d66e412cb82769f684d0e09378aab2d048b3949e029f3cd080ae6ac6242b5a47

Analysis

user interaction
yes
max time kernel
118s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20260513-fr
resource tags

arch:x64arch:x86image:win10v2004-20260513-frlocale:fr-fros:windows10-2004-x64systemwindows
submitted
07/08/2026, 11:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RealSetup_8f3be4861660edf704203b8211bf608bf81ff082d00fd01ab9ead507b3db3f82.exe
Size 16.5MB
Sample260807-m6hmrawxfx
SHA256 d66e412cb82769f684d0e09378aab2d048b3949e029f3cd080ae6ac6242b5a47
MD5 cb6d01cb4f6fb371a8651d4a7348f3b6
SHA1 8c772bf169aaa32096b7768544050e87525eff03
SHA512 7e77b0aef98b99f931b6c4baff5aeaeaae57c76d4ec5ad0898c13157eb74b599ea59f151dade9b13320e5e609f602b859b5c753c05255c0c68bedc2968953c5f
SSDEEP 393216:htQDIqMgneq1R0qTwMa2ulncqk61FDiOUY+OUY:KUqlqin
TLSH
T1CF07BF69A6BC01D9E867C1BCC2965223EB72B41523B057CF5A609AF60F23AD41F7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Real.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1572	powershell.exe
448	powershell.exe
3400	powershell.exe
3812	powershell.exe
5604	powershell.exe
448	powershell.exe
3400	powershell.exe
3812	powershell.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Real.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Real.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	RealSetup_8f3be4861660edf704203b8211bf608bf81ff082d00fd01ab9ead507b3db3f82.exe

Executes dropped EXE 5 IoCs

pid	Process
3804	Update.exe
2712	Update.exe
860	Real.exe
3284	Real.exe
536	luau-lsp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RealSetup_8f3be4861660edf704203b8211bf608bf81ff082d00fd01ab9ead507b3db3f82.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Real.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Real.exe

Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
77	discord.com
79	discord.com
93	discord.com
94	discord.com
76	discord.com
160	discord.com
161	discord.com
164	discord.com
172	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3284	Real.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4220	msedge.exe
916	msedge.exe
6856	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 15 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Real.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	RealSetup_8f3be4861660edf704203b8211bf608bf81ff082d00fd01ab9ead507b3db3f82.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305742972153883"	RealSetup_8f3be4861660edf704203b8211bf608bf81ff082d00fd01ab9ead507b3db3f82.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Update.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Update.exe

Modifies registry class 16 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\projectreal\URL Protocol	RealSetup_8f3be4861660edf704203b8211bf608bf81ff082d00fd01ab9ead507b3db3f82.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\projectreal\shell\open	RealSetup_8f3be4861660edf704203b8211bf608bf81ff082d00fd01ab9ead507b3db3f82.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{8B443DAF-E002-4F8A-BD7E-5BED44ECD5BB}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{CDE4B540-3DB4-4E9E-9150-FDB2417FAA82}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{BDC0A644-2D51-4C25-91A0-4217E70108E3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\projectreal\shell	RealSetup_8f3be4861660edf704203b8211bf608bf81ff082d00fd01ab9ead507b3db3f82.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{A96FBA28-2A5D-4C36-BE38-1E7047853DE7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\projectreal\ = "URL:Real Protocol"	RealSetup_8f3be4861660edf704203b8211bf608bf81ff082d00fd01ab9ead507b3db3f82.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\projectreal\shell\open\command	RealSetup_8f3be4861660edf704203b8211bf608bf81ff082d00fd01ab9ead507b3db3f82.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\projectreal\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Real\\Update.exe\" --write-deep-link \"%1\""	RealSetup_8f3be4861660edf704203b8211bf608bf81ff082d00fd01ab9ead507b3db3f82.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\projectreal	RealSetup_8f3be4861660edf704203b8211bf608bf81ff082d00fd01ab9ead507b3db3f82.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1572	powershell.exe
1572	powershell.exe
448	powershell.exe
448	powershell.exe
3940	RealSetup_8f3be4861660edf704203b8211bf608bf81ff082d00fd01ab9ead507b3db3f82.exe
3940	RealSetup_8f3be4861660edf704203b8211bf608bf81ff082d00fd01ab9ead507b3db3f82.exe
3804	Update.exe
3804	Update.exe
2712	Update.exe
2712	Update.exe
3400	powershell.exe
3400	powershell.exe
3812	powershell.exe
3812	powershell.exe
3812	powershell.exe
3400	powershell.exe
3400	powershell.exe
5604	powershell.exe
5604	powershell.exe
5604	powershell.exe
2712	Update.exe
2712	Update.exe
3804	Update.exe
3804	Update.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe
860	Real.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3296	msedgewebview2.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
2460	msedgewebview2.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1572	powershell.exe
Token: SeDebugPrivilege	448	powershell.exe
Token: SeDebugPrivilege	3400	powershell.exe
Token: SeDebugPrivilege	3812	powershell.exe
Token: SeDebugPrivilege	5604	powershell.exe

Suspicious use of FindShellTrayWindow 17 IoCs

pid	Process
652	msedge.exe
652	msedge.exe
652	msedge.exe
860	Real.exe
860	Real.exe
860	Real.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
860	Real.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 3296	3940	RealSetup_8f3be4861660edf704203b8211bf608bf81ff082d00fd01ab9ead507b3db3f82.exe	84
PID 3296 wrote to memory of 4780	3296	msedgewebview2.exe	85
PID 3296 wrote to memory of 4836	3296	msedgewebview2.exe	86
PID 3296 wrote to memory of 4836	3296	msedgewebview2.exe	86
PID 3296 wrote to memory of 4836	3296	msedgewebview2.exe	86
PID 3296 wrote to memory of 1064	3296	msedgewebview2.exe	87
PID 3296 wrote to memory of 2856	3296	msedgewebview2.exe	88
PID 3296 wrote to memory of 2856	3296	msedgewebview2.exe	88
PID 3296 wrote to memory of 1196	3296	msedgewebview2.exe	89
PID 3296 wrote to memory of 1196	3296	msedgewebview2.exe	89
PID 3296 wrote to memory of 1196	3296	msedgewebview2.exe	89
PID 3940 wrote to memory of 1572	3940	RealSetup_8f3be4861660edf704203b8211bf608bf81ff082d00fd01ab9ead507b3db3f82.exe	92
PID 3940 wrote to memory of 448	3940	RealSetup_8f3be4861660edf704203b8211bf608bf81ff082d00fd01ab9ead507b3db3f82.exe	94
PID 3940 wrote to memory of 652	3940	RealSetup_8f3be4861660edf704203b8211bf608bf81ff082d00fd01ab9ead507b3db3f82.exe	104
PID 3940 wrote to memory of 2712	3940	RealSetup_8f3be4861660edf704203b8211bf608bf81ff082d00fd01ab9ead507b3db3f82.exe	105
PID 652 wrote to memory of 412	652	msedge.exe	106
PID 3804 wrote to memory of 3400	3804	Update.exe	107
PID 652 wrote to memory of 4220	652	msedge.exe	109
PID 652 wrote to memory of 2772	652	msedge.exe	110
PID 652 wrote to memory of 2772	652	msedge.exe	110
PID 652 wrote to memory of 2772	652	msedge.exe	110
PID 652 wrote to memory of 4180	652	msedge.exe	111
PID 652 wrote to memory of 4180	652	msedge.exe	111
PID 652 wrote to memory of 436	652	msedge.exe	112
PID 652 wrote to memory of 624	652	msedge.exe	113
PID 652 wrote to memory of 436	652	msedge.exe	112
PID 652 wrote to memory of 436	652	msedge.exe	112
PID 652 wrote to memory of 624	652	msedge.exe	113
PID 652 wrote to memory of 624	652	msedge.exe	113
PID 2712 wrote to memory of 3812	2712	Update.exe	115
PID 652 wrote to memory of 4592	652	msedge.exe	117
PID 652 wrote to memory of 4592	652	msedge.exe	117
PID 652 wrote to memory of 4592	652	msedge.exe	117
PID 652 wrote to memory of 4640	652	msedge.exe	116
PID 652 wrote to memory of 4640	652	msedge.exe	116
PID 652 wrote to memory of 4640	652	msedge.exe	116
PID 652 wrote to memory of 3492	652	msedge.exe	120
PID 652 wrote to memory of 3492	652	msedge.exe	120
PID 652 wrote to memory of 3956	652	msedge.exe	123
PID 652 wrote to memory of 3956	652	msedge.exe	123
PID 652 wrote to memory of 5136	652	msedge.exe	125
PID 652 wrote to memory of 5136	652	msedge.exe	125
PID 652 wrote to memory of 5136	652	msedge.exe	125
PID 652 wrote to memory of 5316	652	msedge.exe	127
PID 652 wrote to memory of 5324	652	msedge.exe	128
PID 652 wrote to memory of 5316	652	msedge.exe	127
PID 652 wrote to memory of 5324	652	msedge.exe	128
PID 652 wrote to memory of 5712	652	msedge.exe	129
PID 652 wrote to memory of 5720	652	msedge.exe	130
PID 652 wrote to memory of 5720	652	msedge.exe	130
PID 2712 wrote to memory of 5604	2712	Update.exe	132
PID 2712 wrote to memory of 860	2712	Update.exe	135
PID 860 wrote to memory of 2460	860	Real.exe	136
PID 2460 wrote to memory of 5480	2460	msedgewebview2.exe	137
PID 2460 wrote to memory of 4964	2460	msedgewebview2.exe	138
PID 2460 wrote to memory of 4964	2460	msedgewebview2.exe	138
PID 2460 wrote to memory of 4964	2460	msedgewebview2.exe	138
PID 2460 wrote to memory of 5660	2460	msedgewebview2.exe	139
PID 2460 wrote to memory of 3788	2460	msedgewebview2.exe	140
PID 2460 wrote to memory of 3788	2460	msedgewebview2.exe	140
PID 2460 wrote to memory of 1152	2460	msedgewebview2.exe	141
PID 2460 wrote to memory of 1152	2460	msedgewebview2.exe	141
PID 2460 wrote to memory of 1152	2460	msedgewebview2.exe	141
PID 860 wrote to memory of 3284	860	Real.exe	142

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\RealSetup_8f3be4861660edf704203b8211bf608bf81ff082d00fd01ab9ead507b3db3f82.exe
"C:\Users\Admin\AppData\Local\Temp\RealSetup_8f3be4861660edf704203b8211bf608bf81ff082d00fd01ab9ead507b3db3f82.exe"
1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RealSetup_8f3be4861660edf704203b8211bf608bf81ff082d00fd01ab9ead507b3db3f82.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=3940.1764.1610278053649789105
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7fffa1c7b078,0x7fffa1c7b084,0x7fffa1c7b090
    3⤵
    PID:4780
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView" --webview-exe-name=RealSetup_8f3be4861660edf704203b8211bf608bf81ff082d00fd01ab9ead507b3db3f82.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1732,i,13604799372467036632,1803789189618954975,262144 --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:2
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView" --webview-exe-name=RealSetup_8f3be4861660edf704203b8211bf608bf81ff082d00fd01ab9ead507b3db3f82.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2052,i,13604799372467036632,1803789189618954975,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:3
    3⤵
    PID:1064
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView" --webview-exe-name=RealSetup_8f3be4861660edf704203b8211bf608bf81ff082d00fd01ab9ead507b3db3f82.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2360,i,13604799372467036632,1803789189618954975,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:8
    3⤵
    PID:2856
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView" --webview-exe-name=RealSetup_8f3be4861660edf704203b8211bf608bf81ff082d00fd01ab9ead507b3db3f82.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=fr_FR" --always-read-main-dll --field-trial-handle=3584,i,13604799372467036632,1803789189618954975,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:1196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "try{ $ex=@((Get-MpPreference).ExclusionPath); $want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll'); $stale='C:\Users\Admin\AppData\Local\Temp'; $miss=$want | Where-Object { $ex -notcontains $_ }; if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1} }catch{exit 1}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll');$stale='C:\Users\Admin\AppData\Local\Temp';foreach($p in $want){ $ex=@((Get-MpPreference).ExclusionPath); if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }};if($stale -and @((Get-MpPreference).ExclusionPath) -contains $stale){ Remove-MpPreference -ExclusionPath $stale};$ex=@((Get-MpPreference).ExclusionPath);$miss=$want | Where-Object { $ex -notcontains $_ };if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/projectreal
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7fff9e7fc188,0x7fff9e7fc194,0x7fff9e7fc1a0
    3⤵
    PID:412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,7040164139161639545,13365109631391176020,524288 --field-trial-handle=2432,i,10699556684359981290,8852638737334576451,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,1760033332559415386,18277508377428236837,262144 --field-trial-handle=2432,i,10699556684359981290,8852638737334576451,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:2
    3⤵
    PID:2772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,17444992361297806210,13915542921755995829,524288 --field-trial-handle=2432,i,10699556684359981290,8852638737334576451,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:8
    3⤵
    PID:4180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,618173916211247773,18374008243773168430,2097152 --field-trial-handle=2432,i,10699556684359981290,8852638737334576451,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
    3⤵
    PID:436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,6865263186978551703,7187558603554549965,2097152 --field-trial-handle=2432,i,10699556684359981290,8852638737334576451,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,13072922807967760240,17591495766641458818,2097152 --field-trial-handle=2432,i,10699556684359981290,8852638737334576451,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
    3⤵
    PID:4640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,17108192963353329547,1112955445981754571,2097152 --field-trial-handle=2432,i,10699556684359981290,8852638737334576451,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:2
    3⤵
    PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,15423031582107572963,11668091229537662869,524288 --field-trial-handle=2432,i,10699556684359981290,8852638737334576451,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
    3⤵
    PID:3492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,811249686300589902,10205507388686330922,524288 --field-trial-handle=2432,i,10699556684359981290,8852638737334576451,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
    3⤵
    PID:3956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5444,i,6518989799175389969,1610340933080578183,2097152 --field-trial-handle=2432,i,10699556684359981290,8852638737334576451,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
    3⤵
    PID:5136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,9123232757685785164,6800491163806961628,524288 --field-trial-handle=2432,i,10699556684359981290,8852638737334576451,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
    3⤵
    PID:5316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,13767187959756138504,14048456463985880061,524288 --field-trial-handle=2432,i,10699556684359981290,8852638737334576451,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
    3⤵
    PID:5324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,4313290075671752756,7955509693163324272,524288 --field-trial-handle=2432,i,10699556684359981290,8852638737334576451,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
    3⤵
    - Modifies registry class
    PID:5712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=fr --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,15800377331946074786,25080023847053884,524288 --field-trial-handle=2432,i,10699556684359981290,8852638737334576451,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
    3⤵
    PID:5720
- C:\Users\Admin\AppData\Local\Real\Update.exe
  "C:\Users\Admin\AppData\Local\Real\Update.exe" --processStart Real.exe
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll');$stale='C:\Users\Admin\AppData\Local\Temp';foreach($p in $want){ $ex=@((Get-MpPreference).ExclusionPath); if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }};if($stale -and @((Get-MpPreference).ExclusionPath) -contains $stale){ Remove-MpPreference -ExclusionPath $stale};$ex=@((Get-MpPreference).ExclusionPath);$miss=$want | Where-Object { $ex -notcontains $_ };if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3812
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAIABFAHgAcABhAG4AZAAtAEEAcgBjAGgAaQB2AGUAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAByAGUAYQBsAC0AbAB1AGEAdQAtAGwAcwBwAC4AegBpAHAAJwAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcgBlAGEAbAAtAGwAdQBhAHUALQBsAHMAcAAtAGUAeAB0AHIAYQBjAHQAJwAgAC0ARgBvAHIAYwBlAA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5604
- - C:\Users\Admin\AppData\Local\Real\real-1.8.4\Real.exe
    "C:\Users\Admin\AppData\Local\Real\real-1.8.4\Real.exe" --real-launched-by-updater
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:860
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=fr-FR --mojo-named-platform-channel-pipe=860.5576.13635538282406818055
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:2460
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7fffa1c7b078,0x7fffa1c7b084,0x7fffa1c7b090
        5⤵
        
        PID:5480
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2072,i,17529998303999390808,2209944169823947667,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:2
        5⤵
        
        PID:4964
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1764,i,17529998303999390808,2209944169823947667,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:3
        5⤵
        
        PID:5660
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2316,i,17529998303999390808,2209944169823947667,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:8
        5⤵
        
        PID:3788
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=fr_FR" --always-read-main-dll --field-trial-handle=3544,i,17529998303999390808,2209944169823947667,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
        5⤵
        
        PID:1152
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=fr --service-sandbox-type=audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4448,i,17529998303999390808,2209944169823947667,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:8
        5⤵
        
        PID:5216
  - - C:\Users\Admin\AppData\Local\Real\real-1.8.4\bin\Real.exe
      "C:\Users\Admin\AppData\Local\Real\real-1.8.4\bin\Real.exe" --rbxversion
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:3284
  - - C:\Users\Admin\AppData\Local\Real\real-1.8.4\bin\luau-lsp.exe
      "C:\Users\Admin\AppData\Local\Real\real-1.8.4\bin\luau-lsp.exe" lsp --stdio --definitions:@roblox=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\roblox.PluginSecurity.d.luau --definitions:@real=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\real_executor_apis.d.luau --docs=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\roblox-api-docs.json --base-luaurc=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\base.luaurc
      4⤵
      Executes dropped EXE
      PID:536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://api.projectreal.gg/auth/discord?mode=login&app_auth=1&state=QhmdjYZiVh2zGyely8RziB4ipNY4LTWy4kDhu43Mw-g&loopback_port=58600&hwid=HWIDv5_701a397a4d9d2e76e342ff2f5f24fb9a01d9077f11601f7424fd03a55dc5f075
      4⤵
      PID:5924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://api.projectreal.gg/auth/discord?mode=login&app_auth=1&state=QhmdjYZiVh2zGyely8RziB4ipNY4LTWy4kDhu43Mw-g&loopback_port=58600&hwid=HWIDv5_701a397a4d9d2e76e342ff2f5f24fb9a01d9077f11601f7424fd03a55dc5f075
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5964
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7fff9e7fc188,0x7fff9e7fc194,0x7fff9e7fc1a0
        6⤵
        
        PID:2108
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,367277716677790359,18219950005957842928,524288 --field-trial-handle=2268,i,10133353880089841222,15875626580153362425,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:916
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,8707993998814023373,16600377707822767709,262144 --field-trial-handle=2268,i,10133353880089841222,15875626580153362425,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
        6⤵
        
        PID:436
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,9436475589811029473,16870927237049423664,524288 --field-trial-handle=2268,i,10133353880089841222,15875626580153362425,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
        6⤵
        
        PID:5672
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3360,i,18354215078707400760,9817638064544216121,2097152 --field-trial-handle=2268,i,10133353880089841222,15875626580153362425,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
        6⤵
        
        PID:6120
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3364,i,114763042222060022,18091641734280887840,2097152 --field-trial-handle=2268,i,10133353880089841222,15875626580153362425,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
        6⤵
        
        PID:3536
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,12647853757097259474,1585723154180067837,524288 --field-trial-handle=2268,i,10133353880089841222,15875626580153362425,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:8
        6⤵
        
        PID:2936
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4716,i,4251803800562216837,15530109494818675100,524288 --field-trial-handle=2268,i,10133353880089841222,15875626580153362425,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
        6⤵
        
        PID:1124
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5020,i,2339674943125776560,10335129353205342672,2097152 --field-trial-handle=2268,i,10133353880089841222,15875626580153362425,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
        6⤵
        
        PID:4220
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,4548497582982332058,1904588865675039652,524288 --field-trial-handle=2268,i,10133353880089841222,15875626580153362425,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:8
        6⤵
        Modifies registry class
        
        PID:3580
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=fr --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4716,i,2222925637197175228,11432751680080404684,524288 --field-trial-handle=2268,i,10133353880089841222,15875626580153362425,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:8
        6⤵
        
        PID:5448
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,14074233480848542270,14191223421572749718,524288 --field-trial-handle=2268,i,10133353880089841222,15875626580153362425,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
        6⤵
        
        PID:4820
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,3191087746951764479,7677388671827451751,524288 --field-trial-handle=2268,i,10133353880089841222,15875626580153362425,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
        6⤵
        
        PID:5324
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,10333098710118799031,16218243186103037641,524288 --field-trial-handle=2268,i,10133353880089841222,15875626580153362425,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
        6⤵
        
        PID:6216
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,10333098710118799031,16218243186103037641,524288 --field-trial-handle=2268,i,10133353880089841222,15875626580153362425,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
        6⤵
        
        PID:6236
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,13510360605526703150,3164680236414199210,524288 --field-trial-handle=2268,i,10133353880089841222,15875626580153362425,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:8
        6⤵
        
        PID:6604
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,8579097776066195150,3684018181757384063,524288 --field-trial-handle=2268,i,10133353880089841222,15875626580153362425,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:8
        6⤵
        
        PID:6652
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,874771900957555940,2221586800402877107,524288 --field-trial-handle=2268,i,10133353880089841222,15875626580153362425,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:8
        6⤵
        
        PID:6788
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,1919473718694892258,13519095345301143126,524288 --field-trial-handle=2268,i,10133353880089841222,15875626580153362425,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:8
        6⤵
        
        PID:6880
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7000,i,3088796561737629438,15293914928387841212,524288 --field-trial-handle=2268,i,10133353880089841222,15875626580153362425,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8
        6⤵
        
        PID:4436
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6436,i,15408849622551825445,14071220727489731933,2097152 --field-trial-handle=2268,i,10133353880089841222,15875626580153362425,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:1
        6⤵
        
        PID:6576
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,16241370178831753678,13350917870957607161,524288 --field-trial-handle=2268,i,10133353880089841222,15875626580153362425,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
        6⤵
        
        PID:6960
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,9209000013999280760,7240846768234832676,524288 --field-trial-handle=2268,i,10133353880089841222,15875626580153362425,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:8
        6⤵
        
        PID:6968
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,1020346877877491252,3268689447398999498,524288 --field-trial-handle=2268,i,10133353880089841222,15875626580153362425,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8
        6⤵
        
        PID:6976
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        6⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        
        PID:6316
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff9e7fc188,0x7fff9e7fc194,0x7fff9e7fc1a0
        7⤵
        
        PID:6760
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,16200592116735417826,10749420598373551667,524288 --field-trial-handle=2284,i,5922972335278815842,6771996501615580744,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
        7⤵
        System Time Discovery
        
        PID:6856
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,3757374498314529063,4476174434128663789,262144 --field-trial-handle=2284,i,5922972335278815842,6771996501615580744,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
        7⤵
        
        PID:6640
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,1468262924609539785,1560053170852686877,524288 --field-trial-handle=2284,i,5922972335278815842,6771996501615580744,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:8
        7⤵
        
        PID:6848
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,12401386111081779780,2423120721702310161,524288 --field-trial-handle=2284,i,5922972335278815842,6771996501615580744,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
        7⤵
        
        PID:4016
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,12401386111081779780,2423120721702310161,524288 --field-trial-handle=2284,i,5922972335278815842,6771996501615580744,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
        7⤵
        
        PID:2176

C:\Users\Admin\AppData\Local\Real\Update.exe
C:\Users\Admin\AppData\Local\Real\Update.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll');$stale='C:\Users\Admin\AppData\Local\Temp';foreach($p in $want){ $ex=@((Get-MpPreference).ExclusionPath); if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }};if($stale -and @((Get-MpPreference).ExclusionPath) -contains $stale){ Remove-MpPreference -ExclusionPath $stale};$ex=@((Get-MpPreference).ExclusionPath);$miss=$want | Where-Object { $ex -notcontains $_ };if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6300

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8af66e73f805729337378c5bb5c8040029e2a6618663f809f5a01093b73c09f1
MD5 daffe303c006689b8507f8612ef5e5f2
SHA1 8096b87391b4fbc9a1277969ba7c9e3be3375e19
SHA512 38b360184e14b9a2bbde85bbcf0159a74bb2e216adee5c144c73b42b67220c3221b1707e409c5829730123805ba35b430ac01bca88459994e4920bc9abeed53d
TLSH
T1BED080107929B6D3E217007E84705B01591585BB6273B3057125580DDE74085F5CB5D2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f6442e759f8a8d0b2f0e05c9e9d4b9bbaaa2ed77e406a2ca3c3dd438907f56f0
MD5 12d94918fd581fca0103fa460709877d
SHA1 17977cd090a5ff6e6fdaa5c1ff18f2f1cd12e5d0
SHA512 eb6565762cdb6e506bfde3ff39aecb3ea3687f008847dbe55e42d374a0c26181cb9d7a27f84b134e7b1809c4450d6639768ca96598e750fe5575bfee03203598
TLSH
T198D02370B935B7D2D21F007D44706B016515817772B7B7517166680DDF70085F1DF9E5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e4fd9c1c3e89a25e7f1347184af56f22628aede47142c5a851e3416974730905
MD5 17e372cd0fe11772a6f6d1a76a1bbadc
SHA1 775b2c8f1bfc3d3e54da381f6a89e54b25621783
SHA512 61ab148ec5c114fd2c2f150054e94ef4ea6f3a5026c6b0ad49bd443389eaca58ad9626911fa51b9a9bcb6cbcdd0bb9e0a502264ade947371b4a6e81d703fa40f
TLSH
T12BD08010752976D3E217007E44605B01591585776273B3057121580DDE74085F58B5D2
MD5 SHA1 SHA512 TLSH

Submit Download

287f7c32-5462-4d6e-bd9f-c2d09fae9133.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\287f7c32-5462-4d6e-bd9f-c2d09fae9133.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

57433da9-15d2-4fa3-9af2-b1e498485dc7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\57433da9-15d2-4fa3-9af2-b1e498485dc7.tmp
Size 414B
SHA256 56b277ceb28dc68b8fc408658cd7e5d87d88f896bfb2151d273fbb42e989b529
MD5 a4c6573f8040963d2d345159ce399521
SHA1 3da2eb8cdf7511728a3ce62346e03ed3dbc4d1d8
SHA512 82f182895a3d9a036f4239b3bc024eb281a745ca319b923b53a2565b550accdc343e35a4801e8479bc64eb55fb913df712ae3912ba8832ef46d0c6fa55b13533
TLSH
T130E02BE5C8A1EC271CFD5B28B015074AE750139B2B91881F3B3D920C8FB1736019685C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 0a8b67cd0b24c7952f7908405398a2aa15eaf126e72dbb789e58abc08d6da85c
MD5 25d890612ba442d53f9b23c9dbdcd5fe
SHA1 43e5874fd33335b2131a4ae76794ddb2241a41e8
SHA512 5fe3661b35109e4846dd413e01b34f6758e530141691f1e2e425e5f087fc3d5c237cc7d1fb3b5298551023db4d449ec39af9e74de45e79a089107e2ace7727af
SSDEEP 192:hk0NLuszEtr1hXXLP8MoOB2V1YT/OtXAKl/dbHx:DNxxA2V1YT2tP/dF
TLSH
T11C3263310A62F82AFB550DB895DA36A47D30D9EBF80B1E9343245DB1EF06B45638F524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 828e1619ef0d67d513c603aeda99dccfa181f41f11acc1b3f811f88af683083b
MD5 18a4a2b77374c6dc6ed44ff1d40f4e6c
SHA1 1fcae6326e9bf13c1efe2fb9be38dfe080cc04de
SHA512 a3dffbd17825e796fb772ab9f3a00d4747ba8b195c77f23b139fec4e1f3ec813f6ab81d123045ec2347505411eae4fe37ff69bd9734406867317f0788704449f
SSDEEP 96:yx8j/7WSP68n70fj0krxEurGnC/j5Ye4IiWxANFY09FI/PvDHfvQYNv4mzDM+zIy:HT5N7Oj/vr3q2iFrI0gEVkfDfce
TLSH
T10402B6351293F96BFF821D7A80CE00617A718AD7F84F0EC383215E71EE46B95239E964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe589ab4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589ab4.TMP
Size 3KB
SHA256 2cdaa4da3cdeb61539de63c3782ecdb08e17d861990e7e2bc1afd61dbb6c2404
MD5 09a0c97b118974d79b482c0d2df3be71
SHA1 430b2889fe1b063fe825dd5da61e4afd0ec633f7
SHA512 72a5f3a0086f13692fb3c4f69b095e296182e142807cb44f7fec4e6e60cd8c9fcb6adfd064ab0bbcd04d3c0e7d814ad230f055872213d21c910b6025d333ea83
TLSH
T1B781E630038A3EA3F3151DB4D1D1010276B08DFAF56F9ED60574AA3A2307F91971D9B9
MD5 SHA1 SHA512 TLSH

Submit Download

bfb5fd15-cc55-4dbb-bc44-c69b9cd25068.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\bfb5fd15-cc55-4dbb-bc44-c69b9cd25068.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

226a63c6-f560-4b38-b6e0-43c5f74b5d97.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\226a63c6-f560-4b38-b6e0-43c5f74b5d97.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 279c26cb8b5e31ca651f2d67d760847729c8b9ebae0c449d311229fdb8979bc2
MD5 922584a4daf738f2afe7a178aa082086
SHA1 3e37659a063ca5b8ee60b0d11d8c9f99443a49f6
SHA512 9feb40eee6fcffd11319b822fc70a51a8f97af9212683e2eae49c0221257612b4e235016af2ed167bb8a354c35b65e066972adeaf32eb6453524ebb5728a24d6
TLSH
T1A53169F3C7E8866D9E1152F4AB156E1BCE2D0954431C3C2AC4E4AE1F97E2561F18095F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 e680bfa4fe4b0b6a45df7bd61f9e85536cf0cb2f251a54cc9773c24e5504ebbf
MD5 2515e2733cf4bf214d53d8de440f6ba3
SHA1 cdfc6a3f391095465baf9b1a16e7fc87c98d6ec5
SHA512 2b2b79aa87df7fb4b1738777de2a8aa7b6162a285861181f2ac36fafbed9891dfdf9e6f3fe258b893d6b2bf6d63053b8c8a4b44b8f1b9fef17f110e2980748a3
SSDEEP 96:DuCpHRxJuBuOuruIu2H2CY+G7XtuRu41uJVuGu3uCZu6Bw6uM:DpHRxJ2LSJFH2d+Gbt2f1g/4nrPx
TLSH
T105B18BB3C7E8876DD91112F05A183E1ECD2D1D5443283D2EC9E5EE4F97E25B2E281A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 365ec56cae7d80135d4f1d3f770128fcf1d7be593bd8b7a0fc7f0eabba865439
MD5 8eb7638f218f5702d17a453a41f9df04
SHA1 2274c882b18879ca9d3e9d52d291be2ff6c04d51
SHA512 b2ac4a7550511e84823c20862931504223da7ad35741c77b6ce49ace931c8bfcba4b8cf4b2c3db48ca936dfab31afb3fea78fb03b7f4d9c04e89655131a0bcfb
TLSH
T111316A63C66EA467542E1D6B0D49780619FAB83A07C654F5EB5AC03CA1C18F78B0B023
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4190ec314fecc9a593417502e9ef0a3d7a8924912c50c5a94e6d7d2e447c987d
MD5 4fbb1f297b1a1ce0bfb4b21ce34234eb
SHA1 ffe7a9dd962a0c6f7a1193f26e8890b20586d3cf
SHA512 0d8d628ed316dbb07dbebf671a7e25405eaa02c94e1953f972fbfecee3f1b54edee6b053a1a8e6e532d8e48d422448d23748a97c8ea0417113b5d60326dfc2ff
SSDEEP 192:sxZC/yHkKOMl8zcj7/frsgWpVGVvEupE4HW6+WNJ3FK/YAnnaPIgEJ:sxZCEJ7/frsgWvGV/5HbG/lMI
TLSH
T1BC52E951AB38697BCCDBD219FA557B53D2F50462A2950E54AAFCDA1C00E7AEC2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a813cf76b5b80ae62abdfac99b2ad0e19bc42eefdbb1ad579258bc7ef099c523
MD5 d52c3c650cec63082e892b5536ae369f
SHA1 e86ef90204c27749948179175e5ea4f4f0c43814
SHA512 561b9f9baa9311aa8b2868bf2d1308a1b0a3ef4c5be9b66aea78dcaea77cf5c309b6251d6e5fd59f5a2f0dc8a0f6ba810262da47631c5b5f90462e048bd2da74
SSDEEP 192:sxZC/yHkKOhl8zcZ7/frsdoWpV4SI/XzkupEMHW6+WNJ3pHfYnmC+nUJIgyJ:sxZCZD7/frs2Wv4SUNHbLf/AO
TLSH
T16B52F901AB38997B8CDBE21DFA557B53D2F55466A2950D4499FCDA1C00E7BEC2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 e499b43026c9ccec9c551f5cad6e682389c309621b1f5368ff36003c3d98ef8a
MD5 5b81072ea835daa0ad9105b885c90090
SHA1 2483b8ecb144125ed84b8f8040ca69241a09720b
SHA512 1e3a828d425a1057bc6e0e9a176f0be4f7d541d173d39a7e7e9ac514857aa4cd2d5eca75d9fa04700e9e74d7f1a9226127ebb45e7e6e8a94be381808ee7a5c78
SSDEEP 192:sxZtq/yHkKOhl8oZ7/frszoWpV4hI/XzkupEMHW6+WNN4/E1+LA65nmDrnJPIgbE:sxZcZb7/frs0Wv4hUNHb511pI
TLSH
T163620B52AA38997B8DDBD21DF5557B53D3F5542692900E84AAFCDA1C00E7BEC2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b6cc9be45fe49259d18a3b5a0abe9cb0d2b46094f2f1f7fd847c64e75aba3eec
MD5 e9b84fe46b6e51496aa841ad01318943
SHA1 11a03f3d97a0d2f644dd42af95f5e6bb24a8e5dd
SHA512 386f7522f62ebdff239bf3d3d97da654f1364a70b605d6f03d0f6946002f5a67c8a0b578462a5c81da4f1a23d796025e2cc23309bd20b40c8dbed152fad8ef32
SSDEEP 192:sxZlq/yHkKOhl8zcZ7/frszoWpV4hI/XzkupEMHW6+WNJ3NyH+k65nm0KnUJIgbE:sxZUZD7/frs0Wv4hUNHbeHZAI
TLSH
T17C621A42AB385A7B8DDBE21DF5557B53D2F5542692910E849AFCDA1C00E7BEC2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 0006fac4a1a16a7d9df10270625accc760e429b28a886743cf84521056bab0c6
MD5 d9811241e611de20e8d95a7d88110979
SHA1 6b1259d5509e6a23c14da6466551dd18fc0b32fe
SHA512 3891e6b926022d422d369bf50cd34a3657fb5b5a4bd96c9cefad7164b5e2d02f682bbb548de903814998e211d159459db10585e6cceccfe8acc04d54e34a1c10
SSDEEP 768:llsqxAlWvJD0T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVT4Ll6AR9aroSzZ:llsqxAlWvJD0Tu1jac4LAs9RS9
TLSH
T11FE21B3B694CC77E4F840E9DEC26AFD76ED801CB67988D5447FA880C02C72EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 922a3fec3a85e6473c5c65b821f29b26b384108638be1b4f68960f71dbe99d82
MD5 4221a3452bdccaddc10c59ddfdec0b80
SHA1 a299ef408c894001ea813e365a005d435e3730d7
SHA512 2007409149c10eb21916262c3e0f65a61acf9850ad8cafea0c8137f1ac1f9bd314f1a779115e5c59c4d0168df568d637f255e14d45b98a32e49100cd0aad52ec
TLSH
T1C5D0956FA0050454E7FA06510533704E4E142CCC585D501CDC31302D0C706535211F57
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 3b95f23989cf849332a6c16db7ddf311dd374c5a7be8b829326d03285a49b8fd
MD5 6c15dddbf9cb20de34fb989a49101411
SHA1 20e34af1c0fc4ec4527f4f4d0a3efdb6e61e32d4
SHA512 90891baf9adffa0831e98f1f095221374b92d1089742bb5b87fbbf3b6d005d344c793ef2f6147710b1013fe03b7a30be135b530537829853f73eba911f9b4ae9
TLSH
T17BD0A7AFA44909A4E7FE4B911A73B15E8E143CCC989E505CDC31102A0C95AA35212F67
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58878a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe58878a.TMP
Size 138B
SHA256 b85dbb268a14b531f31e715ccd9196904686b96d7066d3a327a80ae0dcff50d9
MD5 1f6fa3ee584f445316f1731d495c0272
SHA1 6ec54a911473244567ac142a43d5c6ff50255167
SHA512 48d819920638c3e45b4eeae4183ffa341bf68129f3505a996d3cf9cc8664fb6486f2c6a5abcc3ab5b396cb07221d16154b93650fd85eb196cb9ae357b164c89f
TLSH
T17AC02B7FB0480254ABBC07A20233614C87082CCC9CCE804CA833302C1471E23220AFF3
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a398ccb59b45e67ea488751452c9b3681097c1ae13ecfd85886416a6f1c8923e
MD5 b1d36f337c290794ef8bc9c9160bbdfd
SHA1 79e4a41ea35934088a459c8610deb77c35d3417e
SHA512 a10b0cfce84f21c6550278f46be543a15ef01beafaee314510687f00c20715e9ee1e7ca9fc60f034cf5aebe042e064f89fbc5fffe350617739cbf4eec3897bd4
SSDEEP 96:KYbaKYIK2fKK4EGrmKUAWnvm9ZvNtx05D:ExBaN7
TLSH
T182911606723A060238BD685CF36696378E4131633818A4EF7BB854724EBBE254DFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 91B
SHA256 b5ac12376878718d3accc7ed17f9d3350bcd6e6924328ed81d69eb1b250f83a7
MD5 471b1d93ed8d51f89e63ed5fb3908826
SHA1 7eb6ceead5c1abf3c63bd654f1021303916cf35e
SHA512 435ceaa9bc23e45012e6c72d0c3437862945f0a2a4cddd2458b12a7a04a6d63ac30fcc7e7f470d0c0ec7dc6c38796f7adec849b6ecd006fccb61f12f0b656825
TLSH
T168B002BB504259D55F7534F7014731DDC56633CC9C85DE8D9472205C321457F2001D65
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5942fb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5942fb.TMP
Size 178B
SHA256 59ff3fcd4ce854711f8972a283f1f4125b4b7dc6c131693b00d4a2fc9564ce73
MD5 593eb9a92431ffe1675ab1c844fa30ff
SHA1 37aed355703032bd8ae79fcf0fb6dd3acb708884
SHA512 7376c3621636dfc0823f2d09256fe24e16968984be933fab43a7ef0058384774289666907e7c89d5f7c729858c1054135ce9a172f30d2810a0daa06e9c3e1ff8
TLSH
T1F7C0807F014355912F7814FF024331D8C7353FC88CC59A4C4871300D3234C6B1501D54
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 f2d79f016324f6ab7dcd672f243ac51ed2327aa5f3cc718e4994584ea68b3409
MD5 de16367d73a664ce2adde06894a99306
SHA1 b3dd6101a5c0cf23cf7fa52d0c41bdf3ebaa1efb
SHA512 f07d58f79109e4ee165d91ea0e5a11eb7b49e8caa0d8b43e55a46a12ce3bb5980dc54f142852d1d0a7e427262d333b0d85294a8c15c08c2047de9333d3baf495
SSDEEP 192:uuLf+xasuheOwQxMTsNkBQ99IkRbF5QmiU1dPI4VRNM+Fd10hwaKJnA4qBtiKF7r:n1ZcIosNkBibb1j3VRNHdmfrF7Iz5a
TLSH
T1D2825C716C385CB799F6AD06E55B2A035FF8513BAAC41E84D6ED9B0E00D76981307C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 73910a994efa372dcd95fedc6e3a95ff64c0729a9372977301d4ade949e3a412
MD5 6764adf025e6325fcb85eec7e3b52684
SHA1 60d2cf7e5f49028b49abdf2421db719c4668df52
SHA512 ba2c6f019c2e66d0ba1b5d81c5cb92233d5d129f95d03840030ed12e67de8b0b2daf9e32e22d1a407b39d1b87b2fcd00b58dc1a266d1c35e6b45b2e04b72626d
SSDEEP 384:n+ZcIf3sNi0ibbBQ3VRNHdmXyorx7OM9ukcGrF7Iz5a:8f3OlHHwNrEM9MGka
TLSH
T113B25CB1E8644CE744D5E5CAA54AE5072DB84237CA8D5E9CA2FCBA3E309F4F85312C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 c826eb00f3a0c0f49b59f73ad3ec61d8c72b34b9346424d6bc19f6ad164297ef
MD5 3151fb438cb13534594ba7b6ed558595
SHA1 2b66ffab9385f54437c68784156923daffaa2faa
SHA512 93e06a2ffb280b24f6205c09839b549365b0e45237d5a5ea96b2a524629f0c85bb8281ee7cf6718f4efabf91a20ea8b7dadcdde6d4f80c396727685d86457f0f
SSDEEP 384:zJsNtULibbeqiVRNHdqWkAStPl1ip5mkchU:N8wHHYMSEp5UhU
TLSH
T1F38229B1E8645CE74895E9C9914BE5032DB4413BCA8D1E8CE2F87A3D309F5F85342C6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 30f6fa871185cf30528b5f7ce92a29b7be0d2a9d75e36c990e81dae6632a067e
MD5 a647fe0e1c5b84b58ea873f66aafc7aa
SHA1 3d579b1d7c672da30d2bf3a42f27a3b2bc2a106e
SHA512 9afc7bd4ba913f3d62d05c00d0c33bb65d5e768851b2b0b4440b63d0a68ce95c333ea92c25c1cdc26332a951be643bba91d54271400b6c298eee5588518d39ab
SSDEEP 192:zLdsNkLQ99IkRbFUQmiU2UJIZVRNM+Fd10hwaKIoA4qBtiKF7Izt:zJsNkLibbediVRNHdQfrF7Izt
TLSH
T1C54219756C385CB78DE6AD06E55B26036FF8512F99C52E90D6E85F0E00DB29C130782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2e4af0fd07a17c5afb91ad831c2fb4b1a53100af38dd29d65ceee9c0c84b5a67
MD5 b85cf105b4445cf00298d639e518d287
SHA1 811417dae496a59247049cc0bf4ebb0c3c68371c
SHA512 096c59175688f3a6b50ebe21c037fd7125bbc2ddfad6623b2a6bccf64749c13c0c5dbc2ba8296f3b51dc27e022d7f0aa6cbccfb3ddb5d1f3f966dcf1a4b5b987
SSDEEP 192:tONr6JkRtQmiUy0NW+RNM+Fd10hoh3ERyU6:tONr6UrlW+RNHd1dU6
TLSH
T1A802E835BD386CBB9EF2AD09B58727175FA5212BFA952F80D6E80F0C01D765C1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0946eb5d58d2cd89c9c0030356e35a589f3270f1d29345f48ad9e7701ba46621
MD5 94e3154fc6c0943b5db2e05f0f0357fc
SHA1 bb48fb4a2bf2db90328d60dffe840fd1cd7cc40a
SHA512 c26a7eae6d65b9d22f6e479a286857681eb32875c0087cdfc6e69ba8f262416cdbf89017a20db31fe7cc913371718b520c158cc27c10466a6370fc0d62bd7a71
SSDEEP 192:rON36JkRIQmiUypNF+RNM+Fd10hwaK1Vc8qQ07U6:rON36Uo6F+RNHdY1U6
TLSH
T158120835A838AC7749E6B805F48736935EA8217BED856F81D6E84F0C01D779C270BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c385076a-6615-4430-bf3c-4904420876da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c385076a-6615-4430-bf3c-4904420876da.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2d206e0c67bac38429a3c306e7ab325ef514565e3cf61f5f26bf754946cd1a76
MD5 efe7f8482d9c55b54256829b40795ce5
SHA1 9e7c7c1ce75b5ae2aa4a2b6776b8a4a164de19b6
SHA512 969d8b471dfa1871496cf8bfce392f5ace91dca5484ca1bea9cca9e5c4cc2640e5fa1a5713ce4aa705429cc0c5830e6b70913a632367489d8533902efff8c733
TLSH
T1BE114523F78C8920CC96163A509DAC5172B686CB81AEDF9F7FC0C210E5BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

.real-write-probe-2712-240678312.tmp

Path C:\Users\Admin\AppData\Local\Real\.real-write-probe-2712-240678312.tmp
Size 4B
SHA256 aa33996d60e89311b4d1a920dae03c6d7fa3ae1956c52662e273aad4683e577f
MD5 4bca24304861acde5770fdbe3cc2503b
SHA1 c9c64e071d2853bc7906c017a231ad1cc46ab630
SHA512 310070ab4092002aa33f550eb98680fa6662e7305fce227843430aba334fdfad1fe0dd4a6484264b59f9b02a780433a552ce3d5c3da643a77427463c06e47800
MD5 SHA1 SHA512

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\Real\Update.exe
Size 8.2MB
SHA256 d4a07f712ec40e4ab8bbb1245bee820d1294a4557af279c94402b33d0e451f77
MD5 516e2613ac7c08b18da590128cded6f5
SHA1 eb24a3d41ed2ef6d73d7077ed7f9e7022bcd51b3
SHA512 a17c7942162741a2bf9c68cce5179ea59abef0e41611a2cd442e9de9bfec0d96abadfea8d920348cb546a414f6fe1cdfc634e9c3affb861479ff683bcad84fb5
SSDEEP 98304:JXj9S0C2/bIa2ulkYfEqk6DdbIYis+kU0mwbEXev8wcFOvkSxMy5/Dn:N8w/Ua2ulkYcqk6DdbIYDrBwOUgBRD
TLSH
T15D86CF69A6BC01D9E867C2BDC2965227EB72B415237057CF1A609AF60F23AD41F7F700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 cf60a7414142dad73782b04074497383e67690c9c4dfbc114939acdb4f9feace
MD5 8ae3c61a610f66acbe291301be2fd4f0
SHA1 35a7ca29b72aaf03d53ce67576697b72eb38c30b
SHA512 4ad8e72e59d7ebcfab1eba5bd3b7fdb36f48e17a31242eb35fb2ce56e89001ef4ab8e5b88df46c6361bc7a7877c5ca7861c59529c46d0e1ec1c26f24f0ae9d8b
TLSH
T162D01213B201067CC49024330442710C0501C92FC14A4000543AD51D6B044540D02D41
MD5 SHA1 SHA512 TLSH

Submit Download

14d7bf8c-b678-4f83-affb-3a188d36d16b.tmp

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\14d7bf8c-b678-4f83-affb-3a188d36d16b.tmp
Size 6KB
SHA256 e79eb4dfb1202f754db3185d9ed39cb3690652c1403daabe828cf477d2dbe28f
MD5 2091a720c1bc798c9bd290addbfc68ed
SHA1 f418872bc4370955519ac1476de3a033f5b0183a
SHA512 670435d930eab3150fd75c04ec84ef9f2f20f664f9dd1589e29af8c2a47622a57be67e07476bea0ea70aa062c1533fb2d94a37b54b97f10bc1744efee5f1eacf
SSDEEP 96:stq05FF8Sb9Wbff4C8i0vhE1ktym/7qx+WVHMSm+uecJNNjMdQjB+g3QtMaB:stq0PUfAC8paUv/S+WiTNNodw6tMW
TLSH
T17DD19542AE28A9774CC7E61D7A35BB52E2F9606166C40E98EBFCC55C08D66CC2207D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 576B
SHA256 97c98835da0fea0128c644b4e97e29916e5c63ecb138a11b510a4e92b643c112
MD5 e2d4a80bae1d8fc9b2e051aadbbdae68
SHA1 ca1509287daa037793227c203ea704adee7abe80
SHA512 9ad0f2c332cc60662bb9b0637c5f3b421961c0ea4c8d98964440e6c9e317551f0027a1acbcc8f328f53b616b97d7d1a3c1a4033b3f12aaff7d6dc5d65bfc1aba
TLSH
T1D4F092A85C75FC5AEB44A5B060D842E6B63C1AD706035D934B551FB4EC4935482E7C36
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590dd1.TMP

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe590dd1.TMP
Size 48B
SHA256 0c9a8b487bdbb215f51f452379757fdbbc6a1d92ffe1f95abde008da129bc1ca
MD5 114413e706c37032eba66582e5266013
SHA1 18e5420f2aa185c52d4a3a53408f051688041b76
SHA512 e11128b531449aabc09e43213638f1839314e85f844fcbc698d41efcdf0225643e5f01e11cd9d2cb4138d3522c9a4ce008569bb53fe9fbc6f84345797f067d1a
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Preferences
Size 6KB
SHA256 ff750253f14c41eb7a28373228b4a8138198c87c20460086a35a85ce65918c09
MD5 15a941b7b1a85d20d7423cd22d155c03
SHA1 e8ce44b53286f4b0a9051a9b98a98c375285967b
SHA512 905a8f6159f753b0aae88c24f248833a2f8c7428bfe8b94d795351cc7a452b5d19a3828a405ef2cdac5b9f5dd421db28da89956c58855afcd1a3241317da276d
SSDEEP 96:stq05FF8Sb9Ibff4C8i0vhE1ktym/7qx+WVHMSm+uecJNNjMdQjB+gmQtM4B:stq0P+fAC8paUv/S+WiTNNodwdtMI
TLSH
T19BD187429E2869774CC7E61D7A25BB52E2F5506266C40E98EBFCC65C09E66CC2307D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 16KB
SHA256 1d262f373534a90d656d4c4723035166b86593650265dcfa27661072e76078d3
MD5 b588d2293dbd74dd6ff3f777a5a94175
SHA1 b9cbf4f959f4b52e1e84de636faefdb04d258ab5
SHA512 4b1c681bc60c1892cc9a427bac70d3651c018e656745abd97c5fd16a72c65d82400d304bd130964f4761dcc97f773fb5d75e624e9026b56f4510e133474ecdba
SSDEEP 192:z61DFOKH/2/aQWjYhwZ00i+z/kNWIU6ZwNj1Jfo/iVQ45hgj4kbNb4FpooDU0hl6:zy+aQikB+z/xvxjg/qhEHNb+5czuK9z7
TLSH
T126728E7755687E2394F3F90879190B5BDBB584B681C12EB88AED5F0D06CB2D81342D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 1KB
SHA256 020f069e06436d32b83234074c6924d7da48637648afed9680c3dd117f75241a
MD5 b379c4732525767923888870f10c0c1d
SHA1 f7531214aed2360945f32bd4399540fda4c188e7
SHA512 a8ec767b8bba818800449f411e89ddce2518fcee46f52970cd4489ad9834dc501b81c872df25b3ab67c245b952e609cc624b741e2c6a4bda628688376f5bc37e
TLSH
T15F31A7F390D02B725D93D58DB203AB575E109129C3514E9C86DD871C03DB5DC6A26E37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 2KB
SHA256 c11e6768c6e9d7d20ac9090ac96d983763da96e71b6314ef76cd5bc933734208
MD5 ed654fe51d4c5ca559a45747903d1e48
SHA1 c81cac031a342cbb0e3956ac779e7187fd84af98
SHA512 b968702245007b790d82f696095b235c56a811f969d0226667091a0e613274855fbae7c10e11f52c73a7125e93ee1f18111171a5c4a6b34a31fd2e592fcfd1b6
TLSH
T16551AAF364446B7749E3D94CB9066F22DA259165D7911FA49ADD0B1C01CB59C2703C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 16KB
SHA256 bdb52f969315a9031b55e5ceb8b3e628601851d7c3184aec80ee6490caf57e3a
MD5 1b585740020daa89fe6da92d7ee8b774
SHA1 1cb551afb016566f12cb2d46fa66178342d5b482
SHA512 fb6cf5e829409d98b69150df864b1ec517fa4dbd3aad8ab5166fc91ebb1fc7367cb83a4f8dda3f4361c45d3588560a3e944eb8359b61016b6ff926ed66ff6d3c
SSDEEP 192:z67DFOKH/2/aQWjYhwZ00i+z/kNWIU6ZwNj1Jfo/iVQ45hgj4k0Nb4FpooDU0hl6:zS+aQikB+z/xvxjg/qhEwNb+5czuK9z7
TLSH
T1A2729E7751683E2399F3F908BA4D0B5BDBB584B681C12EB88AED5F0D06CB2D81343D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 3KB
SHA256 2f087405f4ff5c2f6a03c0f1028519b9c168dc7724ac4f69b4005d1ec4272005
MD5 c9cd332d962ad64ce93f036ba88293c6
SHA1 eafd9faa801da1c816b132ad209c976fa97ef0c0
SHA512 e537fa4b645c73d31ac3ee8f71df4d7146c42e5eea3ae2af227c5bd34871ec0c05b3849194c64e0c304801deb82f481c860adfa8a55b6add90ef0d962de5ffaf
TLSH
T11771B8B66564A9674EF3D948B9862B16B7559137D6C53FA8CAEC0F0C01CB2DC2342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 17KB
SHA256 348718c12fe083e60a9dc51b168b73ed4477b55e714462f6fa1985c81c78d905
MD5 8508e9b2ef267fce41292e7d595a5c92
SHA1 8993229134cd4feba7155d1719ede266d2c982f7
SHA512 0c1a67684e9810466a8e85a959c51573aaf335f0a994bbcf459ef0a40f615275fedbced330e8ef3c73b80a09fcccb146463508eb4483a63c8786f8f2fd610f81
SSDEEP 384:zP+aQikB+z/xvxjg/qhEHNb95ct/a5uK9z7:i/UxvxjgC+R8a5uKF7
TLSH
T18A828E7AD464BF2398F3E6487A0A5B5BDBB0846241C51EE88DED5F0D06C72DC1703C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58a5c1.TMP

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State~RFe58a5c1.TMP
Size 1KB
SHA256 c638e1846c383c89387ff15625a23b1cd8a0442778e1f78688627ceb3f8f51c0
MD5 0196dab12d4a46bc1d31888eabd12098
SHA1 8893b24eebed9059e3116dd359f2cb3dbad58423
SHA512 0f882252d12015bdc25aecb4995c0ec70e2924d1acc6cf353d231c4faf6e201edb5d26173a67a6a6ac268df2bda5588141c73c9059820be39ff160e281dfbb6b
TLSH
T12E2162F3C0C52A76AA93C88CB213EB4A2E10912983508E5CC6DD421C06CB4EC9A26D37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Real\data\config\settings.json
Size 207B
SHA256 e4f38f124eb821848eb57d6988c5ef865768188e54d1e8f0ae34c59e9f99dd21
MD5 2b4a40c8495d5ddf7adc222e092fa67c
SHA1 fe7029809ff12457b0e50b92e87b33188fd18848
SHA512 18ba17b46e89fbaad852262144a4399fc6ce616853e80d33e9ea7dae69c2d0f8d2d3853af908c0a78c6e671b30fffcf3983ae02ccfaa5dfd0055db3ba456b9d1
TLSH
T192D02250DCF40E7313DA902A082B0010F0366C67009E3D3C38EA031C9F4F630417D384
MD5 SHA1 SHA512 TLSH

Submit Download

current-version.txt

Path C:\Users\Admin\AppData\Local\Real\data\meta\current-version.txt
Size 5B
SHA256 6ff43122fbf672035ceb986cf032c43e155d9475b21af906f67ee88a49f26ffc
MD5 9b816b35360ae05cf8eb9af8329ae832
SHA1 640b75d1936f52903edd2795db2c553f3ad94165
SHA512 3cec652c6a2e510e2b8d34bbeaaa1d880cf28e9e6cf12cdb8c11409f1a1a915c8bfcc819f3a778b96f7efcfcbf8622eb635ea764347a75a1a4efa9896f406136
MD5 SHA1 SHA512

Submit Download

Real.exe

Path C:\Users\Admin\AppData\Local\Real\real-1.8.4\Real.exe
Size 14.5MB
SHA256 7a4bdeadb0b251ac3219c84737618fdbafa682467e8d9635674fdec3cb8a6c19
MD5 d0abdd8a9a0459802bb49eb659ec26bd
SHA1 61ffb41d0d90bcb15fddc26f8414c2f23f6e8fb4
SHA512 1f865b77185ce2a76bfe6fa2059f64d693a0078b965739424b5749648a6cc2da5d48c2a84ec4aa7ca7479c96fd8303c8ac8ba28dd1b5b2df94b84d15acbb8721
SSDEEP 196608:XqqeVkBP4D6xMX9X7jBTwdnAxF4JJ2JTDEwKBFnzT:EV+4TXVZ+nAfCUCn
TLSH
T11AE69D07F35181E9C0ADC0B9835AA637EA32B8894735B2DF5BE40B112E16FD06B3D759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.dll

Path C:\Users\Admin\AppData\Local\Real\real-1.8.4\bin\Real.dll
Size 3.4MB
SHA256 1c831669fa786a5e5381e6df1e66ccee7cb54a30387b4612bc042d9b88524153
MD5 683b41cb4d247e343a4715fed0810c54
SHA1 c7a71ca7e27737e9ade5a92b4538bef639cb18f4
SHA512 3e2e7d116064f601834cae37fca2a7ee3cc3a4c8e3045a1a9b4e5a304679ba03875c6aeec569c61c5906def9da9fbbe35bd9f5372fe88a569142b4c2af67a91a
SSDEEP 98304:b/JfGZBzQYzgF491uru9VmVGud6D1iLvAPr:KQR491uCPUiiEPr
TLSH
T1A6F5CF3E86CFE9DDF7B9916C10638AD1DF1B976263F5ACC62D0EA01506482D6883F217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.exe

Path C:\Users\Admin\AppData\Local\Real\real-1.8.4\bin\Real.exe
Size 3.9MB
SHA256 1f727a984987f269fd39821042b022b5b54f95bb6ddd20d784e79c4a7525df0d
MD5 2cbc2ace80949abe1086e1c7e3eb6b39
SHA1 145924441ec14e3dcfdf03a0bde11dd06ca80a50
SHA512 7be051da0670d9450102fbdf65e10fa0102083e4b8c096d378f359b3ec9394d8d9b3b20ac4228b10cb8056489e4a488d93fff30deed1fcc06fe415a25d2d8af7
SSDEEP 98304:l6iWicT66Y+Iox5WIMAqVHrQ60B9Xc4XNGZy3Db8:NWi/wIMYIMAScxXtGATb
TLSH
T18F16232BB96B9CBECC87C5348347D96748127CCB0F71F9DB0B455A6A2D522E42B30726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spoofer.exe

Path C:\Users\Admin\AppData\Local\Real\real-1.8.4\bin\Spoofer.exe
Size 2.6MB
SHA256 f4927849fea9d5abd064ed5ec61c45785490a93d75258de466db74e1b70da51a
MD5 1f79f23e16f08c13d3d50cff49b287ac
SHA1 2893622bd2183579b631a14ff4a5015666bfd820
SHA512 9d1f41cef2d5d707b96ab5b35dde8b85164f6e8794b752f576fe192934a4a62b1512ad512d917b98969afd25adf29537cb8c7bdd46c261d2811972b296f76a93
SSDEEP 49152:iSBsRHoPtqamwxg4muCBfxz2MWPUnGJG//2/XmMj17GPwhm9SeD5bc4TH:Iok6dyBh2MbnGM//n+9hm8epL
TLSH
T117C533FA16C2EB38DC8E137B233F07169B4684FC5C5DA16B29E7876D8706539C84588E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

luau-lsp.exe

Path C:\Users\Admin\AppData\Local\Real\real-1.8.4\bin\luau-lsp.exe
Size 16.3MB
SHA256 0da4f09d474e41074f4ec52bfef01eb90c014928358eda88f6a5afad5319b537
MD5 be087717213e34f06e6198159d9c73dc
SHA1 60e2ca8a33531199a644061238b1605f78b8ae66
SHA512 fdc7b914eb7425bc17c23a7e52c7256f0263448ef4e0469302386a17b6ed3d5241bdc4cc2c43092c521368b9c09540ade980deffa16c201455b5a9a8650104b6
SSDEEP 393216:XdTfwgggjgzggsgTguwttbgNlggigggXsgJgUQLCgggggCNc/gggga4ggggcgggg:NRggjgzggsgTgugtbgNlggigggXsgJgB
TLSH
T132075B3A21AC01DCF1BBD0BD8BDB9E47D6B2340903319ADF0591569A1E1BDED4A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

real-mcp.exe

Path C:\Users\Admin\AppData\Local\Real\real-1.8.4\bin\real-mcp.exe
Size 1.6MB
SHA256 1dd7738163b5266d78f30b04281b1d48927acfdd6879e7576f0862a1b6497e95
MD5 52f687164c175d24e9f4f22e6f17181c
SHA1 99b67fe1a7417616656cd9a34b31b1a0c5657bc1
SHA512 ec740a365519531208a5f536277043d71bd4995cc5c06cc65a4984f47bafcf67626e8218e2ba1823c7c88eb1184bdbddf369f48852af9434e9f45219b6ffc064
SSDEEP 24576:RXvDv4konyXJzOaNDOXDPiFBzmQJDXqZXxdOmOTFM3VIH06iyGdXQ:BDv4konMzBOGFBz3DXqZzuhYIU6ilJQ
TLSH
T18C857D03E69580ECC4ADC578C3579A36AA73B88D0A34B2EF67D04A513E2BF905F1D719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 399B
SHA256 f0bc27903fa0128b6ff5997106257cdf09e7760938cc62cf650df5def1d447e7
MD5 122010d72ee3f20ee53416fd5bfca78a
SHA1 466d22bf6616f5d1c3c9cb9c8140da758ad33e7d
SHA512 412fcf1cb2ba05e0ab0a639c2670bcc35876433dab9233a7089ccbaeb191ac581a923097163c2ecc44f7b11af878c7bb184f27250be4a5a159c8ce9792a4855a
TLSH
T178E02239B0FCE0A01E43920A8A3E25879506360C0E1C6678A544812F5DC27232E23B4D
MD5 SHA1 SHA512 TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 2KB
SHA256 4c3464ff45bf92db54c6b42269079512e6368e9eb12e0a5a2754fd455ea32da8
MD5 b2403b6ea7f24cbca8275316a05e1886
SHA1 e41a0448b498922a309908e3c7a4130681c6c479
SHA512 e7374fd05c5f7b9fe224877f5c5e811f1670eaabe45429aa0766e8a9dcef191877c9afe0abfa429d598d6f18aa505f91fccc41809f0edfe73fd2ce5fb73c1cd8
TLSH
T185518E3AA5FCF0A20E53A649DB3D354B950A360C0F5C3ABCA159412E09D2B376D23F0D
MD5 SHA1 SHA512 TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 4KB
SHA256 c361949d7f6abdbce2d435f82981919c2348d4b61cbb1b8de1f7c3a36343b8e9
MD5 a6bd1ef4830960dc6f1142e1566f90d1
SHA1 d0898e259f86381d0df6d7b52fbed843e1c2ade3
SHA512 797c7b73c775b959f2f55955972159b5fe1c43ad3f60c061950f336e3112a189de807f64c4cfb574b30624bcc1e01bff3ab63e4edcf7b72c814a7716293bc259
SSDEEP 96:oixerLYcp17dD2+QYB+2s0rltYUF6WV6rbXK:8rDv+mpZS/K
TLSH
T181815B7AE5FCF0A10F53A689EB6D754B850B320C0E58297CB155412E15E2B3BAD12F4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 4KB
SHA256 923d0ed950fdba6b309a90cfd4e4a9411f735318d88e3eeabc64301322d567b2
MD5 14bae9853d265d1ce33b61438c0b7f52
SHA1 820caacaad8f2e240d634c8e5499764c6cf55493
SHA512 1d0d0df8c07c1d1e63fedfb9639a4a5d203ff2ce5bddac4c305dea60b7bf4a3523efa8b65f55bd8cd770476acb6d1e94a722323c5bac99a39630367bfc8a92ad
SSDEEP 96:oixerLYcp17dD2+QYB+2s0rltYUF6WV6rbX2LYO:8rDv+mpZS/I
TLSH
T105917B7AF9FCF0B20E135689AB6DB50B950B324D0F58297CB145412E16E2B3BAD12F4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 4KB
SHA256 1489e4cfa99331063ea89fffac75dc09568b911565c40cc7be16024d63445998
MD5 e09b0d8e8ae6e939861f865ce5e92c3a
SHA1 e541af0c8cb371e0e53c3e9bf6db483c34c312f2
SHA512 6cb425beb8e3450c6ddd9786d4ea7e4d488502a90242c3e3e2160afb5998a7ad17acbeb4e1861ac1ed03f10331941bedb84dbe491273f802d660c12eef23f80a
SSDEEP 96:oixerLYcp17dD2+QYB+2s0rltYUF6WV6rbX2LYJ:8rDv+mpZS/X
TLSH
T1C0916A7AF9FCF0B20E135689AB6D750B950B320D0F58297CB155412E15E2B3BAD12F4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

19ffb596-a6cb-49ba-aa8b-de0466ec3cfd.tmp

Path C:\Users\Admin\AppData\Local\Temp\19ffb596-a6cb-49ba-aa8b-de0466ec3cfd.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

868420c2-4e02-4019-9d0b-2cae229d0648.tmp

Path C:\Users\Admin\AppData\Local\Temp\868420c2-4e02-4019-9d0b-2cae229d0648.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 efb61621ab96dd483446ed0858497045b7e2844939468115f59b755cf92cc7bc
MD5 0b2b7342db5cb80dfc56316fb96d450d
SHA1 45f1e636421584aeebf856fd4cb1f8ad091a9455
SHA512 a001e8624e102030436dea1f0ecba2e66793be4a56bdf00e8080bcf309d8464ee59ded9e4e74d666927b331de6c7ed0285cf21be5ba2a8430a70604a89eda5c2
TLSH
T1D2D024137711C174C01035331143711C0C00C10FC1074004D43CC71DDF540740D374C1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 766ca02cd1f98b5c706ac0317bc93f043f2b9a67f820ba0dc658674631fde8f2
MD5 9af179ea36092266625adaf94a7fba32
SHA1 50fbbc0da5cbbc7d32f1498dcc98d61bcdc61ef9
SHA512 51be749e7485c44cf3934ff1d507382339558d4c21789b1d442d07410255bebbe346991aa1eb5779c0f5f1067b0fcb2e01f1f0d51778208fbae21e4e5d5c6151
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

72454769-2e8b-4d62-b4aa-e3859b804575.tmp

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Default\72454769-2e8b-4d62-b4aa-e3859b804575.tmp
Size 5KB
SHA256 2ebebc7fceec2c19fd0a495c7921eae873c7c326fb5af1c5ef000a6476086853
MD5 811c2d3b2461f6c7201c02b7fa5b5b57
SHA1 27e2bb9ddaf4287f7fe435c2de58448de52c630f
SHA512 632fc3ebc6de27e8016a13dcabdd1013dc69f1ba84125a8462e14124ca07a4af3c7f3ccf42f2d4570e5010a355bc394326fea0ba66ccc7a2a03c136e1f96eaf2
SSDEEP 96:st105kTfHTb9JffAdC8i0oEsklm/7qx+WVHMSm+uecadQjSQ+g9BKaB:st10CbfeC8pF+/S+Wi8dXQDBKW
TLSH
T1AFC1B9465F28AD7B4CC7E20CBA3A7B42D2FA606166D51E98EBFC861C09D65CC130790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 561b90fec5df0503dfac558f6b5266d773a718fd5c5047a0a27123ef6ab1beff
MD5 b028274e4955127d2d9bb609ef1d3762
SHA1 7cc5aa831145f6fb4be33c142f2da829f98a997d
SHA512 dd3cf4c214f08c2d5eab340ee6f8cf057854b99ea8b1be9dd9bd6df62390ddb860b7ca56e055d6283da4450b8a1d4726951629742c868334f70f45dc8f67144f
SSDEEP 3:LstlNllklkXlEbsSe:LsX3lPEbsSe
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 b576f1073d6d681c0626b478c9657af86022f2b023550a25725686fa00ee9776
MD5 e2d821d7c2cbd602191db6a02a1e4254
SHA1 73ab57cfefcee8836a2b4721b2548f86bd1f1843
SHA512 4af3b6791caf3ae26e6f5121a181ad78e2771e1031942dc819fd4242489c6d8d733d6b544a35d6f585e34375fc44c02c60d6727bd15d5fdf6af1e94a9f13520c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Default\DawnWebGPUCache\index
Size 256KB
SHA256 a2e2272c7f99e8bfd77d1b2496aaeb82ba4b08cc5ad0febf43f350f4384c8a71
MD5 6a4e7f808b1b7deabdfc481555b0bcd3
SHA1 e0f68f13f735bbe62cb9d7adff71b81702c855d9
SHA512 3ae253447b810be48f16ea9419ba5589ed6375c3b0d4c2d52996629ade5a6eab0f844536e5b93d53101be2b34d9dba299f618e91277311345e082e7f7a723199
SSDEEP 3:LstlNllkll/loWt:LsX3lEtoy
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Default\Extension Rules\LOG
Size 367B
SHA256 fb079c04af5e8a2470fc45efcb011fdfe6c3ee563abbe9bc546c8ecd6ec85b40
MD5 adec387c91bd7a4238588a514fc7d3d1
SHA1 1519946d40d09676219fc1d55e0f91f9fab9a521
SHA512 060f92825371ac1c278cbbdd976efbd57d90b96f31f127148e5cb67088100e870272acff20eb61f825a2872582d7d6da6a82a15daebcd09b0b7b90e3154fb1c8
TLSH
T1E6E06881A88E85AE446DBDD7EEB1A34ECB45AC1DA74437248E8CCC81304BE0972D9361
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Default\Extension Scripts\000003.log
Size 38B
SHA256 1c43a1bda1e458863c46dfae7fb43bfb3e27802169f37320399b1dd799a819ac
MD5 51a2cbb807f5085530dec18e45cb8569
SHA1 7ad88cd3de5844c7fc269c4500228a630016ab5b
SHA512 b643a8fa75eda90c89ab98f79d4d022bb81f1f62f50ed4e5440f487f22d1163671ec3ae73c4742c11830214173ff2935c785018318f4a4cad413ae4eeef985df
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Default\Extension Scripts\LOG
Size 371B
SHA256 f9db0a00cfbd00867a01e4da558635b52d01b1d35ed2b85358baf59a5e4088f3
MD5 64928a4cdc9705d1fbc992a2e948ca66
SHA1 bbe0ccffa1a142d3c2083e19b4ee439261b094f4
SHA512 ac4d68aa75e04caa7345fd6d45d97c789d28d84422d268b5245ebf118306100b62e1c8d1c624025b184c2ff4d63a62273a5babf2c98bd1253266f4d9f692619f
TLSH
T1EBE02B8098DD85AE44596DE74A71F34ECB85781D664477144EC8CD80204BF0576D5751
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Default\Extension State\000003.log
Size 114B
SHA256 e2610960c3757d1757f206c7b84378efa22d86dcf161a98096a5f0e56e1a367e
MD5 891a884b9fa2bff4519f5f56d2a25d62
SHA1 b54a3c12ee78510cb269fb1d863047dd8f571dea
SHA512 cd50c3ee4dfb9c4ec051b20dd1e148a5015457ee0c1a29fff482e62291b32097b07a069db62951b32f209fd118fd77a46b8e8cc92da3eaae6110735d126a90ee
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Default\Extension State\LOG
Size 367B
SHA256 ab66768e441315316911b4f897c8f091372ffa446e4f534bafbd343011c4b31d
MD5 b060c3e484840cd02ffad2a68cc7292a
SHA1 d75a36763f4a768ca6762fe19b85b29781a64549
SHA512 4da66aab87fd09b35c3ace315b7311197a10254b76749a7b03a2ec8c84308ad5c072f56f51f6f6bf4fdeaac4c70f234017050533f9b4276eaf9ef8ce0c0c44a4
TLSH
T160E06180C89D85AE48596DD74E31F34ECF457C18664437244DD4DC412107F06B2DD351
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Default\Favicons
Size 20KB
SHA256 46b5ecada4edb2585f87953f7847aefc938be2404b9d9455c772b97295b7b1cb
MD5 babd43551f1b29eb82e221460676126a
SHA1 e9bff307613a14b35830893bdb6d1ecc931b425d
SHA512 5ab681c170dbd1d374bd66edd02cbe21272819ef7389ad1e886bcba112deb91eb68fa930747986da5ca794881939570013e38edd9f8e6f718f7d202e74a82f41
SSDEEP 24:LLipxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:UBmw6fU1zBmI
TLSH
T1C292EE075E383407DBA10E7D366B18768E3FE26C5FA29C94347410618CF9482D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Default\GPUCache\index
Size 256KB
SHA256 72d7f90ac58231b9c16d357b78be5caee5da6d6d7a22f89a536b66effc4f595e
MD5 92debe97cc6fa5fe8ab5222a45517668
SHA1 9d6d68f211c2c561bec6be8eea645afac362608f
SHA512 7246fc194a17910a999307f44c5af8082eca6b053c447b0edd8417ca27bd57da7ca0c5959511c0559d4ad1e2b451e90aad933b371aa4d79da0bfe14197e593c6
SSDEEP 3:LstlNllkll/lqsSat:LsX3lEtqy
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Default\History
Size 184KB
SHA256 7ac0739f534f89ae63c46cd41f0cffaf0335fe348933e3e3d660044351f2a746
MD5 c77e3d0b59e286bc3b50eff7cb8f464c
SHA1 b260bf6f86fb9aff5b2396bfb49dea658a6f05e5
SHA512 e9d95b19019dda281d5cdc16315ae5368b3bab7786955354de93dabe5885c958c556a09e4b57a707244e0052cbabb00029619deba1810677bf9ea06e7287e8fb
SSDEEP 96:xhBttejzH+bF+UIYysX0fxQp97fEHt/DfLjLqL/hbgI4VgNr2jWRk/E0:xhBqH+bF+UI3iWGVfWN3qL/8VgZQW3
TLSH
T1AA04EC1E5F743612CDBD513668E745B3597CF03F8B636AC62CA114B1CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Default\Local Storage\leveldb\LOG
Size 381B
SHA256 2f1305acfaa79fe472a9acaab6832f77506363e2868f3e880eed410dcd1bc364
MD5 336af978e44b4371081166ee112d9ec0
SHA1 1160568819013f5b7527ad456c3f41aabf90b243
SHA512 06c7899168d01dfdd725bd62f9731baedcba1941845bd91894fd1a12d1599a03b52ba3bce37f35b8b7adcf94f8372f845dd258abfd5660011d804ae1e46afece
TLSH
T127E0F1E1C49F81AF0A4D6C9F5A32B38ECB256C0D964837148DC0EE41304B905B7C5383
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Default\Login Data
Size 42KB
SHA256 a5c1d3aad1ea6dfa8484d39b4b6239529889661a0a4d9643175df4d5915c7afa
MD5 cf0d378139d518ac262a5cb0979f238d
SHA1 94a24d2046879c9b26347909eb02cae09d40fabf
SHA512 d856b2d705188592828b2f277967f269ed46e5154d9e20b955b0e131d8de964b400672d167043be454104429be2bb5f285a3c084cd578aff2ffeb5363099bb4f
SSDEEP 96:ALlpeymwACn8MouB6w9f/FlXqiEqUvJKLuyn:ALlrAG7Iw9ftFqidn
TLSH
T17613350F2B682401C8AD8636ACB114B66E7CA13F4B639FD52CB144259D75C63B12D5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5872ba.TMP

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Default\Network\Network Persistent State~RFe5872ba.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Local State
Size 4KB
SHA256 cb60a3655e8c7c4cd8d8a1a1c32ad5bcf6c70535d6f92f7427173eae02ff1c07
MD5 7d7b9f075fa77bff28432b7614fb84b3
SHA1 419810f2b7117d916722308afaa5903448c141e3
SHA512 9705af250be3ea6ca451140c6e850b015651da8635b8a6826a2a90c443e0337766a109d806e911d38545cc74692bcd746e1cf7d0a816081fb1ce66e156ccdbe2
SSDEEP 96:zuObNkCEHsfHb58Frh/cInURoDoto1xdW8rD2pBXZh65mZ7mTrlQa:zDbNbZmooDUWrW8fMXZ/u5
TLSH
T12C81A6369464AA274DF2D944B84A3F03A6B1912BD6D53FE8CAED0F0C03DB3991342C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Local State
Size 1KB
SHA256 00a0f2961982f5d10e6d2fc2fb6b0ee151dfae097d7cd02be1e8018280e961dc
MD5 502dbe0e91d9e6fc3c51b3e5387e060e
SHA1 9418577fbedd0022a70b8863e9b9919747df6b4d
SHA512 13d190337921f9ec2d740e3300148ff718b4c5427b823c1ca89f991bf7c8a423725f66ca1156afbcc721eaaf566b6686337e6271084f296c066b217bda3ba8c2
TLSH
T1DD31B5B2C4502F7248C29580B9163A9B6D71A12ED2500E989BDE8F1C03DBADC8727C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Local State
Size 2KB
SHA256 cfdd56ae3cd30eb83cd61e93972236527ac0eb76699136dc74cbba2adf604c99
MD5 b27ad1eb6920c51fe058327445a64e4f
SHA1 0d8c8c672a2648616bb156da0c33c69a14b57b55
SHA512 1c838e74e62c4a63a72c0ce9efcb9fcc0fc94015f20382028289812458507ee2e5f32e1c332a572d5e99a7153095829b7cfced538702cd0051cdcd1d25adb49b
TLSH
T195519672E804AE7749E28944BD493F53ED71916AD7912FA49ADD1F1C03DB69C1303C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Local State
Size 1KB
SHA256 11a227084377e0b046fa778016743e19fbae99dcb5576818c1a56f77bddfdcac
MD5 d0f6eca615587034e2eb3051b6a1e6e3
SHA1 14be98d13fcef556c13175ff521201b4cb79f130
SHA512 183fdee0e00a7e9e571f8c7493b89a36eb8213445612c775208118f9124c80b334aa27710c56575a000bcb6139c81522a69ba6515928a9f6a7886bfd34bddcfd
TLSH
T1D12195B2C0442F7648818880B9127B8B2D60A22E92501E18CBDE4B1813DB9EC8733C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Local State
Size 3KB
SHA256 64301a2305a0daeb671873a2f12b28f831606444cd9c159fe6b988068c33f1ab
MD5 ef0c4d8680ae5c5be06a126dc04a5c2c
SHA1 dab7c7c8da7272a1acd75ea49b5e52e64794719b
SHA512 eb762ad1f8709da065679de0a0b2f2dd1a2f36e9d4c42e14e066af98a7360c2fffbb71ee611f68dc47613c19e439a90fb9a4f4b16d931eefbca8405e6eaa16a7
TLSH
T18171B9769864A9274DE3D940BC853B16BAA1912BD2D43FA8CAED0F1C03DB7D81342C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D2509F46-7C22-4FFD-A630-11A60D59A050}\wv2\EBWebView\Local State
Size 4KB
SHA256 a454336797e24cc3c1045d82230899e5da53df03ce60fa0af4029affc499cc15
MD5 cccb4e1dff7d618f0d8978530632f5ed
SHA1 d78d05e16096764539118a9c52d2075c5024e5cd
SHA512 e221b368de5acd2a03639b35ffbe5c9fe2d15ad078d8e6eeef4513f8687df6e6181d267db03c6c17bd27a9078ae5342367153fd4f708324e0c5ea95974cd2091
SSDEEP 96:zuOF3NkCEHsfHb58Frh/cInURoDotoixdW8rDsBXZh65mZ7mTNlQa:zDF3NbZmooDUPrW8fgXZ/uv
TLSH
T11091A5769564AA274DF2D944B84A3F17A6B1912BD2D53FE8CAEC0F0C02DB3D91342C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_dsly2blq.30l.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dsly2blq.30l.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

6aa511c6-a5bc-4765-839b-ee25dccd542a.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5964_1112996135\6aa511c6-a5bc-4765-839b-ee25dccd542a.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5964_1112996135\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1196-146-0x00007FFFBC890000-0x00007FFFBC891000-memory.dmp

Download

memory/1572-210-0x0000027479130000-0x00000274791BA000-memory.dmp

Download

memory/1572-218-0x00000274784F0000-0x0000027478500000-memory.dmp

Download

memory/1572-219-0x00000274790D0000-0x00000274790F2000-memory.dmp

Download

memory/1572-220-0x00000274793D0000-0x00000274794D2000-memory.dmp

Download

memory/2856-49-0x00007FFFBC610000-0x00007FFFBC611000-memory.dmp

Download

memory/2856-241-0x0000022485BD0000-0x0000022485BFB000-memory.dmp

Download

memory/2856-58-0x00000224861F0000-0x00000224861F1000-memory.dmp

Download

memory/3284-1310-0x0000000140000000-0x0000000140A98000-memory.dmp

Download

memory/3284-1317-0x0000000140000000-0x0000000140A98000-memory.dmp

Download

memory/3788-1352-0x0000022F41B20000-0x0000022F41B4B000-memory.dmp

Download

memory/3788-1187-0x0000022F41B50000-0x0000022F41B51000-memory.dmp

Download

memory/4836-25-0x00007FFFBC890000-0x00007FFFBC891000-memory.dmp

Download

memory/5604-1042-0x00000239CD5A0000-0x00000239CD5AA000-memory.dmp

Download

memory/5604-1040-0x00000239CD8A0000-0x00000239CD8B6000-memory.dmp

Download

memory/5604-1041-0x00000239CD8C0000-0x00000239CD8D2000-memory.dmp

Download