fdb2a3ad1d350758ced5996a6aa847e516e0c41586d3c27cd8997572a7f345eb

Analysis

user interaction
yes
max time kernel
27s
max time network
31s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RealSetup.exe
Size 16.3MB
Sample260806-c8b8msfd83
SHA256 fdb2a3ad1d350758ced5996a6aa847e516e0c41586d3c27cd8997572a7f345eb
MD5 78425792ad729ddb3de8bca9e041cae1
SHA1 2d68c4f3d07ef419d3ea757a5e21d06df255915f
SHA512 15e61721cf0a9d5a049422c90ef44ac31c8242d397c9bdd9619a2a8db62e903b97cfe4d77078d4b269f49511086c270ee8c20a0809aea7637bdc0267bd2632d6
SSDEEP 393216:zeuglhZR8XZOkNBN5BWH8YexcpjwAhcI/OUYFOUY:68BNyvMI/o
TLSH
T13607BFA9B6BC00D5E867C1BCC2965223E772B45523B057CF5A649AF60F23AD02E7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RealSetup.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1996	msedge.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	RealSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304578923474534"	RealSetup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2984	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3972	msedge.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2984	1976	RealSetup.exe	84
PID 2984 wrote to memory of 3484	2984	msedgewebview2.exe	85
PID 2984 wrote to memory of 3904	2984	msedgewebview2.exe	86
PID 2984 wrote to memory of 3904	2984	msedgewebview2.exe	86
PID 2984 wrote to memory of 3904	2984	msedgewebview2.exe	86
PID 2984 wrote to memory of 1860	2984	msedgewebview2.exe	87
PID 2984 wrote to memory of 4732	2984	msedgewebview2.exe	88
PID 2984 wrote to memory of 4732	2984	msedgewebview2.exe	88
PID 2984 wrote to memory of 4872	2984	msedgewebview2.exe	89
PID 2984 wrote to memory of 4872	2984	msedgewebview2.exe	89
PID 2984 wrote to memory of 4872	2984	msedgewebview2.exe	89
PID 1976 wrote to memory of 3972	1976	RealSetup.exe	99
PID 3972 wrote to memory of 5048	3972	msedge.exe	100
PID 3972 wrote to memory of 1996	3972	msedge.exe	101
PID 3972 wrote to memory of 1800	3972	msedge.exe	102
PID 3972 wrote to memory of 1800	3972	msedge.exe	102
PID 3972 wrote to memory of 4636	3972	msedge.exe	103
PID 3972 wrote to memory of 4636	3972	msedge.exe	103
PID 3972 wrote to memory of 4636	3972	msedge.exe	103

C:\Users\Admin\AppData\Local\Temp\RealSetup.exe
"C:\Users\Admin\AppData\Local\Temp\RealSetup.exe"
1⤵
- Checks whether UAC is enabled
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RealSetup.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=1976.4320.4787255946966361497
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x118,0x16c,0x7ffb643bb078,0x7ffb643bb084,0x7ffb643bb090
    3⤵
    PID:3484
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView" --webview-exe-name=RealSetup.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1700,i,8505415404450276265,5793696827762792074,262144 --variations-seed-version --mojo-platform-channel-handle=1652 /prefetch:2
    3⤵
    PID:3904
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView" --webview-exe-name=RealSetup.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2052,i,8505415404450276265,5793696827762792074,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:3
    3⤵
    PID:1860
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView" --webview-exe-name=RealSetup.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2288,i,8505415404450276265,5793696827762792074,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:8
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView" --webview-exe-name=RealSetup.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3592,i,8505415404450276265,5793696827762792074,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://projectreal.gg/download
  2⤵
  - Enumerates system info in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffb60afc188,0x7ffb60afc194,0x7ffb60afc1a0
    3⤵
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,13264902015168143633,16657724031158738767,524288 --field-trial-handle=2552,i,14472150496562509925,11911712668442741120,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,11013023741472662909,9163569949437515324,524288 --field-trial-handle=2552,i,14472150496562509925,11911712668442741120,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
    3⤵
    PID:1800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,18298112033820151761,7188437205822304387,262144 --field-trial-handle=2552,i,14472150496562509925,11911712668442741120,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:2
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,7518545075389927752,356912538807013383,2097152 --field-trial-handle=2552,i,14472150496562509925,11911712668442741120,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:1736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,4787353749127062613,7182234261950737140,2097152 --field-trial-handle=2552,i,14472150496562509925,11911712668442741120,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:1360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,5478724846979249175,7381253134275955903,2097152 --field-trial-handle=2552,i,14472150496562509925,11911712668442741120,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
    3⤵
    PID:3344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,3938951118176968734,407205955320508340,2097152 --field-trial-handle=2552,i,14472150496562509925,11911712668442741120,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
    3⤵
    PID:4604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,6264242141449332576,9544523268283141246,524288 --field-trial-handle=2552,i,14472150496562509925,11911712668442741120,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
    3⤵
    PID:1512

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 53c8f9363394dba862926aa15399029f21fced73ad4074d3111b6319d88ccfd6
MD5 c50540aa55db588f6bdf54f4315589db
SHA1 af2504975dd429130cac3c466ed483ff9666f996
SHA512 018ece471a4c7e51d596b3c4ce32b68441838810a7176e81d5890d02be22f474fd291b51507c0624dd29f7389fce0d78e93ad2a5a9f0d9f0a463a8ea3b7b5023
SSDEEP 192:tONY6JkRtQmiUyBWW+RNPOmlhPXh36RmoU6:tONY6UrLW+RNPOwvOU6
TLSH
T14A02D7356D385C7B9EE3AE09B98B27275FA4207BB9952F80DAD81F1C01D765C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bb5c2283692346baa4b88696160b7731378bfa2622993fb94404a39090a08ea9
MD5 c10104a82b8a9f4dfc98dced34d0a8bc
SHA1 870bf7b79931687c24a6f8fc392f7e26fe9e0c26
SHA512 9fa87cc991e211d24cbd985d8ec9ba73be2b4b1a13669d2cb3eaaa37a35fb72c2334c4f3057e95da58546f1ee79138236afd54bfa2f64b6b4fab71eed5f71a89
SSDEEP 192:DONU6JkRZQmiUy9WU+RNPOmlhPoB9SF6Vcwqp3U6:DONU6U3BU+RNPOwG9OtfU6
TLSH
T10612097169389C675EE76505FA8733939EA82077ED856F80E5D81E0C01D7B8C370BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 548B
SHA256 fa33a710a25a4144f45a3982932f0bc925b01fc1bef1b413087c1056811113b1
MD5 b478c7b2a50e161a62390c8f8b3b7f19
SHA1 82f2bf37187cf72f7a4005eec3db8a9363c5710c
SHA512 68b47276b970503101541481ee69d9b759419da0a769e096b6cdf95b4ea2d66770685a8a34129c90272f9062858d5aa3330306096f63ecbce8c7560cf45f9090
TLSH
T1D4F0902D52FE96252C6A848F9A1B7DCB411232459D095A20A642508BBED5B4EAF03E06
MD5 SHA1 SHA512 TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 1KB
SHA256 dd31a791d7d2e9b4b7c2fe5422174f21a0e6b331052078667401db11fea2a34e
MD5 b50f214c83f1eb575791a40d113d9475
SHA1 58b7f154fb8841f29f514fd30f2a03f848dc096b
SHA512 2c981399ab9bb16fa3523cd7f422075722a2ba2241a30f9d940e6a385952c2db558c2da5039501b71f1bd17302e62ceb73a4771d2aed42d487c49addecdcadce
TLSH
T13A31662E41FEEA362D4A844F891F7DD6520632554C096A28F282009BB6D5F0EEF13E52
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 113397ea55a27ac843e5b177a1890b4f1a1c0a19a19894e21c68573b1445d5be
MD5 cdb544f9f3481b3f0c5bf37f4b28265c
SHA1 98f226b7599aa9f26dc8ed11f178c6b813eff3f3
SHA512 de3d5bd1d315eb5127b2baef9adfd13fcf9296d65d975a7380296e1e22fb8227a2f4908313b4b5b6f0ac1b1f72896ea3d1ac42d0ccaae4f425180f06df98358a
TLSH
T19CD0041055545401C005D571113151D41310CD04550303040011110C574C3041541041
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 02ebd9d12a89ebe42499fa5202dcebe67c0c4de7401c9f2577ff82e99c9f9572
MD5 b5c897f31a6da9901f4ca1465d3991b8
SHA1 88233a827abbfeb244117315551180ca44125f06
SHA512 92adae6cab6f139a4b90359c3ab5a21ea75e83f2a31fc2de8e2a2aaa0ec672e4b8ed64c294ea8183526e35d1c10db5d2ddc03df443b17bd623f5ce4ae62e5f8d
TLSH
T106D0241337514534C0107573111371CC1500C70FC1074104543DD71D7F0C1541F034C3
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 a42c8cc3134247fcf781ca3b6ac1f4a55485eb3f839c82341f2e61ba2b8bdb18
MD5 c169a72f2df8f1cf26dc4b15a02d5148
SHA1 04d07ff61ae29c7fdf37d2bcdd40ff28d066cc0f
SHA512 884c693fa214f8055a7d20756ddff441415244d997baf817f57425d894fb3bef2efdc39e3afb1e06dba95954c909eaf663abd6698b5c8affef8375aedbc73b09
SSDEEP 3:LstlNllkll/lu7m:LsX3lEtu7
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 09e307a8d3345495468abcb88861ad81445600d07f6f7d61dd4c77fd356baf26
MD5 676b0e0c6f215248012e6fa371823be1
SHA1 571385ecabf115f277ff25089d227927dcd16151
SHA512 9bc13238858233d531c4fcb55098aa528013e729e2abe64995d6a5ffbc88c639501f0b432bbf1d13af53f0e43b5bed4869ff7a9dd65e8d6cdc3da5a1104c9558
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 c874c9425d37dfa848c44666c00f243ec2055867488ce542429e9ff9901101c5
MD5 9631d00f53c9a9ff563cb14720439243
SHA1 a42b69c0bc97eee561690810de1c73277f5dbe52
SHA512 e55dbd698f70449cc6b337683cfa024fcf13dea4eb6c8a0ea3a2508fa59ea8c4627fb8953e63520e4a00c4db40d66bbbd1d46e3f8f81bc3a56a7f73385a2b4c2
SSDEEP 3:LstlNllkll/lS1F//:LsX3lEtSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView\Default\DawnWebGPUCache\index
Size 256KB
SHA256 906247540b82d64e8ce1e1a5d0e9132d588ed060a4413f49a0cbaac2bd50ac88
MD5 2295639e97bdcdc259a8dae8186a40b9
SHA1 f7b7e35bfe397221ffbbae19a54e11abd15357b6
SHA512 cad11ea9016d3b1c5fd5dc6aca09cca473dcd2de00690009a6841599c7c89abc24bb1db5b048812cd49ff0200ee7f0e92ecb9beab64edeaeb36e8e5fc785b80e
SSDEEP 3:LstlNllkll/lUF//:LsX3lEtu
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5898e0.TMP

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView\Default\Network\Network Persistent State~RFe5898e0.TMP
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

fbcb6fb7-f474-4e82-a936-750fa5edf20d.tmp

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView\Default\fbcb6fb7-f474-4e82-a936-750fa5edf20d.tmp
Size 6KB
SHA256 50abb61da53f6d877bfedcf361fcbf9be08141272411bdb9529acc40cb038ddd
MD5 bb3f3528fd0f5ea291522ba7afff5280
SHA1 56b3efd0b516e7b0ba9e8cf3468935e6d36a41b9
SHA512 230fb6af7742e0b3496859adf0de1d9d064f758282dd460750e2c9d16478f4620dce9b3dda746c278607547eb8971c353b5d075639440b064c2b3ba929af2c30
SSDEEP 96:stE05kt24db9uff+dZ8i0oE1klm/7qx+WVHMSm+uecadQja+gZrKEB:stE0Ckf4Z8pFT/S+Wi8djvrK8
TLSH
T1CDC1B8025F28797B4CC7F21DBA3ABB12D6FA102265D51E58EBFD851C08E66DD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView\Local State
Size 1KB
SHA256 a5d83eaa48d52468b21566fb461a061e2d6d29b62679d57bf930932e7d090ee0
MD5 0e19da9f64e7af73fa1ab88e9877dbeb
SHA1 a164533ccaa04d30f0ed8760b186daf8b899b322
SHA512 de26fde86381078b35603e10295429f76b867c116e3de8d9f3aade7cdb8b6a059029d4948fc8ac4f818e8b20079c24671368fd9c68e4e4e6ce866d2c0ef3032d
TLSH
T18B31B5B298C03F3548827B92B64A7A172D711226D1115F18B1DC270C02D76DC2F27C32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView\Local State
Size 2KB
SHA256 8f3fd905cd84d17ab38418f0e7b21d42f9e81ed215d08b58398b5912dd8f0a31
MD5 e381b3172bfc81a54133558c5afa6df2
SHA1 6ab18ea576eecf5fe6f38b7188dfe11f1b7ff32b
SHA512 0530c30ffb1f830640493ccaa9a886b8be3d4cb770bb0294eae29d0225c93201ef3ff21f1dfa3cebc4f2788d2fc32fe4098cd3603c0a92f3d0c640fa7d7a5cba
TLSH
T11C51D8736C446A3788D3AB417E4E3F23AD725261DA622F61A9DD2B0C01D76AC3703C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView\Local State
Size 3KB
SHA256 c4d5bd1ad7cc22828fc06f4b8486d236d3777dbd121aad69763ba99172a8374d
MD5 b9b62b10a03382b26b8d359972855d37
SHA1 4e34bf22d08fa3b7cea8469c6a3c3023b1f4b726
SHA512 06a7a6d2a98363c47218ab7d7e780ac40d5f4428134511f4663b4f8b72dd8936d993595c2dae9c3fd2b96760c0c4025b512b9a24ce642febefc29bd0ad6aadd6
TLSH
T1FC71C77668A4A93B4CE3AF41B98A3B17BAA15223E5953F65D9EC1F0C01D739C2342C12
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView\Local State
Size 4KB
SHA256 c99f6ccd3f636844f4659b5fdb45ba5534dce98a976da3bee094f1cd4a6ef338
MD5 164a96fdf0129de53b6c10e289504037
SHA1 22c005c3eb1d99284ed7e9dcedc731f887b457d9
SHA512 147264797015a79dc50346861656c604e809ce6acef3995c0f0ffef402c20f8d9f350d38116d5f9f0aad3b3cb0add7491b2737aa38fca580e1a10339c8faacf0
SSDEEP 96:zuiUGbNkCEmfHHTN58Frh/cInURoDotoiayD1BBZW6ijZ+aThl7a:zeGbNbLzsooDUDfLBZXi2
TLSH
T19681B66668A4AA374CE3EB45B98A3F13BAA15123D5953FA9D9EC1F0C01DB3DC1342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView\Local State
Size 4KB
SHA256 b05056e80af78371406df21a53a654de994d3fde1464e2630485859709206933
MD5 f8e5254468da64d3b50a4a187205e318
SHA1 bd6964f9b4dc139a2b92befc0223334c23b7aeb3
SHA512 27d89b30f70bda90caff3b8b16785daf474eed1a62a04c34f721e53ec9f50b75fd3f460f6c2764effbd7a91e0a84933b9f78a579602182815294c178eee1846a
SSDEEP 96:zuiUGF3NkCEmfHHTN58Frh/cInURoDotoTayDGBBZW6ijZ+aTal7a:zeGF3NbLzsooDU4fWBZXiD
TLSH
T1D791C66268A4A9374CE3EA45B94A3F17BAA15233D5953FA9D9EC1F0C01DB3DC1342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe583265.TMP

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{CE1445A1-35DE-4C25-85C6-67B6093C96CC}\wv2\EBWebView\Local State~RFe583265.TMP
Size 1KB
SHA256 ce30bd10f50d3262e6cce08acbf294e0f49bac6252b9de5734ebc147d00ae58e
MD5 f513d46d490ae03eae8c3aac3bf3670f
SHA1 3b8c4c3209b3e25f1a71cb09b5e24e606fddf040
SHA512 f5f29645ee1437944bb3de61b3594257cb936c344ce1ac8a21b2a613a11009d24e14f54965b4c696204e387b414f572b4aece50ca460c5504f45dc00c62c303f
TLSH
T14B2165B688C42A3598827B91BA1AB64B2DA05226D5145F18E1DD230802D75DC5F67C32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3904-25-0x00007FFB80260000-0x00007FFB80261000-memory.dmp

Download

memory/4732-47-0x00007FFB7EC50000-0x00007FFB7EC51000-memory.dmp

Download

memory/4732-48-0x00007FFB7EDC0000-0x00007FFB7EDC1000-memory.dmp

Download

memory/4872-127-0x00007FFB80260000-0x00007FFB80261000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads