fd3380b7f768e61ae82c2030ecf8b0d0fc7ad555e875c03308026e99b6010c71

Analysis

user interaction
yes
max time kernel
47s
max time network
90s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 15:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Update.exe
Size 8.2MB
Sample260804-s1vb9a1xa1
SHA256 fd3380b7f768e61ae82c2030ecf8b0d0fc7ad555e875c03308026e99b6010c71
MD5 bf083bfe5246583aaa7e14db963ead13
SHA1 26f33c52187dde073640c46de1f428489acb3d7f
SHA512 b5666d4bce5627f072e3d1baed7ff036c62b85cb0350b8dae56b9f1d7f53f5fb89ecdf9664cf9bd3ec7a402c099805113d5fcfe39404387847136d6435d8149c
SSDEEP 98304:ti5VibZZTWXe4aaW1ro7l3J8bOXT+VndEXev8wcFOvkSxMy5/Dn:Ab+cXe4aaWRo7l3JeODS6OUgBRD
TLSH
T13A86BF69A6BC01D9E877C1BDC6865223EB72B41523B057CF5A609AF60F23AD01E7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5128	powershell.exe
5560	powershell.exe
5560	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2580	Real.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Real.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
78	discord.com
79	discord.com
81	discord.com
92	discord.com
98	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4368	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Update.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303313970030470"	Update.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Real.exe

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\projectreal\ = "URL:Real Protocol"	Real.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\projectreal\URL Protocol	Real.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\projectreal\shell\open\command	Real.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\projectreal\shell	Real.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\projectreal\shell\open	Real.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\projectreal\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Real\\real-1.8.4\\Real.exe\" \"%1\""	Real.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\projectreal	Real.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3184	schtasks.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
4464	Update.exe
4464	Update.exe
5560	powershell.exe
5560	powershell.exe
5128	powershell.exe
5128	powershell.exe
4464	Update.exe
4464	Update.exe
2580	Real.exe
2580	Real.exe
2580	Real.exe
2580	Real.exe
2580	Real.exe
2580	Real.exe
2580	Real.exe
2580	Real.exe
2580	Real.exe
2580	Real.exe
2580	Real.exe
2580	Real.exe
2580	Real.exe
2580	Real.exe
2580	Real.exe
2580	Real.exe
2580	Real.exe
2580	Real.exe
2580	Real.exe
2580	Real.exe
2580	Real.exe
2580	Real.exe
2580	Real.exe
2580	Real.exe
2580	Real.exe
2580	Real.exe
2580	Real.exe
2580	Real.exe
2580	Real.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3200	msedgewebview2.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe
5284	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5560	powershell.exe
Token: SeIncreaseQuotaPrivilege	5560	powershell.exe
Token: SeSecurityPrivilege	5560	powershell.exe
Token: SeTakeOwnershipPrivilege	5560	powershell.exe
Token: SeLoadDriverPrivilege	5560	powershell.exe
Token: SeSystemProfilePrivilege	5560	powershell.exe
Token: SeSystemtimePrivilege	5560	powershell.exe
Token: SeProfSingleProcessPrivilege	5560	powershell.exe
Token: SeIncBasePriorityPrivilege	5560	powershell.exe
Token: SeCreatePagefilePrivilege	5560	powershell.exe
Token: SeBackupPrivilege	5560	powershell.exe
Token: SeRestorePrivilege	5560	powershell.exe
Token: SeShutdownPrivilege	5560	powershell.exe
Token: SeDebugPrivilege	5560	powershell.exe
Token: SeSystemEnvironmentPrivilege	5560	powershell.exe
Token: SeRemoteShutdownPrivilege	5560	powershell.exe
Token: SeUndockPrivilege	5560	powershell.exe
Token: SeManageVolumePrivilege	5560	powershell.exe
Token: 33	5560	powershell.exe
Token: 34	5560	powershell.exe
Token: 35	5560	powershell.exe
Token: 36	5560	powershell.exe
Token: SeIncreaseQuotaPrivilege	5560	powershell.exe
Token: SeSecurityPrivilege	5560	powershell.exe
Token: SeTakeOwnershipPrivilege	5560	powershell.exe
Token: SeLoadDriverPrivilege	5560	powershell.exe
Token: SeSystemProfilePrivilege	5560	powershell.exe
Token: SeSystemtimePrivilege	5560	powershell.exe
Token: SeProfSingleProcessPrivilege	5560	powershell.exe
Token: SeIncBasePriorityPrivilege	5560	powershell.exe
Token: SeCreatePagefilePrivilege	5560	powershell.exe
Token: SeBackupPrivilege	5560	powershell.exe
Token: SeRestorePrivilege	5560	powershell.exe
Token: SeShutdownPrivilege	5560	powershell.exe
Token: SeDebugPrivilege	5560	powershell.exe
Token: SeSystemEnvironmentPrivilege	5560	powershell.exe
Token: SeRemoteShutdownPrivilege	5560	powershell.exe
Token: SeUndockPrivilege	5560	powershell.exe
Token: SeManageVolumePrivilege	5560	powershell.exe
Token: 33	5560	powershell.exe
Token: 34	5560	powershell.exe
Token: 35	5560	powershell.exe
Token: 36	5560	powershell.exe
Token: SeIncreaseQuotaPrivilege	5560	powershell.exe
Token: SeSecurityPrivilege	5560	powershell.exe
Token: SeTakeOwnershipPrivilege	5560	powershell.exe
Token: SeLoadDriverPrivilege	5560	powershell.exe
Token: SeSystemProfilePrivilege	5560	powershell.exe
Token: SeSystemtimePrivilege	5560	powershell.exe
Token: SeProfSingleProcessPrivilege	5560	powershell.exe
Token: SeIncBasePriorityPrivilege	5560	powershell.exe
Token: SeCreatePagefilePrivilege	5560	powershell.exe
Token: SeBackupPrivilege	5560	powershell.exe
Token: SeRestorePrivilege	5560	powershell.exe
Token: SeShutdownPrivilege	5560	powershell.exe
Token: SeDebugPrivilege	5560	powershell.exe
Token: SeSystemEnvironmentPrivilege	5560	powershell.exe
Token: SeRemoteShutdownPrivilege	5560	powershell.exe
Token: SeUndockPrivilege	5560	powershell.exe
Token: SeManageVolumePrivilege	5560	powershell.exe
Token: 33	5560	powershell.exe
Token: 34	5560	powershell.exe
Token: 35	5560	powershell.exe
Token: 36	5560	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2580	Real.exe
2580	Real.exe
5284	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2580	Real.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 5560	4464	Update.exe	89
PID 4464 wrote to memory of 5128	4464	Update.exe	92
PID 4464 wrote to memory of 2908	4464	Update.exe	94
PID 4464 wrote to memory of 3184	4464	Update.exe	96
PID 4464 wrote to memory of 2580	4464	Update.exe	98
PID 2580 wrote to memory of 3200	2580	Real.exe	99
PID 3200 wrote to memory of 3468	3200	msedgewebview2.exe	100
PID 3200 wrote to memory of 1524	3200	msedgewebview2.exe	101
PID 3200 wrote to memory of 1524	3200	msedgewebview2.exe	101
PID 3200 wrote to memory of 1524	3200	msedgewebview2.exe	101
PID 3200 wrote to memory of 1524	3200	msedgewebview2.exe	101
PID 3200 wrote to memory of 2364	3200	msedgewebview2.exe	102
PID 3200 wrote to memory of 2332	3200	msedgewebview2.exe	103
PID 3200 wrote to memory of 2332	3200	msedgewebview2.exe	103
PID 3200 wrote to memory of 2332	3200	msedgewebview2.exe	103
PID 3200 wrote to memory of 4660	3200	msedgewebview2.exe	104
PID 3200 wrote to memory of 4660	3200	msedgewebview2.exe	104
PID 3200 wrote to memory of 4660	3200	msedgewebview2.exe	104
PID 3200 wrote to memory of 4660	3200	msedgewebview2.exe	104
PID 3200 wrote to memory of 4660	3200	msedgewebview2.exe	104
PID 3200 wrote to memory of 4732	3200	msedgewebview2.exe	106
PID 3200 wrote to memory of 4732	3200	msedgewebview2.exe	106
PID 3200 wrote to memory of 4732	3200	msedgewebview2.exe	106
PID 2580 wrote to memory of 5284	2580	Real.exe	107
PID 5284 wrote to memory of 4108	5284	msedge.exe	108
PID 5284 wrote to memory of 5412	5284	msedge.exe	110
PID 5284 wrote to memory of 4368	5284	msedge.exe	109
PID 5284 wrote to memory of 5412	5284	msedge.exe	110
PID 5284 wrote to memory of 5412	5284	msedge.exe	110
PID 5284 wrote to memory of 4936	5284	msedge.exe	111
PID 5284 wrote to memory of 4936	5284	msedge.exe	111
PID 5284 wrote to memory of 3120	5284	msedge.exe	112
PID 5284 wrote to memory of 3120	5284	msedge.exe	112
PID 5284 wrote to memory of 3120	5284	msedge.exe	112
PID 5284 wrote to memory of 4060	5284	msedge.exe	113
PID 5284 wrote to memory of 4060	5284	msedge.exe	113
PID 5284 wrote to memory of 4060	5284	msedge.exe	113
PID 5284 wrote to memory of 2400	5284	msedge.exe	115
PID 5284 wrote to memory of 1076	5284	msedge.exe	116
PID 5284 wrote to memory of 2400	5284	msedge.exe	115
PID 5284 wrote to memory of 2400	5284	msedge.exe	115
PID 5284 wrote to memory of 1076	5284	msedge.exe	116
PID 5284 wrote to memory of 1076	5284	msedge.exe	116
PID 5284 wrote to memory of 1664	5284	msedge.exe	117
PID 5284 wrote to memory of 1664	5284	msedge.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Update.exe
"C:\Users\Admin\AppData\Local\Temp\Update.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll');$stale='C:\Users\Admin\AppData\Local\Temp';foreach($p in $want){ $ex=@((Get-MpPreference).ExclusionPath); if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }};if($stale -and @((Get-MpPreference).ExclusionPath) -contains $stale){ Remove-MpPreference -ExclusionPath $stale};$ex=@((Get-MpPreference).ExclusionPath);$miss=$want | Where-Object { $ex -notcontains $_ };if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAIABFAHgAcABhAG4AZAAtAEEAcgBjAGgAaQB2AGUAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAByAGUAYQBsAC0AbAB1AGEAdQAtAGwAcwBwAC4AegBpAHAAJwAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcgBlAGEAbAAtAGwAdQBhAHUALQBsAHMAcAAtAGUAeAB0AHIAYQBjAHQAJwAgAC0ARgBvAHIAYwBlAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5128
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /query /tn "Real\Launch"
  2⤵
  PID:2908
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /tn "Real\Launch" /tr "\"C:\Users\Admin\AppData\Local\Real\Update.exe\" --via-task" /sc ONDEMAND /rl HIGHEST /ru "" /it /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3184
- C:\Users\Admin\AppData\Local\Real\real-1.8.4\Real.exe
  "C:\Users\Admin\AppData\Local\Real\real-1.8.4\Real.exe" --real-launched-by-updater
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2580.4524.10288031055746362296 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3200
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView /prefetch:4 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff82c445fd8,0x7ff82c445fe4,0x7ff82c445ff0
      4⤵
      PID:3468
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1748 --field-trial-handle=1756,i,15591578951863131861,9675185186803800740,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
      4⤵
      PID:1524
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2184 --field-trial-handle=1756,i,15591578951863131861,9675185186803800740,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
      4⤵
      PID:2364
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2292 --field-trial-handle=1756,i,15591578951863131861,9675185186803800740,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
      4⤵
      PID:2332
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3488 --field-trial-handle=1756,i,15591578951863131861,9675185186803800740,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105 /prefetch:1
      4⤵
      PID:4660
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4340 --field-trial-handle=1756,i,15591578951863131861,9675185186803800740,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
      4⤵
      PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://api.projectreal.gg/auth/discord?mode=login&app_auth=1&state=yd3KNiC0-FviOt4EikjUnjzUh5vjjxZzAKfyK807N4M&loopback_port=58600&hwid=HWIDv5_69dbf4f0706989859589adb92d85c9bfafe4664c6e17af50c5e0ba98493b69de
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x394,0x7ff829d7c188,0x7ff829d7c194,0x7ff829d7c1a0
      4⤵
      PID:4108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,14914418889006018406,15682258688555181453,524288 --field-trial-handle=2612,i,15484388649827101033,12857895613094379254,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:11
      4⤵
      System Time Discovery
      PID:4368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,2492074064378572544,7670275194113496160,262144 --field-trial-handle=2612,i,15484388649827101033,12857895613094379254,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:2
      4⤵
      PID:5412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1540,i,159670004665607005,3132688502595949833,524288 --field-trial-handle=2612,i,15484388649827101033,12857895613094379254,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:13
      4⤵
      PID:4936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3396,i,13006642514745322366,535039742671942079,2097152 --field-trial-handle=2612,i,15484388649827101033,12857895613094379254,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
      4⤵
      PID:3120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,9436302390487468829,4595829082880056682,2097152 --field-trial-handle=2612,i,15484388649827101033,12857895613094379254,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
      4⤵
      PID:4060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4116,i,17060755506288012141,6350255967178021934,2097152 --field-trial-handle=2612,i,15484388649827101033,12857895613094379254,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
      4⤵
      PID:2400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4128,i,8077880180662327788,8000639351191492188,2097152 --field-trial-handle=2612,i,15484388649827101033,12857895613094379254,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:9
      4⤵
      PID:1076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,4814634063302793383,6871549097235569462,524288 --field-trial-handle=2612,i,15484388649827101033,12857895613094379254,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14
      4⤵
      PID:1664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,7845507472750896142,2851405280507744820,524288 --field-trial-handle=2612,i,15484388649827101033,12857895613094379254,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
      4⤵
      PID:3344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,9380903950704994898,12361468606172239769,524288 --field-trial-handle=2612,i,15484388649827101033,12857895613094379254,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
      4⤵
      PID:1948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5788,i,16300459753750855272,12705886343365573958,2097152 --field-trial-handle=2612,i,15484388649827101033,12857895613094379254,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
      4⤵
      PID:5564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,16217121252099042797,15253652138599132711,524288 --field-trial-handle=2612,i,15484388649827101033,12857895613094379254,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
      4⤵
      PID:6728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,16217121252099042797,15253652138599132711,524288 --field-trial-handle=2612,i,15484388649827101033,12857895613094379254,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
      4⤵
      PID:6736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,8096250801085731831,16616515167349874042,524288 --field-trial-handle=2612,i,15484388649827101033,12857895613094379254,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:14
      4⤵
      PID:7132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,13885788089814422943,5323391487030584876,524288 --field-trial-handle=2612,i,15484388649827101033,12857895613094379254,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
      4⤵
      PID:6224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,10600831511443002955,14905785036968585065,524288 --field-trial-handle=2612,i,15484388649827101033,12857895613094379254,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:14
      4⤵
      PID:6640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,18153972077391505476,16974990968296284092,524288 --field-trial-handle=2612,i,15484388649827101033,12857895613094379254,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
      4⤵
      PID:6844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,7810879797062738846,14483340626379835730,524288 --field-trial-handle=2612,i,15484388649827101033,12857895613094379254,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:14
      4⤵
      PID:1260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,7373937648689030653,11360466250462379197,524288 --field-trial-handle=2612,i,15484388649827101033,12857895613094379254,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:14
      4⤵
      PID:3260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4620,i,16810844467895383071,9821951892240677887,524288 --field-trial-handle=2612,i,15484388649827101033,12857895613094379254,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:14
      4⤵
      PID:6064
- - C:\Users\Admin\AppData\Local\Real\real-1.8.4\bin\Real.exe
    "C:\Users\Admin\AppData\Local\Real\real-1.8.4\bin\Real.exe" --rbxversion
    3⤵
    PID:6528
- - C:\Users\Admin\AppData\Local\Real\real-1.8.4\bin\luau-lsp.exe
    "C:\Users\Admin\AppData\Local\Real\real-1.8.4\bin\luau-lsp.exe" lsp --stdio --definitions:@roblox=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\roblox.PluginSecurity.d.luau --definitions:@real=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\real_executor_apis.d.luau --docs=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\roblox-api-docs.json --base-luaurc=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\base.luaurc
    3⤵
    PID:6612

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9bb02e5c3df0fe5da83794bd9fdfc835234bd8051ebd671dc536fc72b521c60f
MD5 1518285c968ab72392c86c75a8ac2a2a
SHA1 8fc3874d30c34841870f1b306694e5b4ff0ac295
SHA512 908df4f740c1becb3f92cf0fc9a04e433e63c9c814f694281b9aec9b65eb60564d14d427617215ecd3564122c459cc98464217d15b9dd5cbf115803275a43a97
TLSH
T12DD023B07529EB80CB0D003540245A00322A82323CC7032399917C0CCD7D800D3DBBF7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 12068a0c01eb8cbad291dcd2af28fff28a30bd232978f203a9f09d119ddb8fdd
MD5 2d2ad1b5a50e105863729bc07b8df3ed
SHA1 2190c3f09737f4893cc846ca09c8c12c7eb8ffee
SHA512 fd27a3725d74b0465fb75fe010a3e429ae9077ee7dab637c9378b87b3fb00c848cfcf9a6a17a0463cf10388567bec4c8a4f47b59acddf07ac9bcb2dd0203feb9
SSDEEP 48:cRazlnu6u8s2R2WLII15FzCyqqJjDkbpQOho+4MkXX92aqaVtsb+W:gaNu56II1rCynDana1dH2KW
TLSH
T1E7A192A15B23A591DB25C67771D694A83BF4C41106871EE52C806FF08B0EF2D61EA8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a3e72.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a3e72.TMP
Size 3KB
SHA256 70bb82958cada56de58cb560ce4fa68c7b9105e7d8956f61224eaf6930c11947
MD5 3a7f4e60549030e24f6188b55a6cb889
SHA1 07291b9a2c68eb70581fcea78afe7bdc0b96ea31
SHA512 3924312deba22e077365094922162d8165bbdca52f23ef2ca818cd07821e9e8dd1fd1bd5ec4e01f991fa2f027be86773bd09f7602c924a4d4e32b123080f088f
TLSH
T1F36195615B22A6D1D721C9B775E154593BF4845506872E3160816FF0CF0EF2864DF8EF
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 7afcbba82b8f9a38bf4ab21f41f541f3fd3707ab2a2c86fed04564e2d27654e7
MD5 e31b95eb9ee5e9621d09b06edc17d475
SHA1 58fcf56d64f2b1c5db1bf2895c3c88e211f7eb4c
SHA512 efa2fd89ee97971a3f45102e1ec0b20f596638b6b8fca2b225fd49160f5608620c8439d95bd47c726e7ef75a35eca3c839367a7c3f1f5c0fed0209a8123e1ab4
TLSH
T13D719FB3C7E8866DC91156F0AB187E1BCE1D0954432C3D2AC9E5EE5BA3E2471F141A4E
MD5 SHA1 SHA512 TLSH

Submit Download

a9cf9f74-abf3-4a3d-832f-d19f127e8c59.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a9cf9f74-abf3-4a3d-832f-d19f127e8c59.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a596279768fe4962f1e308ce981b760d60156ef8d2bb2d0173207f680a689a45
MD5 624ebbc46af499e42013beb831f6a831
SHA1 05506e984ecba21fd19dd6cc867df4445ab89c42
SHA512 921037c5825e1b5d734721bfdf7336bad9f80141cfebcd8a7f2dcdb845c16131a22011e0702b8e4a1b5a4cb0969fbe8782fc689d84657c80f137799b08781ed5
SSDEEP 192:sxR+RUCV/fHsvflZnapzoD8pll/g6+WNpLH/YG2ki+GDIgDFBZ8J:sxR+pV/fHsvfLnadH/5B/piBK
TLSH
T15242B715692869379CC7D21DFA55BF53D3F96033A0941E58B7FC9A1C04EBACD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 39140886aa2e24ff98a2d60c006a4b0cd9a0cb5a549df5758c71780eec19167d
MD5 58effd14f6205d29ab731095c27f0d75
SHA1 4e59e84722f5257a7c37ba52de8941493c7f7c5b
SHA512 6c9094c94c0af60ce0b285ab58fe20aff56786adf2cc14604554a0dd80d52d26ade9152d2d134de8531b8f587af2d1566a311fe7fb275086560190ae2cf666cf
SSDEEP 192:sxR+RPCV/fHsTWpVGflZnapzoD8pll/g6+WNNMLH/YKSkirGgDIgDFBZ8J:sxR+4V/fHsTWvGfLnadH/5i/NinK
TLSH
T16E52B716A928693B9CC7D21DFB55BF53D3F9603361951E58A7FC8A1C00EBADD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b436029b549035fe957f691ee55dfb2e43a976b453286f1ce7e4e6966720a41f
MD5 6661d041d30db2aff5acc862a835219f
SHA1 2ee3203cfa3ced57358d7ba2c4fda17623954e03
SHA512 705687b4e87a4fe38b9b9c8d095ff2c7ee035c9f8e8874d6dd96f2662e83aa091a8897a089ca3d6a116a22509c8bedeffd3491df3b13ba4b1f2fc9a2594d6112
SSDEEP 192:sxR9RUCV/fHsJ7pq1z0pzoD8pll/g6+WNpLH/YGMkki+GDIgV2J:sxR9pV/fHsJ744dH/5B/OiBI
TLSH
T14832B9156928A9379CCBD20DFA55BF53D2FA503361951E58B7FC9A0C04EBADE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1200379d2ff7369aaf5470d8790411f9675accf881f4390c46e847cacd736f74
MD5 076cd270b704f1bc0bb61fc26004d713
SHA1 7f6c7cffc41aa103c9400e783b49a51db5ef199f
SHA512 a4f6caefc9914b03d05071684be40c20360755112a689a45a23dc2eda1cb5df2a8fdbebdbd6c8a6c0dcddf603144ab2d151419e2ca734a30255d6766a1d2ee28
SSDEEP 192:sxR+RUCV/fHsv7pq1z0pzoD8pll/g6+WNpLH/YGMkki+GDIgDH6J:sxR+pV/fHsv744dH/5B/OiBq
TLSH
T18942B9156928A9378CCBD20DFB55BF53D2FA5033A1951E58B7FC9A1C04EB6DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 64028949f5aad857ebdd837890d80fb0367007f56b38e26cd2aa238d3213f4fe
MD5 7bc27176c850afe7d621f77ef493ea2c
SHA1 2cb9002f4b8907a4bb074ecc2940b405061cd061
SHA512 155e2f712c946ee99b7d77e79d339a50cfcdfb0f17f25a0a493b4a86d855f2060b36c136645c98a790962d13af7cdd34e34675dc0d11d48e95921523725a1014
SSDEEP 768:UQYiM37pLuL78NWgv7fxJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVGpNK2roGG:UQYiMxE78NWgv7fxJu1japfKNb
TLSH
T121C2EA7B640CCF7E5F800A9D98197E9F6DA802CB9698CD9047FE941C02C7BFA91164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 af0b03ccf347cf74523ecfaf2845dd86c601ce38758007488d2be29f2657da3c
MD5 59edb84f1666097a4597de8c906f3cba
SHA1 0fe55431ef86b4d96b301637a4c026e0af9b2de7
SHA512 fb5591d189acb5fc07832e236e40317c08a11ab8b409276aab257f3cd47a9f742ab22b7e24a50516652891e84b5c473e94d49376a3f176463050a084c99695f5
SSDEEP 96:KRm7KmgIIOW4tVgGOK47g0OcOGlkdqjXNn7vWj4mgfvK4+gBvcldQzLkHVCbvlfY:Cm7KmgIIJ4tWGm7g09OGlkdqjXNn7Ojt
TLSH
T1F6C14115727A12E0397E7A1C80B59D1B828274733518E82B7FF855A61F67E029CFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 370ccf05f9c94e424f82b4598ea98e908898da4f1a78a15b243cbfd490c66877
MD5 9bedb4d6e549c1a49bf1648f449134b4
SHA1 1e69abf3bf51dd47ac3000f8fc923c09a7125e7c
SHA512 79a703ff59755d4d7f633ecb5e9895a79a49e00cefb2222f53e4a196551f634727c6de96973f02e3e97a7c64dcfcbb97abf52af4792fff3b9229c39d64a16550
SSDEEP 768:acM3PvFTlYykX7Hucys6BRvi82oP4/z6himo6QZ9zxojKgqmU4hOGj:acM3XN3imOz6Imo5/xfgRU48Gj
TLSH
T16D039D7C9C118E3EC8EFB349614D2A662EE41237D4B85D98D3D99B0DD133A5DF31A822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f42a91f591644e12cf806fe269a91135d474abc5adc9cf827531180ee695706f
MD5 60ac25c30d6a7b278ee1a4338ec3fbbf
SHA1 54e77535513e2d91f3ee2ad3103db2402af4a8ba
SHA512 1d0a8076815c8d195fb9a0291714701cf5b113d114136f474deb4423ae18af56c4a60674a61a4fc0f0efcc9930efc62f171357e3b633ed7f791c085bbbfac836
SSDEEP 768:aAh3Pv6TlYykX7Hucys6BRvi82oP4/z6himo6VNojKgqmU4hOGj:aAh3X23imOz6Imo8NfgRU48Gj
TLSH
T171F2BF7094569E72DCEBD289B5863B926FF0213399C85E94E5EEEF0D0143A9D131F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5da95c8057267911477dc8b653454a48aae875db0dd6db5fa4584c4d26659574
MD5 3c78b9e54a9f31c88c1efcc1679bc65b
SHA1 2bb9815adc987daa20120e2e7d1b3a3fd701fb11
SHA512 3dbfd2ce60a778da3d1768b12d06a28f955c2e66fa84dc7f9f4a831cb8f7577d49ce3cb652a30893fdeadc7cb5534a592de3ce9d1f388c8e276bcc818dbb3e61
SSDEEP 768:Ykrv+4UNbdS3hvMTlYyk77Hucys6BRvi82oP4/z6himo6VNw:Ykbsbw3lw3imOz6Imo8Nw
TLSH
T17403AF30A4599E33DCFB9289B1467B937FF4227348885E94E6D69F0D0587A9E131F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 9eac52cfff5f982c0fa77325b86d7ed6c9c0225733122e867326116ce9372fb7
MD5 3bb61450fc3bea291fbb6b431fe5511b
SHA1 996f18a6a07aaaa3d29b278829fb318c12230a5e
SHA512 d3b705c9d0e6f52dd6f0ac60cced3601be59aff642773c51e4c49a9d98ffb5a15801b48fecae4b69db2bd7cd656de96c850a329c31a8910d617f281b9c00e25f
SSDEEP 768:skrv+4UNbdS3avMTlYyk57Hucys6BRvi82oP4/z6himo6VNojKgqmU4hOGs:skbsbw36y3imOz6Imo8NfgRU48Gs
TLSH
T17A13BF30A4599E73DCF79285B1867B933FF4217394881D94E6DA9F4D0287A9E131F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b2e69f4c4e36d10059f011a0683717b68ae6d0a36bdd6ca03869fb1de742de4b
MD5 a4a54d0f750f95c255f9f9996033a2ad
SHA1 776cc00eee4a633b0be0cf65c42917f2ffd4c2fc
SHA512 21cce4e49d391d8f1e46d9a7262a741ea4b5c3d276e184725e13ade1bd6f16ce985a227dfc8de00513276e237e0ddaec5fefd01bcfdff09a4d6ed4e89c0db0c6
SSDEEP 768:xGrv+4UNbdS3ZLElYykW7Hucys6BRvi82oP4/z6himo+R2bwn+h:xGbsbw3ZR3imOz6ImoC0w+
TLSH
T18103CF31E4588D72DCF7C288B14A7A937FF4522345C91AC0E5DE6B0E429BA5E631BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6db6e95-3db3-473d-97e1-60ed9eaaf650.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c6db6e95-3db3-473d-97e1-60ed9eaaf650.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

base.luaurc

Path C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\base.luaurc
Size 276B
SHA256 c64c1d0e92b307134bef070bb109c64f78002acf737224f15520ce28e1a34254
MD5 9cc360a0e912714dbea68cd5f8bc2836
SHA1 f479fb771031ad959461a6c5757212cdd773dcc1
SHA512 f2ec29825476fc907594efafce7bc8b3539ee1e26be7d1e56e910667e5660a1c09503be9e3038ebde874ea6ce2bf2aa9bb135fc7b74b8ce054d2d35a509efbdc
TLSH
T1CCD01728D1691CBC28C180BEA8AE9113592008AB694C3D2CF16A030D2F4DF3D30B9DC0
MD5 SHA1 SHA512 TLSH

Submit Download

roblox-api-docs.json

Path C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\roblox-api-docs.json
Size 6.6MB
SHA256 3941728abb9be6fcb191326754a46a6a7c19373d5e3a66caf40ddcf7f1cd9ac9
MD5 11431ba0ef59a6227e061667f70d81f7
SHA1 d56173d820b35292e0a237b5f06e2e18806908e1
SHA512 662e73ca21b23426f90698bf8941b7d2ea94b85dd087a94852443a5954d1ad5a568608c3255b8a0e80346b52ce0e787435af89ca4286bf300cc038dc6798b286
SSDEEP 49152:dcLtmDo/SZTJGYbihxzWwvkeevJVwG9he/8:J
TLSH
T15766BC72C9A01D932686165DF8B9425AF83840DB285D3D88BA9C732C6F88D7F51763CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a4a59fad9b1424018a2207b6edc2157f4c33def642652f4ccbd8742449cc87fc
MD5 be6927d7b44f87d47680e867ddd7d567
SHA1 111471fb2abdfcbe4392abf62543b4ac57320173
SHA512 2534bad7e22242073cf5385e5eb567e2affc791cadce9efdda5f61e629d451011780df0541e74bc1b7872a3416847629f40dd590bdba62bed3e8aadddb07840c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 cc8e4f963851e9d0954d19006baf17911a611aeaca41a6a2ecea5f2e8c33e1bd
MD5 b68f3f027e9f57c0b8795c57e612644d
SHA1 3ecbce7ce738521fd4c558283d779eed52cbf928
SHA512 f9cd1d807be724a647ccde229cff6186e10a62db03178a355763513c867ba96abaa1eaee8a96fd88eae9879c8243547456ca41853ae80e5e50f9feec60b32b08
TLSH
T1D8D0125272058534C4203433D00271490900C14F810682005439891E5A080950D13841
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

0f935ad2-1ee3-4582-b21a-0336137b16ad.tmp

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\0f935ad2-1ee3-4582-b21a-0336137b16ad.tmp
Size 6KB
SHA256 7a1afdc47ff0e775573ccdb39797f01a7c1e867bf88d48316b41a50f93be5904
MD5 940617edca9169f929496cee7f487943
SHA1 24e8504d3aff6aeae4a470dd31904172cc379860
SHA512 43b71a07b3989732367353b6c39858fe92c8272478c2df232ddab78b9d1335d14350eccd3cd1b607bc44fa55975d9f09ee3da02cdc8b08644bc575ada7ab0fe8
SSDEEP 96:stY/dHAhBb9BkhEo5h16Z0Js7/x+6MhmuecJNz1ejexK+g8K+28XM1C7K:st85mtonJsV+FdNzQjXj+G6K
TLSH
T1D4D195016E24797B4CC6E219BA757A56E3FA607274911E58E7F8862C04DB6CC2317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 576B
SHA256 dea245bb2b25c4e514b6c0e181e7d3ce09e649435f61e9eb3a446257fcdca7b2
MD5 2462ce117196badcc76bb91b0b84bf09
SHA1 776362b813ce5414c9b80d94bd77310a461120bc
SHA512 5d27f781c524c606934f7b710dd9c4c8c48a91c0bb744d60575ac7016cff9bdaa08e66280ceeb9bc323c4bdd22be20198aa3e7ee766312a36c876190993cafe3
TLSH
T1B6F026ACA987149FEB1440B369D4D2A3F238DB30113F6ECE18260CBDE87A380C361016
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ed73.TMP

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59ed73.TMP
Size 48B
SHA256 48259f7c6a47433807f681c7e65468f42b0ffba5ac72c5e99a59a735fe12a4a5
MD5 16694be0aff27e761a09f926fafcdc9e
SHA1 56232d5e55f84e49f1efbd5e406254ba58aac119
SHA512 fc43fc41a35fbf11915d0790746b4bd2d7be6d152ee85a3483bdc4dd0c32501bbf455d21e91c41bfc83755fc7f1fa0c618cd6ea510d65089190706dd592ccea0
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

e7e40741-4238-4b6f-a11e-4f0c3e328447.tmp

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Network\e7e40741-4238-4b6f-a11e-4f0c3e328447.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 15KB
SHA256 c00d7111d5116070036a7d97f8a9e744068df51278a12b784e141e5580c3cc4a
MD5 e3b47ac2cefa69621322fc830b181bd3
SHA1 031129f833948b83c4cdf4ef6227b6fa3c2634b8
SHA512 3413a81d95d1de6e4ea85e7b4dd384924c9437e6da3b8f9509e3e50dc8c98dddda3f45d21d17667a7a72ff97c43e27aaae157593a28848a5281145690d1cb789
SSDEEP 384:s+aQikB+z/xvxjg/qhE4NBSTPdARzd667E9zd:L/UxvxjgC+jlmZ667EFd
TLSH
T12172AF2B96797E2795F7DA05395D078FCBB994B391826EB84AED6F0C02C32981342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 3KB
SHA256 7b080fd63dae4d23abb00d61e21448f0b34629cb3e54b36bc40c20d134f20de0
MD5 cb08258c0a8896270c223f6e0149355c
SHA1 37c4707c3a1eef8494ae93fa6ab1021d5ff3d2f7
SHA512 243084466f685eabf1d3a300ee8e36233659dfc7ee5d298550ad77c6db190f70400f42023b199ee6fc7e2c6e9db11c430f55ddd24ca64b88cfdfdb48af08b64a
TLSH
T18E6187376A74A93B4DF38A05B8863B16E7A65033E5917FA8C6ED1F0C01D72981351C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 15KB
SHA256 4613fb23bd7ca23b3f5bd123cac3da7330a4cabf5a0b0c7a7871f885891b6213
MD5 0f783ca2b876b5baa6bac3f941c4d013
SHA1 bac92e407ca26c2395538d8221db9bfaa539f6a2
SHA512 a492f5780420d88951ed49a1943c8c8d1291899a22f994c72f04673dce8154c872798ea08a94cabb7f19500f178d61916b1c746b6747c8b5bdd06bcf4b33d7e5
SSDEEP 384:h+aQikB+z/xvxjg/qhEsNBSTsdARzd667E9zd:s/UxvxjgC+fwmZ667EFd
TLSH
T16572AF2B96797E2799F7D60579490B8FCBB994B391826EBC09ED5F0D02C72D80342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 2KB
SHA256 d82ee0f35b26425b7d29b16580d63b9a6e843c0cf5963ec9586cd1c0626b060e
MD5 db181bb4f7e9a5fcaedd0aa55d440565
SHA1 e71dea9ec12bfbe9f6b5a9ee2b3c6f5457b30f1e
SHA512 56c0ff9190b000207a527191a6a3f927ad91783df5010a38c84ca1b4e1a4246a53fe92a2edca71020e8b3e23e96bc4208435d66b809a3fc9bbfe51b7d36fb604
TLSH
T1F8517533A924AB3B89F34709798A3F63CB7A90A2AA526F6496DD1B1C00D755C1741C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 15KB
SHA256 c2252f4120ad5d1c6ca6cb0f59e88ca3ecef33cdfa47ad56514e4277c27182b8
MD5 05f755f97607c5bb21008bc9ec95be73
SHA1 1c7c4a31e39da76d3e2cb0890ab918a0b5ed6aa3
SHA512 21997b8ea997049b6bc191e2a0d9f5066b861a7c44d43f41e289d7b7c8789191be3e5e40fabf5cd4367f4f6180be5ead2a86bee2908ef04c8994ef1254dfed13
SSDEEP 384:f+aQikB+z/xvxjg/qhESNBSTsdARzd667E9zd:u/UxvxjgC+1wmZ667EFd
TLSH
T10472AF2B96797E2795F7D6057959078FCBB994B391826EB80AED5F0C02C33980342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59908e.TMP

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State~RFe59908e.TMP
Size 1KB
SHA256 100199e5d4fbba642f085607e5620b5f9a14ecd4b0699e6bfe1c21bb7684f9ad
MD5 436844e638da35e05abbcbbd606b3ed5
SHA1 468b2b85de7669c1b6496a408c90309c67a5041b
SHA512 1771a54d914533bb044dcbc2777bebc75188ed0f261c1e3b365c1d78b8d37b326e3ea53bdb431d186c8e4dc05cbd84867e5a08085c6c603327c96367f1949607
TLSH
T11E2140B3E9609B37ACA2134A35827AABDF2250679211CE8456DE9F2C01D305C9926C33
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Real\data\config\settings.json
Size 207B
SHA256 e4f38f124eb821848eb57d6988c5ef865768188e54d1e8f0ae34c59e9f99dd21
MD5 2b4a40c8495d5ddf7adc222e092fa67c
SHA1 fe7029809ff12457b0e50b92e87b33188fd18848
SHA512 18ba17b46e89fbaad852262144a4399fc6ce616853e80d33e9ea7dae69c2d0f8d2d3853af908c0a78c6e671b30fffcf3983ae02ccfaa5dfd0055db3ba456b9d1
TLSH
T192D02250DCF40E7313DA902A082B0010F0366C67009E3D3C38EA031C9F4F630417D384
MD5 SHA1 SHA512 TLSH

Submit Download

current-version.txt

Path C:\Users\Admin\AppData\Local\Real\data\meta\current-version.txt
Size 5B
SHA256 6ff43122fbf672035ceb986cf032c43e155d9475b21af906f67ee88a49f26ffc
MD5 9b816b35360ae05cf8eb9af8329ae832
SHA1 640b75d1936f52903edd2795db2c553f3ad94165
SHA512 3cec652c6a2e510e2b8d34bbeaaa1d880cf28e9e6cf12cdb8c11409f1a1a915c8bfcc819f3a778b96f7efcfcbf8622eb635ea764347a75a1a4efa9896f406136
MD5 SHA1 SHA512

Submit Download

Real.exe

Path C:\Users\Admin\AppData\Local\Real\real-1.8.4\Real.exe
Size 14.5MB
SHA256 7a4bdeadb0b251ac3219c84737618fdbafa682467e8d9635674fdec3cb8a6c19
MD5 d0abdd8a9a0459802bb49eb659ec26bd
SHA1 61ffb41d0d90bcb15fddc26f8414c2f23f6e8fb4
SHA512 1f865b77185ce2a76bfe6fa2059f64d693a0078b965739424b5749648a6cc2da5d48c2a84ec4aa7ca7479c96fd8303c8ac8ba28dd1b5b2df94b84d15acbb8721
SSDEEP 196608:XqqeVkBP4D6xMX9X7jBTwdnAxF4JJ2JTDEwKBFnzT:EV+4TXVZ+nAfCUCn
TLSH
T11AE69D07F35181E9C0ADC0B9835AA637EA32B8894735B2DF5BE40B112E16FD06B3D759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.dll

Path C:\Users\Admin\AppData\Local\Real\real-1.8.4\bin\Real.dll
Size 3.4MB
SHA256 1c831669fa786a5e5381e6df1e66ccee7cb54a30387b4612bc042d9b88524153
MD5 683b41cb4d247e343a4715fed0810c54
SHA1 c7a71ca7e27737e9ade5a92b4538bef639cb18f4
SHA512 3e2e7d116064f601834cae37fca2a7ee3cc3a4c8e3045a1a9b4e5a304679ba03875c6aeec569c61c5906def9da9fbbe35bd9f5372fe88a569142b4c2af67a91a
SSDEEP 98304:b/JfGZBzQYzgF491uru9VmVGud6D1iLvAPr:KQR491uCPUiiEPr
TLSH
T1A6F5CF3E86CFE9DDF7B9916C10638AD1DF1B976263F5ACC62D0EA01506482D6883F217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.exe

Path C:\Users\Admin\AppData\Local\Real\real-1.8.4\bin\Real.exe
Size 3.9MB
SHA256 1f727a984987f269fd39821042b022b5b54f95bb6ddd20d784e79c4a7525df0d
MD5 2cbc2ace80949abe1086e1c7e3eb6b39
SHA1 145924441ec14e3dcfdf03a0bde11dd06ca80a50
SHA512 7be051da0670d9450102fbdf65e10fa0102083e4b8c096d378f359b3ec9394d8d9b3b20ac4228b10cb8056489e4a488d93fff30deed1fcc06fe415a25d2d8af7
SSDEEP 98304:l6iWicT66Y+Iox5WIMAqVHrQ60B9Xc4XNGZy3Db8:NWi/wIMYIMAScxXtGATb
TLSH
T18F16232BB96B9CBECC87C5348347D96748127CCB0F71F9DB0B455A6A2D522E42B30726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spoofer.exe

Path C:\Users\Admin\AppData\Local\Real\real-1.8.4\bin\Spoofer.exe
Size 2.6MB
SHA256 f4927849fea9d5abd064ed5ec61c45785490a93d75258de466db74e1b70da51a
MD5 1f79f23e16f08c13d3d50cff49b287ac
SHA1 2893622bd2183579b631a14ff4a5015666bfd820
SHA512 9d1f41cef2d5d707b96ab5b35dde8b85164f6e8794b752f576fe192934a4a62b1512ad512d917b98969afd25adf29537cb8c7bdd46c261d2811972b296f76a93
SSDEEP 49152:iSBsRHoPtqamwxg4muCBfxz2MWPUnGJG//2/XmMj17GPwhm9SeD5bc4TH:Iok6dyBh2MbnGM//n+9hm8epL
TLSH
T117C533FA16C2EB38DC8E137B233F07169B4684FC5C5DA16B29E7876D8706539C84588E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

real-mcp.exe

Path C:\Users\Admin\AppData\Local\Real\real-1.8.4\bin\real-mcp.exe
Size 1.6MB
SHA256 1dd7738163b5266d78f30b04281b1d48927acfdd6879e7576f0862a1b6497e95
MD5 52f687164c175d24e9f4f22e6f17181c
SHA1 99b67fe1a7417616656cd9a34b31b1a0c5657bc1
SHA512 ec740a365519531208a5f536277043d71bd4995cc5c06cc65a4984f47bafcf67626e8218e2ba1823c7c88eb1184bdbddf369f48852af9434e9f45219b6ffc064
SSDEEP 24576:RXvDv4konyXJzOaNDOXDPiFBzmQJDXqZXxdOmOTFM3VIH06iyGdXQ:BDv4konMzBOGFBz3DXqZzuhYIU6ilJQ
TLSH
T18C857D03E69580ECC4ADC578C3579A36AA73B88D0A34B2EF67D04A513E2BF905F1D719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

119c2932-3363-41bc-a02c-7238e2f55c20.tmp

Path C:\Users\Admin\AppData\Local\Temp\119c2932-3363-41bc-a02c-7238e2f55c20.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_byrmxgqe.2lk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_byrmxgqe.2lk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

luau-lsp.exe

Path C:\Users\Admin\AppData\Local\Temp\real-luau-lsp-extract\luau-lsp.exe
Size 16.3MB
SHA256 0da4f09d474e41074f4ec52bfef01eb90c014928358eda88f6a5afad5319b537
MD5 be087717213e34f06e6198159d9c73dc
SHA1 60e2ca8a33531199a644061238b1605f78b8ae66
SHA512 fdc7b914eb7425bc17c23a7e52c7256f0263448ef4e0469302386a17b6ed3d5241bdc4cc2c43092c521368b9c09540ade980deffa16c201455b5a9a8650104b6
SSDEEP 393216:XdTfwgggjgzggsgTguwttbgNlggigggXsgJgUQLCgggggCNc/gggga4ggggcgggg:NRggjgzggsgTgugtbgNlggigggXsgJgB
TLSH
T132075B3A21AC01DCF1BBD0BD8BDB9E47D6B2340903319ADF0591569A1E1BDED4A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

real-luau-lsp.zip

Path C:\Users\Admin\AppData\Local\Temp\real-luau-lsp.zip
Size 4.9MB
SHA256 faea1b177f4761e4c34e0dab72009a2fdd00f21d61f3f7b7c1fe1ac3f38a05d2
MD5 1b284c21f9cd1359868016692ace2db2
SHA1 24792218a8d9d76b3f69a274ef6190cd33106f7e
SHA512 fadbb5db04d125e12a5d1e7153026efdf568d51a1b15afa6d732a75fdbfab87eb14a5e2b64364fd47b4ab4b9c4e5fed8ffe8d5e7e09fb8e396e302879f9f6c74
SSDEEP 98304:sBXd2Q4Jz8eM42l/+T/5/Wbv9z8LT6Eb7OuITvBFkF9ba9v:iXd2Q4u+iw92wLT6AOt7BFkF4N
TLSH
T1203633DCC801D7A32B91C32FF9DEE523338FC254CC30316556A85E453A9E578EABA586
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5284_500860779\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1524-374-0x000002B0E62C0000-0x000002B0E63F7000-memory.dmp

Download

memory/1524-151-0x00007FF84E6C0000-0x00007FF84E6C1000-memory.dmp

Download

memory/4660-227-0x00007FF84E6C0000-0x00007FF84E6C1000-memory.dmp

Download

memory/5128-86-0x0000020E32030000-0x0000020E32042000-memory.dmp

Download

memory/5128-87-0x0000020E31CF0000-0x0000020E31CFA000-memory.dmp

Download

memory/5560-46-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/5560-37-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/5560-21-0x00007FF82C18F000-0x00007FF82C190000-memory.dmp

Download

memory/5560-42-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/5560-41-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/5560-40-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/5560-39-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/5560-43-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/5560-44-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/5560-36-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/5560-22-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/5560-35-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/5560-38-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/5560-34-0x00000211F2A40000-0x00000211F2A4A000-memory.dmp

Download

memory/5560-33-0x00000211F2880000-0x00000211F2932000-memory.dmp

Download

memory/5560-32-0x00000211F2860000-0x00000211F287E000-memory.dmp

Download

memory/5560-29-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/5560-28-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/5560-27-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/5560-26-0x00007FF82C000000-0x00007FF82C9A4000-memory.dmp

Download

memory/5560-25-0x00000211F25D0000-0x00000211F25F2000-memory.dmp

Download

memory/6528-595-0x0000000140000000-0x0000000140A98000-memory.dmp

Download

memory/6528-599-0x0000000140000000-0x0000000140A98000-memory.dmp

Download