Overview

overview

8

Static

static

3

RealSetup_...0f.exe

windows10-2004-x64

8

RealSetup_...0f.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    600s
  • max time network
    599s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    12/07/2026, 09:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RealSetup_88ffa30b931c14dae117ff69705dedcb932076f0a89b7cda60f4602b6c56880f.exe
  • Size 15.0MB
  • Sample260712-k6evraht4x
  • SHA256 3d1cd966fccd3416748bb0d259b25753455e995a8f1640d35258e031b4ae06a9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistencetrojan

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    defense_evasiontrojan
  • Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 8 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 15 IoCs
  • Modifies data under HKEY_USERS 6 IoCs
  • Modifies registry class 22 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 5 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 56 IoCs
  • Suspicious use of SendNotifyMessage 41 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RealSetup_88ffa30b931c14dae117ff69705dedcb932076f0a89b7cda60f4602b6c56880f.exe
    "C:\Users\Admin\AppData\Local\Temp\RealSetup_88ffa30b931c14dae117ff69705dedcb932076f0a89b7cda60f4602b6c56880f.exe"
    1⤵
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2888
    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RealSetup_88ffa30b931c14dae117ff69705dedcb932076f0a89b7cda60f4602b6c56880f.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=2888.2004.16373114354978921505
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of WriteProcessMemory
      PID:4704
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ff9c41db078,0x7ff9c41db084,0x7ff9c41db090
        3⤵
          PID:2924
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView" --webview-exe-name=RealSetup_88ffa30b931c14dae117ff69705dedcb932076f0a89b7cda60f4602b6c56880f.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1708,i,5007906126081445682,671166971538098720,262144 --variations-seed-version --mojo-platform-channel-handle=1720 /prefetch:2
          3⤵
            PID:2992
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView" --webview-exe-name=RealSetup_88ffa30b931c14dae117ff69705dedcb932076f0a89b7cda60f4602b6c56880f.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2036,i,5007906126081445682,671166971538098720,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:3
            3⤵
              PID:4600
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView" --webview-exe-name=RealSetup_88ffa30b931c14dae117ff69705dedcb932076f0a89b7cda60f4602b6c56880f.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2380,i,5007906126081445682,671166971538098720,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:8
              3⤵
                PID:1916
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView" --webview-exe-name=RealSetup_88ffa30b931c14dae117ff69705dedcb932076f0a89b7cda60f4602b6c56880f.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3656,i,5007906126081445682,671166971538098720,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
                3⤵
                  PID:4688
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "try{ if((Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Real'){exit 0}else{exit 1} }catch{exit 1}"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3936
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$p='C:\Users\Admin\AppData\Local\Real';$ex=@((Get-MpPreference).ExclusionPath);if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p };$ex=@((Get-MpPreference).ExclusionPath);if($ex -contains $p){exit 0}else{exit 1}"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4392
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAIABFAHgAcABhAG4AZAAtAEEAcgBjAGgAaQB2AGUAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAByAGUAYQBsAC0AbAB1AGEAdQAtAGwAcwBwAC4AegBpAHAAJwAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcgBlAGEAbAAtAGwAdQBhAHUALQBsAHMAcAAtAGUAeAB0AHIAYQBjAHQAJwAgAC0ARgBvAHIAYwBlAA==
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1636
              • C:\Windows\System32\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /create /tn "Real\Launch" /tr "\"C:\Users\Admin\AppData\Local\Real\Update.exe\" --via-task" /sc ONDEMAND /rl HIGHEST /ru "" /it /f
                2⤵
                • Scheduled Task/Job: Scheduled Task
                PID:2136
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/projectreal
                2⤵
                • Drops file in Program Files directory
                • Checks SCSI registry key(s)
                • Checks processor information in registry
                • Enumerates system info in registry
                • Modifies data under HKEY_USERS
                • Modifies registry class
                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:4244
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ff9c008c188,0x7ff9c008c194,0x7ff9c008c1a0
                  3⤵
                    PID:1732
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,16837223933944311294,10885211768308343242,524288 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:3
                    3⤵
                    • System Time Discovery
                    PID:4060
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,295236940004788226,15933623849100753979,262144 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
                    3⤵
                      PID:3896
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,10298777863902831962,14687873839191970821,524288 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:8
                      3⤵
                        PID:5180
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,7583773034401677569,5848986737503389828,2097152 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
                        3⤵
                          PID:5488
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,7954962410466861580,7214502060847683855,2097152 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
                          3⤵
                            PID:5504
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,4279779244256863994,608774937231416346,2097152 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
                            3⤵
                              PID:6096
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,12194737709124835576,14082348570815817052,2097152 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
                              3⤵
                                PID:6104
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,11383543979992483677,14810427640497409295,524288 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
                                3⤵
                                  PID:5912
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5284,i,6727118970057343806,1099333498054070393,2097152 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
                                  3⤵
                                    PID:6296
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,17879860351067320952,10598236655688249535,524288 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
                                    3⤵
                                      PID:6640
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,5310409860048891872,2800947763202137676,524288 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
                                      3⤵
                                        PID:6648
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,10271175738690921657,12559780265933681289,524288 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
                                        3⤵
                                        • Modifies registry class
                                        PID:6956
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2728,i,5266234585819508142,18004761463823016003,524288 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
                                        3⤵
                                          PID:6964
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,8484562849682103045,9694675305373330216,524288 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
                                          3⤵
                                            PID:7016
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,8484562849682103045,9694675305373330216,524288 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
                                            3⤵
                                              PID:7116
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,9324078011699134742,3114233142727553395,524288 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8
                                              3⤵
                                                PID:6292
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7108,i,17207704551498680224,6435713539113819592,524288 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:8
                                                3⤵
                                                  PID:5132
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,2247678018410279636,14001323589180027974,524288 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
                                                  3⤵
                                                    PID:6700
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,10485027604522731644,5864814898177877255,524288 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:8
                                                    3⤵
                                                      PID:5476
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7052,i,5137962839390296763,784181195286644585,524288 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:8
                                                      3⤵
                                                        PID:5104
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4368,i,5749099238177296949,16412317841158192054,2097152 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
                                                        3⤵
                                                          PID:5372
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4412,i,4379080332008099526,7071588363152672204,2097152 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:1
                                                          3⤵
                                                            PID:5720
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6632,i,409974655481477949,13014520331660029813,2097152 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:1
                                                            3⤵
                                                              PID:5400
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=3640,i,4669217113957792946,1253410126115852306,2097152 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:1
                                                              3⤵
                                                                PID:5688
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7292,i,16117195749572702224,10911863286053591673,2097152 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:1
                                                                3⤵
                                                                  PID:3800
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7196,i,8481685108119453571,2021338048777571347,2097152 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:1
                                                                  3⤵
                                                                    PID:6376
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7204,i,7725083810132003660,10542547132732267656,2097152 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=7428 /prefetch:1
                                                                    3⤵
                                                                      PID:4752
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7520,i,7694596324958398381,5581455876738056663,524288 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=7528 /prefetch:8
                                                                      3⤵
                                                                        PID:6880
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,9697671883547691509,721912308050656800,524288 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=7596 /prefetch:8
                                                                        3⤵
                                                                          PID:6868
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7516,i,10044067257502285832,9804761840598700268,524288 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=7640 /prefetch:8
                                                                          3⤵
                                                                            PID:7036
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7632,i,12117954159438363122,11435387911895909316,2097152 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=7620 /prefetch:1
                                                                            3⤵
                                                                              PID:5516
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7432,i,12247381496358209621,3335594045695487014,2097152 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=7660 /prefetch:1
                                                                              3⤵
                                                                                PID:6444
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7516,i,13654700225815616470,16577528413013524997,2097152 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=8132 /prefetch:1
                                                                                3⤵
                                                                                  PID:5040
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=5284,i,11311219593521387288,10738932807491441693,2097152 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=7608 /prefetch:1
                                                                                  3⤵
                                                                                    PID:5436
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,6764735405974320841,14289069271060443728,524288 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
                                                                                    3⤵
                                                                                      PID:2748
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,4341806714472972952,10472151608938997489,524288 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:8
                                                                                      3⤵
                                                                                        PID:760
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7280,i,11582139794894805789,10321829567197501647,2097152 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=7728 /prefetch:1
                                                                                        3⤵
                                                                                          PID:4356
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8220,i,2938689220901707048,6482950312922636757,524288 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=8204 /prefetch:8
                                                                                          3⤵
                                                                                            PID:5848
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7092,i,7867344327865417077,12570691132370913362,524288 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:8
                                                                                            3⤵
                                                                                              PID:6356
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8344,i,14139975854135033752,4400121748772598900,524288 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
                                                                                              3⤵
                                                                                                PID:7040
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,5367093416440419259,6996358682994153146,524288 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
                                                                                                3⤵
                                                                                                  PID:3392
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,2143319093444492189,10027706506640239342,524288 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
                                                                                                  3⤵
                                                                                                    PID:2504
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5432,i,7045997826653060985,9322718775879786138,262144 --field-trial-handle=2244,i,3505193696994384976,14316090252701108024,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
                                                                                                    3⤵
                                                                                                      PID:6068
                                                                                                  • C:\Users\Admin\AppData\Local\Real\Update.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Real\Update.exe" --processStart Real.exe
                                                                                                    2⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Checks whether UAC is enabled
                                                                                                    • Modifies data under HKEY_USERS
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1100
                                                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Update.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{BF0ADF3B-5AFD-427A-948D-0782484B8F11}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=1100.2624.10739321484096088606
                                                                                                      3⤵
                                                                                                      • Enumerates system info in registry
                                                                                                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:3140
                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\RealLottie-{BF0ADF3B-5AFD-427A-948D-0782484B8F11}\wv2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\RealLottie-{BF0ADF3B-5AFD-427A-948D-0782484B8F11}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x23c,0x7ff9c41db078,0x7ff9c41db084,0x7ff9c41db090
                                                                                                        4⤵
                                                                                                          PID:4744
                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{BF0ADF3B-5AFD-427A-948D-0782484B8F11}\wv2\EBWebView" --webview-exe-name=Update.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1800,i,10178551313084409063,4601884948234819131,262144 --variations-seed-version --mojo-platform-channel-handle=1796 /prefetch:2
                                                                                                          4⤵
                                                                                                            PID:5368
                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{BF0ADF3B-5AFD-427A-948D-0782484B8F11}\wv2\EBWebView" --webview-exe-name=Update.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1672,i,10178551313084409063,4601884948234819131,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:3
                                                                                                            4⤵
                                                                                                              PID:5476
                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{BF0ADF3B-5AFD-427A-948D-0782484B8F11}\wv2\EBWebView" --webview-exe-name=Update.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2268,i,10178551313084409063,4601884948234819131,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:8
                                                                                                              4⤵
                                                                                                                PID:5528
                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{BF0ADF3B-5AFD-427A-948D-0782484B8F11}\wv2\EBWebView" --webview-exe-name=Update.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3532,i,10178551313084409063,4601884948234819131,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
                                                                                                                4⤵
                                                                                                                  PID:5984
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$p='C:\Users\Admin\AppData\Local\Real';$ex=@((Get-MpPreference).ExclusionPath);if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p };$ex=@((Get-MpPreference).ExclusionPath);if($ex -contains $p){exit 0}else{exit 1}"
                                                                                                                3⤵
                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:6416
                                                                                                              • C:\Users\Admin\AppData\Local\Real\real-1.1.0\Real.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Real\real-1.1.0\Real.exe" --real-launched-by-updater
                                                                                                                3⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Checks whether UAC is enabled
                                                                                                                • Checks processor information in registry
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:6916
                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Real.exe --webview-exe-version=0.6.4 --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=6916.6408.1921674202074046328
                                                                                                                  4⤵
                                                                                                                  • Drops file in Program Files directory
                                                                                                                  • Enumerates system info in registry
                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:6428
                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x198,0x7ff9c41db078,0x7ff9c41db084,0x7ff9c41db090
                                                                                                                    5⤵
                                                                                                                      PID:6628
                                                                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=0.6.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2092,i,4912851795888370504,4103514867237158534,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:2
                                                                                                                      5⤵
                                                                                                                        PID:5292
                                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=0.6.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1732,i,4912851795888370504,4103514867237158534,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
                                                                                                                        5⤵
                                                                                                                          PID:312
                                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=0.6.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2292,i,4912851795888370504,4103514867237158534,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:8
                                                                                                                          5⤵
                                                                                                                            PID:4440
                                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=0.6.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3564,i,4912851795888370504,4103514867237158534,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
                                                                                                                            5⤵
                                                                                                                              PID:1060
                                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=0.6.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4752,i,4912851795888370504,4103514867237158534,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:8
                                                                                                                              5⤵
                                                                                                                                PID:5324
                                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=0.6.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4608,i,4912851795888370504,4103514867237158534,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:8
                                                                                                                                5⤵
                                                                                                                                  PID:64
                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=0.6.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4888,i,4912851795888370504,4103514867237158534,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:8
                                                                                                                                  5⤵
                                                                                                                                    PID:784
                                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=0.6.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4388,i,4912851795888370504,4103514867237158534,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:8
                                                                                                                                    5⤵
                                                                                                                                      PID:5700
                                                                                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=0.6.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4932,i,4912851795888370504,4103514867237158534,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:8
                                                                                                                                      5⤵
                                                                                                                                        PID:4968
                                                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=0.6.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4916,i,4912851795888370504,4103514867237158534,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=948 /prefetch:8
                                                                                                                                        5⤵
                                                                                                                                          PID:6304
                                                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=0.6.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4924,i,4912851795888370504,4103514867237158534,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:8
                                                                                                                                          5⤵
                                                                                                                                            PID:5568
                                                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=0.6.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4908,i,4912851795888370504,4103514867237158534,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:8
                                                                                                                                            5⤵
                                                                                                                                              PID:5288
                                                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=0.6.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4952,i,4912851795888370504,4103514867237158534,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
                                                                                                                                              5⤵
                                                                                                                                                PID:224
                                                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=0.6.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5048,i,4912851795888370504,4103514867237158534,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:8
                                                                                                                                                5⤵
                                                                                                                                                  PID:3512
                                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=0.6.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5032,i,4912851795888370504,4103514867237158534,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:8
                                                                                                                                                  5⤵
                                                                                                                                                    PID:4172
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=0.6.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4780,i,4912851795888370504,4103514867237158534,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
                                                                                                                                                    5⤵
                                                                                                                                                      PID:5036
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://projectreal.gg/register?app_auth=1&state=MO_v9Bg8ZqVSHtZe4Mh1QQduU0ACu6zDxZEi1jTIEJo&loopback_port=58600&hwid=HWIDv4_e8923ed2a02497d27eea154434c92c6fdb8e728acd20784c90d3ace384654b80
                                                                                                                                                    4⤵
                                                                                                                                                      PID:4572
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://projectreal.gg/register?app_auth=1&state=MO_v9Bg8ZqVSHtZe4Mh1QQduU0ACu6zDxZEi1jTIEJo&loopback_port=58600&hwid=HWIDv4_e8923ed2a02497d27eea154434c92c6fdb8e728acd20784c90d3ace384654b80
                                                                                                                                                        5⤵
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                        • Checks SCSI registry key(s)
                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                        • Modifies registry class
                                                                                                                                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                                        PID:3520
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ff9c008c188,0x7ff9c008c194,0x7ff9c008c1a0
                                                                                                                                                          6⤵
                                                                                                                                                            PID:3808
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,11519996205642242866,6897175934284614852,524288 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
                                                                                                                                                            6⤵
                                                                                                                                                            • System Time Discovery
                                                                                                                                                            PID:6976
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,14865723786170626741,3545945869855548158,262144 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
                                                                                                                                                            6⤵
                                                                                                                                                              PID:5848
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,14893674012288741864,16337813511718525537,524288 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:8
                                                                                                                                                              6⤵
                                                                                                                                                                PID:5388
                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,15163196000478471157,16509471225259495219,2097152 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:4316
                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,17758948385663764927,5329385278384132332,2097152 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:5000
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,17406829868957452940,15680621218492985827,524288 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:8
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:1840
                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,12525576156579041198,1172427272872963706,524288 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:8
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:5408
                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,15568764384045814434,2221918717389865168,524288 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:6680
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,15568764384045814434,2221918717389865168,524288 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:3992
                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6116,i,11006763406563668434,7375015526060447829,2097152 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:1
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:4504
                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6380,i,8874816227405693758,3497187138145539179,2097152 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:6696
                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4244,i,4842987911092976841,1548977610237803513,2097152 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:1
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:5272
                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,3404284637384558105,5890656951444432989,524288 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:8
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:6184
                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6904,i,4850446641797043753,8075632024539301886,524288 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:8
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:3416
                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,17131543293664298515,1392305094345350423,524288 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:8
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:2344
                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,13730088839945504396,6077596558842473074,524288 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:6912
                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,17422061057950410151,9435044715596545826,524288 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:3604
                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,11659202373004735344,16288601949964283395,524288 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
                                                                                                                                                                                            6⤵
                                                                                                                                                                                              PID:5364
                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,15084281182078242002,10434112452769226576,524288 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:8
                                                                                                                                                                                              6⤵
                                                                                                                                                                                                PID:6292
                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,18080403004863538913,10411375744722890918,524288 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                  PID:6516
                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5920,i,14623618713243260391,11023863908911870925,262144 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                    PID:3708
                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,10054765087280995316,15444163546450786702,524288 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:8
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                      PID:2308
                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,47867805561886674,11173820348206138164,524288 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:8
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                        PID:5260
                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3132,i,15232634784950242272,15393324657700298002,524288 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:8
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                          PID:2880
                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,16122494981054730680,7751978590884381691,524288 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:6276
                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,3255380117323975367,18062580291977765137,524288 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                              PID:3000
                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,1636435058996418568,6990986110812304792,524288 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                PID:3424
                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,9986078060977066615,7648866518885718143,524288 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                  PID:5368
                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,8893578109288041199,1339104006676554479,524288 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:8
                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                    PID:5600
                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,7266282224715615506,2318041562099320582,524288 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:8
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                      PID:6040
                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7212,i,14812689392771751798,509610992369798610,524288 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:8
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                        PID:6316
                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6964,i,14456427409005777559,1763296408982758387,524288 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:8
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                          PID:3936
                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3308,i,5358624657876612436,13529296929189186915,524288 --field-trial-handle=2300,i,16843497545171598725,16193918197401119798,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:8
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                            PID:2308
                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:4472
                                                                                                                                                                                                                  • C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:552
                                                                                                                                                                                                                    • C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x64\x64dbg.exe
                                                                                                                                                                                                                      "C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x64\x64dbg.exe"
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                      • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                      PID:4100
                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:3332
                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:5412

                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3520_1004088367\manifest.json
                                                                                                                                                                                                                              • Size 85B
                                                                                                                                                                                                                              • SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              LICENSE
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3520_1074506073\LICENSE
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3520_1074506073\manifest.json
                                                                                                                                                                                                                              • Size 79B
                                                                                                                                                                                                                              • SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3520_140070913\manifest.json
                                                                                                                                                                                                                              • Size 135B
                                                                                                                                                                                                                              • SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3520_1464735329\manifest.json
                                                                                                                                                                                                                              • Size 177B
                                                                                                                                                                                                                              • SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3520_1494365581\manifest.json
                                                                                                                                                                                                                              • Size 72B
                                                                                                                                                                                                                              • SHA256 9811cd3e1fbf80feb6a52ad2141fc1096165a100c2d5846dd48f9ed612c6fc9f
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              llm_user_input_extractor_config.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3520_1771644729\llm_user_input_extractor_config.json
                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                              • SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3520_1771644729\manifest.json
                                                                                                                                                                                                                              • Size 165B
                                                                                                                                                                                                                              • SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3520_1892097629\manifest.json
                                                                                                                                                                                                                              • Size 238B
                                                                                                                                                                                                                              • SHA256 1bdda4a8fc3e2b965fbb52c9b23a9a34871bc345abfb332a87ea878f4472efbd
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3520_1985988893\manifest.json
                                                                                                                                                                                                                              • Size 119B
                                                                                                                                                                                                                              • SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3520_272802105\manifest.json
                                                                                                                                                                                                                              • Size 165B
                                                                                                                                                                                                                              • SHA256 daf50c160ae8f5935baa4a7207e9d04afbbc81a6dd9ed02d99de12056743eeb6
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4244_1608304681\manifest.json
                                                                                                                                                                                                                              • Size 43B
                                                                                                                                                                                                                              • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4244_1709630370\manifest.json
                                                                                                                                                                                                                              • Size 160B
                                                                                                                                                                                                                              • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4244_1762978732\manifest.json
                                                                                                                                                                                                                              • Size 135B
                                                                                                                                                                                                                              • SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping6428_1018400105\manifest.json
                                                                                                                                                                                                                              • Size 69B
                                                                                                                                                                                                                              • SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping6428_106211357\manifest.json
                                                                                                                                                                                                                              • Size 113B
                                                                                                                                                                                                                              • SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping6428_1113573035\manifest.json
                                                                                                                                                                                                                              • Size 76B
                                                                                                                                                                                                                              • SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping6428_1114691732\manifest.json
                                                                                                                                                                                                                              • Size 102B
                                                                                                                                                                                                                              • SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              LICENSE
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping6428_1782689496\LICENSE
                                                                                                                                                                                                                              • Size 499B
                                                                                                                                                                                                                              • SHA256 55064d7d8fecdd90ba36cebaff34f05583c183b34686b17b40b974442fc07523
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping6428_1782689496\manifest.json
                                                                                                                                                                                                                              • Size 1001B
                                                                                                                                                                                                                              • SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping6428_2095050323\manifest.json
                                                                                                                                                                                                                              • Size 116B
                                                                                                                                                                                                                              • SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              verified_contents.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping6428_591909262\_metadata\verified_contents.json
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 c50e8b66b9c681cbc2fa16cb2d8fd7cc934df1a7863dcf4f0ebedf6a5b78638d
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Staging
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping6428_713979669\Sigma\Staging
                                                                                                                                                                                                                              • Size 36B
                                                                                                                                                                                                                              • SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.json
                                                                                                                                                                                                                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping6428_713979669\manifest.json
                                                                                                                                                                                                                              • Size 132B
                                                                                                                                                                                                                              • SHA256 68683970ce6d7de9a2043c34129106ae68af21a3b0a3c53cb59695640a7c1cbc
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              powershell.exe.log
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              blocklist
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                                                                                                                                                              • Size 105KB
                                                                                                                                                                                                                              • SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              protocols.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              autofill_bypass_cache_forms.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
                                                                                                                                                                                                                              • Size 161B
                                                                                                                                                                                                                              • SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              edge_autofill_global_block_list.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
                                                                                                                                                                                                                              • Size 6KB
                                                                                                                                                                                                                              • SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              v1FieldTypes.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
                                                                                                                                                                                                                              • Size 509KB
                                                                                                                                                                                                                              • SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              settings.dat
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                              • Size 280B
                                                                                                                                                                                                                              • SHA256 758df8d3fcc8153add0884f31eebee2a2577adda6817b51a21944c2f22794229
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              settings.dat
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                              • Size 280B
                                                                                                                                                                                                                              • SHA256 51e5afda28b3ceb2469c248bf30307150ff87522abffe0ae308226e1d0b056d7
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              settings.dat
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                              • Size 280B
                                                                                                                                                                                                                              • SHA256 28d5c5409127e94432a66cbd6e7fa3840b5bed4ba199c7eaa0ad5c9ad995390c
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              settings.dat
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                              • Size 280B
                                                                                                                                                                                                                              • SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              settings.dat
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                              • Size 280B
                                                                                                                                                                                                                              • SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              LOG.old
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                                                                                                                              • Size 564B
                                                                                                                                                                                                                              • SHA256 ad4adc9b9db1424f1237f6b4356df40fe24aa9e30187a64c8704d034f5ed8932
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              MANIFEST-000001
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
                                                                                                                                                                                                                              • Size 158B
                                                                                                                                                                                                                              • SHA256 f92681ff1d51a47b79b4e7f625a234299e0e4dacb40d12cf69f839643a24b5f1
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                                              • Size 6B
                                                                                                                                                                                                                              • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_00009d
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
                                                                                                                                                                                                                              • Size 32KB
                                                                                                                                                                                                                              • SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_00009e
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
                                                                                                                                                                                                                              • Size 96KB
                                                                                                                                                                                                                              • SHA256 6c501148aada1207002c4dc6fb8794554897d71abeb97e92d9d15c8cf61a8448
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_00009f
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
                                                                                                                                                                                                                              • Size 67KB
                                                                                                                                                                                                                              • SHA256 2b5ed041424f24d8f0473eb3defed6fe82ab0c9c21d51f959935e8c7f569292a
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_000112
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000112
                                                                                                                                                                                                                              • Size 24KB
                                                                                                                                                                                                                              • SHA256 f254eb93b015455a3c89aaf970631bc989fe2bd387f79e871b514992359651aa
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_000113
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000113
                                                                                                                                                                                                                              • Size 24KB
                                                                                                                                                                                                                              • SHA256 a3cf4861c7d0c966f0ed6564f6aad6b28cbd3421a9ca4f60e2246848d249f196
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_000114
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000114
                                                                                                                                                                                                                              • Size 22KB
                                                                                                                                                                                                                              • SHA256 9c4f02f38678f2628292d66c4f7a1a6a06af7ffac4d279359b09074e7d0f1fe0
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_000115
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000115
                                                                                                                                                                                                                              • Size 21KB
                                                                                                                                                                                                                              • SHA256 6f32da94d4f26e98cb6ccd97034d306aa38945322c816f54a93c7d15dc0905b8
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_000116
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000116
                                                                                                                                                                                                                              • Size 76KB
                                                                                                                                                                                                                              • SHA256 d7b2beaef7154646120273efa8debafbd87b256cfdfb33defc73381e254a602a
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_000117
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000117
                                                                                                                                                                                                                              • Size 41KB
                                                                                                                                                                                                                              • SHA256 0e2e6d1994902577a3d3a7f0e37875dd22de26342bec8403ebe262f92f2eddd7
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              f_000132
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000132
                                                                                                                                                                                                                              • Size 161KB
                                                                                                                                                                                                                              • SHA256 bf5fddb7628f8c21b2ada480ab9b78fac309c6f8c6660c61749ef03890770c0f
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              temp-index
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                                                                                                                                              • Size 13KB
                                                                                                                                                                                                                              • SHA256 6b4f9d8b4a871d9541a11e396925fcfb21ca1e2b0dcadc8a6aa6d6299eabc4c1
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                              • Size 13KB
                                                                                                                                                                                                                              • SHA256 80024abfe3a6ecfae74898896c7c83096fa103ed639c9f403f203e6688d7837e
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              the-real-index~RFe5b35f1.TMP
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b35f1.TMP
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 e8862f2317d9154f5bebe425feaa8031e2b5e651c5806c349a88a78cc6981daa
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              SiteList-Enterprise.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                                                                                              • Size 2B
                                                                                                                                                                                                                              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Edge Profile.ico
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                                                                                              • Size 70KB
                                                                                                                                                                                                                              • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              HubApps
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                                                                                                                                                              • Size 106KB
                                                                                                                                                                                                                              • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              MANIFEST-000001
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
                                                                                                                                                                                                                              • Size 23B
                                                                                                                                                                                                                              • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Network Persistent State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                              • Size 18KB
                                                                                                                                                                                                                              • SHA256 a92f4aab27ae911d15b7244134eb71066c9e00147dbf4039d9414f82e665daca
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Network Persistent State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                              • Size 15KB
                                                                                                                                                                                                                              • SHA256 92e79dd9d63f1aef2d9b37f5b0e81498720e21ac1c537b9d083a36bda94b2250
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Network Persistent State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                              • Size 15KB
                                                                                                                                                                                                                              • SHA256 3d4183fc8e30c3bedeb1ba7429a7123c63b75da3604a13f686c8904aaad1bbdd
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Sdch Dictionaries
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                                                                                                              • Size 207B
                                                                                                                                                                                                                              • SHA256 fe2b69cd61453139afefd621f41d0244024f54705e81690c16b9d2f1b1852c13
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                              • SHA256 4f0b8267c4308296db80a8bc0196922caa1c6c74474e233861288e83c2ae39e8
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                              • Size 16KB
                                                                                                                                                                                                                              • SHA256 3330694392f67f48491715e694b97a0631b2da9a7c42ad06b2328a48b2dc40bf
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                              • Size 19KB
                                                                                                                                                                                                                              • SHA256 7ec0490e0e2d3ed8b124a074d139b631c71795e6476a0488b85200dca7b53c0b
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                              • Size 22KB
                                                                                                                                                                                                                              • SHA256 1e7f019e00222dd85f51806d407a87571fbd76af61a2977b42941226730949e2
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                              • Size 24KB
                                                                                                                                                                                                                              • SHA256 637f7ccc13659da43adfaaf2b978a3be9e6e46df3c7fdaebc81b883de437d37c
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                              • Size 39KB
                                                                                                                                                                                                                              • SHA256 87c09c3ac33f589a8335d9901d3c412b2cb6598142d0f3d6ea206fc4c7164496
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Secure Preferences
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                                                                              • Size 30KB
                                                                                                                                                                                                                              • SHA256 eb0c133242ce8cdd66bc35f85eb1641fcd066b48f392270312d73ff6ace5d31f
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Secure Preferences
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                                                                              • Size 35KB
                                                                                                                                                                                                                              • SHA256 ef2cba2e0ad9b61d5936f4c099f4d3bf41e2b5e83b00fb7ecdc94143540d5173
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 1360283ba04038ed8122577d626f8531760e3de55eda703293da4e98b74050cb
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 6ff9ae4cb6b78380512dc680cd94e1f1cb1652773b3c07db247d4285d508af61
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              the-real-index~RFe59dad6.TMP
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index~RFe59dad6.TMP
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 4a1935f9f6336a2fb5eaf6372ec1d4496f661c445b32d7ef776ee9e0a4d05a3b
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06d224de-168c-4a01-ad8e-6f2003d2a36e\index-dir\the-real-index
                                                                                                                                                                                                                              • Size 72B
                                                                                                                                                                                                                              • SHA256 6ac024a66962dcbe16ba6a0b01f45232b9f592b9105b932d977ff9862b4c3783
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              the-real-index~RFe5c5a7c.TMP
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06d224de-168c-4a01-ad8e-6f2003d2a36e\index-dir\the-real-index~RFe5c5a7c.TMP
                                                                                                                                                                                                                              • Size 48B
                                                                                                                                                                                                                              • SHA256 e1d05a517b28a908e7e16aa16cdd6a2b956bd0ddd1abe1114598e70437348e6f
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3c00c727-a42d-4dda-8781-27462a00dc28\index-dir\the-real-index
                                                                                                                                                                                                                              • Size 72B
                                                                                                                                                                                                                              • SHA256 c763fcb4a934e6c46ad43d141873e589da0ecfe5fe82084d4fff6a09ebc939ba
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\834819d4-20b9-424f-9271-71c3bb438301\index-dir\the-real-index
                                                                                                                                                                                                                              • Size 72B
                                                                                                                                                                                                                              • SHA256 48385c9b35512d267a423b3aef1eb216df13e011a7d384bb4f329ac95df1df21
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\834819d4-20b9-424f-9271-71c3bb438301\index-dir\the-real-index
                                                                                                                                                                                                                              • Size 72B
                                                                                                                                                                                                                              • SHA256 92106286e8579371b637fae5711933f46932ca527f1e5516781b893278f48e9a
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              index.txt
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                                                                                                                              • Size 481B
                                                                                                                                                                                                                              • SHA256 b6c31a37a08af76c829c14873ca1dc8a1e06c21868eaa90cbf37bfc4ee74232d
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              index.txt
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                                                                                                                              • Size 371B
                                                                                                                                                                                                                              • SHA256 2452805744221018c04a1a8c6c94dd2e02b8ca0db1725ba0fa96fbd390f3bbe8
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              index.txt
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                                                                                                                              • Size 476B
                                                                                                                                                                                                                              • SHA256 9ed7ea4ba0c07f0bb9e57d8802d432764568ec0fd9326d15e0cd80a3493d73d9
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              index.txt
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
                                                                                                                                                                                                                              • Size 233B
                                                                                                                                                                                                                              • SHA256 5b6434e93f48a7cbc9686a0b830cd97db7ee47471e3d713826e5ae9a56715189
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              index.txt
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
                                                                                                                                                                                                                              • Size 226B
                                                                                                                                                                                                                              • SHA256 d4cc22cfa59aebf12ad5f9a18e49eae34f6dabd98ce7d50b6f85ed8147a2ecfb
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              index.txt~RFe59a493.TMP
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe59a493.TMP
                                                                                                                                                                                                                              • Size 138B
                                                                                                                                                                                                                              • SHA256 fe4621851f391a47b2ae65ef8ca31284c9880d89947110e58ca081805f72a82c
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                                                                              • Size 72B
                                                                                                                                                                                                                              • SHA256 a86c9f721ff6e404b64fe2f8cdedab9e81d1b8f82f52940ffd3bd9c2a7fe397d
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              the-real-index~RFe5a2da9.TMP
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a2da9.TMP
                                                                                                                                                                                                                              • Size 48B
                                                                                                                                                                                                                              • SHA256 21e4ecfa7a802e1ab947e94cbdf8bc706229430c4c97ab406d65167729bff265
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              sync_diagnostic.log
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                              • SHA256 e728572c452faf3775d8a96ff3e2e4e8ffae9c815cd83e7f1dc8208efa9cacfe
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              d5423bce-5f5a-45ac-a478-3a41efa05a37.tmp
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d5423bce-5f5a-45ac-a478-3a41efa05a37.tmp
                                                                                                                                                                                                                              • Size 414B
                                                                                                                                                                                                                              • SHA256 55ad538e06caa707df0c22ea31648d3936ef4cbbbcc67169f4344bf8678ff87c
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              domain_actions.dll
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
                                                                                                                                                                                                                              • Size 83KB
                                                                                                                                                                                                                              • SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              c4461154-6c20-4c96-9e1d-5c574f2b8f88.tmp
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c4461154-6c20-4c96-9e1d-5c574f2b8f88.tmp
                                                                                                                                                                                                                              • Size 22KB
                                                                                                                                                                                                                              • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              office_endpoints_list.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
                                                                                                                                                                                                                              • Size 9KB
                                                                                                                                                                                                                              • SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                              • SHA256 5247afd3aa8e1380fca0c45c61493a2556b4e66931cef7db3037079cf7df5f9f
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                              • SHA256 d5164975578d3c9100598d1aeedc28bfbfce72cba5f8c9d1e5d9643921c612ea
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                              • Size 38KB
                                                                                                                                                                                                                              • SHA256 96fa9c2bf64b19a2381422b2c5d9ec5d4761fd3aa37950a2df0d30fe34b5584f
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                              • Size 20KB
                                                                                                                                                                                                                              • SHA256 29abc6aff1106dae2373902e88e8e01978d80c562a5974cdb620fea17543ee89
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                              • Size 20KB
                                                                                                                                                                                                                              • SHA256 f024d7c8db9b34c07cf0aa4ba988709b0c54a2e4a9bfc565bb68a629bf3a8850
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                              • Size 31KB
                                                                                                                                                                                                                              • SHA256 9bf3a68898c0d9cfc9aa1f200e93cdebcc1c5275efdfd8d2d0bbc6df23613346
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                              • Size 32KB
                                                                                                                                                                                                                              • SHA256 d42221974f2afe08bcfbeea30c1c45ad774eff1682c2e6e2a00df5b788b2d9c3
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                              • Size 25KB
                                                                                                                                                                                                                              • SHA256 73db4219764ed6c1bc720c37877ff2f90ed4b65ae805fc9cdd2e45aab8d43a78
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                              • Size 30KB
                                                                                                                                                                                                                              • SHA256 48920c015008ce03a2bb981032d2109812d1d941263bff1638f3ff8fba335f82
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                              • SHA256 121c981977b324628bb1e5764bd5998f5b5b6d553a485a5010696c5b78d929fb
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              RevisitationBloomfilter
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                              • Size 392B
                                                                                                                                                                                                                              • SHA256 927f3379bd6477947a130581eddaaac15cf29824ba7b50011ca9311d9cc44780
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              RevisitationBloomfilter
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                              • Size 392B
                                                                                                                                                                                                                              • SHA256 d06ad0154bf3a76b09f0821f451a9e28cb84481d6a5f9efc98a0ca6e761c7f44
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              RevisitationBloomfilter
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                              • Size 392B
                                                                                                                                                                                                                              • SHA256 08abb775c2ee74a34c77b99ceab9e7af7753ce5adc000741d7f6fa9c78d64807
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              RevisitationBloomfilter
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                              • Size 392B
                                                                                                                                                                                                                              • SHA256 23ac0e4fe7b8bf601d863a13049c4fbd7cec26577702200a42aaf40666718cdc
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              RevisitationBloomfilter
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                              • Size 392B
                                                                                                                                                                                                                              • SHA256 f01a1ab4c2d815d14efdb1cefbe15de17c85e459ebbe86887f6ec11160eeb1a4
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              RevisitationBloomfilter
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                              • Size 392B
                                                                                                                                                                                                                              • SHA256 34d777a6b7c3aca2b0b05e7c39827bd5d9e98f9b1ad6285c52228ce37058f4e2
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              RevisitationBloomfilter~RFe5a011a.TMP
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a011a.TMP
                                                                                                                                                                                                                              • Size 392B
                                                                                                                                                                                                                              • SHA256 5907747b8c48f03f6ae97e66ac1408a1f2fdbde4b83f53e8e8902deb3d5949de
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              safety_tips.pb
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\safety_tips.pb
                                                                                                                                                                                                                              • Size 163KB
                                                                                                                                                                                                                              • SHA256 854b7eb22303ec3c920966732bc29f58140a82e1101dffe2702252af0f185666
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              typosquatting_list.pb
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\typosquatting_list.pb
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 3ad368c74c9bb5da4d4750866f16d361b0675a6b6dc4e06e2edd72488663450e
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              keys.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.3.23.1\keys.json
                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                              • SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              nav_config.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              metadata.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                              • Size 372B
                                                                                                                                                                                                                              • SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              metadata.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 7ae3abeff1a7ac2b396b3e38dc9d2900c37a4fa3623cd6a74cdc34b502978149
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              metadata.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 757c40068c8b44526fedddbae76f4ef49d46e6f99e9c5b6ac7daee04f31c52bc
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              metadata.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 ae32d9950928870c88235c4c17204b62b83ed38c436c2dd65ff80e018454fd14
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              metadata.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                              • Size 132B
                                                                                                                                                                                                                              • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              metadata.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                              • Size 252B
                                                                                                                                                                                                                              • SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              metadata.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                              • Size 972B
                                                                                                                                                                                                                              • SHA256 590065152acec5cf42dffc28eb04749514feaa899eb2ae04edce7d38a148fbda
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              metadata.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                              • Size 732B
                                                                                                                                                                                                                              • SHA256 a5548ca519cf47ecb420c8f1299a8a50517fa463459a704ef2ff17c4db35117a
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              metadata.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                              • Size 852B
                                                                                                                                                                                                                              • SHA256 142a7cc7a4933a976aae32a9d04e1758464486092207243f09edbbad51f1d934
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              metadata.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 21075672ed04fcc0ad86c96036a015a0479bc539f9eb22ed2ee07d5f51ed51d5
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              metadata.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 df444b5ed91161c5d2e84013e91e57a28fbbd1e4302590bddff64bc98663199a
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              metadata.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 2b7c607fd6a639934c6f7311f36aa760dd4a600f84b9f8e2d066832856488091
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              metadata.json
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                              • Size 612B
                                                                                                                                                                                                                              • SHA256 98d9b184e4c7220b5aaf7ae412b0c1b3f32e3dc4933afcf852538b8082017b9e
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              2dbd3d2d-21b5-4e14-915c-d52dd31b85bb.tmp
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2dbd3d2d-21b5-4e14-915c-d52dd31b85bb.tmp
                                                                                                                                                                                                                              • Size 13B
                                                                                                                                                                                                                              • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 3ffd46dae522dfb4e5809baf094d148419a82e218406bdfe793b7b2b3bad0290
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              StartupProfileData-NonInteractive
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                              • Size 944B
                                                                                                                                                                                                                              • SHA256 e4cd394f07186212fa62da0e169bfbc0e10381d404703d3e2411ed1f21c07404
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              StartupProfileData-NonInteractive
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                              • Size 944B
                                                                                                                                                                                                                              • SHA256 17c7b3c895766071a0d87318ec4134a9032ed113b46d3ba75889819a61a9cc19
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              StartupProfileData-NonInteractive
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 f4e5758b03b6e05f5f0c9498437ee6ae858aad05b55ca5f9f9aa0eef124ffa59
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              .real-write-probe-1100-240753984.tmp
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\.real-write-probe-1100-240753984.tmp
                                                                                                                                                                                                                              • Size 4B
                                                                                                                                                                                                                              • SHA256 aa33996d60e89311b4d1a920dae03c6d7fa3ae1956c52662e273aad4683e577f
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Update.exe
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\Update.exe
                                                                                                                                                                                                                              • Size 6.8MB
                                                                                                                                                                                                                              • SHA256 adecd05dcf6e9baf2a439ba652592e245145305f2b66a5c9c13e565d0863bcf4
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              crl-set
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
                                                                                                                                                                                                                              • Size 22KB
                                                                                                                                                                                                                              • SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              settings.dat
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad\settings.dat
                                                                                                                                                                                                                              • Size 280B
                                                                                                                                                                                                                              • SHA256 b2bc97793c8774d63ca5a1acf885678324e2537b93387309c8bbd567c91d264a
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                              • Size 48B
                                                                                                                                                                                                                              • SHA256 b59b9cfcc0bd211a80696d52ca9a0380939ee6cd11464114a5a6b2b0e5b9781e
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                              • Size 408B
                                                                                                                                                                                                                              • SHA256 8f0cfb16271bb1da5af08b2f7937bd37adc3a142eb823b33a9dfefab7954e628
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ExtensionActivityComp
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\ExtensionActivityComp
                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                              • SHA256 8c471cab38a1696289186d01b06ff6af2a888852dc18d6fb8d2a0e54898104ed
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              58c11847-fcbd-41bb-a31e-f219476adc04.tmp
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Network\58c11847-fcbd-41bb-a31e-f219476adc04.tmp
                                                                                                                                                                                                                              • Size 40B
                                                                                                                                                                                                                              • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Network Persistent State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Network\Network Persistent State
                                                                                                                                                                                                                              • Size 821B
                                                                                                                                                                                                                              • SHA256 6ab25b64011392dcf3c37d302c5a09b48945bf4b9d6faaec0fc9f5dcc7702bf8
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Preferences
                                                                                                                                                                                                                              • Size 6KB
                                                                                                                                                                                                                              • SHA256 a913eadd05c2741a99678d5b8a567aaddb297de406477e3c3297c876470f3585
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Preferences~RFe5a5a85.TMP
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Preferences~RFe5a5a85.TMP
                                                                                                                                                                                                                              • Size 6KB
                                                                                                                                                                                                                              • SHA256 38e4467e8c0fb80ba5832819c916e7528f1e97def6000f7c4027aa1ce5b62c52
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 6e67cdfc59cc3c1cfe5d3974181e79f3a5c9dd349e0ac6e4433dbaca1ebae561
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 3f1a029495309f8dbb3bcd78830fd4415d6f0693de696e70d6d08a8875ace4b4
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
                                                                                                                                                                                                                              • Size 16KB
                                                                                                                                                                                                                              • SHA256 26586871faa37941bda413a758117cd1cb773f94731f956b4303cdaac297eaae
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 9b746a25cb9ef4380711c0067d964f25541bf90560efd4c4d848a5145cd0fee6
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
                                                                                                                                                                                                                              • Size 17KB
                                                                                                                                                                                                                              • SHA256 781999b4ef12a22d594e6c0a67ae69d79ff260d7a5a4c73c38a088d5a414c297
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State~RFe59bd8a.TMP
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State~RFe59bd8a.TMP
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 0a187443203866f08293ec57c7ec5e9f5bd8052d6655e7d69a057d6a8896d7ca
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              crs.pb
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\PKIMetadata\46.0.0.0\crs.pb
                                                                                                                                                                                                                              • Size 233KB
                                                                                                                                                                                                                              • SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ct_config.pb
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\PKIMetadata\46.0.0.0\ct_config.pb
                                                                                                                                                                                                                              • Size 16KB
                                                                                                                                                                                                                              • SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              kp_pinslist.pb
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\PKIMetadata\46.0.0.0\kp_pinslist.pb
                                                                                                                                                                                                                              • Size 10KB
                                                                                                                                                                                                                              • SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Filtering Rules
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                              • SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              LICENSE
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
                                                                                                                                                                                                                              • Size 24KB
                                                                                                                                                                                                                              • SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Advertising
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Advertising
                                                                                                                                                                                                                              • Size 19KB
                                                                                                                                                                                                                              • SHA256 5989ccf9a58e4ffd47c2422bd8dfcb3ea4e1d412fbdec2291385a9955af9eace
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Analytics
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Analytics
                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                              • SHA256 163a5318312b814104d244a4b37b676a02f827068820aa60fc069e6346cb2b75
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              CompatExceptions
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Trust Protection Lists\1.0.0.34\Mu\CompatExceptions
                                                                                                                                                                                                                              • Size 689B
                                                                                                                                                                                                                              • SHA256 5b462316a51c918d0bae95959bf827cb9c72bbd84ffb0e43b750aa91fbf3ba53
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Content
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Content
                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                              • SHA256 7869993fcb93b302598643be96c6ab94c4f3be47c9fc344959773c754291376e
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Cryptomining
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Cryptomining
                                                                                                                                                                                                                              • Size 668B
                                                                                                                                                                                                                              • SHA256 1e92781e88ee786bf6d1d5cb71d467a92fe7f281f2d1e548524bf119d7ddc700
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Entities
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Entities
                                                                                                                                                                                                                              • Size 68KB
                                                                                                                                                                                                                              • SHA256 f6e93c83d9e3cfdff064535647cee76fc85aa1c86fd22a93dcf3d2c377346d94
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Fingerprinting
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Fingerprinting
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 c7d2b05ff6e790af78b0f1f341219fdb554dc5e14fbf3e3981819fccdd1ddfed
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              LICENSE
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Trust Protection Lists\1.0.0.34\Mu\LICENSE
                                                                                                                                                                                                                              • Size 34KB
                                                                                                                                                                                                                              • SHA256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Other
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Other
                                                                                                                                                                                                                              • Size 34B
                                                                                                                                                                                                                              • SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Social
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Social
                                                                                                                                                                                                                              • Size 754B
                                                                                                                                                                                                                              • SHA256 4955c3e7f56641a4ae0ce9c79b4ceee4b21733b0f6dedc980bf8d822a792eba2
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              TransparentAdvertisers
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Trust Protection Lists\1.0.0.34\Mu\TransparentAdvertisers
                                                                                                                                                                                                                              • Size 105B
                                                                                                                                                                                                                              • SHA256 d2cd0bef5f45daf490c53e705d6f67dfe12390c72a00efa6f5117432bd8edb8c
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Advertising
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Advertising
                                                                                                                                                                                                                              • Size 20KB
                                                                                                                                                                                                                              • SHA256 868f3ed3f86f1e82a5041f0a7b382bdd720e411531df2dc680da34eb60580b75
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Analytics
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Analytics
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 33d2b069ea874c12ec96242ca7eb539c1086d38ac6c2e4858c0efcd74fc632e5
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Content
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Content
                                                                                                                                                                                                                              • Size 5KB
                                                                                                                                                                                                                              • SHA256 d99df5936c57a50aebb7f0a3ca65fcc682f523ace93641fbcfb9b09cfb71c739
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Cryptomining
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Cryptomining
                                                                                                                                                                                                                              • Size 32B
                                                                                                                                                                                                                              • SHA256 696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Entities
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Entities
                                                                                                                                                                                                                              • Size 106KB
                                                                                                                                                                                                                              • SHA256 0f305323c627cf0c790831c7e0bc38455b7a99983c4ab5bd9d2d9567766c3499
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Fingerprinting
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Fingerprinting
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 ec0fcbf71d58e707aaf6ba8d3c0719972f26727febe03f8efbf570b9635faddf
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              LICENSE
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\LICENSE
                                                                                                                                                                                                                              • Size 66B
                                                                                                                                                                                                                              • SHA256 44071e0fcffb9a9a32e8fa7010bb18dbc41afd0b176f81bf700b15b638a88a51
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Other
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Other
                                                                                                                                                                                                                              • Size 198B
                                                                                                                                                                                                                              • SHA256 c9ab8dbc87043c71dd649fc06bb006e7f62e81c973c37b125afb88e654e436f8
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Social
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Social
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 e520603e6fb543cd078b2a7dbd8ccfc175e9aecf71654fc19785927a014d3435
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              manifest.fingerprint
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Trust Protection Lists\1.0.0.34\manifest.fingerprint
                                                                                                                                                                                                                              • Size 66B
                                                                                                                                                                                                                              • SHA256 f96cf59ef5cdf10cdebb367e16c6736d188af934062a8721eb9d60539556a2a9
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              luau-lsp-version.txt
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\data\meta\luau-lsp-version.txt
                                                                                                                                                                                                                              • Size 6B
                                                                                                                                                                                                                              • SHA256 a05b8f505a7ae3fa34e22d97ade349a7b3e7828a7d98d987e0a312eae5c59113
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Real.exe
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\real-1.1.0\Real.exe
                                                                                                                                                                                                                              • Size 10.1MB
                                                                                                                                                                                                                              • SHA256 11ceebe9c8af83e2aea61c28da7d7e0902daa9eda124f7a946c85b958152bbab
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Real.dll
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\real-1.1.0\bin\Real.dll
                                                                                                                                                                                                                              • Size 2.8MB
                                                                                                                                                                                                                              • SHA256 2756337a38a4525aa9b90b5dd2a843526d79f5b345258f56e8b093b51122b167
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Real.exe
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\real-1.1.0\bin\Real.exe
                                                                                                                                                                                                                              • Size 3.9MB
                                                                                                                                                                                                                              • SHA256 949ed91c5395e407b3b29c7842bca3c50b61c0df62b9a891211f7297c79f148c
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              setup.log
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\setup.log
                                                                                                                                                                                                                              • Size 912B
                                                                                                                                                                                                                              • SHA256 ca3cd2a8fcbe9682d990b3e07149d35ce04cec3c8a6d8e32454bda5f49e9317a
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              setup.log
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\setup.log
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 bd6eeba3ca3c94eefd7a17e9c33752fe6724623bf996497f95c77681eb4e1319
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              setup.log
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\setup.log
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 abfaa2bafcb731be8b0b2bc5471504e2c012b1b78832a8f7a8639391f728fb90
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              setup.log
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\setup.log
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 ad413d0137ec9a638177c26439b7b8cff8e37a651d0f4c769551cb5a925f53d3
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              setup.log
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\setup.log
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 ab35788d3a31039cffc9d9959b9a2b18b722a733bbf8ca018e8de219af9cb482
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              setup.log
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Real\setup.log
                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                              • SHA256 73a3a236109d4309043c98be80482348dae57bf259c1e670e237ae3f8798701a
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              22403589-32d7-4b40-9a0c-1dbd7f9643fe.tmp
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\22403589-32d7-4b40-9a0c-1dbd7f9643fe.tmp
                                                                                                                                                                                                                              • Size 10KB
                                                                                                                                                                                                                              • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              481a6aae-cc53-47e3-87d7-b342eb1c4ee7.tmp
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\481a6aae-cc53-47e3-87d7-b342eb1c4ee7.tmp
                                                                                                                                                                                                                              • Size 1B
                                                                                                                                                                                                                              • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              settings.dat
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{BF0ADF3B-5AFD-427A-948D-0782484B8F11}\wv2\EBWebView\Crashpad\settings.dat
                                                                                                                                                                                                                              • Size 280B
                                                                                                                                                                                                                              • SHA256 afcb5971f4fe73bb36d1364c7a07f657f4ffe0871f3cf16c0a99a87c228be0f1
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              settings.dat
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{BF0ADF3B-5AFD-427A-948D-0782484B8F11}\wv2\EBWebView\Crashpad\settings.dat
                                                                                                                                                                                                                              • Size 280B
                                                                                                                                                                                                                              • SHA256 ed1bd052142a0919eb72ec42fd4d8a638a8c1ff1e4df0af834a2a9ffc346bde9
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              index
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{BF0ADF3B-5AFD-427A-948D-0782484B8F11}\wv2\EBWebView\Default\DawnGraphiteCache\index
                                                                                                                                                                                                                              • Size 256KB
                                                                                                                                                                                                                              • SHA256 78aa59ab04dafc9879e2af0be3cfc48ebd249814df3ffe9794c305e8351f4585
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{BF0ADF3B-5AFD-427A-948D-0782484B8F11}\wv2\EBWebView\Local State
                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                              • SHA256 90805388d8b026f1b5aa940e9bf3788ddc2177113ad142951e930ee8c8553d37
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{BF0ADF3B-5AFD-427A-948D-0782484B8F11}\wv2\EBWebView\Local State
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 5308d2deb7c3fb42517ca52b2a032ddc712d295a95af2a73cb0cd5a47dbe473a
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{BF0ADF3B-5AFD-427A-948D-0782484B8F11}\wv2\EBWebView\Local State
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 cca8eac8831ef799c8a51d8079a7d5cb949ad2513adfc33fc1cf826407a95dba
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{BF0ADF3B-5AFD-427A-948D-0782484B8F11}\wv2\EBWebView\Local State
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 b36c266072cb6c9fd53651b0fd56e11ab80ae33e083744a1023ef676baf29301
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State~RFe599699.TMP
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{BF0ADF3B-5AFD-427A-948D-0782484B8F11}\wv2\EBWebView\Local State~RFe599699.TMP
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 fc7a42900d214ba34cfaa98e4c4ab5d633ad4171cc61f62b08c64316fc9abf65
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              settings.dat
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView\Crashpad\settings.dat
                                                                                                                                                                                                                              • Size 280B
                                                                                                                                                                                                                              • SHA256 a3e11cb912c9bf5b1645fc9da0dae84ddb80c0f00b7413a060681c691c3eccf6
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              settings.dat
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView\Crashpad\settings.dat
                                                                                                                                                                                                                              • Size 280B
                                                                                                                                                                                                                              • SHA256 bf7b1d03de493210c1a20e675ae2cb759154d7b70a7e3f696edd043946baf786
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              throttle_store.dat
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView\Crashpad\throttle_store.dat
                                                                                                                                                                                                                              • Size 20B
                                                                                                                                                                                                                              • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              data_1
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView\Default\Cache\Cache_Data\data_1
                                                                                                                                                                                                                              • Size 264KB
                                                                                                                                                                                                                              • SHA256 2f070fe4486d9781a568ffaeb1624efd225db1385aa48c89f64ca8293042ed3e
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              index
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView\Default\Cache\Cache_Data\index
                                                                                                                                                                                                                              • Size 256KB
                                                                                                                                                                                                                              • SHA256 ba1369133a64845a7f1fdf04b8b1ee6266e29e39304f96e94d4ecfb03090135d
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              index
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView\Default\Code Cache\wasm\index
                                                                                                                                                                                                                              • Size 24B
                                                                                                                                                                                                                              • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
                                                                                                                                                                                                                              • Size 48B
                                                                                                                                                                                                                              • SHA256 dee6f4eb6ebafd20111fa09986baa08f15531f6b013051ddc53d2b34b2cbdd8c
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              index
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView\Default\DawnGraphiteCache\index
                                                                                                                                                                                                                              • Size 256KB
                                                                                                                                                                                                                              • SHA256 ebc916b73a86737b87022338fe512fc0f8464e3acbb3d4ae1cec6b4b0b20aaee
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              data_0
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView\Default\DawnWebGPUCache\data_0
                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                              • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              data_1
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView\Default\DawnWebGPUCache\data_1
                                                                                                                                                                                                                              • Size 264KB
                                                                                                                                                                                                                              • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              data_1
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView\Default\DawnWebGPUCache\data_1
                                                                                                                                                                                                                              • Size 264KB
                                                                                                                                                                                                                              • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              data_2
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView\Default\DawnWebGPUCache\data_2
                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                              • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              data_3
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView\Default\DawnWebGPUCache\data_3
                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                              • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              MANIFEST-000001
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView\Default\Extension Rules\MANIFEST-000001
                                                                                                                                                                                                                              • Size 41B
                                                                                                                                                                                                                              • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Network Persistent State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView\Default\Network\Network Persistent State
                                                                                                                                                                                                                              • Size 111B
                                                                                                                                                                                                                              • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Network Persistent State~RFe599486.TMP
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView\Default\Network\Network Persistent State~RFe599486.TMP
                                                                                                                                                                                                                              • Size 59B
                                                                                                                                                                                                                              • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              SCT Auditing Pending Reports
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                              • Size 2B
                                                                                                                                                                                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView\Default\Preferences
                                                                                                                                                                                                                              • Size 6KB
                                                                                                                                                                                                                              • SHA256 5712f49c40daaccbd53a3d2f57b0c7d4d332963371bf0ae21861cae8fda4681a
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView\Default\Preferences
                                                                                                                                                                                                                              • Size 6KB
                                                                                                                                                                                                                              • SHA256 eeb0dba21c91ea14e517a1a0cd8174dc8286f7011512b48c7967886fe3a56fff
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Preferences~RFe5933c8.TMP
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView\Default\Preferences~RFe5933c8.TMP
                                                                                                                                                                                                                              • Size 5KB
                                                                                                                                                                                                                              • SHA256 2e635fd93e4306c6791f31f5bf851a4d353991b4af5013dc872dbeebdcf19bf5
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              CURRENT
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView\Default\Sync Data\LevelDB\CURRENT
                                                                                                                                                                                                                              • Size 16B
                                                                                                                                                                                                                              • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView\Local State
                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                              • SHA256 502a6a9f437ea284baf626149618a5044322c5124727e1192b315423bfd6b733
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView\Local State
                                                                                                                                                                                                                              • Size 5KB
                                                                                                                                                                                                                              • SHA256 23d7e2e9d4715fb0f69865d64dca08907f4addbf0569b0928737afeacf76bee9
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView\Local State
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 f53c16e208fdb9a91a1a4d06caca82416b9d545c3d57d8ac59731e8b663c8fab
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView\Local State
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 b5fcd7104eab9c5f05588331f2dfddcf7585943ab6749de2a5ae0460b7440374
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView\Local State
                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                              • SHA256 dd36cb47e7d709a4610f0f770eba6ba7bbc72ea43070421718a106bce92791ad
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView\Local State
                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                              • SHA256 57d50efec2e698ced617acdfe67810ac4108bb522db48f4e4dcf6240b0314953
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Local State~RFe58942d.TMP
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{C9EFB119-B4FE-4EB5-BD49-572ADAF9A233}\wv2\EBWebView\Local State~RFe58942d.TMP
                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                              • SHA256 14449f2063f6aaeb2a9efd6418a23e9325c2b91753aac425ea501cbc3f19f60f
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              __PSScriptPolicyTest_3uho1eg3.kqb.ps1
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3uho1eg3.kqb.ps1
                                                                                                                                                                                                                              • Size 60B
                                                                                                                                                                                                                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              luau-lsp.exe
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\real-luau-lsp-extract\luau-lsp.exe
                                                                                                                                                                                                                              • Size 16.1MB
                                                                                                                                                                                                                              • SHA256 9e85ce9370f208c97f1dfc1b8fcf7185fe64386f23130a65fc834f5323a0d653
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              real-luau-lsp.zip
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\real-luau-lsp.zip
                                                                                                                                                                                                                              • Size 4.9MB
                                                                                                                                                                                                                              • SHA256 15f2add7c70191c5cd636b047968760f0056893b63be10294453c75430bcb339
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              content_new.js
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4244_1840660011\CRX_INSTALL\content_new.js
                                                                                                                                                                                                                              • Size 10KB
                                                                                                                                                                                                                              • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              7df0a77f-baba-4570-ba45-96f2588dd407.tmp
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4244_80672748\7df0a77f-baba-4570-ba45-96f2588dd407.tmp
                                                                                                                                                                                                                              • Size 152KB
                                                                                                                                                                                                                              • SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              ccba5a5986c77e43.customDestinations-ms
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                              • SHA256 80d5df184247c83a4aea8b36f62275925997e3f844bd042bda0fbae6e28ea264
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Real.lnk
                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Real\Real.lnk
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 580569847a5c09a108de2325ea41a03e27d40d165be45b737ab6450512bffe94
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              Real.lnk
                                                                                                                                                                                                                              • Path C:\Users\Admin\Desktop\Real.lnk
                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                              • SHA256 45c080a53db2e19e6373e332ab6e15a108605b12668d293495e2398eb18bff44
                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                              memory/784-3662-0x000001A79A7D0000-0x000001A79A7D1000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/784-3664-0x000001A79A7D0000-0x000001A79A7D1000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/784-3668-0x000001A79A7D0000-0x000001A79A7D1000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/784-3672-0x000001A79A7D0000-0x000001A79A7D1000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/784-3674-0x000001A79A7D0000-0x000001A79A7D1000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/784-3663-0x000001A79A7D0000-0x000001A79A7D1000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/784-3670-0x000001A79A7D0000-0x000001A79A7D1000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/784-3669-0x000001A79A7D0000-0x000001A79A7D1000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/784-3673-0x000001A79A7D0000-0x000001A79A7D1000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/784-3671-0x000001A79A7D0000-0x000001A79A7D1000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/1636-310-0x0000022FE45A0000-0x0000022FE45B2000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/1636-311-0x0000022FE4590000-0x0000022FE459A000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/1636-318-0x0000022FCB120000-0x0000022FCBBE1000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/1916-47-0x00007FF9DE920000-0x00007FF9DE921000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/1916-48-0x00007FF9DFF80000-0x00007FF9DFF81000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/2992-25-0x00007FF9DF810000-0x00007FF9DF811000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/3936-270-0x00000251F09C0000-0x00000251F09E2000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/3936-273-0x00000251EFA20000-0x00000251F04E1000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/3992-4074-0x000001C5D7AD0000-0x000001C5D7E8B000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/4100-3692-0x000000005FD00000-0x000000005FD15000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/4100-3644-0x00007FF9B6CD0000-0x00007FF9B7225000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/4392-284-0x0000020095580000-0x0000020096041000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/4688-143-0x00007FF9DF810000-0x00007FF9DF811000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/6416-1034-0x00000210E6540000-0x00000210E675C000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/7116-2272-0x000001F7DC800000-0x000001F7DCBBB000-memory.dmp
                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                              memory/7116-2481-0x000001F7DC800000-0x000001F7DCBBB000-memory.dmp
                                                                                                                                                                                                                              Download