45bddd53f8138278b93bb88731e5e2fbfbad4cc545578faea30b047b6bd639c5

Analysis

user interaction
yes
max time kernel
68s
max time network
69s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/07/2026, 03:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Update.exe
Size 8.1MB
Sample260730-dk69jsah46
SHA256 45bddd53f8138278b93bb88731e5e2fbfbad4cc545578faea30b047b6bd639c5
MD5 63bbb88e782a012f1ed7205763acf047
SHA1 f24402b5952b2d4a48640cb274dcd0d8241975b5
SHA512 e736d68ea9ce095d66e710e095b1ffb5ef24b5475b99802cd3434e5b7b8642fcfdd51f12fe9b471a3f8320fc475db781204c15d955e5e97cd3cd3cdf2d7b8327
SSDEEP 98304:xmE/FxwK2eMVH8YexcpjDkAhr4+F/XaWFkgsEXev8wcFOvkSxMy5/Dn:xNH0eWH8YexcpjDkAhcqyW9FOUgBRD
TLSH
T13C86CFA9B6BC00D9E467C2BCC2965223E772B55523B057CF5A648AF60F23AD01E7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Real.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1544	powershell.exe
4768	powershell.exe
1544	powershell.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Real.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Real.exe

Executes dropped EXE 2 IoCs

pid	Process
440	Real.exe
1048	Real.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Real.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Real.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1048	Real.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Update.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298543256372103"	Update.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Real.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\projectreal\shell	Real.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\projectreal\shell\open	Real.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\projectreal\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Real\\real-1.7.5\\Real.exe\" \"%1\""	Real.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\projectreal	Real.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\projectreal\ = "URL:Real Protocol"	Real.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\projectreal\URL Protocol	Real.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\projectreal\shell\open\command	Real.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1544	powershell.exe
1544	powershell.exe
4768	powershell.exe
4768	powershell.exe
2180	Update.exe
2180	Update.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe
440	Real.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
840	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1544	powershell.exe
Token: SeDebugPrivilege	4768	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
440	Real.exe
440	Real.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
440	Real.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1544	2180	Update.exe	80
PID 2180 wrote to memory of 4768	2180	Update.exe	86
PID 2180 wrote to memory of 440	2180	Update.exe	88
PID 440 wrote to memory of 840	440	Real.exe	89
PID 840 wrote to memory of 1716	840	msedgewebview2.exe	90
PID 840 wrote to memory of 4436	840	msedgewebview2.exe	91
PID 840 wrote to memory of 4436	840	msedgewebview2.exe	91
PID 840 wrote to memory of 4436	840	msedgewebview2.exe	91
PID 840 wrote to memory of 2192	840	msedgewebview2.exe	92
PID 840 wrote to memory of 2648	840	msedgewebview2.exe	93
PID 840 wrote to memory of 2648	840	msedgewebview2.exe	93
PID 840 wrote to memory of 340	840	msedgewebview2.exe	94
PID 840 wrote to memory of 340	840	msedgewebview2.exe	94
PID 840 wrote to memory of 340	840	msedgewebview2.exe	94
PID 440 wrote to memory of 1048	440	Real.exe	95

C:\Users\Admin\AppData\Local\Temp\Update.exe
"C:\Users\Admin\AppData\Local\Temp\Update.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$p='C:\Users\Admin\AppData\Local\Real';$ex=@((Get-MpPreference).ExclusionPath);if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p };$ex=@((Get-MpPreference).ExclusionPath);if($ex -contains $p){exit 0}else{exit 1}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAIABFAHgAcABhAG4AZAAtAEEAcgBjAGgAaQB2AGUAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAByAGUAYQBsAC0AbAB1AGEAdQAtAGwAcwBwAC4AegBpAHAAJwAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcgBlAGEAbAAtAGwAdQBhAHUALQBsAHMAcAAtAGUAeAB0AHIAYQBjAHQAJwAgAC0ARgBvAHIAYwBlAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4768
- C:\Users\Admin\AppData\Local\Real\real-1.7.5\Real.exe
  "C:\Users\Admin\AppData\Local\Real\real-1.7.5\Real.exe" --real-launched-by-updater
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:440
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Real.exe --webview-exe-version=1.7.0 --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=440.4900.11443141924819810127
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:840
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x174,0x178,0x17c,0x150,0x184,0x7ffed3f6b078,0x7ffed3f6b084,0x7ffed3f6b090
      4⤵
      PID:1716
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1852,i,2425210319179489632,6110899393743389138,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1844 /prefetch:2
      4⤵
      PID:4436
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2156,i,2425210319179489632,6110899393743389138,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:11
      4⤵
      PID:2192
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2388,i,2425210319179489632,6110899393743389138,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:13
      4⤵
      PID:2648
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3612,i,2425210319179489632,6110899393743389138,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:340
- - C:\Users\Admin\AppData\Local\Real\real-1.7.5\bin\Real.exe
    "C:\Users\Admin\AppData\Local\Real\real-1.7.5\bin\Real.exe" --rbxversion
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 aaefbd2226ce7536a8e8926e59c12f01db4e24845153f67185b01ff90ab8bdde
MD5 2cad48500214b2c516f416fa81eae7f7
SHA1 18667db8df11a7eaf6ee561311b045f19c3048d3
SHA512 fa4bb946488f5b0d0bd3e3227eef016a64d2bd3a266b7297d954bd8b2dc7cac10d7118adc4c4547ffa7d935d4690de9e6a154f6fe0c6780d748de00e1d0988dc
TLSH
T14621AB33B7ACC234C8D9117A1088AD01B1B5C3C7449ECECB7B84C508A57F5DADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 567cf75591bd909fc78507dca1ea077ebb1651f9b570473acce08ce6c05a4b2d
MD5 32c2a89718d3750170bf62c0ff9d140e
SHA1 ea8556251fc3246f67d5a6cd035f27f349eacee3
SHA512 ba83334b3fcebbb3953f5a44dd962c6a18ab9c89fe52d4adf7d997348556cc383bb2ed7abfbae2595379add76c2356312fe3fe7eab89ae2819b366bf41daa0a4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6c44a4372f2b72782cb96730b2d840336e145b7e6a7c61a7f0c1b87859a610d0
MD5 a7ef46008a554a958414b6a358d9e8a1
SHA1 4e2bea06b6fbba4f495e0a426451050dbba087bc
SHA512 0ed05c948fc43f97333ecdd9df9983d7c8c91a2ab7e817e51ee3f0fb8eff414fda0acfb089c56a7e54b40913e91fbda95863c755635543943b199107830c7c09
TLSH
T1EDD0121232250134C42075331912A2080400C11F810640087838953D2B140D00907482
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 e2a1fc2731477d6beb1aca8f577a3ccf50a3e0dfb602f479930dad1be07bbfef
MD5 506deec5c732e0cd7498a3acd691acdf
SHA1 1892afc2335c5c228837518cec6bc408eecf27bc
SHA512 29f2dc52ce20168693f4633888383991c86e9192dc049fa18c29c92426f5d36b08c511e57e1e45d177c0df953f33ca26f5f29986c76e0cffcc4b23baab1c835f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 456B
SHA256 46adbc865f1901bc99742a7ec4b8458ae38a0d0fba45ec57a6dc093aed67cc24
MD5 c26b5650ccbf0f2e6a62de8f2919725c
SHA1 be36dbed1dacd44bf73aef6f2a5b13751b6700b1
SHA512 9c677224e23d4de61e4193a90ba92587a77e8c8b87f48edc9c76acfba7c8cf8574c8afc58bfdedfe73507b57d6082f60872d18983bcaca2353b3837929ecf24e
TLSH
T10AF08C64748E9369CF08733068C6F9973632B9AC04C30FC3044652B01382F2EBD61984
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 c584d730789a23bb3f602f82a7930e41bf652dbb592ca3df5e368b338aa6653a
MD5 675ff959622ca902cedfe22bdace4510
SHA1 b98ac73fe564e1eae36017d3eb1d6a955c1119a9
SHA512 144a5d7dd8f7a87d70a59b9f75d499e597b32b90f01f58746c94437b78a46aa62c48a4cd2bbd319d328b0f8ea92f91c99c8cc5a5f7b3b54c187e8d47b20f911b
SSDEEP 3:LstlNllkll/lcall:LsX3lEt
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 1KB
SHA256 9980aafdfb7653cfca6883000efa769c47cb933fc7a0c375be0b9a98d7dd1cb6
MD5 b4223e657b8652993140b985be09a0d0
SHA1 9dfdf53e79111e25d752e4ff1fe5a15ea73ab353
SHA512 6156b2bb4d0972c0760df54047eeba1029ef03103241540398da6ec2dbaa56dfde4d0ca129fd4bf4d7ab9e553d24b979bf953e7719f934552e233317dda4da69
TLSH
T167318572E5806F331DC659A9B507BF0B0E215062C3555E4CA2FE4B1C12EF69C7A16C32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 2KB
SHA256 4c1ad76713076d7889f4e06e40baf0d505d721ad947c531b1899298248a4b66e
MD5 24c7a9859e8055059c3ac929b2cfe5dc
SHA1 2674ba302201aaf88cf0b4f4a7fdcddbd8f89ef9
SHA512 dd7ac4089568c5c83edeb7aa84d6b178d39c3f533d93f515873fd9e741c0ac40508f47d33ef6ca8135b02eacf58cec5950a6903a11ee734ff04d9968edb3836c
TLSH
T1C5519473B844AB374AD38968B84A7F075A3551A1D7662F58D6FD0B0C01DF69C3702C2A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 3KB
SHA256 d5aeab6d8722b373b3323e07f5ee7e7b4430e37ae6d591c06c297ff55cbcb5ae
MD5 1789a05e7a9e1e9c906a7b341a8b8ff0
SHA1 936e5207d93891bc73a5909813365daaaab9fda7
SHA512 deeb15a20f110ad81c1870a8ee26bf5175220acf7ea9b872e3037bc87334acea1a030fc6d2bc6b285de135ea71bffa2f55580f9673ae57842c8ef8f4c8619b9f
TLSH
T1B6719637A954AA274EE39D54B8863F0B66615123D6953F99D6FC0F0C01DB7D82342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 16KB
SHA256 c959a3a04de4fc1ffa1417f721bdb00abc01c28819c6a49471fd412531be08d8
MD5 c55e02815ada614a7b5aafc88ba34c63
SHA1 6aa4daf21cc65506dc314e8e0ac25c90d5ed428b
SHA512 dbad44d12680c237eac8adef4ee9aa96f0594b6b7fe971f77a7d1b92b1fca1b8794fbccfb59068cce850b5a052ee77af7af9d92b031810836c1e2ad50bdf7953
SSDEEP 384:zF+aQikB+z/xvxjg/qhEcNbnXpMowyi9zY:U/UxvxjgC+qWowyiFY
TLSH
T1F4729E3B55686E235AF3E914B94E5B4FDAB88472D1C17ABC8AFD4F0D06CB2D41342C0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe588028.TMP

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State~RFe588028.TMP
Size 1KB
SHA256 f7f94eaa8ea4b02ac37eed5fce8c49d4d28c255386774e1364c5fb6e183e16db
MD5 756788e202e7b02bc0de67b4aa76a827
SHA1 11f9c7df5510137d8b0063fa95bedb142fa0a9c8
SHA512 d2c995c9155eb243ccbf4d763932537b0290a5e4d1ae2493a896f64062e680cd6990ac0c6fead6b9f6d81b3b79dd6993ce9ad442ba14cd33f7d9ab14229238d9
TLSH
T130216577D4846E7719854869B507BF0B0D515062D3555A0CE2FE071816EF9987A27C32
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Real\data\config\settings.json
Size 208B
SHA256 6c0f89f0d156d08ca1922af2e89d72b017ceacd83b3e83b55f00e3b492e85bb8
MD5 acdc681f252e500448b4708ba38ca191
SHA1 b5bd6f4510457eb01058898bb45458cd401d86dd
SHA512 ddae681dfd9b9c9b7a7ce5f43e4d1c91e6725bb9917ba60cd9f51217c01ad0891eab8be05d6c925425e0e04bc589dcd726894a896e628e636af55a9aa5c7238c
TLSH
T1D1D0C9509CF50A7216DA9569046B0021A1369C6752AD3E3D78EA461D9F8A57045B9384
MD5 SHA1 SHA512 TLSH

Submit Download

current-version.txt

Path C:\Users\Admin\AppData\Local\Real\data\meta\current-version.txt
Size 5B
SHA256 98594a3b3cc978c5e9824f1cd88414949f7208bb9addc14186429543afc6639c
MD5 5c3484771d810fb8db11cebf8ccc952f
SHA1 b26853e0fc7b2e0fccdc39c5fe508249d0d5d410
SHA512 92640448d966dac7dca20d53e5de94e34d8ec20a1457eee7aeb5f2ed857579b0d38a3db299544181b6fb8bedf166196b02bed2b08f912f6f83cc110d30f8dc7c
MD5 SHA1 SHA512

Submit Download

Real.exe

Path C:\Users\Admin\AppData\Local\Real\real-1.7.5\Real.exe
Size 15.1MB
SHA256 ae7388c0c5a37c0be684d4a204f7b2ce8957465e1f37826d8b76f81f7fb85908
MD5 37ca2d04c0950aa9080a7e57a38b2324
SHA1 f3e1b7d5d1e69e4f5aa0395144a67668462f06a6
SHA512 90af2ecd0fcd9d6c778ad165da12137a9045569a9f152455af8490188d2c2349b0bc2a4b5d0825eee640d41b7ae83221bcab04522aa7fe27fc678ba25772acb9
SSDEEP 196608:iYkzLF7UFmC6ufQxTjcAwKAhZsRTkRpB0hEKW4JJnmMc8U3v+t2:tBQxcphCmDCrWCRm/62
TLSH
T1B1F69D07F29581E9C0ADC0B8835AA633FA31B8894731B2DF5BE44B512E16FD06B3D759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.dll

Path C:\Users\Admin\AppData\Local\Real\real-1.7.5\bin\Real.dll
Size 3.4MB
SHA256 1c831669fa786a5e5381e6df1e66ccee7cb54a30387b4612bc042d9b88524153
MD5 683b41cb4d247e343a4715fed0810c54
SHA1 c7a71ca7e27737e9ade5a92b4538bef639cb18f4
SHA512 3e2e7d116064f601834cae37fca2a7ee3cc3a4c8e3045a1a9b4e5a304679ba03875c6aeec569c61c5906def9da9fbbe35bd9f5372fe88a569142b4c2af67a91a
SSDEEP 98304:b/JfGZBzQYzgF491uru9VmVGud6D1iLvAPr:KQR491uCPUiiEPr
TLSH
T1A6F5CF3E86CFE9DDF7B9916C10638AD1DF1B976263F5ACC62D0EA01506482D6883F217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.exe

Path C:\Users\Admin\AppData\Local\Real\real-1.7.5\bin\Real.exe
Size 3.9MB
SHA256 1f727a984987f269fd39821042b022b5b54f95bb6ddd20d784e79c4a7525df0d
MD5 2cbc2ace80949abe1086e1c7e3eb6b39
SHA1 145924441ec14e3dcfdf03a0bde11dd06ca80a50
SHA512 7be051da0670d9450102fbdf65e10fa0102083e4b8c096d378f359b3ec9394d8d9b3b20ac4228b10cb8056489e4a488d93fff30deed1fcc06fe415a25d2d8af7
SSDEEP 98304:l6iWicT66Y+Iox5WIMAqVHrQ60B9Xc4XNGZy3Db8:NWi/wIMYIMAScxXtGATb
TLSH
T18F16232BB96B9CBECC87C5348347D96748127CCB0F71F9DB0B455A6A2D522E42B30726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spoofer.exe

Path C:\Users\Admin\AppData\Local\Real\real-1.7.5\bin\Spoofer.exe
Size 2.7MB
SHA256 61205ef3bb52bdc1f45453a88dfc43b1e65e0e574c79da2393bac288d06e653d
MD5 0ff1f63e40a320345243790a19b314d6
SHA1 fccd578ff5c5ebc254774e485d673d1af6b57407
SHA512 b79b79526197266b31b1a95c37477c78a733952fc9189b6f5cad19256116bde5ed9f524b9b21d93de9e49a8e577aa532c537f54fc7ffbdd297cf2324b2e5f95c
SSDEEP 49152:vWJhio1u7PS8nbWE9UT2xRLUdorOyiCsBgdxTEL21IuIPkknEqweIQye38RrlB:eJtQnboq5Um0lguL21ITA638RhB
TLSH
T1DDD5236AEAA410B5E1A7C0BCCA978907FB72788D07719FCF17E149A51E13AD06E39311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

real-mcp.exe

Path C:\Users\Admin\AppData\Local\Real\real-1.7.5\bin\real-mcp.exe
Size 1.6MB
SHA256 e8f4c9336d141cef5c2277867fee49042f1ddb66c745753e4fb001edf799676f
MD5 190eeba2d3f52b8a0d1e64380a5882e0
SHA1 b3c8b335e16a64e87c01fce93b8f79af747081ab
SHA512 2edb8ebaf09a46118dfcd7486af6ecf9cbafcae49704bb786b251d20c751b8a4e4d5ff09610fbfcff9c911e5da130eb47a4bf447ddd7985177cffd34ed9a398c
SSDEEP 24576:eWa997F91SlNoZ4uo6BkEc9Ha5AXvK31pdOmGFM3VIH06iy:ra997F9ANoOu8EcJSAXvK3ZAYIU6i
TLSH
T192857D03E69580EDC46DC178C3579A36AA73B88D0A34B2EF6BD04A513E27F906F1D719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 1KB
SHA256 88f0e5b9292e214a152885ca1ed00d163f6ae0eba57aa34983190ef41a8bc42d
MD5 4da4f4637111cff3648b030840e294d1
SHA1 8cd54f45c410dec6919c6b9619a1b94eb3f2eb12
SHA512 d3a41fd0705d61a08a643f052b3d9e6823bf8858349772e3d6d30d63d7195b88bfe6a93f8ef0d3ebbede068f2fb336928be6af81275b93eed2d4c8d2cb4ce807
TLSH
T147210ABC0A78E5B60542E053CB115F4B91ACF80764052D3036B28888ABB5FBFDE0BE42
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_yv2ysxth.rjy.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yv2ysxth.rjy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

luau-lsp.exe

Path C:\Users\Admin\AppData\Local\Temp\real-luau-lsp-extract\luau-lsp.exe
Size 16.3MB
SHA256 0da4f09d474e41074f4ec52bfef01eb90c014928358eda88f6a5afad5319b537
MD5 be087717213e34f06e6198159d9c73dc
SHA1 60e2ca8a33531199a644061238b1605f78b8ae66
SHA512 fdc7b914eb7425bc17c23a7e52c7256f0263448ef4e0469302386a17b6ed3d5241bdc4cc2c43092c521368b9c09540ade980deffa16c201455b5a9a8650104b6
SSDEEP 393216:XdTfwgggjgzggsgTguwttbgNlggigggXsgJgUQLCgggggCNc/gggga4ggggcgggg:NRggjgzggsgTgugtbgNlggigggXsgJgB
TLSH
T132075B3A21AC01DCF1BBD0BD8BDB9E47D6B2340903319ADF0591569A1E1BDED4A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

real-luau-lsp.zip

Path C:\Users\Admin\AppData\Local\Temp\real-luau-lsp.zip
Size 4.9MB
SHA256 faea1b177f4761e4c34e0dab72009a2fdd00f21d61f3f7b7c1fe1ac3f38a05d2
MD5 1b284c21f9cd1359868016692ace2db2
SHA1 24792218a8d9d76b3f69a274ef6190cd33106f7e
SHA512 fadbb5db04d125e12a5d1e7153026efdf568d51a1b15afa6d732a75fdbfab87eb14a5e2b64364fd47b4ab4b9c4e5fed8ffe8d5e7e09fb8e396e302879f9f6c74
SSDEEP 98304:sBXd2Q4Jz8eM42l/+T/5/Wbv9z8LT6Eb7OuITvBFkF9ba9v:iXd2Q4u+iw92wLT6AOt7BFkF4N
TLSH
T1203633DCC801D7A32B91C32FF9DEE523338FC254CC30316556A85E453A9E578EABA586
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/340-278-0x00007FFEF2F90000-0x00007FFEF2F91000-memory.dmp

Download

memory/340-400-0x0000029740670000-0x00000297409E8000-memory.dmp

Download

memory/1048-352-0x0000000140000000-0x0000000140A98000-memory.dmp

Download

memory/1048-350-0x0000000140000000-0x0000000140A98000-memory.dmp

Download

memory/1544-31-0x0000026B7ED90000-0x0000026B7EDA0000-memory.dmp

Download

memory/1544-39-0x0000026B1B930000-0x0000026B1B94C000-memory.dmp

Download

memory/1544-44-0x0000026B7FEE0000-0x0000026B7FEFA000-memory.dmp

Download

memory/1544-43-0x0000026B7ED50000-0x0000026B7ED5A000-memory.dmp

Download

memory/1544-42-0x0000026B7EDC0000-0x0000026B7EDDC000-memory.dmp

Download

memory/1544-41-0x0000026B7ED40000-0x0000026B7ED4A000-memory.dmp

Download

memory/1544-40-0x0000026B1BA10000-0x0000026B1BAC3000-memory.dmp

Download

memory/1544-46-0x0000026B1B960000-0x0000026B1B966000-memory.dmp

Download

memory/1544-38-0x00007FF4F02F0000-0x00007FF4F0300000-memory.dmp

Download

memory/1544-45-0x0000026B1B950000-0x0000026B1B958000-memory.dmp

Download

memory/1544-47-0x0000026B7EDA0000-0x0000026B7EDAA000-memory.dmp

Download

memory/1544-23-0x0000026B7ED90000-0x0000026B7EDA0000-memory.dmp

Download

memory/1544-22-0x0000026B7ED90000-0x0000026B7EDA0000-memory.dmp

Download

memory/1544-30-0x0000026B7ED60000-0x0000026B7ED82000-memory.dmp

Download

memory/4436-398-0x0000021F69600000-0x0000021F69978000-memory.dmp

Download

memory/4436-159-0x00007FFEF2F90000-0x00007FFEF2F91000-memory.dmp

Download

memory/4768-101-0x0000023DC8A20000-0x0000023DC8A32000-memory.dmp

Download

memory/4768-102-0x0000023DC8A10000-0x0000023DC8A1A000-memory.dmp

Download

memory/4768-100-0x0000023DC8B90000-0x0000023DC8C43000-memory.dmp

Download