3f5cd39aa188021b95e86ad23fc7c5b5d17802c81
TLSH
T18851A57378089A7789A39F44BA4A3B0369353152E3922F6095DD1B0C02DFADD2302C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{BDC085FE-6E10-4FAA-AC83-B9411D354183}\wv2\EBWebView\Local State
Size 3KB
SHA256 c6e7a4a729f1690dd3ddf529312a5eb953c4005370a6d1f268fb8ed1ba809c21
MD5 b1e3bd6bd6a671ca3a187e502b27ff4a
SHA1 6dd1d482fdffe3e7075b7708fd15eec068267347
SHA512 964a6e63eef1ed4f57b2d0568e8c21aab8b60d5786a8b9971b73249365a1140403adeca55cf89d7e88fc9fef2feaf3ab9c80cdc31332d580460e09008f19cbe6
TLSH
T1527194736968A93B4DB39E44BA892B0776652127E2C13FA5D9ED1F0C02DB7D81302C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{BDC085FE-6E10-4FAA-AC83-B9411D354183}\wv2\EBWebView\Local State
Size 1KB
SHA256 6135371c958c1ad58ba86012935b21e6d58b57cdcf21b7baeb1de585af05ebab
MD5 ac1832bde9f3a2241d52d75c1ea84799
SHA1 f1b6156d157d622fa8c849bf082e69ca1d051f7f
SHA512 2aa9d82e52a98519fb426b1f7b76fc8e034880ef151db84ac1fc2801b16a5551bb0de58b44d580c0f16b850c975a8326d8db4800c130d8d7a218619ab289aada
TLSH
T10F31A7B3E5881E766C565B55B756674B2C303557E3414E0462DD1B0803DF9CDD127C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{BDC085FE-6E10-4FAA-AC83-B9411D354183}\wv2\EBWebView\Local State
Size 4KB
SHA256 cd89ae1cdcfb1d40983553a22824a701cb43112cada420a2aed8ab496963dc49
MD5 b1a6f770dbc56f6f72547df6c7fb90f2
SHA1 b9abeba1a9299e1903c6c5cc68ced1eebdbd73ef
SHA512 146df4e7e02ccca2891a4f57eaec3774c11bc98198c8eea99a42d61a3be525edb4405d8ef2e36001f1cdda005717c3ee3890ff33900645f868442797c36588a8
SSDEEP 96:zuOjyF3NkCE7f83Y6j/58Frh/cInURoDotoTIOscDIi+iBK8cQgZ6U6ZgZiTvZlv:z5yF3Nbn3Y6jCooDU4IDKIi+iK8cQgr0
TLSH
T17191B62365A499374CF3DE45BA8A3B0766646123E6D53F99DAEC0F0C028F7D91302C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58844e.TMP

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{BDC085FE-6E10-4FAA-AC83-B9411D354183}\wv2\EBWebView\Local State~RFe58844e.TMP
Size 1KB
SHA256 262c4def42de7c15763cbb875c7e0d1311000fb04aae32c02b9487a47714ad9a
MD5 0a2236c6d8d4035290c1ebd56d154ba9
SHA1 1ee44c98e0c5f9241d4261b2e20cbb4a8c91792a
SHA512 bdf6e4319bfd1f903ff6bcd5bf3dddbaa2df2c74e66fba36d27c5bd0888f867b27969cc1f59cf56fedfe286938a4cc0f0154442162185acd2f216486fb9eb918
TLSH
T10321B4B3C4886E7AA8464A51B612B78F2C202123E3005F19A2CE170803DF9DCD227C33
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_1zdzjcg2.wkk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1zdzjcg2.wkk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

luau-lsp.exe

Path C:\Users\Admin\AppData\Local\Temp\real-luau-lsp-extract\luau-lsp.exe
Size 16.1MB
SHA256 9e85ce9370f208c97f1dfc1b8fcf7185fe64386f23130a65fc834f5323a0d653
MD5 0e14d186ed05911115868aec341ca13c
SHA1 525708cd63fbcaa2bd68225aa2411b0f46c3e9fb
SHA512 e3acd3aad750e35cf9993384fc274db9ffdfd18099d4fd90a39ad0c039410d4e451baa6a2e1a5b1fd2658281bed8d33a2a3d2403675ef3976f10322ec5d5d029
SSDEEP 393216:E4BgLVggOglggqgTgXi17gCFggqgggocgQgejM9gggggdvFBggggjCggggoggggg:KBggOglggqgTgXi17gCFggqgggocgQgP
TLSH
T188077B3A21AC10DCF1BBD0BD8BCB9E47D6B2340903319ADF0591569A1E1BDED4A7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

real-luau-lsp.zip

Path C:\Users\Admin\AppData\Local\Temp\real-luau-lsp.zip
Size 4.9MB
SHA256 15f2add7c70191c5cd636b047968760f0056893b63be10294453c75430bcb339
MD5 a381249f48d581c99737933b8995a0aa
SHA1 70534fbce598370edb1aea4f17334d91a9ad3b26
SHA512 f64cae2bf145b64b06b10f6978eea9d8dbcc8bc87c9d6a952d8142aec8aef86e34f8f828f7d80ba0b6f14bab32e9ee637251dd962cd29026627705aa2848cb7f
SSDEEP 98304:Z7GKCIDz2TUFQoFpWW5WU7+zN15Su1RSEN9qp3UngUerKUQeAp0bwPTUPhQhbs1t:AakUmoPWW5WUazNf/RvvyFKUQeAa0PTC
TLSH
T18F363353EFE87A26D7CC5677AC763C5C84A628E3405990882EAB5CF012D73640EB1DED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

98cea432-7b63-43e1-ac1f-7eba432f7f54.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6116_1076293128\98cea432-7b63-43e1-ac1f-7eba432f7f54.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6116_194609527\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Real\Real.lnk
Size 2KB
SHA256 e4ff3f52cddbba3989e6f1b0b2589bc592aa497d746c45829dead596146c3740
MD5 017ec52a10414f601b5885388856fbde
SHA1 5201feec61744a4cf20240d9d8dd42dd02a0e2d4
SHA512 d7b9f3bc42728214eef41bb8771171b8013e462c2b2c3ca0ec419736439e45e880f007ca6e46f21a5aa7a5c3b60e27b1e351e40e8d59aa5f88ae5a7c88dbfd7f
TLSH
T14541AC42F9D67720E3BBDE78A9F75676C5F5B870B7424A0D000083891C22B01AD19F0F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1544-120-0x00007FFA76050000-0x00007FFA76051000-memory.dmp

Download

memory/2072-25-0x00007FFA76050000-0x00007FFA76051000-memory.dmp

Download

memory/3636-239-0x000001EBA28D0000-0x000001EBA28DA000-memory.dmp

Download

memory/3636-238-0x000001EBA29B0000-0x000001EBA29C2000-memory.dmp

Download

memory/3636-237-0x000001EBA29B0000-0x000001EBA29BA000-memory.dmp

Download

memory/3636-236-0x000001EBA28F0000-0x000001EBA29A3000-memory.dmp

Download

memory/3636-235-0x000001EBA28D0000-0x000001EBA28EC000-memory.dmp

Download

memory/3636-228-0x000001EBA2640000-0x000001EBA2662000-memory.dmp

Download

memory/4012-277-0x0000027CE3660000-0x0000027CE3713000-memory.dmp

Download

memory/4012-280-0x0000027CE3750000-0x0000027CE376C000-memory.dmp

Download

memory/4012-281-0x0000027CE3730000-0x0000027CE373A000-memory.dmp

Download

memory/4012-282-0x0000027CE3BF0000-0x0000027CE3C0A000-memory.dmp

Download

memory/4012-283-0x0000027CE3740000-0x0000027CE3748000-memory.dmp

Download

memory/4012-284-0x0000027CE3770000-0x0000027CE3776000-memory.dmp

Download

memory/4012-285-0x0000027CE3780000-0x0000027CE378A000-memory.dmp

Download