76f69c0da1a57b7345f9802e189153c5f386fbe1631cc063f8e6bfe5a183bd6b

Resubmissions

23/07/2026, 17:34

260723-v5tbvs11b1

23/07/2026, 17:29

260723-v2zpgacb789

Analysis

max time kernel
151s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 17:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Update.exe
Size 6.8MB
Sample260723-v2zpgacb78
SHA256 76f69c0da1a57b7345f9802e189153c5f386fbe1631cc063f8e6bfe5a183bd6b
MD5 a2a977ba4231f63c1074b85ca04d36c6
SHA1 8a381b19534fad0e6ed9b8104bff735203df5bab
SHA512 d3ac2f8b6e389bc948ce9f17140a513e0fa83058458567b970075a2efaae81bb2106a7d36553fb5f4e2edc772151e23060bc5338c321810f0cbb2f25ec8dc92b
SSDEEP 49152:3Gtlq/sVwASOfUNM3Jaax/kK1SJRxTmrJDQ6qYAFSce2JDmfj9ZPukMBsqUsKg4F:8H1KJ2DFz/xhsIAldpFyYyw+JD9DY0
TLSH
T12376AEA9B6B800D9E867C1BCC2865213E772B45523B057DF5A649AFA0F23BD01E7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Real.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1444	powershell.exe
1444	powershell.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Real.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Real.exe

Executes dropped EXE 2 IoCs

pid	Process
1904	Real.exe
4904	Real.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Update.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Real.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Real.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4904	Real.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1407603401\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1407603401\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3764_1407603401\manifest.fingerprint	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Update.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293014215498891"	Update.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Real.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\projectreal	Real.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\projectreal\ = "URL:Real Protocol"	Real.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\projectreal\URL Protocol	Real.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\projectreal\shell\open\command	Real.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\projectreal\shell	Real.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\projectreal\shell\open	Real.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\projectreal\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Real\\real-1.5.1\\Real.exe\" \"%1\""	Real.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1444	powershell.exe
1444	powershell.exe
1444	powershell.exe
5236	Update.exe
5236	Update.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe
1904	Real.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5032	msedgewebview2.exe
3764	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1444	powershell.exe
Token: SeIncreaseQuotaPrivilege	1444	powershell.exe
Token: SeSecurityPrivilege	1444	powershell.exe
Token: SeTakeOwnershipPrivilege	1444	powershell.exe
Token: SeLoadDriverPrivilege	1444	powershell.exe
Token: SeSystemProfilePrivilege	1444	powershell.exe
Token: SeSystemtimePrivilege	1444	powershell.exe
Token: SeProfSingleProcessPrivilege	1444	powershell.exe
Token: SeIncBasePriorityPrivilege	1444	powershell.exe
Token: SeCreatePagefilePrivilege	1444	powershell.exe
Token: SeBackupPrivilege	1444	powershell.exe
Token: SeRestorePrivilege	1444	powershell.exe
Token: SeShutdownPrivilege	1444	powershell.exe
Token: SeDebugPrivilege	1444	powershell.exe
Token: SeSystemEnvironmentPrivilege	1444	powershell.exe
Token: SeRemoteShutdownPrivilege	1444	powershell.exe
Token: SeUndockPrivilege	1444	powershell.exe
Token: SeManageVolumePrivilege	1444	powershell.exe
Token: 33	1444	powershell.exe
Token: 34	1444	powershell.exe
Token: 35	1444	powershell.exe
Token: 36	1444	powershell.exe
Token: SeIncreaseQuotaPrivilege	1444	powershell.exe
Token: SeSecurityPrivilege	1444	powershell.exe
Token: SeTakeOwnershipPrivilege	1444	powershell.exe
Token: SeLoadDriverPrivilege	1444	powershell.exe
Token: SeSystemProfilePrivilege	1444	powershell.exe
Token: SeSystemtimePrivilege	1444	powershell.exe
Token: SeProfSingleProcessPrivilege	1444	powershell.exe
Token: SeIncBasePriorityPrivilege	1444	powershell.exe
Token: SeCreatePagefilePrivilege	1444	powershell.exe
Token: SeBackupPrivilege	1444	powershell.exe
Token: SeRestorePrivilege	1444	powershell.exe
Token: SeShutdownPrivilege	1444	powershell.exe
Token: SeDebugPrivilege	1444	powershell.exe
Token: SeSystemEnvironmentPrivilege	1444	powershell.exe
Token: SeRemoteShutdownPrivilege	1444	powershell.exe
Token: SeUndockPrivilege	1444	powershell.exe
Token: SeManageVolumePrivilege	1444	powershell.exe
Token: 33	1444	powershell.exe
Token: 34	1444	powershell.exe
Token: 35	1444	powershell.exe
Token: 36	1444	powershell.exe
Token: SeIncreaseQuotaPrivilege	1444	powershell.exe
Token: SeSecurityPrivilege	1444	powershell.exe
Token: SeTakeOwnershipPrivilege	1444	powershell.exe
Token: SeLoadDriverPrivilege	1444	powershell.exe
Token: SeSystemProfilePrivilege	1444	powershell.exe
Token: SeSystemtimePrivilege	1444	powershell.exe
Token: SeProfSingleProcessPrivilege	1444	powershell.exe
Token: SeIncBasePriorityPrivilege	1444	powershell.exe
Token: SeCreatePagefilePrivilege	1444	powershell.exe
Token: SeBackupPrivilege	1444	powershell.exe
Token: SeRestorePrivilege	1444	powershell.exe
Token: SeShutdownPrivilege	1444	powershell.exe
Token: SeDebugPrivilege	1444	powershell.exe
Token: SeSystemEnvironmentPrivilege	1444	powershell.exe
Token: SeRemoteShutdownPrivilege	1444	powershell.exe
Token: SeUndockPrivilege	1444	powershell.exe
Token: SeManageVolumePrivilege	1444	powershell.exe
Token: 33	1444	powershell.exe
Token: 34	1444	powershell.exe
Token: 35	1444	powershell.exe
Token: 36	1444	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1904	Real.exe
1904	Real.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1904	Real.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 5236 wrote to memory of 5032	5236	Update.exe	89
PID 5032 wrote to memory of 3928	5032	msedgewebview2.exe	90
PID 5032 wrote to memory of 932	5032	msedgewebview2.exe	91
PID 5032 wrote to memory of 932	5032	msedgewebview2.exe	91
PID 5032 wrote to memory of 932	5032	msedgewebview2.exe	91
PID 5032 wrote to memory of 932	5032	msedgewebview2.exe	91
PID 5032 wrote to memory of 2420	5032	msedgewebview2.exe	92
PID 5032 wrote to memory of 4092	5032	msedgewebview2.exe	93
PID 5032 wrote to memory of 4092	5032	msedgewebview2.exe	93
PID 5032 wrote to memory of 4092	5032	msedgewebview2.exe	93
PID 5032 wrote to memory of 2552	5032	msedgewebview2.exe	94
PID 5032 wrote to memory of 2552	5032	msedgewebview2.exe	94
PID 5032 wrote to memory of 2552	5032	msedgewebview2.exe	94
PID 5032 wrote to memory of 2552	5032	msedgewebview2.exe	94
PID 5032 wrote to memory of 2552	5032	msedgewebview2.exe	94
PID 5236 wrote to memory of 1444	5236	Update.exe	95
PID 5236 wrote to memory of 1904	5236	Update.exe	98
PID 1904 wrote to memory of 3764	1904	Real.exe	99
PID 3764 wrote to memory of 2624	3764	msedgewebview2.exe	100
PID 3764 wrote to memory of 2936	3764	msedgewebview2.exe	101
PID 3764 wrote to memory of 2936	3764	msedgewebview2.exe	101
PID 3764 wrote to memory of 2936	3764	msedgewebview2.exe	101
PID 3764 wrote to memory of 2936	3764	msedgewebview2.exe	101
PID 3764 wrote to memory of 3008	3764	msedgewebview2.exe	102
PID 3764 wrote to memory of 4232	3764	msedgewebview2.exe	103
PID 3764 wrote to memory of 4232	3764	msedgewebview2.exe	103
PID 3764 wrote to memory of 4232	3764	msedgewebview2.exe	103
PID 3764 wrote to memory of 3704	3764	msedgewebview2.exe	104
PID 3764 wrote to memory of 3704	3764	msedgewebview2.exe	104
PID 3764 wrote to memory of 3704	3764	msedgewebview2.exe	104
PID 3764 wrote to memory of 3704	3764	msedgewebview2.exe	104
PID 3764 wrote to memory of 3704	3764	msedgewebview2.exe	104
PID 1904 wrote to memory of 4904	1904	Real.exe	105
PID 3764 wrote to memory of 5276	3764	msedgewebview2.exe	110
PID 3764 wrote to memory of 5276	3764	msedgewebview2.exe	110
PID 3764 wrote to memory of 5276	3764	msedgewebview2.exe	110
PID 3764 wrote to memory of 5640	3764	msedgewebview2.exe	111

C:\Users\Admin\AppData\Local\Temp\Update.exe
"C:\Users\Admin\AppData\Local\Temp\Update.exe"
1⤵
- Checks whether UAC is enabled
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5236
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Update.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{2422AAEF-00DB-4E1D-8832-96996CA54912}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5236.4976.13355632955600526754 /pfhostedapp:0a1f2608a61404d1b3d0286fc86f01325887a98b
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\RealLottie-{2422AAEF-00DB-4E1D-8832-96996CA54912}\wv2\EBWebView /prefetch:4 /pfhostedapp:0a1f2608a61404d1b3d0286fc86f01325887a98b --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\RealLottie-{2422AAEF-00DB-4E1D-8832-96996CA54912}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffaf5bc5fd8,0x7ffaf5bc5fe4,0x7ffaf5bc5ff0
    3⤵
    PID:3928
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{2422AAEF-00DB-4E1D-8832-96996CA54912}\wv2\EBWebView" --webview-exe-name=Update.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1904 --field-trial-handle=1908,i,5576207881537079286,11891059342506141728,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:0a1f2608a61404d1b3d0286fc86f01325887a98b
    3⤵
    PID:932
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{2422AAEF-00DB-4E1D-8832-96996CA54912}\wv2\EBWebView" --webview-exe-name=Update.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2096 --field-trial-handle=1908,i,5576207881537079286,11891059342506141728,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:0a1f2608a61404d1b3d0286fc86f01325887a98b
    3⤵
    PID:2420
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{2422AAEF-00DB-4E1D-8832-96996CA54912}\wv2\EBWebView" --webview-exe-name=Update.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2316 --field-trial-handle=1908,i,5576207881537079286,11891059342506141728,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:0a1f2608a61404d1b3d0286fc86f01325887a98b
    3⤵
    PID:4092
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{2422AAEF-00DB-4E1D-8832-96996CA54912}\wv2\EBWebView" --webview-exe-name=Update.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3532 --field-trial-handle=1908,i,5576207881537079286,11891059342506141728,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:0a1f2608a61404d1b3d0286fc86f01325887a98b /prefetch:1
    3⤵
    PID:2552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$p='C:\Users\Admin\AppData\Local\Real';$ex=@((Get-MpPreference).ExclusionPath);if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p };$ex=@((Get-MpPreference).ExclusionPath);if($ex -contains $p){exit 0}else{exit 1}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1444
- C:\Users\Admin\AppData\Local\Real\real-1.5.1\Real.exe
  "C:\Users\Admin\AppData\Local\Real\real-1.5.1\Real.exe" --real-launched-by-updater
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Real.exe --webview-exe-version=1.2.2 --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1904.5900.7426064125498122255 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3764
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView /prefetch:4 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7ffaf5bc5fd8,0x7ffaf5bc5fe4,0x7ffaf5bc5ff0
      4⤵
      PID:2624
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.2.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1836 --field-trial-handle=1840,i,13065132945569943605,13839505456039448495,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
      4⤵
      PID:2936
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.2.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2052 --field-trial-handle=1840,i,13065132945569943605,13839505456039448495,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
      4⤵
      PID:3008
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.2.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2452 --field-trial-handle=1840,i,13065132945569943605,13839505456039448495,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
      4⤵
      PID:4232
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.2.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3480 --field-trial-handle=1840,i,13065132945569943605,13839505456039448495,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105 /prefetch:1
      4⤵
      PID:3704
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.2.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4508 --field-trial-handle=1840,i,13065132945569943605,13839505456039448495,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
      4⤵
      PID:5276
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.2.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4528 --field-trial-handle=1840,i,13065132945569943605,13839505456039448495,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
      4⤵
      PID:5640
- - C:\Users\Admin\AppData\Local\Real\real-1.5.1\bin\Real.exe
    "C:\Users\Admin\AppData\Local\Real\real-1.5.1\bin\Real.exe" --rbxversion
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:4904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

account-vault.dpapi

Path C:\Users\Admin\AppData\Local\Real\data\account-vault.dpapi
Size 298B
SHA256 f9b66d596e6a071d1eed34a33bdd20d7d8e134fdedce2102a8c20876f1c5f76a
MD5 e9ae7c705511be73a576a8e794eae91d
SHA1 7c9262544cce2e6a82702d19a436586ef0163821
SHA512 727bc8b6213678a440149c457424b32a28877e2bbfde9cad135a07bfc74584537710f907e3f58bda35ce7603d6a4a89f3f1546d563cd5691a1194e7d6c0e357d
TLSH
T16CE0EB25481704D2C19F8338CCB70D0E86D23B39427E8014CCE780AFE064E828908B12
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 cf4df078cac79fd17ea02acd5db9e02089b123f80b43c1d819ecb011bf39bf17
MD5 2a8257ae60a485a0b756bbfbb0fd64a3
SHA1 cfa25638fc00dd0ad1f7033c34cdeab774bc4597
SHA512 d0e867e574644fc207b42afafbc27ab7bed7a52b10b72219a2234ef3b180b27befbaf092cf4112d8ee2c458a9f9e8baaeb0fa54ef018c4b18991602ad1a3d722
TLSH
T172D0041D71547D11C40175750014410413014D55110301C1101403554C545001CC7001
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7e1cecd5293ea902e7be6582b7bd46c8c77c4216732dd09a9093de4dbef36356
MD5 71c1c061e7692fc3ab381e7ae2b96923
SHA1 5fd09ba23b93a477eb497e28ae1b19aa0014b9a7
SHA512 e8080734f0115b41d75f880188357af32f6737d5bab0ab4075499aef02f3cc58b7bccf75783b54e9c9982755d8cb949ab94ae3d3d4acbee420809e7702a95cb7
TLSH
T1D4D0121B32515A34C41035730002610C1501C61F41074081642C876E5E184501D47442
MD5 SHA1 SHA512 TLSH

Submit Download

40c40df0-8873-4af4-ac56-2f262bd8c684.tmp

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\40c40df0-8873-4af4-ac56-2f262bd8c684.tmp
Size 6KB
SHA256 1416a88533c1be0fa1cb5b9a762d9005750b2a0ea06e8dd36f580ec4b2264501
MD5 2951e0bd9540f9fbcc71bde928ad56a3
SHA1 f0de9ab9f7c384d2e9d2d3511c20d3c0507cd36b
SHA512 288b40d92a8dd37bc5f540d753cf50fcb84a14b64bcb0aaa20aba78ae789fddf01f3069777e49eebbb0bf10d18bee06ac902a1028a4991fdf72d80b25f710256
SSDEEP 96:stT/dHO7Jb9SkAo5h16Z0es7/x+6MhmuecJUl1eje0K+g9sl28XM1C7K:stL5dzonesV+FdUlQjMPslG6K
TLSH
T1EED1B6065E2879BB4CC6F548BA39BB17E3F9607261D51D58E7F88A1C08DA6CC2317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 432B
SHA256 431f16e55385aaa3ef8ab018b5630913ff75a3b7461cb5de677aaedee5c0d6df
MD5 846fe5d99ef01359a629b656f8c6edde
SHA1 1c5a70d0c537cf2b78d4240db4eb66f0f2edb380
SHA512 d80d6ef7341ec3dae4bebed083b4631ad69d3c2f0dee5b2b2567c7e756ec1ba61cd1950d7bc98b675fd2c98e75685aa0f046f743e4295edefb3373cb01583f44
TLSH
T1F7E02B6055729982C70C8330D4E494D3BDBF18B541AF1E5244A737BA0121723C2D3B20
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bb76.TMP

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59bb76.TMP
Size 48B
SHA256 e84a1005fa63b444be23a4d64c1a9129b305b21e9f69dedd5170471d008b1931
MD5 d65842450eed5cd29e54a6fd6c4c36a5
SHA1 27618427ebb1c8219f97004898df66a0b0783685
SHA512 6ac2026171c2d84fdb49e7845f523b3eaee9746f2f2f3dba12c6da08a65ba96a587d8cb41d337968ea871f31e554a691132beed8ce7354b492717e93aac8dc16
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Network Action Predictor

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Network Action Predictor
Size 4KB
SHA256 9827429749037198cb3d19a851ccff2adafad344fbade7220aa022d3c9e2fa85
MD5 9088df5de5b8306c52e744141a100532
SHA1 0aea85a36ef3ddc53df198227fcaf212139ae1db
SHA512 96c0c8ee90bd8aec34ea905f48e76ed7dc370d24f64efaeadf36e9b59b9ff01856ed837b5169241ef2bd4a6b8fe2ee77de443b09b9ee604e39f9ba57929859e8
TLSH
T15C819285F7C02420DA346EF3A4824BBD5E72CA82A5124B93097002D0FCA74ECCC796AA
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 474c58ece71a3beb61b9171b995f9214961274652351db84a37370bffbd04675
MD5 35f65be728d8d430b6126991720227da
SHA1 cf9ee07e7cdcf43fc059c91fd8305a423fa82081
SHA512 6cf748e5061090be9c46b4a364c93ef67974dfd673d35d1783fb4882a63591a047645239982d7fad20a9c0a163c8d96a3eb39c3a894ae7da4dd90be6c84cab88
TLSH
T100018EA6C3D4C67D8A4126F027343827CD3E0919A2283D27CDE9EBDA97E14B5D21150F
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 16KB
SHA256 1a80bcddad7e3daaf392a1eb13f281a1c7ebc01cdbfeedc4a0934ae8fbc14a9c
MD5 21a51cd29bcf9d73c845189490cd9e67
SHA1 a17c40bd44b91e4e4429fcaa74e2196eab2bc271
SHA512 527d599b440ac1d18e95c13522f9ec4858a55c46ef92d19597ef39783617d4d56bb44ad73f289b6a3b76b75b234ec7068a8cca7864114bdec5f844b5ccb76b5c
SSDEEP 384:B+aQikB+z/xvxjg/qhESNBSZ5QEG6isdYt9zo:M/UxvxjgC+7yd6isutFo
TLSH
T1C2729E3B95783D3395B3EA05794D579BDBB884B2A1C26EB48AED5F0D0AC76980343C06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 2KB
SHA256 b5c84aed5f7942f16f5d901d6fcd0e1d4eb86fef9709a1fce25bab0e042cdb15
MD5 5eb80cb84b06ddd93fd49e59f2987278
SHA1 771ae1c589dcad563b75591ffe2cab2e8b063ee5
SHA512 35afb94960cef54afb0cf4afd4c3c80f4504100f7ee02ce94add28f7816e3c0dece637128d23f86dd2969f31f5875a0e035b76ae9247d7274bd765a52a8bbca9
TLSH
T1885183336950AA3789E28649794A7F738F7591B6EBA22F50AADC0B0C00DB95C1347C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 3KB
SHA256 1a47849a6a61a4ba81fa24015e645f7cabc5ce4ec3b16f353bac912b6385a1d1
MD5 fcc22f9f87138c50cb71a4652fb1c014
SHA1 3f480e01e40e71095d635b519b57b316c5e26529
SHA512 66fcd0cd3e032c2902f403c7375f903d3ba11c43f3dc8206245e6cbc03d65e2e79fd311dedcb7ea30b79b1d640633c1d52bc804c36c0982d5db378c178ed3568
TLSH
T16571663B59A0A9374DE2890978867B26ABA15177E6D17F94D5EC0F0C01D765C1353C12
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe596037.TMP

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State~RFe596037.TMP
Size 1KB
SHA256 5f1bf62d62cd341a9db022e6087c206a5688d42753979dcb82d3a9f7830e35ec
MD5 4dd23404a2a3b5d70c7f68563c40f117
SHA1 9b345ebe0938b12ac60361984c2fa263d1e0abda
SHA512 66bd5b119d5a36df7b1b630fa4b827eb7d3f7336d4c24599b7b86f6f93b3e73ed6691d16442e8debb8b97c1e759d88eb2241b1c05d4ad4c6f3e2bdde0752d67c
TLSH
T1443174B799E05A33AC92924A354BBABB5F6141BB93924F40B4CD070C05EB44C937FC32
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Real\data\config\settings.json
Size 114B
SHA256 ab4a743527a86d03565c96fc4a4abde6b6c43c56885f3ea776823c14f6d3481b
MD5 4e8e2bdd7e5fc095060d763948e0f4bb
SHA1 790c3b304a5b9dcd8731b6e6a1e465093ea6b2fe
SHA512 ba716e46cdf50ac5ca053d5377ec48ece5c9200888e85c1fc965b16d13e0cd92af5b75b9b164e43e857412e2e26dfc601e70afda18e9f8663ba86c90e785d5bb
TLSH
T1D0B0129198BA0F4316DFE45D085B4420F63BE96707D83C7DB1E20A0ED78397149BE780
MD5 SHA1 SHA512 TLSH

Submit Download

current-version.txt

Path C:\Users\Admin\AppData\Local\Real\data\meta\current-version.txt
Size 5B
SHA256 9c50cdf6b7b54ba51e2a2f927862161bccb6f629ca71fa4457c157f9dad55d25
MD5 3ef04b1c4bad2e221ab8bdb7ce5bb803
SHA1 29cd3f50fdf56b43132cb011be27e5a2567b76ae
SHA512 694f5f7bdec36572179713e64b44eb8c81aed980278ffe52a46624282a0564e129d88786e8e3ff47f238ee2a9ddba794645c7e15c1776aae99b422368866f48b
MD5 SHA1 SHA512

Submit Download

Real.exe

Path C:\Users\Admin\AppData\Local\Real\real-1.5.1\Real.exe
Size 12.4MB
SHA256 a58f662a33c876ad4121bd7b213906d09b67fecb9ea2837f1a1995da5b57e4df
MD5 df38b05600b9a2e7722b7ca8bb7ddf63
SHA1 4b3bdd6d254c92557fb8a2a05ddc3e02c5c2de9e
SHA512 3a093af0ab3d51b106f6f569b3373226dc1b2d42356265702c7d22831d7381f6f5fc0d1f66b63de66de4505492b4affb11a916ec51ee7d4e69ff7bec041a4c60
SSDEEP 196608:Mc/aboKzIVAwKiBERYCa46bU3vgFHzO4JJur/+Jzlh++f:rKkPiP6UoZzOCY+JrZf
TLSH
T1B2D6BF07E39481E9C0ADC4B8C35AA637EA31B8894731B2DF5BE44B112E16FD06B3D759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.dll

Path C:\Users\Admin\AppData\Local\Real\real-1.5.1\bin\Real.dll
Size 2.8MB
SHA256 6db57ec2c9b7c6b25912bf8477c202ef372ddb04f86e29a7ce464c3a2573a0fa
MD5 a0142c93c41aa088a76fdc1cb6f28fac
SHA1 482ee496fe1b7673077f53275a92a2739e621390
SHA512 c423a530ce741c13b022654265b9bf7e4288c199fee15afd34d692024df56f2b927ea9ccc8821707e6c139c994936108d87a4082abeb6a72407e5ad8d7f68f7e
SSDEEP 49152:mo9tTMDecabvsw7MswoZirdymae51a/lD4cJKuyVvA:59WDeN7crwm/51a/mck/K
TLSH
T14DD5AD7ADC0A0B23496AB583C8F7385F22DDE34221FE6D49447F1E307275A5127B69A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.exe

Path C:\Users\Admin\AppData\Local\Real\real-1.5.1\bin\Real.exe
Size 3.9MB
SHA256 48068551c61bd60002dd2d99042dbc3f70c3c875980303e7c19b6d89fa8017fe
MD5 821edcaa7e4e906db265cedb7b60a467
SHA1 eb94eff5e6c461a839745d376dbb9bc97c1eda11
SHA512 70bf134849b82a07d9fc95141b52def079de956b4054c635b9c0e9f295b7e01c1dc9f8cd4a9aa30bc71b94f611a57c4b903207a3f157127f4b930d5f53bacc17
SSDEEP 98304:2rLQSrRPw7Fa0mbuPHRElUwKuE+9lclYb7+AgBMdki:rqCFa0mbKHCDqM+A31
TLSH
T1A0162329A6479CADCC9AC4348607E977961A3CCA2B33F8DF078646A27D275F41F35306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spoofer.exe

Path C:\Users\Admin\AppData\Local\Real\real-1.5.1\bin\Spoofer.exe
Size 2.7MB
SHA256 61205ef3bb52bdc1f45453a88dfc43b1e65e0e574c79da2393bac288d06e653d
MD5 0ff1f63e40a320345243790a19b314d6
SHA1 fccd578ff5c5ebc254774e485d673d1af6b57407
SHA512 b79b79526197266b31b1a95c37477c78a733952fc9189b6f5cad19256116bde5ed9f524b9b21d93de9e49a8e577aa532c537f54fc7ffbdd297cf2324b2e5f95c
SSDEEP 49152:vWJhio1u7PS8nbWE9UT2xRLUdorOyiCsBgdxTEL21IuIPkknEqweIQye38RrlB:eJtQnboq5Um0lguL21ITA638RhB
TLSH
T1DDD5236AEAA410B5E1A7C0BCCA978907FB72788D07719FCF17E149A51E13AD06E39311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 1KB
SHA256 445d62e41e0fe805da7e55ac9368295fc750616bc1bcd1b28260050afcb60644
MD5 66ab1bcaf01ff208f950738a35ef2afd
SHA1 d9e40e152cafdd91ea9dfd8918ed2b1349f979d2
SHA512 3b4a78e421e7e8752035c651de198cafb411bbcafe18d0980701028ae5b6595d05f90db0a13e85c1c7d4a59982246fe7b81b4bc4ba5fd57ea9f999d336ee9296
TLSH
T1B6212C2F00FCFD750D644057E3137D63D1C6B21D0689AB2036DA9420A7A5B9F6ABFB42
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2422AAEF-00DB-4E1D-8832-96996CA54912}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 fb6d1b075e1bfdfebc0eb90cabb04e124c1d3265963c1f93e7ad59dc8786096b
MD5 301d7e514d60fd638f53557ef8ce713a
SHA1 928f447b048e5a4b3050b5f31196db9d07463324
SHA512 49b207293531c3b9ccc37f02f229a7d73fdae6d6a5b5a5a7a55488c33a3921dfb52df7649753e16bfaf29b7da91acbc1b69bbaf0ac62acbfbc8d8b3b4e6315bb
TLSH
T158D02B6322160674C714713B40C2E58C1201C11F008781402E35F91C5E444E10D85881
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2422AAEF-00DB-4E1D-8832-96996CA54912}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 36c9a2f20b3e5d5e3df6bcfde580e62d891f017611a18cb654fa8cf357f93b6a
MD5 d8f2c1852d5008984e0aade8721ee982
SHA1 5ceecc0bd8560d11a324b050d893b4643839ce98
SHA512 d2258250e215f174b07e8dafa18e65775c41c44ac3f62a1d0fb005a2ff8211b019615e3be4d5cc486df9c88ce93a7be5c7cc9d0625565cc1629607884a94cef8
TLSH
T10ED0121372420278C41020371043654D0601C10F408781406838C51D6E184541A16481
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2422AAEF-00DB-4E1D-8832-96996CA54912}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2da4fcf6bc62d28dfd57602a3aa084a048821cf1bc468ee6b4a38fffb47e77ec
MD5 8e35ff3302ba74fa5cd6af1b0120a86e
SHA1 ada57617eaed7c35dd5b461ace5533a5b96c004d
SHA512 01e73d3e2a4edc5423f7ebde1816b8d549c9ef91337318035c9b4bdec3811ee68b2fc1967037ae8abc4a5e53ba77e5edd57386ff2bd2b56fd79fe46fa2067a52
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2422AAEF-00DB-4E1D-8832-96996CA54912}\wv2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

092c9d9b-20e7-4e1b-b7a2-5660503ce04d.tmp

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2422AAEF-00DB-4E1D-8832-96996CA54912}\wv2\EBWebView\Default\092c9d9b-20e7-4e1b-b7a2-5660503ce04d.tmp
Size 5KB
SHA256 9a65b2e35d89c315e9e387221e908193454e79b72fefc479bd4ca6cdb81a489a
MD5 59451f76a9df3f21de4f3a1651161c6c
SHA1 2ad0004a0b8c1d63ad0b485b4d7234ad372c6a47
SHA512 d892b7c1f0499f17c30a5eeffa5a3aa2605ffe171f26f426a1ef300b9cb0722073dcdc4c6bc8dcb2c392ec87c356b25c7ef70891b23879057909a61c793cc892
SSDEEP 96:stI3/dRZaRzoYNbb9lkWSEo5h16ZZs7/x+6Mhmuecmje5IK+gYN7I8XM1C7K:st8stlo+sV+Fijmug6K
TLSH
T138C195066E28787B4CC6E158BA39BA43D2F9607271D51E58EBF8461C08EB6CC2307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2422AAEF-00DB-4E1D-8832-96996CA54912}\wv2\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2422AAEF-00DB-4E1D-8832-96996CA54912}\wv2\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2422AAEF-00DB-4E1D-8832-96996CA54912}\wv2\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe595809.TMP

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2422AAEF-00DB-4E1D-8832-96996CA54912}\wv2\EBWebView\Default\Network\Network Persistent State~RFe595809.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2422AAEF-00DB-4E1D-8832-96996CA54912}\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2422AAEF-00DB-4E1D-8832-96996CA54912}\wv2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2422AAEF-00DB-4E1D-8832-96996CA54912}\wv2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2422AAEF-00DB-4E1D-8832-96996CA54912}\wv2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2422AAEF-00DB-4E1D-8832-96996CA54912}\wv2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2422AAEF-00DB-4E1D-8832-96996CA54912}\wv2\EBWebView\Local State
Size 15KB
SHA256 b4e84e338567eddcf24f6caf216fbfd45b764b0eecc42e6ff16f8b23772ae25f
MD5 90a8426118e36c51cd006fa9f2a54083
SHA1 79d9d7e80ee777a7da5e6d1099d336a0f06bab3f
SHA512 83c35bfc74c9873edd42669910612c06956fccc9f3d60b356b1620d75ce2b4523d3b19f94e86fb96b38ea16459d2b7a16a7c872f6cf8ac220804830707be0cc4
SSDEEP 384:h+aQikB+z/xvxjg/qhEwNBS6CK/w/isdiF9z+:s/UxvxjgC+SI/issFF+
TLSH
T1A3729E3B68793D3395B7EA05794957ABDBB884B291C27D788EED5F0C06C72980342C06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2422AAEF-00DB-4E1D-8832-96996CA54912}\wv2\EBWebView\Local State
Size 2KB
SHA256 9d7c42d0948f8296f6c2206d5fac317080178a2a16674e8bbb6157d87f9a1fae
MD5 e0ec39dd6498b5097d55606ea7e4967f
SHA1 a5c8d75f462d31c5378fabf3acb90d721568c9e4
SHA512 3c36fb40b5a01c7c624991c752274b906f600c69fddacf7e03dc364d1a0ebaabf8980d50e70c009c82b70c5473c23f93af65ce3d35471253070d79cc8176ab9b
TLSH
T17E51B5337C10AA3799B286467D4ABB338F7540A59B922F15EADD0B0C11DB90C2747C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2422AAEF-00DB-4E1D-8832-96996CA54912}\wv2\EBWebView\Local State
Size 3KB
SHA256 b5722da3838dbfc5786ef8e565f34fdcaf71f5ca8b01c54dc3389434a378a549
MD5 afd2fa88c69f7fc6948150945871d1ec
SHA1 27050c227f90f403fc62ef69133091e4501c4021
SHA512 172466f2a2d9888ff64323098ca131986cbf184f4fa3b4a28a309b4b5fb4393a7a06e988f36a5ecc3b81bcd6a677ef7e9932765254dfe12c20aeb78f1f0ff1a4
TLSH
T15471B57B7960E93B4DB28A45BC857B26ABA14036E6C53F59DAEC0F0C11C768C2343C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59011f.TMP

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{2422AAEF-00DB-4E1D-8832-96996CA54912}\wv2\EBWebView\Local State~RFe59011f.TMP
Size 1KB
SHA256 e5fcbc183dceb589a19b9b341628f0ff7d77a3a1dfc050001f37365d21e0bfc3
MD5 98d6eaf12288144194c9f6f4a562c261
SHA1 0891e34687ed2c2a873c7b0bbaae20319a79faf4
SHA512 fe20cf1ed9501242995a6eea58d4b12dcdd9b2110fb0b0154440152d91754c51c658ca1a5ad724479b1522a4594ecf9d48bfca7708402c867baa98c1d8fe31f6
TLSH
T11A3174B668A09A32AC5251873641FBB75F3100BA93811F04A9DE0B0C22E780C6B2BC33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/932-27-0x00007FFB171C0000-0x00007FFB171C1000-memory.dmp

Download

memory/1444-192-0x00000203CC760000-0x00000203CC812000-memory.dmp

Download

memory/1444-193-0x00000203CC510000-0x00000203CC51A000-memory.dmp

Download

memory/1444-191-0x00000203CC4F0000-0x00000203CC50E000-memory.dmp

Download

memory/1444-188-0x00000203CC480000-0x00000203CC4A2000-memory.dmp

Download

memory/2552-109-0x00007FFB171C0000-0x00007FFB171C1000-memory.dmp

Download

memory/4904-592-0x0000000140000000-0x0000000140A66000-memory.dmp

Download

memory/4904-591-0x0000000140000000-0x0000000140A66000-memory.dmp

Download

memory/5276-865-0x00007FFB17E60000-0x00007FFB17E61000-memory.dmp

Download

memory/5276-864-0x00007FFB18580000-0x00007FFB18581000-memory.dmp

Download

memory/5640-932-0x000001BAA72F0000-0x000001BAA72F1000-memory.dmp

Download

memory/5640-930-0x000001BAA72F0000-0x000001BAA72F1000-memory.dmp

Download

memory/5640-937-0x000001BAA72F0000-0x000001BAA72F1000-memory.dmp

Download

memory/5640-941-0x000001BAA72F0000-0x000001BAA72F1000-memory.dmp

Download

memory/5640-940-0x000001BAA72F0000-0x000001BAA72F1000-memory.dmp

Download

memory/5640-939-0x000001BAA72F0000-0x000001BAA72F1000-memory.dmp

Download

memory/5640-936-0x000001BAA72F0000-0x000001BAA72F1000-memory.dmp

Download

memory/5640-938-0x000001BAA72F0000-0x000001BAA72F1000-memory.dmp

Download