d801660422f58d0e592737616d9382b0c0fd3fc654c8074cbdd2daca2b004ea8

Resubmissions

05/07/2026, 11:06

260705-m7rbaafx2k8

05/07/2026, 10:49

260705-mw29eafw5m8

Analysis

user interaction
yes
max time kernel
139s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 11:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RealSetup_40983b38ce93588ab4cfe03b7a9afd1578f6b63fc866f26dd2c75a68e2bec788.exe
Size 15.0MB
Sample260705-m7rbaafx2k
SHA256 d801660422f58d0e592737616d9382b0c0fd3fc654c8074cbdd2daca2b004ea8
MD5 287cb7c30b11612706505db5008e4b95
SHA1 d87663478afd6138d5b604bfc96f4081065c82fb
SHA512 e6f727709c502ab7c874dcbbf04ef2c5adfe9df72ebae46ae884ca569ebbf4fb9ff80353de9fc7ef00bbf05f57f57c5f6fdfd637677dc781057b72268b76ee7d
SSDEEP 393216:j1vQ9y6mG+2Xwd3Vusv+CRTV7pUDTpOUY:vZFdkp
TLSH
T143F6AFA9B6BC00D9E467C1BCC2965223E772B45523B057CF5A649AF60F23AD02E7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6296	powershell.exe
4576	powershell.exe
788	powershell.exe
6296	powershell.exe
4276	powershell.exe
4576	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1384	Update.exe
4264	Real.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RealSetup_40983b38ce93588ab4cfe03b7a9afd1578f6b63fc866f26dd2c75a68e2bec788.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Update.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Real.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
56	discord.com
57	discord.com
59	discord.com
66	discord.com
69	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1376265155\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1376265155\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_8558409\kp_pinslist.pb	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1376265155\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1376265155\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1376265155\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1376265155\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1376265155\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1376265155\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1376265155\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1376265155\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_8558409\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_8558409\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_1376265155\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_8558409\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5696_8558409\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4528	msedge.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	RealSetup_40983b38ce93588ab4cfe03b7a9afd1578f6b63fc866f26dd2c75a68e2bec788.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277233337786115"	RealSetup_40983b38ce93588ab4cfe03b7a9afd1578f6b63fc866f26dd2c75a68e2bec788.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Update.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\projectreal\shell\open\command	RealSetup_40983b38ce93588ab4cfe03b7a9afd1578f6b63fc866f26dd2c75a68e2bec788.exe
Key created	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\projectreal\shell	RealSetup_40983b38ce93588ab4cfe03b7a9afd1578f6b63fc866f26dd2c75a68e2bec788.exe
Key created	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\projectreal\shell\open	RealSetup_40983b38ce93588ab4cfe03b7a9afd1578f6b63fc866f26dd2c75a68e2bec788.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\projectreal\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Real\\Update.exe\" --write-deep-link \"%1\""	RealSetup_40983b38ce93588ab4cfe03b7a9afd1578f6b63fc866f26dd2c75a68e2bec788.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2900715619-172032027-1873877232-1000\{44145800-E9EC-4CB6-9A40-7A070C3F79AF}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\projectreal	RealSetup_40983b38ce93588ab4cfe03b7a9afd1578f6b63fc866f26dd2c75a68e2bec788.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\projectreal\ = "URL:Real Protocol"	RealSetup_40983b38ce93588ab4cfe03b7a9afd1578f6b63fc866f26dd2c75a68e2bec788.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\projectreal\URL Protocol	RealSetup_40983b38ce93588ab4cfe03b7a9afd1578f6b63fc866f26dd2c75a68e2bec788.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
692	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2428	msedgewebview2.exe
2428	msedgewebview2.exe
788	powershell.exe
788	powershell.exe
788	powershell.exe
6296	powershell.exe
6296	powershell.exe
6296	powershell.exe
4276	powershell.exe
4276	powershell.exe
4276	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
1384	Update.exe
1384	Update.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5696	msedgewebview2.exe
824	msedge.exe
824	msedge.exe
860	msedgewebview2.exe
824	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	788	powershell.exe
Token: SeIncreaseQuotaPrivilege	788	powershell.exe
Token: SeSecurityPrivilege	788	powershell.exe
Token: SeTakeOwnershipPrivilege	788	powershell.exe
Token: SeLoadDriverPrivilege	788	powershell.exe
Token: SeSystemProfilePrivilege	788	powershell.exe
Token: SeSystemtimePrivilege	788	powershell.exe
Token: SeProfSingleProcessPrivilege	788	powershell.exe
Token: SeIncBasePriorityPrivilege	788	powershell.exe
Token: SeCreatePagefilePrivilege	788	powershell.exe
Token: SeBackupPrivilege	788	powershell.exe
Token: SeRestorePrivilege	788	powershell.exe
Token: SeShutdownPrivilege	788	powershell.exe
Token: SeDebugPrivilege	788	powershell.exe
Token: SeSystemEnvironmentPrivilege	788	powershell.exe
Token: SeRemoteShutdownPrivilege	788	powershell.exe
Token: SeUndockPrivilege	788	powershell.exe
Token: SeManageVolumePrivilege	788	powershell.exe
Token: 33	788	powershell.exe
Token: 34	788	powershell.exe
Token: 35	788	powershell.exe
Token: 36	788	powershell.exe
Token: SeDebugPrivilege	6296	powershell.exe
Token: SeIncreaseQuotaPrivilege	6296	powershell.exe
Token: SeSecurityPrivilege	6296	powershell.exe
Token: SeTakeOwnershipPrivilege	6296	powershell.exe
Token: SeLoadDriverPrivilege	6296	powershell.exe
Token: SeSystemProfilePrivilege	6296	powershell.exe
Token: SeSystemtimePrivilege	6296	powershell.exe
Token: SeProfSingleProcessPrivilege	6296	powershell.exe
Token: SeIncBasePriorityPrivilege	6296	powershell.exe
Token: SeCreatePagefilePrivilege	6296	powershell.exe
Token: SeBackupPrivilege	6296	powershell.exe
Token: SeRestorePrivilege	6296	powershell.exe
Token: SeShutdownPrivilege	6296	powershell.exe
Token: SeDebugPrivilege	6296	powershell.exe
Token: SeSystemEnvironmentPrivilege	6296	powershell.exe
Token: SeRemoteShutdownPrivilege	6296	powershell.exe
Token: SeUndockPrivilege	6296	powershell.exe
Token: SeManageVolumePrivilege	6296	powershell.exe
Token: 33	6296	powershell.exe
Token: 34	6296	powershell.exe
Token: 35	6296	powershell.exe
Token: 36	6296	powershell.exe
Token: SeIncreaseQuotaPrivilege	6296	powershell.exe
Token: SeSecurityPrivilege	6296	powershell.exe
Token: SeTakeOwnershipPrivilege	6296	powershell.exe
Token: SeLoadDriverPrivilege	6296	powershell.exe
Token: SeSystemProfilePrivilege	6296	powershell.exe
Token: SeSystemtimePrivilege	6296	powershell.exe
Token: SeProfSingleProcessPrivilege	6296	powershell.exe
Token: SeIncBasePriorityPrivilege	6296	powershell.exe
Token: SeCreatePagefilePrivilege	6296	powershell.exe
Token: SeBackupPrivilege	6296	powershell.exe
Token: SeRestorePrivilege	6296	powershell.exe
Token: SeShutdownPrivilege	6296	powershell.exe
Token: SeDebugPrivilege	6296	powershell.exe
Token: SeSystemEnvironmentPrivilege	6296	powershell.exe
Token: SeRemoteShutdownPrivilege	6296	powershell.exe
Token: SeUndockPrivilege	6296	powershell.exe
Token: SeManageVolumePrivilege	6296	powershell.exe
Token: 33	6296	powershell.exe
Token: 34	6296	powershell.exe
Token: 35	6296	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
824	msedge.exe
4264	Real.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5652 wrote to memory of 5696	5652	RealSetup_40983b38ce93588ab4cfe03b7a9afd1578f6b63fc866f26dd2c75a68e2bec788.exe	89
PID 5696 wrote to memory of 5944	5696	msedgewebview2.exe	90
PID 5696 wrote to memory of 7152	5696	msedgewebview2.exe	91
PID 5696 wrote to memory of 7152	5696	msedgewebview2.exe	91
PID 5696 wrote to memory of 7152	5696	msedgewebview2.exe	91
PID 5696 wrote to memory of 7152	5696	msedgewebview2.exe	91
PID 5696 wrote to memory of 5752	5696	msedgewebview2.exe	92
PID 5696 wrote to memory of 5152	5696	msedgewebview2.exe	93
PID 5696 wrote to memory of 5152	5696	msedgewebview2.exe	93
PID 5696 wrote to memory of 5152	5696	msedgewebview2.exe	93
PID 5696 wrote to memory of 2688	5696	msedgewebview2.exe	94
PID 5696 wrote to memory of 2688	5696	msedgewebview2.exe	94
PID 5696 wrote to memory of 2688	5696	msedgewebview2.exe	94
PID 5696 wrote to memory of 2688	5696	msedgewebview2.exe	94
PID 5696 wrote to memory of 2688	5696	msedgewebview2.exe	94
PID 5696 wrote to memory of 4456	5696	msedgewebview2.exe	97
PID 5696 wrote to memory of 4456	5696	msedgewebview2.exe	97
PID 5696 wrote to memory of 4456	5696	msedgewebview2.exe	97
PID 5696 wrote to memory of 6032	5696	msedgewebview2.exe	98
PID 5696 wrote to memory of 6032	5696	msedgewebview2.exe	98
PID 5696 wrote to memory of 6032	5696	msedgewebview2.exe	98
PID 5696 wrote to memory of 2428	5696	msedgewebview2.exe	99
PID 5652 wrote to memory of 788	5652	RealSetup_40983b38ce93588ab4cfe03b7a9afd1578f6b63fc866f26dd2c75a68e2bec788.exe	100
PID 5652 wrote to memory of 6296	5652	RealSetup_40983b38ce93588ab4cfe03b7a9afd1578f6b63fc866f26dd2c75a68e2bec788.exe	103
PID 5652 wrote to memory of 4276	5652	RealSetup_40983b38ce93588ab4cfe03b7a9afd1578f6b63fc866f26dd2c75a68e2bec788.exe	105
PID 5652 wrote to memory of 692	5652	RealSetup_40983b38ce93588ab4cfe03b7a9afd1578f6b63fc866f26dd2c75a68e2bec788.exe	107
PID 5652 wrote to memory of 824	5652	RealSetup_40983b38ce93588ab4cfe03b7a9afd1578f6b63fc866f26dd2c75a68e2bec788.exe	110
PID 824 wrote to memory of 6996	824	msedge.exe	111
PID 5652 wrote to memory of 1384	5652	RealSetup_40983b38ce93588ab4cfe03b7a9afd1578f6b63fc866f26dd2c75a68e2bec788.exe	112
PID 1384 wrote to memory of 860	1384	Update.exe	113
PID 860 wrote to memory of 2064	860	msedgewebview2.exe	114
PID 824 wrote to memory of 4528	824	msedge.exe	115
PID 824 wrote to memory of 2616	824	msedge.exe	116
PID 824 wrote to memory of 2616	824	msedge.exe	116
PID 824 wrote to memory of 2616	824	msedge.exe	116
PID 824 wrote to memory of 2804	824	msedge.exe	117
PID 824 wrote to memory of 2804	824	msedge.exe	117
PID 824 wrote to memory of 5868	824	msedge.exe	118
PID 824 wrote to memory of 5868	824	msedge.exe	118
PID 824 wrote to memory of 5868	824	msedge.exe	118
PID 824 wrote to memory of 6608	824	msedge.exe	119
PID 824 wrote to memory of 6608	824	msedge.exe	119
PID 824 wrote to memory of 6608	824	msedge.exe	119
PID 860 wrote to memory of 2920	860	msedgewebview2.exe	121
PID 860 wrote to memory of 2920	860	msedgewebview2.exe	121
PID 860 wrote to memory of 2920	860	msedgewebview2.exe	121
PID 860 wrote to memory of 2920	860	msedgewebview2.exe	121
PID 860 wrote to memory of 3400	860	msedgewebview2.exe	122
PID 860 wrote to memory of 6820	860	msedgewebview2.exe	123
PID 860 wrote to memory of 6820	860	msedgewebview2.exe	123
PID 860 wrote to memory of 6820	860	msedgewebview2.exe	123
PID 860 wrote to memory of 2892	860	msedgewebview2.exe	124
PID 860 wrote to memory of 2892	860	msedgewebview2.exe	124
PID 860 wrote to memory of 2892	860	msedgewebview2.exe	124
PID 860 wrote to memory of 2892	860	msedgewebview2.exe	124
PID 860 wrote to memory of 2892	860	msedgewebview2.exe	124
PID 824 wrote to memory of 2964	824	msedge.exe	125
PID 824 wrote to memory of 2964	824	msedge.exe	125
PID 824 wrote to memory of 2964	824	msedge.exe	125
PID 1384 wrote to memory of 4576	1384	Update.exe	126
PID 824 wrote to memory of 4944	824	msedge.exe	128
PID 824 wrote to memory of 2464	824	msedge.exe	129
PID 824 wrote to memory of 2464	824	msedge.exe	129
PID 1384 wrote to memory of 4264	1384	Update.exe	130

C:\Users\Admin\AppData\Local\Temp\RealSetup_40983b38ce93588ab4cfe03b7a9afd1578f6b63fc866f26dd2c75a68e2bec788.exe
"C:\Users\Admin\AppData\Local\Temp\RealSetup_40983b38ce93588ab4cfe03b7a9afd1578f6b63fc866f26dd2c75a68e2bec788.exe"
1⤵
- Checks whether UAC is enabled
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5652
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RealSetup_40983b38ce93588ab4cfe03b7a9afd1578f6b63fc866f26dd2c75a68e2bec788.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{8D9E1683-0181-4987-A546-8521B2F99245}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5652.4956.17629470764192177239 /pfhostedapp:056bec545056252ffb430543f703a0d62c994c81
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5696
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\RealLottie-{8D9E1683-0181-4987-A546-8521B2F99245}\wv2\EBWebView /prefetch:4 /pfhostedapp:056bec545056252ffb430543f703a0d62c994c81 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\RealLottie-{8D9E1683-0181-4987-A546-8521B2F99245}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff924cd5fd8,0x7ff924cd5fe4,0x7ff924cd5ff0
    3⤵
    PID:5944
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{8D9E1683-0181-4987-A546-8521B2F99245}\wv2\EBWebView" --webview-exe-name=RealSetup_40983b38ce93588ab4cfe03b7a9afd1578f6b63fc866f26dd2c75a68e2bec788.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1780,i,1815769996474860868,13507795640174531569,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:056bec545056252ffb430543f703a0d62c994c81
    3⤵
    PID:7152
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{8D9E1683-0181-4987-A546-8521B2F99245}\wv2\EBWebView" --webview-exe-name=RealSetup_40983b38ce93588ab4cfe03b7a9afd1578f6b63fc866f26dd2c75a68e2bec788.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2124 --field-trial-handle=1780,i,1815769996474860868,13507795640174531569,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:056bec545056252ffb430543f703a0d62c994c81
    3⤵
    PID:5752
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{8D9E1683-0181-4987-A546-8521B2F99245}\wv2\EBWebView" --webview-exe-name=RealSetup_40983b38ce93588ab4cfe03b7a9afd1578f6b63fc866f26dd2c75a68e2bec788.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2232 --field-trial-handle=1780,i,1815769996474860868,13507795640174531569,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:056bec545056252ffb430543f703a0d62c994c81
    3⤵
    PID:5152
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{8D9E1683-0181-4987-A546-8521B2F99245}\wv2\EBWebView" --webview-exe-name=RealSetup_40983b38ce93588ab4cfe03b7a9afd1578f6b63fc866f26dd2c75a68e2bec788.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3400 --field-trial-handle=1780,i,1815769996474860868,13507795640174531569,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:056bec545056252ffb430543f703a0d62c994c81 /prefetch:1
    3⤵
    PID:2688
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{8D9E1683-0181-4987-A546-8521B2F99245}\wv2\EBWebView" --webview-exe-name=RealSetup_40983b38ce93588ab4cfe03b7a9afd1578f6b63fc866f26dd2c75a68e2bec788.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4380 --field-trial-handle=1780,i,1815769996474860868,13507795640174531569,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:056bec545056252ffb430543f703a0d62c994c81
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{8D9E1683-0181-4987-A546-8521B2F99245}\wv2\EBWebView" --webview-exe-name=RealSetup_40983b38ce93588ab4cfe03b7a9afd1578f6b63fc866f26dd2c75a68e2bec788.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=3988 --field-trial-handle=1780,i,1815769996474860868,13507795640174531569,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:056bec545056252ffb430543f703a0d62c994c81
    3⤵
    PID:6032
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{8D9E1683-0181-4987-A546-8521B2F99245}\wv2\EBWebView" --webview-exe-name=RealSetup_40983b38ce93588ab4cfe03b7a9afd1578f6b63fc866f26dd2c75a68e2bec788.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4500 --field-trial-handle=1780,i,1815769996474860868,13507795640174531569,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:056bec545056252ffb430543f703a0d62c994c81
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "try{ if((Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Real'){exit 0}else{exit 1} }catch{exit 1}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$p='C:\Users\Admin\AppData\Local\Real';$ex=@((Get-MpPreference).ExclusionPath);if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p };$ex=@((Get-MpPreference).ExclusionPath);if($ex -contains $p){exit 0}else{exit 1}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAIABFAHgAcABhAG4AZAAtAEEAcgBjAGgAaQB2AGUAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAByAGUAYQBsAC0AbAB1AGEAdQAtAGwAcwBwAC4AegBpAHAAJwAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcgBlAGEAbAAtAGwAdQBhAHUALQBsAHMAcAAtAGUAeAB0AHIAYQBjAHQAJwAgAC0ARgBvAHIAYwBlAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4276
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "Real\Launch" /tr "\"C:\Users\Admin\AppData\Local\Real\Update.exe\" --via-task" /sc ONDEMAND /rl HIGHEST /ru "" /it /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/projectreal
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x384,0x7ff9124ac188,0x7ff9124ac194,0x7ff9124ac1a0
    3⤵
    PID:6996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,4107184255496365449,4066988509818952623,524288 --field-trial-handle=2416,i,8022052612907617222,9428310099777830528,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,2746907032879829525,10104345911901069603,262144 --field-trial-handle=2416,i,8022052612907617222,9428310099777830528,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:2
    3⤵
    PID:2616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,8947798661195029888,9423209312501713253,524288 --field-trial-handle=2416,i,8022052612907617222,9428310099777830528,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:13
    3⤵
    PID:2804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,10078303279720249537,7389160751703958901,2097152 --field-trial-handle=2416,i,8022052612907617222,9428310099777830528,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:5868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,7855516280735902285,17548873923094743401,2097152 --field-trial-handle=2416,i,8022052612907617222,9428310099777830528,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
    3⤵
    PID:6608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5144,i,18251412958378643835,6776702051090472539,2097152 --field-trial-handle=2416,i,8022052612907617222,9428310099777830528,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:1
    3⤵
    PID:2964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,12320055543411465470,5929967654980143340,524288 --field-trial-handle=2416,i,8022052612907617222,9428310099777830528,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:14
    3⤵
    - Modifies registry class
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,16898187828588638434,17617202287732714950,524288 --field-trial-handle=2416,i,8022052612907617222,9428310099777830528,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:12
    3⤵
    PID:2464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,14361665439461798135,15753240092463595277,524288 --field-trial-handle=2416,i,8022052612907617222,9428310099777830528,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:14
    3⤵
    PID:6452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,7692722526190929969,15673901661929291248,524288 --field-trial-handle=2416,i,8022052612907617222,9428310099777830528,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
    3⤵
    PID:6392
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,4474910425115968354,12786867502694923090,524288 --field-trial-handle=2416,i,8022052612907617222,9428310099777830528,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
    3⤵
    PID:2516
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,4474910425115968354,12786867502694923090,524288 --field-trial-handle=2416,i,8022052612907617222,9428310099777830528,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
    3⤵
    PID:1360
- C:\Users\Admin\AppData\Local\Real\Update.exe
  "C:\Users\Admin\AppData\Local\Real\Update.exe" --processStart Real.exe
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Update.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{59B8DB45-35A1-46E4-A7DD-50E6AC6A9DBC}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1384.6980.8510162300041741095 /pfhostedapp:e41fd5d2d23f36ed5e23df9b2aece6b381ec97c8
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:860
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\RealLottie-{59B8DB45-35A1-46E4-A7DD-50E6AC6A9DBC}\wv2\EBWebView /prefetch:4 /pfhostedapp:e41fd5d2d23f36ed5e23df9b2aece6b381ec97c8 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\RealLottie-{59B8DB45-35A1-46E4-A7DD-50E6AC6A9DBC}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0xa8,0x198,0x7ff924cd5fd8,0x7ff924cd5fe4,0x7ff924cd5ff0
      4⤵
      PID:2064
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{59B8DB45-35A1-46E4-A7DD-50E6AC6A9DBC}\wv2\EBWebView" --webview-exe-name=Update.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1784 --field-trial-handle=1788,i,17997277915053899502,6227625694632376006,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:e41fd5d2d23f36ed5e23df9b2aece6b381ec97c8
      4⤵
      PID:2920
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{59B8DB45-35A1-46E4-A7DD-50E6AC6A9DBC}\wv2\EBWebView" --webview-exe-name=Update.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2172 --field-trial-handle=1788,i,17997277915053899502,6227625694632376006,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:e41fd5d2d23f36ed5e23df9b2aece6b381ec97c8
      4⤵
      PID:3400
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{59B8DB45-35A1-46E4-A7DD-50E6AC6A9DBC}\wv2\EBWebView" --webview-exe-name=Update.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2248 --field-trial-handle=1788,i,17997277915053899502,6227625694632376006,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:e41fd5d2d23f36ed5e23df9b2aece6b381ec97c8
      4⤵
      PID:6820
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{59B8DB45-35A1-46E4-A7DD-50E6AC6A9DBC}\wv2\EBWebView" --webview-exe-name=Update.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3412 --field-trial-handle=1788,i,17997277915053899502,6227625694632376006,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:e41fd5d2d23f36ed5e23df9b2aece6b381ec97c8 /prefetch:1
      4⤵
      PID:2892
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$p='C:\Users\Admin\AppData\Local\Real';$ex=@((Get-MpPreference).ExclusionPath);if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p };$ex=@((Get-MpPreference).ExclusionPath);if($ex -contains $p){exit 0}else{exit 1}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4576
- - C:\Users\Admin\AppData\Local\Real\real-0.6.55\Real.exe
    "C:\Users\Admin\AppData\Local\Real\real-0.6.55\Real.exe" --real-launched-by-updater
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of FindShellTrayWindow
    PID:4264
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Real.exe --webview-exe-version=0.6.4 --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4264.6928.10450875227095068409 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
      4⤵
      Enumerates system info in registry
      PID:6556
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView /prefetch:4 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7ff924cd5fd8,0x7ff924cd5fe4,0x7ff924cd5ff0
        5⤵
        
        PID:6804
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=0.6.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1784 --field-trial-handle=1788,i,8686211215741246263,16940764991818267668,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
        5⤵
        
        PID:5804
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=0.6.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2288 --field-trial-handle=1788,i,8686211215741246263,16940764991818267668,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
        5⤵
        
        PID:4724
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=0.6.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2500 --field-trial-handle=1788,i,8686211215741246263,16940764991818267668,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
        5⤵
        
        PID:3388
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=0.6.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3416 --field-trial-handle=1788,i,8686211215741246263,16940764991818267668,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105 /prefetch:1
        5⤵
        
        PID:5404

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b363f693690aa479b03b10f13d837c7277e1cd8d6c10d7150235a6d4eee0f34
MD5 ddf8b13fdf9db751ce6cc3328e266fa7
SHA1 1cd0cf7ab6698157c24338d81d076859d18cfba7
SHA512 e7b35b46a0f47d516568817a1f6db4f2445e353959197912eea8a7ab8f6a257b9bc5ba855ad99faa8b859e7ac8c3141a43c223c051fe9bd656f75b6384e18fc8
TLSH
T1E8D08CF0BB297982D26534B2B5229711B2B140AA3A2BD6D1A4A0C50C8C3B8D9A786183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3838e0c9b97b740997025cc20f9894a4fb2fc1d09513fd3de779b19d7f969df9
MD5 339ab2331fb3aae4a95fd88c7e816532
SHA1 6574ff6ed98e60945fa77f8a7d8ad1edb5290a0d
SHA512 5703e993048ce770ae38db5cd87e9d20ad636253535d52856c3755705dc6df3c453a6d3e0d99cf03becd2767b8b650787c5242fb56cd30f29d5089d3da98f0d9
TLSH
T14DE02BEAC961EC3B08FC0F2C74924749EB50132B2B41494F3B3C920C4FB5276819187C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5dce9dfa-0b69-4b88-b562-862fa1290cb2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5dce9dfa-0b69-4b88-b562-862fa1290cb2.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f434c7dae8285d3f9c2d5e772c08c4f56145d0cfb2df0c4342f16ed55b28a9f2
MD5 aa6e1950a379b3a182a865ed57b3f240
SHA1 1e322c03900c6f7a3f3f92d312b9bc922c58aa06
SHA512 fbc635c920aa3b6a791cb87e98a1e37988d05d02be421de611653c4fc6e408227d0a4a3c7fa4cb68714422004d105c25288d63f7ae62f010c7fb7f51738acc3d
SSDEEP 192:sxRyRmyMqZjK1Ml8wce/fKsIRgpZsGJlsJZXzoA8pTY/g6+WNpzw/eBymcIGZIgR:sxRyvCe/fKsIinsGr4Z+M/5+/eEjd
TLSH
T1C472E91AA578597BCCDBD219FA457B63D6F81523A2904F44AAFC8A0C01EB6DD211383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 2601cb6c8941daa75cfce22639e77a9f6d8bf2c502191d31c0a3b47111403c51
MD5 240d575bc77328a2b2e6bf351ff9fba4
SHA1 43ec897495e6cae9a4d97cd37d458d4d3b3632d2
SHA512 ba4e774434a1565465219ca5f1187770ea65e23e2372f45cf555be2626e4edd764a2711f28dc7745fe1e4a1467d6905466bb3fd2023a95462d5baeae7a15adde
SSDEEP 768:RGqO3j7pLuL7yrWgzvfsX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXu7z9wQroPwBg:RGqO3VE7yrWgzvfsXu1jaMu7pw7PwBg
TLSH
T14BE2FD3B680CCB7F4F804A9CEC29BE9A5DA802CF56D8895447EE884C03C76FB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 d1aa054482f2fca1c7cacf6065d33e17947b729677491f8b85801ab8eab07b25
MD5 bc3a579e686b312ba9a0308960fc65c4
SHA1 8437a39e801275fea3bfa4f079738720bb85040c
SHA512 fbf25c9e873925ee784d0b638c5251e88d0a12a49a589d019c6f1aad8d7e7e9fe225e27c1ad3516ad80ec112d740eed6b1e7c0dee9bafcb8314b84884742e84f
TLSH
T1F1D0A76FE1560884E7EE4BA11522145A87242C8525829488E4172E7D18F1B97B311FB6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a98a7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5a98a7.TMP
Size 138B
SHA256 3703283f9c4ac2045b7fcab33b3c8bfcb37437b9405e3e81d00d8a772ac3c426
MD5 60668f09c2412e3e9b7b57a2934c1835
SHA1 d591a8a5a0eb4973a3667ca4649c5c668edfcd7c
SHA512 816534ba2951e8037d5c137834bdfd39842f16ece03ba8d50d62c818faa8da20eb5ab9a41b2be3ae57f5e5c6cf16dbd197c6bd09a990ec6af4ce70772b44c44b
TLSH
T195C02BBFE304080DC75407900233510C831A2CCC4886908CF01339183472F736301FE9
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 f33868b426bbca74f7552d6522d90cbf3140aaa8f9cd2e254843faed8b64fc54
MD5 93c8675083bff27388a2543183e2c516
SHA1 952b58bf5ff1dde0872b6e2ed27ff9a04e923f49
SHA512 5b4c5ec92448c353948190dde4ea16daadd021cc95eda42138da87b666e14fd46435edcec45ac729583d87e99e2746e2214d43372ec253b5b7e53d5825b6ee3b
SSDEEP 384:9TqfDxl5UVY3bXp3ZUzD4BzSc7eCUG2XatW6AE3k18UFa20TWaseefCFeSo83Mt6:aR55IlHnOLRXxxin93s
TLSH
T12EB2905071BA2700387D29099379D42F5A4630E230DEA87B3B6835E66F67E005FFDAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 2dc0ca3fbbd6760f7d64b845cc10b3c932458fba2f54446f1e8e00070358acda
MD5 c4787a89e85bcf10b9931de2fa70f99c
SHA1 2ffcffeedf5c0790a320616ec8ec3a5aced2556b
SHA512 98937fcdf5426e00fee87b9d46a50f823a63ae39cb758dca74754917ff0abad51deacb7dc5129efc6bb12902adcf1c468e3c07e4458610330d5decf8175eec28
SSDEEP 384:ndiFstNn/s3n9SW8Ni8TUNTUlIRYzznN78mX+foDMCpF797vQ07E8L+1IzY:UFsj+9z3wgh0MC797vQ0i
TLSH
T1F8B23A71DCA5CE67ACE68BD4B70A7687DEF411A385885EC4EAD95D4C01C32EE130BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 afeda3f4a17621fd77895d3b561d1e3c31d372f2cda933151439992fabddfd65
MD5 b275fd27526390cc74dd5dae35ba3907
SHA1 f13e0186dda81def5b9bbba042773bc286afd4dd
SHA512 6e5f335ee11453cb57f23fd6a56ee12ea8dda82a337e490c918b6028bb09afb22516ca7d42a9c55f646aa6cfa584077095cc426f9aed9ef1fd327e68881f86e9
SSDEEP 384:nZiF1tNn/s3n9SsD8NJg8TUNTUlIRYkznNV29HX+foDMCpF797Pimmn15wbAjEJK:wF1j+9RLwgGLMC797Pimmn12bfJ7W
TLSH
T129C23936DCA4CA6BEDE38FC9B70A7646EEE4126381981AD4DAD85D4D01C32DD1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9cfd50c475412f38f1bd6a00508ad74aa59d32459fd1596051d951588deb02b4
MD5 2c5046d389c241c123f203b0eed0c98e
SHA1 f9dde80fe50c6d814129dc8d6009943482de491f
SHA512 8eb528f8d669078b66be9edc128cbd7a09b46bbb73f6b890773ff295d88c3afd8c1ea7be9b26d9039d4d902c841a96a3e8f3757c4af69f7faab4736f43ae90c6
TLSH
T10B216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3b7148698096910b4507444a98a28e62cad0a00b150c0f166d160ffd6ccc242d
MD5 9f7b9633f1847d09aa0bc44f66bed224
SHA1 ea5380134fff010ca4375cc07ad4b6f50f13b241
SHA512 e46d7d92b19437f98371775c6be235bd7ae7d0e28236740de870dc0985d737c7aacda0b6ce479b239d2a8b742e2c7fa5e237d5504bf2912a51d182d11d36e39f
TLSH
T13A317C33B3DC86E4D899413A00CAAD1037B697D790DECED77B84D249B53F298DE60690
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\Real\Update.exe
Size 6.8MB
SHA256 7b2b0fb50ab0cc5728cc2ad70c6d8aeafcb0d96a66e73768102343a363c015f5
MD5 1f6cfeba6c53087d4f4a5f5bb175c586
SHA1 31b74446ab6c50702834af3e7198ffe65ea79a5f
SHA512 47b4661a7bc44b613557fdc7e0dab69d501a18903d80922c8933780370533b055bca6fab21af073a3f1a5a86f254c3539f5440a7898c9712af7e3ead87b5b4a1
SSDEEP 98304:k5xI+ZC4W9IuG3v+CqITV7pUDG4++Js0:kz24VuG3v+CRTV7pUDTZ
TLSH
T18E669EA9B6BC00D9E467C2BCC2965213E772B45523B057CF5A649AF60F23AD02E7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 270441deadabf05627afc573234591aeb57d9a8b86abe4855eb534e0700ff548
MD5 d923010b4ec765d93e554c859120e699
SHA1 4826198680aa2f3fc3bbf84ede4de778f3c78adf
SHA512 b51571a797ecff45cd23f96590c06d31ed2f271bca347749f98478b5445e075754833f5e2f3e53efe0c9127086f290dbd3e6f43a0229f4a18d1deb7c5425881a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 009d2ecb5526a285768062d102785d0ba91ec232c4031a20f9ec9e16bd0912cc
MD5 34f0115c79e2c33eaa31061fa246ff1c
SHA1 7b546b6f6a15fe55b2cadf8438eb339ccfd2d8e6
SHA512 56040ecd802bb65c2cb9ffff0a2f872e943520492f9b64d3b82262dd532bf0eecc972d06eb79af8fc1ea4b7f1641142a6208abdcb72d27e6fa118f7f8a237a46
TLSH
T1B7D01123BA020238C020283300A2AB0E0BC0C20F820E8020A828EA3EAB088A00A02882
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\ExtensionActivityEdge
Size 32KB
SHA256 82a98efe1f51a8563b600bff853ca537c225247c494950c7048004a22394edce
MD5 a23e48300fa45773d9b8d84e831a2c70
SHA1 88e29c6f99a0812f58858e14ce9eade6326bc395
SHA512 e657006f0035df4ea5a022d2f111878fa87876d6d7269cf3d7c2acbdd531f61ffee27b865806024aef201a01484150e02e652afa35371db7963659f52aeecdfa
SSDEEP 24:TLTWK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tcm+/9ZW943WOT/
TLSH
T160E23A2A5E3C7121DD6671367C61A4275CB910EA977336F27EE000696F8268BC538CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 2KB
SHA256 404abba799f09ad43165dd959b54052ee59dec9bfb2269cc838bd1e008f20adf
MD5 7cefea3b59c0c7a86a403ecb90dc34dc
SHA1 04dc659ed578c19b97f9d8c87b485f3ea68d5232
SHA512 472e681bf84c91e29bcb94c7e36652974ba944cf1f9b2af7be053d01528dee901a6d160a99b366bef584b3065cf889ef25a5850e0427a047003289ebecf8c64b
TLSH
T16C51B53398946A368DA396047E097F53CE755096AB522FA0AADC0B0C02CB95C1317C73
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 3KB
SHA256 33e8e408f22bdbd45293f06929e2d4fb3aab72f7866711b617ddaef3d02dd75d
MD5 7a0dfba671f666f77a6141a24d4d331f
SHA1 e7eac7e374cf007c2cb91126a269ba078bd30584
SHA512 0227bf10ea8f1b724ee36fb10c03a0bcc961094c3e368aa9f4ba62c03738814764c5f48e282ea5f9c1c770699678b2a69a7d54bde7e5963451f76d073458838f
TLSH
T13971B67B99A4A9374DF39A057D852B07E7A55027E6913FA4DAEC0F0C02C768C1353C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 15KB
SHA256 ffccd87e32dfb8945932d7f052adff03a9726c90f4c8885b049a1a60e4a6ae44
MD5 1a7f77b96cb4d67d78ffe68ae4b547a6
SHA1 ef6985d243b70946baffd74a3475124883b15544
SHA512 a44762c7e636622795e77f3191f83297d759fe61f707e66491e537d06fee230417a938ccd809e1d30696d3f7d5df2a98bac4a652682a0ded48327935d3d4b9fe
SSDEEP 384:1srv+89zHqlDNP9oid0NBSjVfivgK3dYNr:Crv+4UNbdVagK3mNr
TLSH
T1F172AE33D57CAA379DB3D409B44A6E07BBB8649762C20BA0E9991B4C42CB4CD3307D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5aa6a1.TMP

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State~RFe5aa6a1.TMP
Size 1KB
SHA256 0fa8f46e4a3c683d810c035b93e02caf376d7db2b3ed86a38e4fcc7cd765b363
MD5 ec100433835d6c2c64e785c4192e6ef8
SHA1 abc966612ece52b9907e73d6263e8add145920dc
SHA512 cbe4e6078717dcca5e983a6c568cf34ad1247f35aaa7c26915eeee7aff112e2c16163ce9c0ada556baf1c5f5bd07edd5ff1358f19a0945a6f6c29f807672dcde
TLSH
T10E3182B6C9D02A31AC9662023605BF8B8EB0506B93014F80B6DD0B0C07DB40C963FC33
MD5 SHA1 SHA512 TLSH

Submit Download

current-version.txt

Path C:\Users\Admin\AppData\Local\Real\data\meta\current-version.txt
Size 6B
SHA256 2fc60396357c66c7cb3234b6f4d835567ffbb7124136f2ffc4fa659c8720c622
MD5 a0c545fbdbbb162c76225517559c9b14
SHA1 9b877e8a643c590dbe6096f645668b011f37c84d
SHA512 1cfed66911ceb4deb8257cec1d17b41409c8a6256fc7c8abd71c7e79f2df145b2d72e84ddb0b71d3670c18370e94e877384c6a4334d6d2dc372cbd6ad87fd200
MD5 SHA1 SHA512

Submit Download

luau-lsp-version.txt

Path C:\Users\Admin\AppData\Local\Real\data\meta\luau-lsp-version.txt
Size 6B
SHA256 a05b8f505a7ae3fa34e22d97ade349a7b3e7828a7d98d987e0a312eae5c59113
MD5 a22cce4bee21191d79a932d7df4a9b7f
SHA1 f91d4c1844ac055a09c2568a391e0bb490dcbad4
SHA512 3ef0596f273b290e1efeb4dba24745365c14c13f6c38b36bf238f9e65e38835b076e576dd5b34077ea06a1c505b1ecdb52e6e7b2873044bbd5a25bd21ce3f351
MD5 SHA1 SHA512

Submit Download

Real.exe

Path C:\Users\Admin\AppData\Local\Real\real-0.6.55\Real.exe
Size 10.1MB
SHA256 11ceebe9c8af83e2aea61c28da7d7e0902daa9eda124f7a946c85b958152bbab
MD5 13245a843284875ae6ca268c1ec796de
SHA1 437e725ca4befb25b133cf262244c04f92cbf36a
SHA512 199e33a952799db552ec67d1b14c3a761974bd3c2fc2a0907034b4687503f8777715a565e86e6abbf1fe2ab27572f5bc28f9aa3f02a0db245861dbe7586b72ea
SSDEEP 196608:V2ExZyTwBfkqMIjjwK36U3v4J+c6BcMwUU4JJyfFVXLoFo:pdlBrgJ29aCIFVXLoW
TLSH
T10AB6BE07E29081E9C0ADC5B9C35BA637EA32B8894731B1DF1BE44B112E16FD06B3D759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.dll

Path C:\Users\Admin\AppData\Local\Real\real-0.6.55\bin\Real.dll
Size 2.5MB
SHA256 b61c98b12ac8a7061da2106f2652cebea896f86ad1b2de57acf77a80de9b17c9
MD5 2bb0bc397c709115511bdba106cf69d3
SHA1 8332b7df9422464cff51e46d0be0daa1f0e83820
SHA512 dde1e3e1328bce390fb019d2808468c0d479fa3442f23a207ce5cad7c9dd49d04e7889d40d525fdd0c44dec54565b7aaa703305f04661f070d6fe84932982e95
SSDEEP 49152:s6SXWpxQ2YWzrf84nJU/KhwHXs7ZIZjnIX9Aoru039MV15zXdt4xK6fCL:LSXIxVYUf84S/OwHXs7ZIZjnIX9Aorub
TLSH
T153C5CF719E14ED305F9E93A9C489391BA0E223F77EF22165BED35B712230A15201B9DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.exe

Path C:\Users\Admin\AppData\Local\Real\real-0.6.55\bin\Real.exe
Size 4.1MB
SHA256 c7ebe67be606840224001920b62da597af42a0df3d5ce54929b41064ee1312d6
MD5 e6aa1fcf0889172a37b61c03633c888b
SHA1 405e0637dcb667f4057c496d82b49828d2977b84
SHA512 5b7ea593926da2a33e9d4cecd96d6b3ed3f0dea6e0b8ae53214d7219c46cd4837fab19437b32feeaa78d9dedb8381d92064fcaed0bc858a15277c23cb6bf85f2
SSDEEP 49152:mLnbnSiKPJoyJndw9Dy7pfV03I3Cnm0BdlVynCzpvD2JQrXF0jEJmlh4eQsfXe6M:mHSiKPJosqUz3c0ClqP4JiZfXJcv1pG
TLSH
T144162321DBA389BED84792B4CB49C563985B7C4F0F7372DF479A82102D23AD86F34256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 1KB
SHA256 031de5c0aee3f7a498f5c1fedbd7dcc0c5a749f32c23bd337065a90165d98f2f
MD5 676924371f41df62efa0f2355abff038
SHA1 e174932514ad79c7fbaac0a54c95601684812166
SHA512 ba0bd12cede7c3adcd4d18991537e496d497991781f1929fccee3c5c2a91ce4efdf3408bfe5cecd0b83d04346c3de96f73dc1e541556e58de33dee05157b25f7
TLSH
T15211E73F827AA4B605004253921BDD43D78EB2A74C057A1437F243136BD5A2FEB0BE9E
MD5 SHA1 SHA512 TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 1KB
SHA256 8949692ce2bac296568e05bb3dc1cdef38b4460e38c2e465274b048535a714ef
MD5 52ba9e9f49f3858ba0bcac74cd357719
SHA1 ffca57d426203cc77236eebd6a92c36872b95334
SHA512 453e94ff834ae4bda616b336b240b2179e7acf68a8cb4e9ebc9240f8ca3c39698584ea986a035e25de04ca8f5bc89aee58dbb5e2863ecad0081564d4f909dc92
TLSH
T1ED31157FC16D68B605404253811ADD52EB8DB2A749017A2463E2431627D5A2BFB0BEDE
MD5 SHA1 SHA512 TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 2KB
SHA256 0e7ca9d6654baa2cc7be4c5cc7d52707f201f25318a3a03339696f107c11de92
MD5 9ab7cb54ab3377c4f16c82f85377b8b8
SHA1 5146505e9b40ee523707e33a6a515346d3d56b66
SHA512 5483e80e10d327a99f5ca1aee0581ff9def54850e8974523ae077188475f0d7ed0bc5d9ab5110f3153e71b5651dcf856b28e7e20392f68e21a5fc07f9f058981
TLSH
T1FD41537FC26D68B605504243C11ADD82EB8DB2A749057A2873F2430637D492BFB0BEDE
MD5 SHA1 SHA512 TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 2KB
SHA256 45d5bf46219435a75468e051f4f724bebfafcee2304b25b44e84b7a79389415d
MD5 25454e511afc173870ce55058de3dab5
SHA1 a9e5fac78d5cb431f624872fdf3e292520f93957
SHA512 c779cf5bfb8a4419b4b5544f6ee2ad16ca22b7bbac2a4a6a4052dbd28ab04449960744386fc1b08e9580f216610ca1a70ed377250a92ff69821bd7ac7c5f3336
TLSH
T18151567FC26D68B216504243C11ADE83EB89B29709057A2473A143063BD492BFF0FEDE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{59B8DB45-35A1-46E4-A7DD-50E6AC6A9DBC}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f29d582ea56a04a9194f54d732e59c668e6250be8429a01a422549ce4c70678f
MD5 4eed5ea18c49074c6a5d67b8280343d5
SHA1 a0d8a08eaeb2ad1a02ddf3cc5e7ac035ca818e8e
SHA512 5c30c10fd5c7720d1ab00ee735d3d8bb1fa4aeb81d3080e351f1df77208f66c608d6fdab6cb97bd3458eb944d4526e8200f7138c64c1f79c7e55a62f3e7002cd
TLSH
T11FD02B13F210023FC43030720241E93C3B11B30F2046821B942EC61D5D884F78BC18E2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{59B8DB45-35A1-46E4-A7DD-50E6AC6A9DBC}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c789bea1c935f1fd88eb355c282231f9ce6de182108e05ecdc4ddb61bfb4abbd
MD5 32012e57e5557a77cb02564dcd93a355
SHA1 cfe5e939f38167385156a87f1c41d49178432a97
SHA512 6fbc7a7ed986e9195ce6c127cbedc91cb4323ee02ee891bd3ab723176393db407c3ef8039a6ef67c0d805e4216bd52a8701cacd50f9d4f38940ba0b5aa345e53
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{59B8DB45-35A1-46E4-A7DD-50E6AC6A9DBC}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 21e8e912df1789bdb7cc765955d569e2f4ca5c9b20195696af054e65db281f89
MD5 6703fa2ba8e511e5c61fbc32e91acb0d
SHA1 757dde308dacf41b731477255ccf7ca5bcccbb12
SHA512 3ea191c0627871cac5577dc6e70b37dd30a9aa21e6fc5d8ef32d1430111b70a3d02cba51c4d6a1a2102f1dbf22848dc44112296d7f365a80813075ac7edb0913
TLSH
T11DD0121376010135C43020330502690C3560D21B40498346542AC51E1E844B05942482
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{59B8DB45-35A1-46E4-A7DD-50E6AC6A9DBC}\wv2\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

ExtensionActivityComp

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{59B8DB45-35A1-46E4-A7DD-50E6AC6A9DBC}\wv2\EBWebView\Default\ExtensionActivityComp
Size 4KB
SHA256 9827429749037198cb3d19a851ccff2adafad344fbade7220aa022d3c9e2fa85
MD5 9088df5de5b8306c52e744141a100532
SHA1 0aea85a36ef3ddc53df198227fcaf212139ae1db
SHA512 96c0c8ee90bd8aec34ea905f48e76ed7dc370d24f64efaeadf36e9b59b9ff01856ed837b5169241ef2bd4a6b8fe2ee77de443b09b9ee604e39f9ba57929859e8
TLSH
T15C819285F7C02420DA346EF3A4824BBD5E72CA82A5124B93097002D0FCA74ECCC796AA
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{59B8DB45-35A1-46E4-A7DD-50E6AC6A9DBC}\wv2\EBWebView\Local State
Size 15KB
SHA256 d975287d715e126156ffc2428417084184302bfd75e65bb9154a4450205265ed
MD5 6d71c48d099eeaf0f1dada1633024f55
SHA1 2f83843c3c991206cc7b3dcde865c66c844837d5
SHA512 a1c95de97d1af2521b725b1b6d8ea215e024d354adb70be66543f6ef95f00114f0f5283ca016c9d5fc93be257ad9f9e93eae365d98779856e934b9bd14ea00e6
SSDEEP 384:Psrv+89zHqlDNP9oid93NBShJSd+Wu3P6Ne:Urv+4UNbd9GSTu3P6Ne
TLSH
T1FD72AE33D57CA637ADB3C909B48A6E177B7860A761C20BA0E9A95B4D428F0D93307D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{59B8DB45-35A1-46E4-A7DD-50E6AC6A9DBC}\wv2\EBWebView\Local State
Size 2KB
SHA256 ab2a6cc5445a8b1b6fa1244165fe833b2bbba1e12f25b54725cb8d515d055ab2
MD5 ebe55f01c3110928e9eecb80fd64dd66
SHA1 515b6cf3e95a5b79ad8e4a578bc615e7c7e744ce
SHA512 0789bd5acef67f7e6cf66849e910df4d6574e81c9a9f69a2b004753ac7aa271b138461f80920597323925fb3c49a89e2b8da8367632cd791240f3ab2c210cf17
TLSH
T1425176336854573BA9F687097E463E63DF355065AF521F10A5EC0B0802DB61C2316C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{59B8DB45-35A1-46E4-A7DD-50E6AC6A9DBC}\wv2\EBWebView\Local State
Size 3KB
SHA256 a46ba29a1c98704e6a4a528db56ebd417b97b2e67d330c41e2b8c34e480f8e8c
MD5 e5873efdc5bdc23f6534d3d23cc0b8be
SHA1 b376121f3a1c45e98907d687715f3674083a94e6
SHA512 7fe9b06af64743fb13d9ba7d5bbd92acb2150c0b6af4c2ab9d992357d92e3e0a33f7ec3b2d075ada1eebd6687293671e915b6d8574689f735eb133339baf5071
TLSH
T1D1718637A9A4AA3B5DF79A057D852F16A7A15027E9917F54E5FC0F0C02CB35C2352C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5a8cc0.TMP

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{59B8DB45-35A1-46E4-A7DD-50E6AC6A9DBC}\wv2\EBWebView\Local State~RFe5a8cc0.TMP
Size 1KB
SHA256 eb8ab025979b56ea242bfcc425bc5e74340bdcd5d6e0f43efb570d53a14bce06
MD5 5c24cef003ea7249426f272fc370c5e6
SHA1 6593ec296678f5bd377559658fa84acf9e34df37
SHA512 2f4d94367d2deb4f667c529f4ca5a2277671f0f10e91ce2cbe802ad5a98f1b7a7d8db59188935262eb41194e75bf64dcb5f70c6b0890c7a6802c84a713855db4
TLSH
T1C73176B7A4A41B36BDAA930B3A557E879F3160379B514F04B1ED4B0803DB50C653BC32
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{8D9E1683-0181-4987-A546-8521B2F99245}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2846542465ca47dc69ed951591af2cdcc2a8aa16a900846cdf73fff53cd2da61
MD5 0f774194d08f6072947d43887ec8d05a
SHA1 a253c311a3dc54752c59c37cca5afc3323a1fc0a
SHA512 a4f417c90999306f4de6e5290200d25b6a5f8e1bfc54c218edebf20d9f5800e6815333a380f9f26d12468aeba7d134cbc2030be8e4a5473db34cceddeec7c2f3
TLSH
T1C9D01227331111B4C01030330103750C0400C61BC0458082553A851F5E040945973842
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{8D9E1683-0181-4987-A546-8521B2F99245}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 af578998960bfda0c5936b179d3e0c7a30e019d46ee2ca2b5f6bf0b7bb42faf3
MD5 e3ebe9c228db21423aced75a03f59e9d
SHA1 4610a0fe159936869ed366b561f9c486f51ef88b
SHA512 cf6be4093c9066197bfa784065a70a821f727991336522f7ad95f6779c20d345b9978520fcc29cf402155faacb64a3bcfeb33c4cd277e79ab1f2cbe7f8376b7a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{8D9E1683-0181-4987-A546-8521B2F99245}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2aeeca5270bd9d8f8429cc52f3c3fc3fa1f7159985078807e70493b000bb8ce2
MD5 7c9e0153ae2942d460b8cfdc38f91f92
SHA1 d7bda28bb3009dfc4d89484eeaaa9ae7beb09ab3
SHA512 3dc12564ebe5572de2f380acd221e0ef63ac68dd647b74e42479bd80e57983a3bd2953f98a65c29947c3cf9b58ad91c6736c7c4d4fcdbc03f66659bb7559ed87
TLSH
T1A1D02B27F32012BDC01030720242F52C1A01F30F90428067943E861E9D080DB8BE2CA2
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{8D9E1683-0181-4987-A546-8521B2F99245}\wv2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{8D9E1683-0181-4987-A546-8521B2F99245}\wv2\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{8D9E1683-0181-4987-A546-8521B2F99245}\wv2\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59b089.TMP

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{8D9E1683-0181-4987-A546-8521B2F99245}\wv2\EBWebView\Default\Network\Network Persistent State~RFe59b089.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{8D9E1683-0181-4987-A546-8521B2F99245}\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{8D9E1683-0181-4987-A546-8521B2F99245}\wv2\EBWebView\Default\Preferences
Size 5KB
SHA256 dd316474d4b6eaf15b8244922c1aba87a57519696c644984699e220c35570c57
MD5 a30fb53f1f2ea3a6e7b1a7beba158823
SHA1 20e4da61b409687e09e16cf320bae93b7d647300
SHA512 c4489aeffa511a82a93643cb9407d516e88e23362550aa3058b84fce3a801834378354d9ade1677cdc2bc85f73be88b5566ed1ff9cbbdc8cb0252ac665f6457a
SSDEEP 96:stP/dKi1y4b9Gk1o5h16ZZs7/x+6MhmuecmjedK+gE0J8+28XM1C7K:stXwZoo+sV+Fijv3y+G6K
TLSH
T128C195025E28A87B4CC6E519BF35BB03D2F9643275E11E58EBF8461C09DB6DD630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{8D9E1683-0181-4987-A546-8521B2F99245}\wv2\EBWebView\Default\Preferences
Size 5KB
SHA256 43ee51a50be356111b31df6e31f6cb2c371a332123885f8e4c073994d4a8133a
MD5 5d64602f1f796cc24a27c5c7c11b10bf
SHA1 f3d6cfc944646f99e7ce6261497afec1910ab8e1
SHA512 51e209b5d3363e5f8b0e8c93b9a34916d86d084654abb65fea8515654e66d0486469ee1fd571a1c0b19997baaa8d2c7cf1f4910fbb1c2c3fba2e72737a780465
SSDEEP 96:stP/dKicGy4b9Gk1o5h16ZZs7/x+6MhmuecmjedK+gE0J8+28XM1C7K:stXwnoo+sV+Fijv3y+G6K
TLSH
T14BC195025E28A87B8CC6E519BF35BB03D2F9643275A11E58E7F8461C09EB6DD630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{8D9E1683-0181-4987-A546-8521B2F99245}\wv2\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a89c4360-0ed8-4809-9e3c-62b8395bcd84.tmp

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{8D9E1683-0181-4987-A546-8521B2F99245}\wv2\EBWebView\Default\a89c4360-0ed8-4809-9e3c-62b8395bcd84.tmp
Size 5KB
SHA256 5ccd81d46c005b2153c896e9ec2d60870a65ce7304e22481d89017b8f3c4827c
MD5 24fbce00e9e936d82e356245b195b554
SHA1 28d3e4e7477e8e76f22234d542b91e529d4ef74e
SHA512 591391c6e8cbff9283033372e4547bfb322378649767bb308d47d0ff7650df030111f2a57d61db893d26cb2cfa0ed393da0eccf95d38899dab7d908d8bc02108
SSDEEP 96:rP/dKi1y4b9Gkpdo616ZZs7/x+6MhmuecmjedK+gpZ+28XM1C7K:rXwZkojsV+FijvJ+G6K
TLSH
T194C195025E28A87B4CC6E508BB397B03D2F9643275E61E58E7F9861C09DB6DD631780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{8D9E1683-0181-4987-A546-8521B2F99245}\wv2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{8D9E1683-0181-4987-A546-8521B2F99245}\wv2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{8D9E1683-0181-4987-A546-8521B2F99245}\wv2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{8D9E1683-0181-4987-A546-8521B2F99245}\wv2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{8D9E1683-0181-4987-A546-8521B2F99245}\wv2\EBWebView\Local State
Size 2KB
SHA256 c6b7e557515cfbab056223212b4cc5392d93f0d07d2647648448dc251c1a0430
MD5 c1cd2bf7d18e064de6666b4516ef694b
SHA1 c5461abfdcf9c52496a0341eb98ba19760acfe34
SHA512 91bece07b7c7f7f71309743e818a96580419b4cd2bef24c54df35de5454f40a1209241e587075074f87352794af8f2b12cd08f690e318ccc41098d3d261d6738
TLSH
T1DA51957368646A7799E2C6087E4A2F13CF7590669A632F50A9ED0B0C02DB55E1317C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{8D9E1683-0181-4987-A546-8521B2F99245}\wv2\EBWebView\Local State
Size 3KB
SHA256 63e22693462c22481a16b36cf21f67a6a35e3a8a3dd73b4db43703ff164f0682
MD5 370747413c80c6f5464ee524cbe2eec0
SHA1 87f3115ba5b93068b8a4694e94721d5098474044
SHA512 20d49d091de48668befa3dfca06f5beec29aa47efa3f73594202b3a99b76c76091d8d3a9fac2d9d140bd901093b3dfca24cf7630835dea81c97f00b88fb5fca8
TLSH
T12971947B69A4A93B4DE2DA087D862B07EBA55027E9923F94D5FC0F0C02DB29D1353C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{8D9E1683-0181-4987-A546-8521B2F99245}\wv2\EBWebView\Local State
Size 3KB
SHA256 d8eeb873cdf2209c569d764e70e8a3a121c67c29ed4588a01be9b62d4f799d5b
MD5 5f119754ebba3f453cdb83fc383e2f42
SHA1 486b68a00b1314fbc50127b5af7aa10e5ae6d801
SHA512 b3df64b69ff1cc6a9b5a09157c313a020b7448eadc744688b9fe0545416872128e981877880243112189d7471e67be65a211174378ac3292848fc6bb990ae52f
TLSH
T14F81736799B4A9275DF2D9087E862B07ABA5502799927F98D9EC0F0C02DB28D1353C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{8D9E1683-0181-4987-A546-8521B2F99245}\wv2\EBWebView\Local State
Size 16KB
SHA256 5d0d5727d166d473f0ef71c28e9ce8af0c8d32c632ce06407825ac02602c888d
MD5 ec71f5297e9b3e6cabd3635eb0ff6f8d
SHA1 e10ab6b6f06d545f881227c4afa7907c415b6654
SHA512 5014b03df5442acdeb2db036188290691794e65220aacfe388734f6efaab1dbb14302f2a4d7e1de8cae13172612968fcd69c0baa0742cd3a8f763dfbcd9150a8
SSDEEP 384:3srv+89zHqlDNP9oid6NBSkRowoz8yfL3DxNq:8rv+4UNbdzvL3FNq
TLSH
T1A1727C32D568DB379DB3C589B54BBA4BABB4119356C20AD4D8D91F8C82CB4DE2307D03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe588a0b.TMP

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{8D9E1683-0181-4987-A546-8521B2F99245}\wv2\EBWebView\Local State~RFe588a0b.TMP
Size 1KB
SHA256 dbcf0ee7a6a605d74d841a5c0d651cd3043fc4f6fe9f4b78e7ced5dee028697d
MD5 8a9a895dac335a48da0810b598aa2540
SHA1 a31a865669ef9c9ba3820bf43c013c3043c159d2
SHA512 c5fde2bd05c4c1c68f4f8af46088e8f0ea2ee1e6eed0e9fb34c062d1d6d7484bd91a54f8110fbc291b51242ca72f97726c2805755c9b45dc94cff96893bce048
TLSH
T1BB3196B399A41A76AC92E10A3B027F87DF71106B82525F44B5DD4B0C03EB44E923BC33
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_15azgpot.mjq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_15azgpot.mjq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

luau-lsp.exe

Path C:\Users\Admin\AppData\Local\Temp\real-luau-lsp-extract\luau-lsp.exe
Size 16.1MB
SHA256 9e85ce9370f208c97f1dfc1b8fcf7185fe64386f23130a65fc834f5323a0d653
MD5 0e14d186ed05911115868aec341ca13c
SHA1 525708cd63fbcaa2bd68225aa2411b0f46c3e9fb
SHA512 e3acd3aad750e35cf9993384fc274db9ffdfd18099d4fd90a39ad0c039410d4e451baa6a2e1a5b1fd2658281bed8d33a2a3d2403675ef3976f10322ec5d5d029
SSDEEP 393216:E4BgLVggOglggqgTgXi17gCFggqgggocgQgejM9gggggdvFBggggjCggggoggggg:KBggOglggqgTgXi17gCFggqgggocgQgP
TLSH
T188077B3A21AC10DCF1BBD0BD8BCB9E47D6B2340903319ADF0591569A1E1BDED4A7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

real-luau-lsp.zip

Path C:\Users\Admin\AppData\Local\Temp\real-luau-lsp.zip
Size 4.9MB
SHA256 15f2add7c70191c5cd636b047968760f0056893b63be10294453c75430bcb339
MD5 a381249f48d581c99737933b8995a0aa
SHA1 70534fbce598370edb1aea4f17334d91a9ad3b26
SHA512 f64cae2bf145b64b06b10f6978eea9d8dbcc8bc87c9d6a952d8142aec8aef86e34f8f828f7d80ba0b6f14bab32e9ee637251dd962cd29026627705aa2848cb7f
SSDEEP 98304:Z7GKCIDz2TUFQoFpWW5WU7+zN15Su1RSEN9qp3UngUerKUQeAp0bwPTUPhQhbs1t:AakUmoPWW5WUazNf/RvvyFKUQeAa0PTC
TLSH
T18F363353EFE87A26D7CC5677AC763C5C84A628E3405990882EAB5CF012D73640EB1DED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Real\Real.lnk
Size 2KB
SHA256 20880c33d5b5df1ae0cbdddd45c84912a116c57bcaf92c3b98419c41d3de3680
MD5 c02004ad20166df459c5ae2b756707d9
SHA1 e880e74c5c9161a19212bc1345ce8f883a0564cb
SHA512 1cf902edda9827943241f46e53054e9920aef6fb99be45fb3fd336862008769532505699299b5847b81a9aecad31b26a6ff97704b1d7814a459c057a39b02db9
TLSH
T13B419E15EEC32B20C377E878ADFB5665C5B87422EB568B4D0080D28A1D25702BB94F4F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/788-363-0x000001F3F55E0000-0x000001F3F5602000-memory.dmp

Download

memory/788-371-0x000001F3F5850000-0x000001F3F586E000-memory.dmp

Download

memory/788-372-0x000001F3F58F0000-0x000001F3F59A2000-memory.dmp

Download

memory/788-373-0x000001F3F5870000-0x000001F3F587A000-memory.dmp

Download

memory/2428-326-0x000002E3B23B0000-0x000002E3B23B1000-memory.dmp

Download

memory/2428-320-0x000002E3B23B0000-0x000002E3B23B1000-memory.dmp

Download

memory/2428-327-0x000002E3B23B0000-0x000002E3B23B1000-memory.dmp

Download

memory/2428-330-0x000002E3B23B0000-0x000002E3B23B1000-memory.dmp

Download

memory/2428-331-0x000002E3B23B0000-0x000002E3B23B1000-memory.dmp

Download

memory/2428-328-0x000002E3B23B0000-0x000002E3B23B1000-memory.dmp

Download

memory/2428-329-0x000002E3B23B0000-0x000002E3B23B1000-memory.dmp

Download

memory/2428-322-0x000002E3B23B0000-0x000002E3B23B1000-memory.dmp

Download

memory/2688-112-0x00007FF9456D0000-0x00007FF9456D1000-memory.dmp

Download

memory/2688-186-0x0000025B48420000-0x0000025B484D2000-memory.dmp

Download

memory/2892-1246-0x0000024336450000-0x0000024336502000-memory.dmp

Download

memory/2920-1385-0x0000017109680000-0x0000017109732000-memory.dmp

Download

memory/4276-419-0x000001F4A1DA0000-0x000001F4A1DB2000-memory.dmp

Download

memory/4276-420-0x000001F4A1D90000-0x000001F4A1D9A000-memory.dmp

Download

memory/4456-244-0x00007FF945C60000-0x00007FF945C61000-memory.dmp

Download

memory/4456-243-0x00007FF945960000-0x00007FF945961000-memory.dmp

Download

memory/4576-856-0x000001F951DF0000-0x000001F951EA2000-memory.dmp

Download

memory/7152-185-0x000001DC984E0000-0x000001DC98592000-memory.dmp

Download

memory/7152-230-0x000001DC984E0000-0x000001DC98592000-memory.dmp

Download

memory/7152-26-0x00007FF9456D0000-0x00007FF9456D1000-memory.dmp

Download