Analysis
- user interaction
yes - max time kernel
1050s - max time network
1046s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 04:29
General
- Target RealSetup_8a30f46c7316ce665775a65576070a6ace1ecdd997352baa69cf8bd3d7568f69.exe
- Size 16.5MB
- Sample260804-e4m6fsvzbs
- SHA256 78f2843d249600549c44d831920114562d0096af3b973e96abec818293d1166b
Score
9/10
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
- Drops file in Program Files directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 14 IoCs
- Modifies Internet Explorer settings 1 TTPs 6 IoCs
- Modifies data under HKEY_USERS 7 IoCs
- Modifies registry class 44 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 51 IoCs
- Suspicious use of SendNotifyMessage 35 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\RealSetup_8a30f46c7316ce665775a65576070a6ace1ecdd997352baa69cf8bd3d7568f69.exe"C:\Users\Admin\AppData\Local\Temp\RealSetup_8a30f46c7316ce665775a65576070a6ace1ecdd997352baa69cf8bd3d7568f69.exe"1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RealSetup_8a30f46c7316ce665775a65576070a6ace1ecdd997352baa69cf8bd3d7568f69.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{0DC94BB4-AACB-4A79-AB9B-BFE1CC11DD33}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=4976.4740.82956668753864297132⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\RealLottie-{0DC94BB4-AACB-4A79-AB9B-BFE1CC11DD33}\wv2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\RealLottie-{0DC94BB4-AACB-4A79-AB9B-BFE1CC11DD33}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffdf73bb078,0x7ffdf73bb084,0x7ffdf73bb0903⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{0DC94BB4-AACB-4A79-AB9B-BFE1CC11DD33}\wv2\EBWebView" --webview-exe-name=RealSetup_8a30f46c7316ce665775a65576070a6ace1ecdd997352baa69cf8bd3d7568f69.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1744,i,14681044087428751616,16369360804301958142,262144 --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{0DC94BB4-AACB-4A79-AB9B-BFE1CC11DD33}\wv2\EBWebView" --webview-exe-name=RealSetup_8a30f46c7316ce665775a65576070a6ace1ecdd997352baa69cf8bd3d7568f69.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2040,i,14681044087428751616,16369360804301958142,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:33⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{0DC94BB4-AACB-4A79-AB9B-BFE1CC11DD33}\wv2\EBWebView" --webview-exe-name=RealSetup_8a30f46c7316ce665775a65576070a6ace1ecdd997352baa69cf8bd3d7568f69.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2396,i,14681044087428751616,16369360804301958142,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{0DC94BB4-AACB-4A79-AB9B-BFE1CC11DD33}\wv2\EBWebView" --webview-exe-name=RealSetup_8a30f46c7316ce665775a65576070a6ace1ecdd997352baa69cf8bd3d7568f69.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3588,i,14681044087428751616,16369360804301958142,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:13⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "try{ $ex=@((Get-MpPreference).ExclusionPath); $want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll'); $stale='C:\Users\Admin\AppData\Local\Temp'; $miss=$want | Where-Object { $ex -notcontains $_ }; if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1} }catch{exit 1}"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll');$stale='C:\Users\Admin\AppData\Local\Temp';foreach($p in $want){ $ex=@((Get-MpPreference).ExclusionPath); if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }};if($stale -and @((Get-MpPreference).ExclusionPath) -contains $stale){ Remove-MpPreference -ExclusionPath $stale};$ex=@((Get-MpPreference).ExclusionPath);$miss=$want | Where-Object { $ex -notcontains $_ };if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1}"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAIABFAHgAcABhAG4AZAAtAEEAcgBjAGgAaQB2AGUAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAByAGUAYQBsAC0AbAB1AGEAdQAtAGwAcwBwAC4AegBpAHAAJwAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcgBlAGEAbAAtAGwAdQBhAHUALQBsAHMAcAAtAGUAeAB0AHIAYQBjAHQAJwAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "Real\Launch" /tr "\"C:\Users\Admin\AppData\Local\Real\Update.exe\" --via-task" /sc ONDEMAND /rl HIGHEST /ru "" /it /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/projectreal2⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffde2bdc188,0x7ffde2bdc194,0x7ffde2bdc1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,7429569403301150753,14911349516254166764,524288 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,2870233678381893591,8207317471862158008,262144 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,6535996121444521985,4193753719894595505,524288 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,1034298353175059437,3519937204457357007,2097152 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,2777082067267648239,1397777167989224234,2097152 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4968,i,14289011877321940136,8563240586449920481,2097152 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,16482995004838675899,18424367199683161753,524288 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:83⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,8767808351873267002,9540712484091564387,524288 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,2694523828523917585,4042705282140713421,524288 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,7662050188986938242,17907185073362132840,524288 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,9807501075776693051,8442543401655330325,524288 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,9807501075776693051,8442543401655330325,524288 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,9487265377083516624,10766938528747649586,524288 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,1051931247874914485,7801108081649149964,524288 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,10091818841582003596,8762098712745718810,524288 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,7212265519560297143,16212576308962814472,524288 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,10946560471752566936,8237971139920159178,524288 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6912,i,5361185981306651029,15183829161899420984,2097152 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,17630274544346950850,593622892301054153,524288 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,10691510574632956077,2438581543190928479,524288 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,2396231239259211380,12795339921389185317,524288 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,12049021022950617024,8202406587918545773,524288 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4992,i,1038586831681637760,5601825897637546326,262144 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,11592935212784759732,14046276447974775577,524288 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,10657412229777558697,13658667092348674815,524288 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,6296038160328634966,825849074198362644,524288 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,6026753230661498406,10515951446936009484,524288 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,436454172774109853,7712768553311981088,524288 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,3597272472597948268,13513840381852658674,524288 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,1921385850418855501,15042157151943900189,524288 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,5090728333735878834,12406121399589335422,524288 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,17717128026170289261,17595348991961127027,524288 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,13396410853681948565,16575068782198152904,524288 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,9630751858775218099,10550680110801712709,524288 --field-trial-handle=2608,i,12908709828346030874,12345015324294210441,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:83⤵
-
-
-
C:\Users\Admin\AppData\Local\Real\Update.exe"C:\Users\Admin\AppData\Local\Real\Update.exe" --processStart Real.exe2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll');$stale='C:\Users\Admin\AppData\Local\Temp';foreach($p in $want){ $ex=@((Get-MpPreference).ExclusionPath); if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }};if($stale -and @((Get-MpPreference).ExclusionPath) -contains $stale){ Remove-MpPreference -ExclusionPath $stale};$ex=@((Get-MpPreference).ExclusionPath);$miss=$want | Where-Object { $ex -notcontains $_ };if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1}"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /query /tn "Real\Launch"3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /tn "Real\Launch" /tr "\"C:\Users\Admin\AppData\Local\Real\Update.exe\" --via-task" /sc ONDEMAND /rl HIGHEST /ru "" /it /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Real\real-1.8.3\Real.exe"C:\Users\Admin\AppData\Local\Real\real-1.8.3\Real.exe" --real-launched-by-updater3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=6016.2672.156548606608948166994⤵
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x13c,0x164,0x168,0x144,0x174,0x7ffdf73bb078,0x7ffdf73bb084,0x7ffdf73bb0905⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1936,i,18122276547977101405,13165296305422888303,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1720,i,18122276547977101405,13165296305422888303,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:35⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2316,i,18122276547977101405,13165296305422888303,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3472,i,18122276547977101405,13165296305422888303,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1796,i,18122276547977101405,13165296305422888303,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1884 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4576,i,18122276547977101405,13165296305422888303,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4708,i,18122276547977101405,13165296305422888303,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=764 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=764,i,18122276547977101405,13165296305422888303,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4284,i,18122276547977101405,13165296305422888303,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4088,i,18122276547977101405,13165296305422888303,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1884 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4660,i,18122276547977101405,13165296305422888303,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4552,i,18122276547977101405,13165296305422888303,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4684,i,18122276547977101405,13165296305422888303,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=992 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4140,i,18122276547977101405,13165296305422888303,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4664,i,18122276547977101405,13165296305422888303,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2920,i,18122276547977101405,13165296305422888303,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4716,i,18122276547977101405,13165296305422888303,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:85⤵
-
-
-
C:\Users\Admin\AppData\Local\Real\real-1.8.3\bin\Real.exe"C:\Users\Admin\AppData\Local\Real\real-1.8.3\bin\Real.exe" --rbxversion4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Real\real-1.8.3\bin\luau-lsp.exe"C:\Users\Admin\AppData\Local\Real\real-1.8.3\bin\luau-lsp.exe" lsp --stdio --definitions:@roblox=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\roblox.PluginSecurity.d.luau --definitions:@real=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\real_executor_apis.d.luau --docs=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\roblox-api-docs.json --base-luaurc=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\base.luaurc4⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffde3ccc728,0x7ffde3ccc734,0x7ffde3ccc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1792,i,7889626791926740681,4226042343609054470,262144 --field-trial-handle=1996,i,17297043571548842194,2616747475858807163,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1984 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1660,i,11025375828560885725,448311724066192632,524288 --field-trial-handle=1996,i,17297043571548842194,2616747475858807163,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2284 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,11189187144805340704,16911435325585239995,524288 --field-trial-handle=1996,i,17297043571548842194,2616747475858807163,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2588 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,5965883587806006112,7634106387363997316,2097152 --field-trial-handle=1996,i,17297043571548842194,2616747475858807163,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,17407140567115203424,6875574920301402529,2097152 --field-trial-handle=1996,i,17297043571548842194,2616747475858807163,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4460,i,303780292031855345,13044086637942547261,2097152 --field-trial-handle=1996,i,17297043571548842194,2616747475858807163,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4492 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4688,i,18135680563168361321,15622275781466842498,2097152 --field-trial-handle=1996,i,17297043571548842194,2616747475858807163,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4732 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,12025319441779777411,12318208063532730973,524288 --field-trial-handle=1996,i,17297043571548842194,2616747475858807163,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5808,i,16153149728671065772,17338475596727166511,2097152 --field-trial-handle=1996,i,17297043571548842194,2616747475858807163,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5764 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5960,i,2119779113739397117,12514257485852096939,2097152 --field-trial-handle=1996,i,17297043571548842194,2616747475858807163,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4832 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3980,i,14767228334367542246,5005260092897539780,524288 --field-trial-handle=1996,i,17297043571548842194,2616747475858807163,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4788 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4824,i,12727066149970347013,7392727969093662765,524288 --field-trial-handle=1996,i,17297043571548842194,2616747475858807163,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6128 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4724,i,15383873425663445114,10909702463783112530,524288 --field-trial-handle=1996,i,17297043571548842194,2616747475858807163,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4796 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3964,i,11606492238222406733,13208553276980754224,524288 --field-trial-handle=1996,i,17297043571548842194,2616747475858807163,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4736 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3292,i,1832695642681705980,3031775157474770443,524288 --field-trial-handle=1996,i,17297043571548842194,2616747475858807163,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6128 /prefetch:82⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6156,i,7353006666609123036,5041423564828131219,2097152 --field-trial-handle=1996,i,17297043571548842194,2616747475858807163,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3992,i,17283331980756058406,1263723166138129718,2097152 --field-trial-handle=1996,i,17297043571548842194,2616747475858807163,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6292 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3748,i,3249240487915948674,15956642492073695664,524288 --field-trial-handle=1996,i,17297043571548842194,2616747475858807163,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3680 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller-CBRRXTV4DT.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller-CBRRXTV4DT.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe" -personalizedToken CBRRXTV4DT --deeplink https://www.roblox.com/games/6872265039/BedWars --webBtid 1785818423870020 --downloadSource web_game_join --authenticationTicket 31Ir1Vzss9ACqsw-TSXq-0eof2-QIKtHqwJRDBHsFi3YqWDppBTctpattPsgqXHtcZeojV25aNrxOk5zk92O22IU6C-kiwYinNvlMyQAOFSTDsPLpccL3cRAjWRNKkIoW46TE9bKnHLjX7XtooShooVg6oSsPYzjIdOzWpc5BsxkD9iZh1j-QH7a8p43-F6ILcBAsQmM9SEbBFjdoTlVlKFxGhH4LQNqmcJBDRW6tGsJJvrFWOO2ihZOlCRbJJgi0EGpdLFzRiYerH-bdCREQJv2syCxm9ERqy1RrjoKz5jZoov16kWv3eyk0eCf8Fq2DWQL3L2bjO8pPvLmAA2cJ7Tg9nsUbGV8t8zWYMDkfCZjCZXZI5Ldd8u8Ae90Q5JowgZCDC6eu8vBB6CzEMR0g6DLBeIkqJf3Ygedt5d3sbb7q5C3-03u5dXjTHH1enA09mg9m9ZwHF_hECmwJ21bh3HnVHKdh7ieyPbzdH1OSVieuwxihmffVB-Ry9Dbz1GwGI5Ng5v8ZbC8V4LVml5u_AfJLpxZNdn2lMU2iF7u5jE -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 54883⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6552,i,6068842831713646657,15883941265163049791,262144 --field-trial-handle=1996,i,17297043571548842194,2616747475858807163,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6076 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6216,i,15329785515013866929,7828741442000831758,2097152 --field-trial-handle=1996,i,17297043571548842194,2616747475858807163,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1580 /prefetch:12⤵
-
-
C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe"C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:y4MuDQMa4pu0MX4gZeLrwgzT3tKQ3STwXk7Z8pWXzlAF1ucZHFw-b7XsK8tyvijovO4keCxalp-NvKIzajt1sjkF7iJG3VRlZN-PNNyPPqbpx6QRtw2IWca8O_91dTcm1wW1Z8x96dn5DTSZc2VmchKEEgUZxn8KMtEnq1KMj5dCrHib9pDowc8kRWHCttOMMrMS0HV1A82eN8T-iXpnsd-M2JM78lWTla4vHIkO1HEfMFE7kOJ6Mj2Vk0Vu7x_a-kCXsX12w_tvCct5peIz8BuMSH8yLgsMJ8hFPJb3YVz7QAHo-JMa5m1PKTQSQjMiPJ9Wcy61yAQxP8vdlSIsnr01tQkkKXDSWav9L0kI4Ott0FEX7GZSf4sWfH7WjTviBCgAW8fVOarENU5F3G8RddQsL9zoWbD2vjE23QgrycP_nafajZZLscWw0bCkMz1eFGZduj6zpKdumqmkLlHC4HD1mbOnExaBhtrLCfMtgBERiM7Iz1iNokcpBvrMxk0iTiulQRTbv_gmee2SjFA4yMktqFyLOsKXpQH-FecEbhM+launchtime:1785818552431+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1785818423870020%26placeId%3D6872265039%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D5ca48d62-98f5-4d7d-afc4-43d037502011%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1785818423870020+robloxLocale:en_us+gameLocale:en_us+channel:zdrsexperimentjuly22control+LaunchExp:InApp2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
RobloxStudioInstaller.exe
manifest.json
manifest.json
edge_checkout_page_validator.js
manifest.json
Filtering Rules-AA
Filtering Rules-CA
Part-DE
Part-ES
Part-FR
Part-IT
Part-NL
Part-RU
Part-ZH
hyph-as.hyb
hyph-hi.hyb
hyph-nb.hyb
manifest.json
notification_fast.bundle.js.LICENSE.txt
tokenized-card.bundle.js.LICENSE.txt
strings.json
manifest.json
LICENSE
verified_contents.json
widevinecdm.dll
widevinecdm.dll.sig
manifest.json
manifest.json
verified_contents.json
hyph-af.hyb
hyph-be.hyb
hyph-bg.hyb
hyph-cs.hyb
hyph-cu.hyb
hyph-cy.hyb
hyph-da.hyb
hyph-de-1901.hyb
hyph-de-1996.hyb
hyph-de-ch-1901.hyb
hyph-el.hyb
hyph-en-gb.hyb
hyph-en-us.hyb
hyph-es.hyb
hyph-et.hyb
hyph-eu.hyb
hyph-fr.hyb
hyph-ga.hyb
hyph-gl.hyb
hyph-gu.hyb
hyph-hr.hyb
hyph-hu.hyb
hyph-hy.hyb
hyph-it.hyb
hyph-ka.hyb
hyph-kn.hyb
hyph-la.hyb
hyph-lt.hyb
hyph-lv.hyb
hyph-ml.hyb
hyph-mn-cyrl.hyb
hyph-mul-ethi.hyb
hyph-nl.hyb
hyph-or.hyb
hyph-pa.hyb
hyph-pt.hyb
hyph-ru.hyb
hyph-sk.hyb
hyph-sl.hyb
hyph-sq.hyb
hyph-sv.hyb
hyph-ta.hyb
hyph-te.hyb
hyph-tk.hyb
hyph-uk.hyb
hyph-und-ethi.hyb
LICENSE
verified_contents.json
Staging
manifest.json
adblock_snippet.js
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
BrowsingTopicsState
f_000040
the-real-index
the-real-index
the-real-index
000004.log
000005.ldb
LOG
MANIFEST-000001
Network Persistent State
Network Persistent State
TransportSecurity
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe61a0d3.TMP
the-real-index
the-real-index~RFe634859.TMP
index.txt
index.txt
index.txt
index.txt~RFe62ae6b.TMP
MANIFEST-000001
Local State
Local State
Local State
Local State
Local State
powershell.exe.log
manifest.json
protocols.json
settings.dat
settings.dat
LOG.old
LOG.old
MANIFEST-000001
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_0000a8
temp-index
the-real-index
the-real-index
the-real-index~RFe58c6b6.TMP
the-real-index
SiteList-Enterprise.json
7e13d419-f017-41e0-a447-f55756ec92d0.tmp
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe5cea67.TMP
index.txt
the-real-index
the-real-index
the-real-index
the-real-index
index.txt
index.txt
index.txt
index.txt~RFe585678.TMP
sync_diagnostic.log
index.txt
index.txt~RFe58d9b1.TMP
data.txt
office_endpoints_list.json
wallet-checkout-eligible-sites.json
wallet-notification-config.json
wallet-stable.json
wallet-tokenization-config.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
keys.json
typosquatting_list.pb
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
metadata.json
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
Update.exe
account-vault.dpapi
crl-set
settings.dat
8c9fb385-b441-499c-b1c8-a29128d277e4.tmp
the-real-index
the-real-index~RFe58d59b.TMP
Network Persistent State
Preferences
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State~RFe58632a.TMP
crs.pb
ct_config.pb
kp_pinslist.pb
Filtering Rules
LICENSE
Advertising
Analytics
CompatExceptions
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Other
Social
TransparentAdvertisers
Advertising
Analytics
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Other
Social
manifest.fingerprint
settings.json
Real.exe
Real.dll
Real.exe
Spoofer.exe
real-mcp.exe
setup.log
setup.log
setup.log
settings.dat
settings.dat
throttle_store.dat
2131f64c-0a80-4a4d-8f59-8f1451d132f6.tmp
index
the-real-index
index
the-real-index
index
data_0
data_1
data_2
data_3
index
LOG
MANIFEST-000001
000003.log
LOG
000003.log
LOG
Favicons
data_1
index
History
LOG
Login Data
Cookies
Network Persistent State
Reporting and NEL
SCT Auditing Pending Reports
CURRENT
Local State
Local State
Local State
Local State
Local State
Local State~RFe5801b1.TMP
__PSScriptPolicyTest_4qwxw1sf.5fr.psm1
luau-lsp.exe
real-luau-lsp.zip
default.dic
RobloxPlayerInstaller-CBRRXTV4DT.exe
memory/432-25-0x00007FFE138D0000-0x00007FFE138D1000-memory.dmp
memory/640-1487-0x000001C180000000-0x000001C181000000-memory.dmp
memory/1304-272-0x00000227C1880000-0x00000227C1892000-memory.dmp
memory/1304-273-0x00000227C1860000-0x00000227C186A000-memory.dmp
memory/1380-210-0x0000024076870000-0x0000024076892000-memory.dmp
memory/2356-118-0x00007FFE138D0000-0x00007FFE138D1000-memory.dmp
memory/3020-67-0x00007FFE11B70000-0x00007FFE11B71000-memory.dmp
memory/3020-69-0x00007FFE12CC0000-0x00007FFE12CC1000-memory.dmp
memory/3028-1178-0x0000000140000000-0x0000000140A98000-memory.dmp
memory/3028-1153-0x0000000140000000-0x0000000140A98000-memory.dmp
memory/4736-246-0x000001B332AE0000-0x000001B333AE0000-memory.dmp
memory/5520-3265-0x00000121914E0000-0x00000121914E1000-memory.dmp
memory/5520-3264-0x00000121914E0000-0x00000121914E1000-memory.dmp
memory/5520-3263-0x00000121914E0000-0x00000121914E1000-memory.dmp
memory/5520-3275-0x00000121914E0000-0x00000121914E1000-memory.dmp
memory/5520-3274-0x00000121914E0000-0x00000121914E1000-memory.dmp
memory/5520-3273-0x00000121914E0000-0x00000121914E1000-memory.dmp
memory/5520-3272-0x00000121914E0000-0x00000121914E1000-memory.dmp
memory/5520-3271-0x00000121914E0000-0x00000121914E1000-memory.dmp
memory/5520-3270-0x00000121914E0000-0x00000121914E1000-memory.dmp
memory/5520-3269-0x00000121914E0000-0x00000121914E1000-memory.dmp