d66e412cb82769f684d0e09378aab2d048b3949e029f3cd080ae6ac6242b5a47

Analysis

user interaction
yes
max time kernel
86s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 02:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RealSetup_438c17bc24d9d6c7df7b596bbd2133e16d6722a9d0a81648fe6404bdefeb7c70.exe
Size 16.5MB
Sample260809-cnwrjsstew
SHA256 d66e412cb82769f684d0e09378aab2d048b3949e029f3cd080ae6ac6242b5a47
MD5 cb6d01cb4f6fb371a8651d4a7348f3b6
SHA1 8c772bf169aaa32096b7768544050e87525eff03
SHA512 7e77b0aef98b99f931b6c4baff5aeaeaae57c76d4ec5ad0898c13157eb74b599ea59f151dade9b13320e5e609f602b859b5c753c05255c0c68bedc2968953c5f
SSDEEP 393216:htQDIqMgneq1R0qTwMa2ulncqk61FDiOUY+OUY:KUqlqin
TLSH
T1CF07BF69A6BC01D9E867C1BCC2965223EB72B41523B057CF5A609AF60F23AD41F7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Real.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4716	powershell.exe
4436	powershell.exe
3044	powershell.exe
5972	powershell.exe
4716	powershell.exe
4436	powershell.exe
3044	powershell.exe
340	powershell.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Real.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Real.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	RealSetup_438c17bc24d9d6c7df7b596bbd2133e16d6722a9d0a81648fe6404bdefeb7c70.exe

Executes dropped EXE 5 IoCs

pid	Process
3404	Update.exe
5220	Update.exe
3792	Real.exe
5696	Real.exe
3056	luau-lsp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Real.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RealSetup_438c17bc24d9d6c7df7b596bbd2133e16d6722a9d0a81648fe6404bdefeb7c70.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Real.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
91	discord.com
92	discord.com
94	discord.com
98	discord.com
106	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5696	Real.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1220	chrome.exe
4448	msedge.exe
6100	msedge.exe
644	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 17 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Update.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Real.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	RealSetup_438c17bc24d9d6c7df7b596bbd2133e16d6722a9d0a81648fe6404bdefeb7c70.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307153047589010"	RealSetup_438c17bc24d9d6c7df7b596bbd2133e16d6722a9d0a81648fe6404bdefeb7c70.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Update.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\projectreal	RealSetup_438c17bc24d9d6c7df7b596bbd2133e16d6722a9d0a81648fe6404bdefeb7c70.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\projectreal\shell\open	RealSetup_438c17bc24d9d6c7df7b596bbd2133e16d6722a9d0a81648fe6404bdefeb7c70.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\projectreal\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Real\\Update.exe\" --write-deep-link \"%1\""	RealSetup_438c17bc24d9d6c7df7b596bbd2133e16d6722a9d0a81648fe6404bdefeb7c70.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{A91726B4-048E-4621-A232-C8170976213C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{7E6C3712-0EB4-4E7B-A336-A711B3B07E6C}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\projectreal\ = "URL:Real Protocol"	RealSetup_438c17bc24d9d6c7df7b596bbd2133e16d6722a9d0a81648fe6404bdefeb7c70.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\projectreal\URL Protocol	RealSetup_438c17bc24d9d6c7df7b596bbd2133e16d6722a9d0a81648fe6404bdefeb7c70.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\projectreal\shell\open\command	RealSetup_438c17bc24d9d6c7df7b596bbd2133e16d6722a9d0a81648fe6404bdefeb7c70.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\projectreal\shell	RealSetup_438c17bc24d9d6c7df7b596bbd2133e16d6722a9d0a81648fe6404bdefeb7c70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{BC782842-BE68-4D29-B669-0D78E5F6F635}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5972	powershell.exe
5972	powershell.exe
4716	powershell.exe
4716	powershell.exe
2792	RealSetup_438c17bc24d9d6c7df7b596bbd2133e16d6722a9d0a81648fe6404bdefeb7c70.exe
2792	RealSetup_438c17bc24d9d6c7df7b596bbd2133e16d6722a9d0a81648fe6404bdefeb7c70.exe
3404	Update.exe
3404	Update.exe
5220	Update.exe
5220	Update.exe
4436	powershell.exe
4436	powershell.exe
4436	powershell.exe
3044	powershell.exe
3044	powershell.exe
3044	powershell.exe
340	powershell.exe
340	powershell.exe
340	powershell.exe
3404	Update.exe
3404	Update.exe
5220	Update.exe
5220	Update.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1844	msedgewebview2.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
3952	msedgewebview2.exe
5508	msedge.exe
5508	msedge.exe
3044	chrome.exe
3044	chrome.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5972	powershell.exe
Token: SeDebugPrivilege	4716	powershell.exe
Token: SeDebugPrivilege	4436	powershell.exe
Token: SeDebugPrivilege	3044	powershell.exe
Token: SeDebugPrivilege	340	powershell.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2792	RealSetup_438c17bc24d9d6c7df7b596bbd2133e16d6722a9d0a81648fe6404bdefeb7c70.exe
1500	msedge.exe
1500	msedge.exe
3792	Real.exe
3792	Real.exe
3792	Real.exe
5508	msedge.exe
5508	msedge.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
3792	Real.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe
3044	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 1844	2792	RealSetup_438c17bc24d9d6c7df7b596bbd2133e16d6722a9d0a81648fe6404bdefeb7c70.exe	86
PID 1844 wrote to memory of 5796	1844	msedgewebview2.exe	87
PID 1844 wrote to memory of 3672	1844	msedgewebview2.exe	88
PID 1844 wrote to memory of 3672	1844	msedgewebview2.exe	88
PID 1844 wrote to memory of 3672	1844	msedgewebview2.exe	88
PID 1844 wrote to memory of 5264	1844	msedgewebview2.exe	89
PID 1844 wrote to memory of 3432	1844	msedgewebview2.exe	90
PID 1844 wrote to memory of 3432	1844	msedgewebview2.exe	90
PID 1844 wrote to memory of 5008	1844	msedgewebview2.exe	91
PID 1844 wrote to memory of 5008	1844	msedgewebview2.exe	91
PID 1844 wrote to memory of 5008	1844	msedgewebview2.exe	91
PID 2792 wrote to memory of 5972	2792	RealSetup_438c17bc24d9d6c7df7b596bbd2133e16d6722a9d0a81648fe6404bdefeb7c70.exe	92
PID 2792 wrote to memory of 4716	2792	RealSetup_438c17bc24d9d6c7df7b596bbd2133e16d6722a9d0a81648fe6404bdefeb7c70.exe	94
PID 2792 wrote to memory of 1500	2792	RealSetup_438c17bc24d9d6c7df7b596bbd2133e16d6722a9d0a81648fe6404bdefeb7c70.exe	112
PID 3404 wrote to memory of 4436	3404	Update.exe	113
PID 2792 wrote to memory of 5220	2792	RealSetup_438c17bc24d9d6c7df7b596bbd2133e16d6722a9d0a81648fe6404bdefeb7c70.exe	115
PID 1500 wrote to memory of 4284	1500	msedge.exe	116
PID 1500 wrote to memory of 4448	1500	msedge.exe	117
PID 1500 wrote to memory of 4036	1500	msedge.exe	118
PID 1500 wrote to memory of 4036	1500	msedge.exe	118
PID 1500 wrote to memory of 4036	1500	msedge.exe	118
PID 1500 wrote to memory of 6136	1500	msedge.exe	120
PID 1500 wrote to memory of 6136	1500	msedge.exe	120
PID 5220 wrote to memory of 3044	5220	Update.exe	121
PID 1500 wrote to memory of 2708	1500	msedge.exe	123
PID 1500 wrote to memory of 3200	1500	msedge.exe	124
PID 1500 wrote to memory of 2708	1500	msedge.exe	123
PID 1500 wrote to memory of 2708	1500	msedge.exe	123
PID 1500 wrote to memory of 3200	1500	msedge.exe	124
PID 1500 wrote to memory of 3200	1500	msedge.exe	124
PID 1500 wrote to memory of 2540	1500	msedge.exe	126
PID 1500 wrote to memory of 2540	1500	msedge.exe	126
PID 1500 wrote to memory of 2540	1500	msedge.exe	126
PID 1500 wrote to memory of 4344	1500	msedge.exe	128
PID 1500 wrote to memory of 1356	1500	msedge.exe	129
PID 1500 wrote to memory of 1356	1500	msedge.exe	129
PID 3404 wrote to memory of 340	3404	Update.exe	130
PID 1500 wrote to memory of 3812	1500	msedge.exe	134
PID 5508 wrote to memory of 1840	5508	msedge.exe	135
PID 5508 wrote to memory of 6100	5508	msedge.exe	136
PID 5508 wrote to memory of 3428	5508	msedge.exe	137
PID 5508 wrote to memory of 5036	5508	msedge.exe	138
PID 5508 wrote to memory of 3428	5508	msedge.exe	137
PID 5508 wrote to memory of 3428	5508	msedge.exe	137
PID 5508 wrote to memory of 5036	5508	msedge.exe	138
PID 3404 wrote to memory of 3792	3404	Update.exe	140
PID 5508 wrote to memory of 6032	5508	msedge.exe	142
PID 3792 wrote to memory of 3952	3792	Real.exe	143
PID 3952 wrote to memory of 4968	3952	msedgewebview2.exe	144
PID 3952 wrote to memory of 4356	3952	msedgewebview2.exe	145
PID 3952 wrote to memory of 4356	3952	msedgewebview2.exe	145
PID 3952 wrote to memory of 4356	3952	msedgewebview2.exe	145
PID 3952 wrote to memory of 5316	3952	msedgewebview2.exe	146
PID 3952 wrote to memory of 1876	3952	msedgewebview2.exe	147
PID 3952 wrote to memory of 1876	3952	msedgewebview2.exe	147
PID 3952 wrote to memory of 3616	3952	msedgewebview2.exe	148
PID 3952 wrote to memory of 3616	3952	msedgewebview2.exe	148
PID 3952 wrote to memory of 3616	3952	msedgewebview2.exe	148
PID 3792 wrote to memory of 5696	3792	Real.exe	150
PID 3792 wrote to memory of 3056	3792	Real.exe	152
PID 3952 wrote to memory of 4720	3952	msedgewebview2.exe	155
PID 3952 wrote to memory of 4720	3952	msedgewebview2.exe	155
PID 3792 wrote to memory of 6000	3792	Real.exe	156
PID 6000 wrote to memory of 3124	6000	msedge.exe	158

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\RealSetup_438c17bc24d9d6c7df7b596bbd2133e16d6722a9d0a81648fe6404bdefeb7c70.exe
"C:\Users\Admin\AppData\Local\Temp\RealSetup_438c17bc24d9d6c7df7b596bbd2133e16d6722a9d0a81648fe6404bdefeb7c70.exe"
1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RealSetup_438c17bc24d9d6c7df7b596bbd2133e16d6722a9d0a81648fe6404bdefeb7c70.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=2792.5540.13571823861327172054
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffcbaa3b078,0x7ffcbaa3b084,0x7ffcbaa3b090
    3⤵
    PID:5796
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView" --webview-exe-name=RealSetup_438c17bc24d9d6c7df7b596bbd2133e16d6722a9d0a81648fe6404bdefeb7c70.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1736,i,5448999828219386445,2572177713939948703,262144 --variations-seed-version --mojo-platform-channel-handle=1732 /prefetch:2
    3⤵
    PID:3672
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView" --webview-exe-name=RealSetup_438c17bc24d9d6c7df7b596bbd2133e16d6722a9d0a81648fe6404bdefeb7c70.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2040,i,5448999828219386445,2572177713939948703,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:3
    3⤵
    PID:5264
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView" --webview-exe-name=RealSetup_438c17bc24d9d6c7df7b596bbd2133e16d6722a9d0a81648fe6404bdefeb7c70.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2376,i,5448999828219386445,2572177713939948703,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:8
    3⤵
    PID:3432
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView" --webview-exe-name=RealSetup_438c17bc24d9d6c7df7b596bbd2133e16d6722a9d0a81648fe6404bdefeb7c70.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3616,i,5448999828219386445,2572177713939948703,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
    3⤵
    PID:5008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "try{ $ex=@((Get-MpPreference).ExclusionPath); $want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll'); $stale='C:\Users\Admin\AppData\Local\Temp'; $miss=$want | Where-Object { $ex -notcontains $_ }; if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1} }catch{exit 1}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll');$stale='C:\Users\Admin\AppData\Local\Temp';foreach($p in $want){ $ex=@((Get-MpPreference).ExclusionPath); if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }};if($stale -and @((Get-MpPreference).ExclusionPath) -contains $stale){ Remove-MpPreference -ExclusionPath $stale};$ex=@((Get-MpPreference).ExclusionPath);$miss=$want | Where-Object { $ex -notcontains $_ };if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/projectreal
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x334,0x7ffcb76dc188,0x7ffcb76dc194,0x7ffcb76dc1a0
    3⤵
    PID:4284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,15187226124802888440,13978788780440046343,524288 --field-trial-handle=2168,i,11792743546514221890,2203960639498869989,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,14372278062765836708,2179984194016167657,262144 --field-trial-handle=2168,i,11792743546514221890,2203960639498869989,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
    3⤵
    PID:4036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,18362750159984029416,16485605677641272131,524288 --field-trial-handle=2168,i,11792743546514221890,2203960639498869989,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:8
    3⤵
    PID:6136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,14452568060265150362,3521605277704706135,2097152 --field-trial-handle=2168,i,11792743546514221890,2203960639498869989,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:2708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,8859981476061807535,1081598744984785138,2097152 --field-trial-handle=2168,i,11792743546514221890,2203960639498869989,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:3200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4832,i,16944313117265139420,15840727313254130260,2097152 --field-trial-handle=2168,i,11792743546514221890,2203960639498869989,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:1
    3⤵
    PID:2540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,17956347669884643628,4749171076619202785,524288 --field-trial-handle=2168,i,11792743546514221890,2203960639498869989,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
    3⤵
    - Modifies registry class
    PID:4344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,4290409123449660979,16015324761995524650,524288 --field-trial-handle=2168,i,11792743546514221890,2203960639498869989,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
    3⤵
    PID:1356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    PID:3812
- C:\Users\Admin\AppData\Local\Real\Update.exe
  "C:\Users\Admin\AppData\Local\Real\Update.exe" --processStart Real.exe
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll');$stale='C:\Users\Admin\AppData\Local\Temp';foreach($p in $want){ $ex=@((Get-MpPreference).ExclusionPath); if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }};if($stale -and @((Get-MpPreference).ExclusionPath) -contains $stale){ Remove-MpPreference -ExclusionPath $stale};$ex=@((Get-MpPreference).ExclusionPath);$miss=$want | Where-Object { $ex -notcontains $_ };if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3044

C:\Users\Admin\AppData\Local\Real\Update.exe
C:\Users\Admin\AppData\Local\Real\Update.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll');$stale='C:\Users\Admin\AppData\Local\Temp';foreach($p in $want){ $ex=@((Get-MpPreference).ExclusionPath); if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }};if($stale -and @((Get-MpPreference).ExclusionPath) -contains $stale){ Remove-MpPreference -ExclusionPath $stale};$ex=@((Get-MpPreference).ExclusionPath);$miss=$want | Where-Object { $ex -notcontains $_ };if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAIABFAHgAcABhAG4AZAAtAEEAcgBjAGgAaQB2AGUAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAByAGUAYQBsAC0AbAB1AGEAdQAtAGwAcwBwAC4AegBpAHAAJwAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcgBlAGEAbAAtAGwAdQBhAHUALQBsAHMAcAAtAGUAeAB0AHIAYQBjAHQAJwAgAC0ARgBvAHIAYwBlAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:340
- C:\Users\Admin\AppData\Local\Real\real-1.9.0\Real.exe
  "C:\Users\Admin\AppData\Local\Real\real-1.9.0\Real.exe" --real-launched-by-updater
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3792
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3792.5932.4880532759124324416
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3952
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x19c,0x7ffcbaa3b078,0x7ffcbaa3b084,0x7ffcbaa3b090
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1772,i,2373914404042663899,13886343730234759735,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1764 /prefetch:2
      4⤵
      PID:4356
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1876,i,2373914404042663899,13886343730234759735,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:3
      4⤵
      PID:5316
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2332,i,2373914404042663899,13886343730234759735,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:8
      4⤵
      PID:1876
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3572,i,2373914404042663899,13886343730234759735,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:3616
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4432,i,2373914404042663899,13886343730234759735,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
      4⤵
      PID:4720
- - C:\Users\Admin\AppData\Local\Real\real-1.9.0\bin\Real.exe
    "C:\Users\Admin\AppData\Local\Real\real-1.9.0\bin\Real.exe" --rbxversion
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:5696
- - C:\Users\Admin\AppData\Local\Real\real-1.9.0\bin\luau-lsp.exe
    "C:\Users\Admin\AppData\Local\Real\real-1.9.0\bin\luau-lsp.exe" lsp --stdio --definitions:@roblox=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\roblox.PluginSecurity.d.luau --definitions:@real=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\real_executor_apis.d.luau --docs=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\roblox-api-docs.json --base-luaurc=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\base.luaurc
    3⤵
    - Executes dropped EXE
    PID:3056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://projectreal.gg/login?app_auth=1&state=asohbLMZDqLt3M3AUzmIWQhzxgsI4MGWDREnR8r69PE&loopback_port=58600&hwid=HWIDv5_7c4bddb93223d4df88f26cc914d0c40911c819fc5c8100246627e39487089b5e
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://projectreal.gg/login?app_auth=1&state=asohbLMZDqLt3M3AUzmIWQhzxgsI4MGWDREnR8r69PE&loopback_port=58600&hwid=HWIDv5_7c4bddb93223d4df88f26cc914d0c40911c819fc5c8100246627e39487089b5e
      4⤵
      PID:3124

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f4,0x7ffcb76dc188,0x7ffcb76dc194,0x7ffcb76dc1a0
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,4737934498607655197,15352387062461676097,524288 --field-trial-handle=2756,i,7710627884240440600,13929819543412868031,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:3
  2⤵
  - System Time Discovery
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,3624767766021132047,1649301827528709332,262144 --field-trial-handle=2756,i,7710627884240440600,13929819543412868031,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:2
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,14412120655130332585,9800683468589910788,524288 --field-trial-handle=2756,i,7710627884240440600,13929819543412868031,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4632,i,3630175690800756781,7389039914326235484,524288 --field-trial-handle=2756,i,7710627884240440600,13929819543412868031,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4632,i,3630175690800756781,7389039914326235484,524288 --field-trial-handle=2756,i,7710627884240440600,13929819543412868031,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:8
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4956,i,5811801664628784999,9621692112585656005,2097152 --field-trial-handle=2756,i,7710627884240440600,13929819543412868031,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4960,i,16487496595247241992,5881880956097583354,2097152 --field-trial-handle=2756,i,7710627884240440600,13929819543412868031,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,967200386317929475,6900669757567600064,524288 --field-trial-handle=2756,i,7710627884240440600,13929819543412868031,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,5927409625504263632,11551173996740968597,524288 --field-trial-handle=2756,i,7710627884240440600,13929819543412868031,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:2136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b8,0x7ffcb76dc188,0x7ffcb76dc194,0x7ffcb76dc1a0
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,14945406618154242256,610994777459325345,524288 --field-trial-handle=2848,i,4236875122408708313,17603437283474319359,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:3
    3⤵
    - System Time Discovery
    PID:644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,4162143212265403214,17231851724764092758,524288 --field-trial-handle=2848,i,4236875122408708313,17603437283474319359,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:8
    3⤵
    PID:3996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,13500545370096966125,9081483027071512873,262144 --field-trial-handle=2848,i,4236875122408708313,17603437283474319359,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:2
    3⤵
    PID:5276
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,4005040713376258435,13543734015479552491,524288 --field-trial-handle=2848,i,4236875122408708313,17603437283474319359,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
    3⤵
    PID:4760
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,4005040713376258435,13543734015479552491,524288 --field-trial-handle=2848,i,4236875122408708313,17603437283474319359,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
    3⤵
    PID:3812

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4568

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1664

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffcb8d7c728,0x7ffcb8d7c734,0x7ffcb8d7c740
  2⤵
  PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2096,i,10498921752720429179,5274753687827102510,524288 --field-trial-handle=2060,i,8020855884271157889,1976710407516844022,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2116 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1784,i,12663390697185144310,635700247172555306,262144 --field-trial-handle=2060,i,8020855884271157889,1976710407516844022,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1656 /prefetch:2
  2⤵
  PID:3988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2496,i,12939231879563847290,8546034239394145283,524288 --field-trial-handle=2060,i,8020855884271157889,1976710407516844022,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3284,i,12097520250337518600,11912262214219471516,2097152 --field-trial-handle=2060,i,8020855884271157889,1976710407516844022,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3308,i,9090671594082027857,8368568607213237636,2097152 --field-trial-handle=2060,i,8020855884271157889,1976710407516844022,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4488,i,9496469332100069151,15051447209571197522,2097152 --field-trial-handle=2060,i,8020855884271157889,1976710407516844022,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4500 /prefetch:2
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4756,i,11135274955175438516,16103390554648236344,2097152 --field-trial-handle=2060,i,8020855884271157889,1976710407516844022,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,2842549129371986686,12156954490318370804,524288 --field-trial-handle=2060,i,8020855884271157889,1976710407516844022,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:6600

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7ec2320c774b4848c6a2b11369c02e42e6867051ef3c18382f9743306dd9757c
MD5 429ea3335974bf60da93eea74bd0807e
SHA1 28b814985bb8ed881887417222ea4c115a699203
SHA512 8064545d25ada316061f693ce7ced4666340ed5a4e08ffcb99417a4946259027edd80f86c76f2dfb9302703464c21643358c789e83998f1c111688dd790d33e9
TLSH
T19DE022AEC962EC3718FD171DA0510786EA6423473A41849F3E3D8A198FB563B429785C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4abb840a81beae9cc2edd5a63d104e677ed0fe1c2c1294b78875e62f91055031
MD5 bf9df1ccd73fafae4e9fea210c5ad561
SHA1 2a1f63a5a6eb4657097c5be2d99fa2e32fdb6e84
SHA512 a5681b694460652175d72d8004a8be08f425c178eb40dafda8431d6ff7229dadb0fe004c33852a851b7071f1d8d84b839e8c7313a2e6f34420a2b9201e71bdfd
TLSH
T180418BF7C3E49A7E890096F4AB156F1FCE690914532C7CA6C9D4AE1B53E2972D20068F
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 dc62b0d7dfe27770f98205366c6b90203d745cb2aa792d9c4e7e9664f592e8bd
MD5 63e28dea925cbe7f90938437f225b065
SHA1 0fc1cf3f1c70dd0eb72baa46b2812c49bd928c71
SHA512 a843657bb3a1caa2d95f1013319d58ac55cebe97dfc1274a62adcfe5880a7310d4ab4bf4f9a48357c5c0aeeeb43e8a202e5df94937a6d6f1dd9a1a0ebf00fcc9
TLSH
T125F0E097E6BA747760B949EB5D05794A647E983105405CE5CF5642BCD1D14F30B12443
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 12a36a64a156f4f29c51b2a7d227a5431635dc7de0541b1110783b7d8e85557e
MD5 d3a37653ba6b45348e744b034d534ec3
SHA1 649340ae3cd2ac184f8da0df6d1907a090b42154
SHA512 d6b586bbc063f6c9cba7a8a761b60c83de9134864b856cfe3599811dab50e9f579e0467febfa4e850df04af2c72ac425123a7a2e7b22c27d14de6081ea83b194
SSDEEP 192:hRjprQqBO560v71hpAPRp2g92Hsb+WNnBR0ReSPyIsnAUge:hRjpzFwBhUXDQwj0R3e
TLSH
T19932A36EA910A5BB6CCFD22AF9227B93D7F5102164E12E84E6FCC92C05D75CD222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 0616f1a4759461c86d535b965b0d6369e5b5ebec0073fdf3c664200690a4c25d
MD5 650eae1e3384274dd3ff704ef1beaa8c
SHA1 6d04ebb616341536f815a64d24a1a18936721513
SHA512 f183b9d88837688066471582e5ced184225c932f3abf7cf467e5001a7a0108351661977f5025c0cc824e98a33fa875eee1112fbb7543fc3872425b30f36e56b1
TLSH
T114B01201C0415102C04207B81206148871549F10D60D170153E0AA2388254618014061
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5999d5.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5999d5.TMP
Size 96B
SHA256 e7e2652cbc9169358eb45d867c8b6fb1449683c30f40435dc391a0e5038b1dcb
MD5 3501a3cdd82ecfdf4fea39f47690276e
SHA1 8566509c4d837fcec33f88a64ea0fa2e2b04960d
SHA512 cab2a3745695d7b834b98eacadceadf6239ec93b617c70c4863399ed91b628475a9df65d77291173e6fd6ecca4334864b454341e41f1f4bcb74f1c9c47549d8e
TLSH
T115B02220C003320FC08203F0288080E83220CF28C203030A82E00AB3CC382200020020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 c70b500fc339c8b80c9e0d51152e012f169e6649c716d9557d7360449eca7c9c
MD5 6fc143b6b35c257e83d52bf960bc9128
SHA1 3ce5518e81e9cf45bd3d518503bbbdac5ecf6296
SHA512 fbaa50095503403e5d491ca654fe0261490e97e7bfc511ef77e350b2fe730fd1dc6261e2435508af7e41d0016f0a4dd032c47e37002cb2c346943247a04e92ec
SSDEEP 6144:fhxNPRW2PYddqmY7U52Fom7Rkm1tYpBeh2BAoE:pXPRW4Kq97UAx9oBGcAoE
TLSH
T19C3423122DB5AE784C5DFE1D318F2D2F2EF28EE494A4AEC2C8D49F08279F9841552D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 dac55a7591817ce38a32406dd7f5e525656f3d60ddf99ff25bed8f205d0aef97
MD5 b9f390190212f948d207c6dd553e717c
SHA1 b61efca2a1dd5233fc4e403862832aef8ffb3da6
SHA512 f97256c9f4c9041fd84195dfcdfe7366e71e818b9700f756097a709c19e7378dafd12562999ac7447cfc1e6a02b0f7c5b6cc730355dc52bc2edf023e22883abd
SSDEEP 3072:wGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:7m7Rkm1tYpBeh2BAo3
TLSH
T12AC312275D71E9375D79A74EB08E0B1F1EF14AA6CD30DE92C8D85A0437EA7CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 30e4009636793c3c95a340ad303dcc559ace6401874410be7d426f17712d5832
MD5 3c9b6859b7a6c907402e63d240ca41e6
SHA1 d49454d3d8d6df4df55a54e8ed51ad01edca38f7
SHA512 266412abcf57844ac7c35236c4625cd866573baabe48d0233cab85ba3ca796e06bcf25c2555b855bf69741de46130634e53eaaa3b45ea32d39202b6e7d2d0af0
TLSH
T197D097F46916B2A0E02D083260204600B22C02A328A3A30AE1AD180CEDB802062CAAC9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e3dda413deb0056300d64212636a6785cc542fbbae4383b4383d4cf0ebbc4
MD5 fb1e85b1485d88ba9cec2cd1f023e621
SHA1 aa0fc9167f42bc9470e917c18515afaaad960620
SHA512 94193e242c6de1dd160dfed5c111ba549c783ae9bd7ef959f60c690664d2f3279ec6a50445fb7fe4b959e2c95eeb27fa56c5920a84e5d00761487e4265cb997b
TLSH
T1CAD0A7B61A1EB490F27D0A32A011C700776D16E32D52A305F32C880CDDBD0D526C66C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 98234720ff46abd050393cdaa7bce984b8ca7bdc8f0f1625836bf4a70a2638f2
MD5 6e215dd660b60da8aef8e23b38f5187e
SHA1 1df4eb9dca428e8ea693485b553831fb30be1389
SHA512 8851365cccd84a61408cf2c9499acc6b628567164e9af27688f8d7832f5b02ff814e0364edbe050d2e1aefd3a6bdb2c6059dd9104117c8c7571fda8e59af0c18
TLSH
T1CCE02BA6D821EC2B08FE1B58A0194A56E70013176A40495F3A3D820E8FB076746C685C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 d487f9851c76836c90f5a0bd6b97b01e35a2442076d9dcda702e3e7eb8c6494e
MD5 d5dd35f0a4e93a65718d7bac9337c606
SHA1 c060283748b39e0961f8738ab729bc52d8070d27
SHA512 be3e826d765660f2953513ae9a420c44127ec711560b1944b4f5158823608d436fd55a9cc23fd2c639d38ca97d95b09008840dfd935f2c9f5a1b576c49be0c04
SSDEEP 96:flvBxtLNFihT8kzmTUSccqyHVKoUlgMpS/njPSRkyN:B1NFMokCTgcXMs+dN
TLSH
T1F5B14CB99B6802B0EFEF83B807E1A6207F7112E5F987ED810B468E325530724AC20D07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 c7a85c7b3ff9fa4b744e7891d43a7f06c80f336d25c7ae02390c23a281ae7d35
MD5 0c28bb3395f9741c5e0ef2b512ba53ea
SHA1 a3ada076107c10e4142ef7cf0f42cb26e5573242
SHA512 7fc79c6777694ef0f7c61be8fd131618fc2f403c6345a22c2a92d83a073a84cd0c645f3f1be49347b2854d8fedf92cf584b32d17860486fb10517cbda12096d1
SSDEEP 96:nsd4PuWP5vHUYigDPnLR9HEeSO3zhiM25uG2aH2nlE5yW:nsd9eH4AL30MCuU2kR
TLSH
T1ACC13EF9976802A0EF9F93B806E5A6607F7112E5F987ED850B969E321934724AC20D07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe590cf6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590cf6.TMP
Size 2KB
SHA256 ee526ca7d469865118aea212fcce357e303c25853ae88a07dab059eeefcbd385
MD5 43d297eb3c40f3cc10fae196b59e5599
SHA1 f8b7a5172599eab184f8b5bb990b41ee7bff4df9
SHA512 7da17aba6091a635ac89c629ed9a6f689ec45a5a405a0cd6c140519c00634d5dbaece978bde9c3c93a55541c84ef62cd433fd27e525ce36d4af92eb4bfeeba31
TLSH
T18D512DF999B91261EBED05FC9BD13B34B37017D8F8D35D854E8867756830B354D20A02
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

63c9bb02-6545-4273-8fd3-2d9012838c09.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\63c9bb02-6545-4273-8fd3-2d9012838c09.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5d6769ec98c1c4f52058bdf5aed9225143af2e29c2188325494d697df5569571
MD5 69d5117c1868f4df48872fb53f3e99c3
SHA1 6f28cf3a7fdcb654d7dae491fdf31420c5c3d5f6
SHA512 0bbe70d740ba9bc8baddc6172a4de911f028b082764dd9d6d82a650cc4e90fb2b066a551cb525e31c290c66087d9a18500d0d5bfc44b474c433c5c1b51bb2121
TLSH
T1757180F3C3E48A2ED91155F0AB186E1BCE5D0914532C3D6BC9E4EE5B63E2471F141A4B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 645eec0fe4ab78a3377e997ec3404eb3e0cfc614535405653f93f50ae41f62ca
MD5 c50bc5319596a3328b7455ca14f76ba9
SHA1 4091fdaeb54f1a0f4481cde607524ded1ca57007
SHA512 33efb7fb6e773c21441e56aae1d55f72eae5e75cd44c51067b8bef0540eee4c4bd27c38b188dccfbd8eb0731b41bc8dde306fa2ceb92291710f33fe35d822f26
TLSH
T17C41AFF387F4866EDA1192F0AA18BE1FCE2D0514431C3D6AC5E4AE1B93E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 857B
SHA256 2165da706d87090da1d1a793945154d849427927ae2cd3f97b8a60ed1a24c3e9
MD5 fa8bfd1217f4dd1554b4763852ade7b7
SHA1 388035319b909731725e27077490a355b9f46ebc
SHA512 d0a6e7493d7335bd355b58d1590626165c41a750cb4c08a45a1ad54ae6be7e2555d56b49b03a29229c76f433bb72c62904f77296ae08949e18746caa7002fdda
TLSH
T13F118E9785FEF43750284A3F8D897C0A1DB7A439019658F8DF9285BCB0D1AF30B164B2
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 956db652c1c4986dbf8727926b3076004f603b83b5fc333db1d01db142f36114
MD5 277f64826c29b2ec16dfd23b6c90f253
SHA1 cf541add8034ec301619bb2b664e8ff5e9b794e8
SHA512 9cc5803856a1155c0e2013f80584ddc1f4f83768b21c6e949707415582c8ada7b522f27cf953ce649b7c51b21c9333ce8e6d67985a96d752d4aa488c37847016
SSDEEP 384:sxZZsZy/fIs5PWv0wazIKY+eHbmA/djZf:sB2y/flY0wazuHbRdd
TLSH
T19582E906A93459BB8DDBD219FA45BB53D7F81523E5904E449AFC8E1C01E7BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 514fa39b49da41a4b71d521bb6cb12413f8e75819d11ca669efdd306f32c469f
MD5 7bcd76dada260e98c74dc71192dd3510
SHA1 ccdc333b4f5321b325906a81bfe49adc9011a8b3
SHA512 123c999602f22c6d908cd417090d445f9bcea6c303d261b39fc74014ac054e82a81186853b631b95e7c93cd3ec9d0fcbd377711461062993ceb957b348ce6b03
SSDEEP 192:sxZZR+yMqZjK1Ml80jy/fIssYWpV0QaZdIaRuvVzodp+XHW6+WNPYif/YPAG+qsZ:sxZZT9y/fIssYWv0QazIKY+UHbd/35Zf
TLSH
T1C072F806A924597B8DDBD219FA457F53D7F80523E5905E449AFC8A1C01E7BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 2f5c1a3320147f642fc9ff45e6860b3f606bc683e54646a76b7eb9184f470b1c
MD5 f09e8b71390a4fa77078f203bcd6c3ff
SHA1 de64a203e31c34ece3f7eb26d6c7dd28fd903230
SHA512 94a1a785bdd33722d6e5954e8354f7f20221ac3e712da3849ce391de8a3763e610d8223aac5db746197c44d05044339dbec9c3104ab09f3ec6395234aaef3b6d
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvQX8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6ysy10Lli:eY8Od/HEnFhWvFvQXu1jait10Lm2Nuo0
TLSH
T1D6F2FB3B6C0CCB7E4F844E9CED2A7F8A6DE802CB5698895447FA844C02C76EB15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 4dc51f9600957e9252333d70bf8cad469735e333ad284fabcb61eba9cbc49241
MD5 1b916ed2bc7770222da81bedb486e4e0
SHA1 fc808d3a47f261877df8f9ef735eab4771ec1a03
SHA512 ce97baaf9a5dcfc5376275f5ade8d245cd1a690f2a75de13b7b95a0a71106a669b4349ba19914a47a87e35abcd00cc10b62cd13862aa30ec9c2adf250ee17a76
TLSH
T1CED0A76FE61A1880DBBA4A831A32515F8B22BC8455D49048E002282958B1A97D617F72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 75aafb5924105fbead0840327ad8c1e87d8ce8e9e2d9904105f9c8df613e8467
MD5 1e8ecfc24eea00d3ef9ab83d2c000b75
SHA1 e5e4ba442217fc8738afdb36420d2ed477f98ce1
SHA512 77841cf9bec3729fcfa069ac40c49ca71bedd99c8f65a3a3fe913ea0ed7d206e4d42d543e01773b0c8b38c87a136f500511bcfd889ce807367d044262939a232
TLSH
T12ED0236FF61D1880DAFE4F821A33525F8B22FCC455D89048F00208259CD1EA3D117F72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58f6af.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe58f6af.TMP
Size 138B
SHA256 9a7af88dea60bf140393e6046e9a8e051c629b38b907a6e515dbca4f32280d32
MD5 850452dc1fd019dbd5e80c73d4645375
SHA1 42afac91aeabc4d4964d53186a143dfdc5eebb52
SHA512 37af1c6b8a72ffef3b37ff127327cb2a925109c3e9f48723558cafcad125c140cade314fdcfb092f2834b7de8419a93b2a42d198b1d56da4c1165e565c963c94
TLSH
T19FC09BBFF1440911CF6947910633515ECB167CCD9985D48DE017346420F4E33A50BFD1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 7bda510f8cc3e41313aa2141554a60b3ac1b1f40f7b52d7d46bfb52c4412d24e
MD5 38dd974809da3ac58f35afeab1ebf5d4
SHA1 e6a0814b751ba9d79260a01895a2619cda234f63
SHA512 0b1517890ec9ab2c5f122dd6ca6590b3b1343ed43e7de9a107f2214052f4f0e98872963d12634347cb744142ce35d3cdc93664966d8ec320035694f80323ce38
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGo:05ppxnY753RNBvRJJdt7p5J9fvX2fPN
TLSH
T136C2435A713E0212397E2948B29696364F4235A33058E4BF7FF814A14F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a7631682-cb18-46d2-a1e0-5633cd3da909.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a7631682-cb18-46d2-a1e0-5633cd3da909.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 3ad26d3ab92f49dbcdbbf5bec14110c8fbdcc6dda54d5495bfcc10e2b11152da
MD5 d9f50b40321742c4f93aa00951cdcbe7
SHA1 886a7be93b18a753664fad775a63291f351963d7
SHA512 508aaf66b56a61effcaad07b3d9a60cbc753a79235c3522862794f234b5c26af670585d6de34c9a46bb199da8a8a3fb67b586eda43e6cc5935538a0654841785
SSDEEP 768:peFScpAiwgfkABFGb/X2kFiSqiCK4GHLXs:wAAB5bljgLXs
TLSH
T1CAE22872E8948DF798DACAC9578AB613ADE01133898C499CE6F87D2C309F1BC174B815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 67bdfbf5bc48f162448ce88f9eb7f0db8547ed5eb79ac52c8d6b64df7b60bae1
MD5 b2f9c788c3cf3e57eb23c948b23625f7
SHA1 ae9cd783e2b9095eb205a724d6086140b78bc786
SHA512 811726ef81ac22df47def396791f1dd0758d29ea6578c05e3a8380151b29a45630825231c4cecfd2b4244e2884cfb297a0e1990ad30616b5de4971549f8efdc5
SSDEEP 768:peFSacwg1kdBFGb/X2kQ3SflCK4GHzHXc6:Zacu5OMjgzX1
TLSH
T189E21872D8949DFBA8DACAC95746B5179EF04133858C4A9CE6F87D3D309F5B80306829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 2b32bda5798bceb01ac849acc2ff01873945af69a8385c8f667246bda7cd9815
MD5 8efdc347c81973cc163c34d6d3c09f3f
SHA1 4b30022020a34e38763d3158ff319f984095d98b
SHA512 5686159b4306b68f6206c754610dafa917326e8221f36cf00e0c4783ea29fe93ca168ae0777a90c8d8ba4758d96a49c4fd0e0d8fc30178d76204c2993347352f
SSDEEP 384:npziFAZcI2sNF8TUNTUlI4oQckCrBC6PphifGGb/4w9VokEL5n57XjF7Iz56:peF+2cwg1kqBFGb/X2kK57Xc6
TLSH
T1E3B23A32ECA8CAB7FDEB8A85AB4A3617CEF44163D9CC5AD4D5D95D1C009719D030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 199758d19c920ff13d5d1f8e8ae6be5d346a3b2a89f60ade4125539f42c322c3
MD5 502e256420e1abbd344c6fdb6d9798be
SHA1 acfb5bc62dec91a949877979cb18f97ad3abd197
SHA512 76ac08a8c47d7a095ca1e0f22c9d2b92a6ac1706713650cc2213875ead84a7e14785103efc8eb9647333c66c0884e400cd438fca99bf0c12fc624cc638ac6fc7
SSDEEP 384:npDiF9CcmyWCs3sNf8TUNTUlIm2QckCr9G9MphifGGb/4w9VokEL54Ee4KV8p0TV:puFccps3ywgbkUCaFGb/X2klEI8p0j1
TLSH
T14BC26B32E858CEB7ECDB4B99BB4A3647DEE01163C98C5AE4D6D85E0C10972DD170F81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 3d270a77cfcdb8442563ffcb0aaf05169192934d6b101a5111a81fb2dfdaaa61
MD5 1fc5b358d67ba9531f543b4736edffe9
SHA1 c04763cd98550b3c58475fd1cb328e9fb99c12d3
SHA512 50255f072393971317ff436f389ce1fc2c1d33fd15f06ea62897c642d70175cffa2f7473d93c43dcfdf035fd3edcb1826005eba142f011f1c4cb24adc68b39f7
SSDEEP 384:npdiF9CcmyWCs3sNC8TUNTUlIm2QckCr9lTKphifGGb/4w9VobdpdEe4KV8p0TH1:pUFccps3PwgbkU5kFGb/X2bWI8p0j1
TLSH
T12EB26D36EC58CEFBEDE74F89B70A7A07DEE01227859C59E4DAD85D0D009719C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2d206e0c67bac38429a3c306e7ab325ef514565e3cf61f5f26bf754946cd1a76
MD5 efe7f8482d9c55b54256829b40795ce5
SHA1 9e7c7c1ce75b5ae2aa4a2b6776b8a4a164de19b6
SHA512 969d8b471dfa1871496cf8bfce392f5ace91dca5484ca1bea9cca9e5c4cc2640e5fa1a5713ce4aa705429cc0c5830e6b70913a632367489d8533902efff8c733
TLSH
T1BE114523F78C8920CC96163A509DAC5172B686CB81AEDF9F7FC0C210E5BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 17c7b3c895766071a0d87318ec4134a9032ed113b46d3ba75889819a61a9cc19
MD5 2ad33642f863ae14ee53bc6853ee330e
SHA1 ca81cc7d8c33a46ebe97bc1d3db55e41a813029e
SHA512 52c59a7bde3751e07da53f3942c15cc3e19a4bf1929fbc28ae568ed96531852747b4f724e01438e159c4c98bf2d846db205c48e32f4b5984e9fddeb936eb8aa9
TLSH
T1A3112223F38C8921CC96153A509DAC5172B586CB81AEDF9F7BC0C211A5BF584CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 1d6d60dcfd25039d047a74208f7be6e2e04174a2e4be210dddb745e177a0a73e
MD5 84eb732e0fe61632e190d38677e634ee
SHA1 add2238375a1dcf79f377f40e5537699ec14ed2a
SHA512 8e586d3d12a4273a0d231a86a72f715c146f3e07fff2e2fe618f3ec2127dfd8f78ad57086c553d4e0410580e29eff93f7d5d1e875a1926ac6529322cb9e7f263
TLSH
T196112223F38C8920CC96153A509DAC5172B586DB81AEDF9F7BC0C210A5BF584CBA1294
MD5 SHA1 SHA512 TLSH

Submit Download

.real-write-probe-5220-240708078.tmp

Path C:\Users\Admin\AppData\Local\Real\.real-write-probe-5220-240708078.tmp
Size 4B
SHA256 aa33996d60e89311b4d1a920dae03c6d7fa3ae1956c52662e273aad4683e577f
MD5 4bca24304861acde5770fdbe3cc2503b
SHA1 c9c64e071d2853bc7906c017a231ad1cc46ab630
SHA512 310070ab4092002aa33f550eb98680fa6662e7305fce227843430aba334fdfad1fe0dd4a6484264b59f9b02a780433a552ce3d5c3da643a77427463c06e47800
MD5 SHA1 SHA512

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\Real\Update.exe
Size 8.2MB
SHA256 d4a07f712ec40e4ab8bbb1245bee820d1294a4557af279c94402b33d0e451f77
MD5 516e2613ac7c08b18da590128cded6f5
SHA1 eb24a3d41ed2ef6d73d7077ed7f9e7022bcd51b3
SHA512 a17c7942162741a2bf9c68cce5179ea59abef0e41611a2cd442e9de9bfec0d96abadfea8d920348cb546a414f6fe1cdfc634e9c3affb861479ff683bcad84fb5
SSDEEP 98304:JXj9S0C2/bIa2ulkYfEqk6DdbIYis+kU0mwbEXev8wcFOvkSxMy5/Dn:N8w/Ua2ulkYcqk6DdbIYDrBwOUgBRD
TLSH
T15D86CF69A6BC01D9E867C2BDC2965227EB72B415237057CF1A609AF60F23AD41F7F700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 372b31d4ea1c6bf38866b44508021e3805356d23ebaa516b921b678265ff3059
MD5 61f46097592a8bd296f5a4f8eba562c5
SHA1 e44c484c58620e7669f173b8e7d33e6336594367
SHA512 e685dc0b9c0b10a05cd19c9da1f7cdcba8a56deff7285bc4790611655c6f93a3539efba4c4cab98e1cd57a9f9d6184dcb9aaf674b11513acb60c3603803aec63
TLSH
T131D012137A415134C01020330003BA481841C11F40468000542DC97E5A544941D0A442
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 576B
SHA256 cf82a2331fc44717ff2e93655c1749e0930339a28d60fcf80f7e988fa156a071
MD5 ca8c53d9c3bcd1c1a2f7fbc5c5195c73
SHA1 878b6fb162224cb39542c5e3adc940d57aa42733
SHA512 b97aadf8aa2d3c7a2c05ea9e3f3945a53ebf02f4061a710f9b22b6b32408a0b9e9b85a8dc204e9b3134c9776d0127404405dbb3c4da709a2ff7ea7b6c62a1501
TLSH
T1A2F0D8E8484F0096FB9797B160D091E7BE7C196013077D9D97571CB4A4BB740C160007
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59840b.TMP

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59840b.TMP
Size 48B
SHA256 3469f36a1906e1c73225cd76f4b5414fa43dd6e6ce41865174947102308f64f9
MD5 faca218b9ff7263a6603afb0c1474ef9
SHA1 6ad3e173fd600d579a7acae0739a03cb00c30640
SHA512 097b66a55340961f441ceceef3b08db57cbd0b3ba05a2e60dbf0fa13a8fa0fad184d055e91e07a8913946887895b4169705ac17074c41368a1f5834be100971c
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 5278683350d45444d2fa1913e7113d50090894b34fce06c19588c1323fc98469
MD5 3606dc8f1281d5a6b1d5301c96c75462
SHA1 404a7b281298ed91131b14a61007a832d0eb8e5e
SHA512 71d9727e18876ea9227a845c6adf2bc99841175087152506514dcd0c4dd2a2b60711f645035acc6ab6df62a1db5ae72d14cd17e2b0cc92f942a9818d0261d0a5
SSDEEP 3:LstlNllkll/lQ/q+X:LsX3lEtqjX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 1KB
SHA256 f93f208a75044eab148540ba5a70e2e183a04653ef5123439ef429e862cc1466
MD5 1be7e27d5dd0e7b933ac21a7f767462d
SHA1 41cd7e80be7164ecf48d0934399d641319a73dfa
SHA512 9fdf9712a99b1d1fbcb7c2c4e09424c1210ea0fbe8555427d91845032191f6029d4c02d198d355119c1db0f2a78a39a2b79bc363c43c320dba1ef6b4510ec6f7
TLSH
T1EF318272D8806BB76CCAA5467201AE5BBF61112FC0418F4C91EF5B2C53E768CA526E32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 2KB
SHA256 cca18e005a8e5ea3acfa654ee1f6ebeb1cc00bc02bb7cefe4a25b393a65b20a8
MD5 fd82ef54e407e48d444158f78dda012c
SHA1 64fadac312b8859f7f9cc8cd0fbe218de3f03dd6
SHA512 d7cb5e082692fd65547ef35bea5ae603dd9de9388a3296b11e19b6e312cb45710307c8163427d8f732c26499309931a5c51c2599e31707f5816773c8a1b44fee
TLSH
T12351C733AC04AAB789EA9904B9053F13FF75516AD9522F6885EF1B2C02D769C3302D37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 3KB
SHA256 36f09a68ebfd903934dd86ee5ed1ae753115dcfc5a9572afbf1e033fb97d6796
MD5 c26f53b5b00b13795d646bceeaa7bc85
SHA1 95ba8184adf439167320fb48a5f7aa8df86c42f7
SHA512 01f34aacac436f32b6f5aebb96b485d0e284db870bf5205dc63a5118c530c50cb88bdadb32aed1c8b51103e960db28492af6ca23906faa853d59371934d8502e
TLSH
T1CF71B632A864A97B4DE6D904B8812F17BBA5112BD4813FA8C5EE1F1C02D77D82301D17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 16KB
SHA256 8b85d87339fc6976dff07d2d3ba7338f883168d532b2b615a1bfb73dbc6dba5a
MD5 bf46cecdb8b2dc713aa195c079965bfe
SHA1 588971c3c2304117a3c5aee01fa9cf40a008b26f
SHA512 84133ab4f2fbb8096e595de382020bc87e07cd3a31735b60f7db4383ec2d57ca2b4925dc3f8d635a9e9ba3fd9145e9b03b0dcb3982fd9206ca5eeb11d7d4133a
SSDEEP 384:zC+aQikB+z/xvxjg/qhEwNbZUYLmrbN9zS:B/UxvxjgC+FYir5FS
TLSH
T126728C2B55683E3799FBF5057A480B4BDBB594B2D4C16EBC89EE5F0906CB3D81302E12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe591ac2.TMP

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State~RFe591ac2.TMP
Size 1KB
SHA256 eb20a9df33560624ada45d2ae2fa29137c19f26bf46a29ad5f176d43629796b9
MD5 41f87bfae9bebadb1ba30446ecaf40e0
SHA1 8adae9e8b7d7f29ce2d8abd0393189d3d3f94920
SHA512 3367d9a54eac33f2a8c4d492ba5eceaaca982b441711c5404f3f01a60155cf03bd3d0909d92d27daa5b84a2fdb3d748c497722a1c042c243b3613f57ed605a4e
TLSH
T13F214032C8846AB7A9C99845B211AA8B7E91512FC1418F0C91EF1B2863D7A9C9626D33
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Real\data\config\settings.json
Size 207B
SHA256 e4f38f124eb821848eb57d6988c5ef865768188e54d1e8f0ae34c59e9f99dd21
MD5 2b4a40c8495d5ddf7adc222e092fa67c
SHA1 fe7029809ff12457b0e50b92e87b33188fd18848
SHA512 18ba17b46e89fbaad852262144a4399fc6ce616853e80d33e9ea7dae69c2d0f8d2d3853af908c0a78c6e671b30fffcf3983ae02ccfaa5dfd0055db3ba456b9d1
TLSH
T192D02250DCF40E7313DA902A082B0010F0366C67009E3D3C38EA031C9F4F630417D384
MD5 SHA1 SHA512 TLSH

Submit Download

current-version.txt

Path C:\Users\Admin\AppData\Local\Real\data\meta\current-version.txt
Size 5B
SHA256 7717cbf90c63a3b096008763a02066239916fa9916f98254d1aa3b2470830fcd
MD5 d16b8f0e3a892df62c1444dfc991ee4f
SHA1 57f75e869bf26cdb7eaddcd7bb1de6cfbb0594c3
SHA512 6ad82be153f790f779a5857af637db6bb94b2f3a54ad294dea9be74e8385266646317477320a0ea980c3313f94b1c521d42458b23b61f330b5d9455d93118406
MD5 SHA1 SHA512

Submit Download

Real.exe

Path C:\Users\Admin\AppData\Local\Real\real-1.9.0\Real.exe
Size 14.5MB
SHA256 7a4bdeadb0b251ac3219c84737618fdbafa682467e8d9635674fdec3cb8a6c19
MD5 d0abdd8a9a0459802bb49eb659ec26bd
SHA1 61ffb41d0d90bcb15fddc26f8414c2f23f6e8fb4
SHA512 1f865b77185ce2a76bfe6fa2059f64d693a0078b965739424b5749648a6cc2da5d48c2a84ec4aa7ca7479c96fd8303c8ac8ba28dd1b5b2df94b84d15acbb8721
SSDEEP 196608:XqqeVkBP4D6xMX9X7jBTwdnAxF4JJ2JTDEwKBFnzT:EV+4TXVZ+nAfCUCn
TLSH
T11AE69D07F35181E9C0ADC0B9835AA637EA32B8894735B2DF5BE40B112E16FD06B3D759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.dll

Path C:\Users\Admin\AppData\Local\Real\real-1.9.0\bin\Real.dll
Size 3.5MB
SHA256 868f61c55ab11b5da9b90693228a5275f477fc9a1e62470fcc7d6ad0b0260db8
MD5 9d24ff354d97baf48c24b072673fe62b
SHA1 81fef6b51bf95aa867b08b6fa19531e4f9909df8
SHA512 8165a0718c7d1d0706a1ce662c56a01219deadbd7cd928de0a9f9a51d213e128618d00f68326b3008e96e4fc12fa6190edc383d88c2b62811bebf2ba4df72f05
SSDEEP 49152:O3I1UbcWkn0J2Q91AmItrOdzuApdCdhKE2/5YRK+CUSkGMaKJvJTXKg22Qr8/frR:XKbynk2ubgApdCdEER9SK5TXJgkQI
TLSH
T18006CE2E05DDD39AFA6B937BA60933744F6343913C2D10B8327A3A8D17769E51BB2311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.exe

Path C:\Users\Admin\AppData\Local\Real\real-1.9.0\bin\Real.exe
Size 4.0MB
SHA256 9d316dc7a9d4a744ab5c0c24d0c494f43ebd77f08f585cf98299e8fac07ce515
MD5 ed30d14de85c9795be18b43e15f236e1
SHA1 c5069d4bcdd6fc548a09582a2eb3bab693f5e1a7
SHA512 c100159cf0633cd0e541f30db88b556c6a8485cfa00a769b2e3ee11e50f618af51fd266956e8fd7e74972dbffdab75a7761df16ed3b46bb831b52e1eb807b9a1
SSDEEP 98304:HIc8W7JtDL7kvynCMFPcT0MyAKSEJNsCJLnOOHE4vtIDnS:HIrWJtjkvyrWT0dAKSsmKqu9KS
TLSH
T13A1623167A9988BECE87C4B5E206DDB7C607788B1F71B9DF034016363D636E06B39612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spoofer.exe

Path C:\Users\Admin\AppData\Local\Real\real-1.9.0\bin\Spoofer.exe
Size 2.6MB
SHA256 f4927849fea9d5abd064ed5ec61c45785490a93d75258de466db74e1b70da51a
MD5 1f79f23e16f08c13d3d50cff49b287ac
SHA1 2893622bd2183579b631a14ff4a5015666bfd820
SHA512 9d1f41cef2d5d707b96ab5b35dde8b85164f6e8794b752f576fe192934a4a62b1512ad512d917b98969afd25adf29537cb8c7bdd46c261d2811972b296f76a93
SSDEEP 49152:iSBsRHoPtqamwxg4muCBfxz2MWPUnGJG//2/XmMj17GPwhm9SeD5bc4TH:Iok6dyBh2MbnGM//n+9hm8epL
TLSH
T117C533FA16C2EB38DC8E137B233F07169B4684FC5C5DA16B29E7876D8706539C84588E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

luau-lsp.exe

Path C:\Users\Admin\AppData\Local\Real\real-1.9.0\bin\luau-lsp.exe
Size 16.3MB
SHA256 0da4f09d474e41074f4ec52bfef01eb90c014928358eda88f6a5afad5319b537
MD5 be087717213e34f06e6198159d9c73dc
SHA1 60e2ca8a33531199a644061238b1605f78b8ae66
SHA512 fdc7b914eb7425bc17c23a7e52c7256f0263448ef4e0469302386a17b6ed3d5241bdc4cc2c43092c521368b9c09540ade980deffa16c201455b5a9a8650104b6
SSDEEP 393216:XdTfwgggjgzggsgTguwttbgNlggigggXsgJgUQLCgggggCNc/gggga4ggggcgggg:NRggjgzggsgTgugtbgNlggigggXsgJgB
TLSH
T132075B3A21AC01DCF1BBD0BD8BDB9E47D6B2340903319ADF0591569A1E1BDED4A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

real-mcp.exe

Path C:\Users\Admin\AppData\Local\Real\real-1.9.0\bin\real-mcp.exe
Size 1.6MB
SHA256 1dd7738163b5266d78f30b04281b1d48927acfdd6879e7576f0862a1b6497e95
MD5 52f687164c175d24e9f4f22e6f17181c
SHA1 99b67fe1a7417616656cd9a34b31b1a0c5657bc1
SHA512 ec740a365519531208a5f536277043d71bd4995cc5c06cc65a4984f47bafcf67626e8218e2ba1823c7c88eb1184bdbddf369f48852af9434e9f45219b6ffc064
SSDEEP 24576:RXvDv4konyXJzOaNDOXDPiFBzmQJDXqZXxdOmOTFM3VIH06iyGdXQ:BDv4konMzBOGFBz3DXqZzuhYIU6ilJQ
TLSH
T18C857D03E69580ECC4ADC578C3579A36AA73B88D0A34B2EF67D04A513E2BF905F1D719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 399B
SHA256 e4613007a2374bf431d490151d1984d33b08983adb8882e4c7461aa1dd5be350
MD5 75ba7d7caf6dbbba430feb3eba9efedf
SHA1 d84886c155f3263a07f045ac7198e185dd660303
SHA512 ddd48ec068f90b53145c47e97569495d84b566913656a8605ef12ac3bbd49df9b6c85105047400257d9239578bbb024d48358ad22038a67b77e55a8d5de459ad
TLSH
T180E0926970FE28793E45F88BB03A9605C152F96408784420F541844C7FE84FA2FA3A49
MD5 SHA1 SHA512 TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 1KB
SHA256 f03ccebaf3bf0fb88f0ae4407cbe60f450d0b849182c20698d835845dda6a42e
MD5 c5b51f4c293daf32c05bb0561b99dd78
SHA1 4d5b83d9f136b818789b0933d36954ff88ad3f40
SHA512 97959768c8e5b2af273b1d2b4779ae601c4079159a6aae70ca93ad65a1d410a4cb5bd18f4ac6584b78c2ee0df61fb40e8ef4be88d53e4149e6797bd567b52bf5
TLSH
T11E31997A30FD78691A4AF89FB13AE504C186FC6508B95911F15184083FE89FE6F63E51
MD5 SHA1 SHA512 TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 3KB
SHA256 cbf369d1549d26519a16d9833a3c5258a9278419952d9eac5ed09b79f102fd62
MD5 525e17c09c446f1fc7979904c3e836a0
SHA1 cc4076441e122bacebb944219208bf97ee601ed3
SHA512 ef54d8e2532bcb4f17452c815c40842fc274d581fe7e56c02ea0519d86737a4c24d69aab70fd496190ebec55bbc3e24cbcd6194f082dd6770c37511bcbd894ce
TLSH
T1A0517B2A30FD746A2E5AF48FF12AA508D246FC5509781810F651C4087FF89FE6FA3D42
MD5 SHA1 SHA512 TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 4KB
SHA256 c4fbc8a3db746a79309aba4ad28dd6996ca5783713a9b36d4208aa4e84ade25b
MD5 6ff6bce5b6a580aa0adba81c355ad97d
SHA1 c957349c3862d4a7d9d06484941b0044e095ed35
SHA512 b49b59cd9a95d0712979f0ff3d9ba2c4d1fac29ae2c0a0e6c20455adde4bc3681a774f20e7ee857cba5a95ca3b2da48cccccbbbde1dd1662b19d6def235e2992
SSDEEP 96:o/wBreYwnctxD9vloQY7mtXNrCPY7REhRM2wrpK:Ts8vcmTeCZFK
TLSH
T1B1A18B6A30FC747E1E0AF98EF63DA505C159BC6509B91821F65184082BF8EFF6F92D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 5KB
SHA256 a090f9ed2bd1399cc66ed7084f2dc152bad7b20e772503c720a682da0327b892
MD5 dc2648b3e55d3713ee3c75f0eb218f02
SHA1 e754f8d826efd6ea83462e15ac86a559557c2f73
SHA512 340ea17442ff0971187a616f183981a28683c5b5dafd658fdfef5f02e5f051a07e1070b036110bc2658363b84f4114d22f559c48241a6d7ec26b8ac8b1a3cb8a
SSDEEP 96:o/wBreYwnctxD9vloQY7mtXNrCPY7REhRM2wrphYbcb9M:Ts8vcmTeCZFxe
TLSH
T1B9C18C2E30FC747E190AE98EE67DA505C159BC650DB61C21B65180082BF8EFF6F93E52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 72d6b747a6076d18dd2e2be6c0922b7e6031f2a346038af582c96822a8baeabf
MD5 14eb190bc910d7206df4cb6fd24e7c4d
SHA1 4eee6ae659363b5d6a2f2c2b905e774cdc790ce5
SHA512 bd7e020d00f62d534d9cd9fd4c5e17c3e36d80969eb1137b0f459769d9ce66687f5a3d26b94492baa0e79bc62fdd58e6dadc71671f751786e5c481a4677e655a
TLSH
T1B8D0041073140004D1C4D0F55031D74015144DC031311100D15C501D34404051141405
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7c6e7fe3c60e7bcc1e2e03c0c7aec6e06c04d8b1fe656c28a43b574da8a3b467
MD5 cedb797c73df8296d4290a0bd4709a50
SHA1 c059ea7dda18f2701994ded52123b03f3ac6defb
SHA512 b5b39792c7ccc86440df4b2c7c3bf81f3c1034a92fd1668accf96c646d1ffb34dfefb7d367f95be8dc78d020d8589fa84f9f24f2bbafdad0519e0463986eb581
TLSH
T1E9D0121233110138C050A0B31023B6481800C64B51154000E42CD52E3A044541A02842
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 6341ad8f8003c53aec1295fa71f5b9e93dab8a79dd26014cfd9df478f366b8e0
MD5 91b314b39f0a5ef70a2f52650593eb93
SHA1 b25fd4400763fe7993b0b6e0abc4e64e3717f278
SHA512 9427dc40471d55723e0f5b490f2cb216302501fd5b9a36847a69a6b5101b4e61525a09b4eaebba57c33b2f2143cb06a08ec751e3382ac0f702c093280639bfea
SSDEEP 3:LstlNllklkXlKX:LsX3lPq
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 809fc2bfff2d5a6110a92d618286007f8458ec6d563358fb4156d9600b74d0ff
MD5 ecea39e189a4458d62d5b9b00f2c68b6
SHA1 6e31e4ce3b7c6dd6131730ce64f2959b4b65fc80
SHA512 32d71380f395aaf17da1763f34c8289eb34cf51aaad0133af49f9a67fbad5a6dea0cfb50cd785ce3b90734c8dde096bb5fc6751d6a76547cde752dbd6edd4f9f
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 354d11d5806a155f3830d649a3044fb087036172a508f8f2a81c24e4083434b2
MD5 cd8a2814c21545e82f6fb7ce64313883
SHA1 5a4797b474b4d9536788424cc4c41d1a132cb53b
SHA512 466d2fea7e414b519b90e36caa4fd7c528683fad498bb8e098e83aba29e89a385577c302487e42b80b5ec8ba4a21d3a3098a1f9818c6be61174c129ca7cab8f8
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Default\DawnWebGPUCache\index
Size 256KB
SHA256 71d438217697eca1c30d31c6e8de4b596d1c3265b97df539318bae5472389a56
MD5 e1ba34e0d97fc59d73e47ccba830cb10
SHA1 7c854931e6b458eaed450a9b1cef97a52117f14d
SHA512 635d157dbd74666362b21d9e923bd47a80419b6fae26dd71f665cfe60101aefc8a19b9ffe3f01a6436b476475a6ebd22349a0684600091476bdc922f8d5f224e
SSDEEP 3:LstlNllkll/lrq+X:LsX3lEt2e
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Default\Extension Rules\LOG
Size 367B
SHA256 8872cbf0faf32811b8fb8b4bf61617edfe1b1b0ba4627832bfde16c7b9e72e40
MD5 3877f2dbf720f8b2df0a7e14bc0e2a58
SHA1 e5e443fa56fb4b1d55b32379a65c1975c7773eac
SHA512 af72a2cab62afa84b0a3b9075903d2a27b6e7dd5d85530fe09425d073d7fcb5db21b51def681fdc611fae4e3c01971fbf38a7cafe97e560e0d55d6fed75fd0bd
TLSH
T17CE0220228A988A90E85BCBFE8A05B48C2A03D0CAA84BB194F4898C9308310C7388701
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Default\Extension Scripts\000003.log
Size 38B
SHA256 1c43a1bda1e458863c46dfae7fb43bfb3e27802169f37320399b1dd799a819ac
MD5 51a2cbb807f5085530dec18e45cb8569
SHA1 7ad88cd3de5844c7fc269c4500228a630016ab5b
SHA512 b643a8fa75eda90c89ab98f79d4d022bb81f1f62f50ed4e5440f487f22d1163671ec3ae73c4742c11830214173ff2935c785018318f4a4cad413ae4eeef985df
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Default\Extension Scripts\LOG
Size 371B
SHA256 6a3ce786c2d48e1814f33883029c81fe695da08c19d6af839c8844a5065252e0
MD5 9ffa04f45742b444d263f4bef2e65f79
SHA1 2edf0c53bc49bb16016855b25bbf025e9f92e242
SHA512 b3fe5a2e7c091b264c5141a14ed71b9e9ae496aa5b290331f71f0b1e78754f0ce2540751d41679b423ef319eb8b45814456d6711c6376a16ed65f96b65bd1dfc
TLSH
T18CE02205285EC8B90E89BDBFA8B55B4CC2E439087A84BB194E409C882087208B388B01
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Default\Extension State\000003.log
Size 114B
SHA256 e2610960c3757d1757f206c7b84378efa22d86dcf161a98096a5f0e56e1a367e
MD5 891a884b9fa2bff4519f5f56d2a25d62
SHA1 b54a3c12ee78510cb269fb1d863047dd8f571dea
SHA512 cd50c3ee4dfb9c4ec051b20dd1e148a5015457ee0c1a29fff482e62291b32097b07a069db62951b32f209fd118fd77a46b8e8cc92da3eaae6110735d126a90ee
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Default\Extension State\LOG
Size 367B
SHA256 584819a18bd0f70f3b1ac75431bea704f6c9ff17e0fd2e03e13dafd5f10c5b6f
MD5 4f3f6d46d22fe3479975c70a05001962
SHA1 32c0b609069e38e9adccc28529895a72c0a0db1f
SHA512 5d9b8bb1c7879d1eb4327eed6de61d91ddd948787f02c472265996af7238177d883dcaaf16be08d141f13c520ef3ca9bc43070c2aec5a7f7486cb95813a4ff06
TLSH
T180E06801545EC9B98E84ACFF99750B4CCB913E097AC47F154E44ACC8308314C7388711
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Default\Favicons
Size 20KB
SHA256 46b5ecada4edb2585f87953f7847aefc938be2404b9d9455c772b97295b7b1cb
MD5 babd43551f1b29eb82e221460676126a
SHA1 e9bff307613a14b35830893bdb6d1ecc931b425d
SHA512 5ab681c170dbd1d374bd66edd02cbe21272819ef7389ad1e886bcba112deb91eb68fa930747986da5ca794881939570013e38edd9f8e6f718f7d202e74a82f41
SSDEEP 24:LLipxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:UBmw6fU1zBmI
TLSH
T1C292EE075E383407DBA10E7D366B18768E3FE26C5FA29C94347410618CF9482D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Default\GPUCache\index
Size 256KB
SHA256 331ee52ae432b51a100739452cfd3031029af1c31bcb8fe21aed2db90c99ea07
MD5 d3fa52c3ceae35795ba06a85f769073c
SHA1 fa7201e03e64482a910bac776a161f95e45514f0
SHA512 c4012e217f9a330348199573b6d00672bfcdf91c480bf3df50cd9d273786cd07d7a25986f3ed7f1bfcaf78426f321908ace8ec04fc96671960bfcea4f9317289
SSDEEP 3:LstlNllkll/lCP7X:LsX3lEtMr
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Default\History
Size 184KB
SHA256 7ac0739f534f89ae63c46cd41f0cffaf0335fe348933e3e3d660044351f2a746
MD5 c77e3d0b59e286bc3b50eff7cb8f464c
SHA1 b260bf6f86fb9aff5b2396bfb49dea658a6f05e5
SHA512 e9d95b19019dda281d5cdc16315ae5368b3bab7786955354de93dabe5885c958c556a09e4b57a707244e0052cbabb00029619deba1810677bf9ea06e7287e8fb
SSDEEP 96:xhBttejzH+bF+UIYysX0fxQp97fEHt/DfLjLqL/hbgI4VgNr2jWRk/E0:xhBqH+bF+UI3iWGVfWN3qL/8VgZQW3
TLSH
T1AA04EC1E5F743612CDBD513668E745B3597CF03F8B636AC62CA114B1CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe58e73e.TMP

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Default\Network\Network Persistent State~RFe58e73e.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Default\Preferences
Size 6KB
SHA256 3287b18ecbf2bc73a3491b05a56825df80661c7314fab0e7b7de0ba141afbbce
MD5 4f09f26cf7a8d0e15664f0ddeb72be56
SHA1 982ba05db56b1692ccbd5fa26cb3a26d33737152
SHA512 3531eb0d885319dd1cd3797c413cc62d6b39de5a8295e4211849bd0ac4d5d9d1679d42a224a83fa6fdc798ca394965ec17960a6d9202c062dfbc76097cb7e054
SSDEEP 96:stA05kHyZOb9k0ffsdZ8i0oE+klm/7qx+WVHMSm+uecadQjy+gUIMEB:stA0COf0f6Z8pFg/S+Wi8dr+IM8
TLSH
T1E1D1B8025F686D778CCBF21D7A357B52D2FA5022A5D50E68EBFD862C08D66CD120790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58daea.TMP

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Default\Preferences~RFe58daea.TMP
Size 5KB
SHA256 8dcde53dbdcaa6b6d755fc8c37df717493ed6137402088d473fea5325760a232
MD5 9133e53796d3d1bb634c7c3bfb1cf6b3
SHA1 8bf76eb6c97609fb9343a06d1b0522be11cd31bb
SHA512 ed152eee3dcfc6a7433181df95a054b7ed9998dcd3f4f9c7cbc67656bb1197d6c1bc17c1096cd44f865ecced628eaaa2fe805fa97669e977fa1a9124338067cb
SSDEEP 96:stA05kHyZOb9tffsdZ8i0oE+klm/7qx+WVHMSm+uecadQjy+gwIMEB:stA0CO0f6Z8pFg/S+Wi8drCIM8
TLSH
T120C1B7035F2869774CCBF21DBA35BB52D2FA102265D50E58EBFD862C08D65CC530790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Local State
Size 1KB
SHA256 6a2ea1d601d68afda15dfee67bb400bd84fcca6ebf4c1fa5ae4d47a7456a5584
MD5 40a6cd3fcc8ee448144ad55e8a91c364
SHA1 937739dffc4e112929621cf8e3616254cf84b436
SHA512 dffaf6e187d80c5889d14152b8e0f932ff67d03489e9971e7cafaee36b8924b50930d19e7f6b1cccfe06cfecd959d9267fe5a3a52a0a444b3505d6a14e0b3a5c
TLSH
T190318573E0906B336CCAA18AB5456FD72D115176C1004FE850EF5B2C02EB0CC963AE33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Local State
Size 2KB
SHA256 a97e70c4318d06d8d53fe8270c1c7b17b897f6f54486cdb2d8fc445c27b08403
MD5 959a99a842f18a3743f6190805d6dce2
SHA1 ee20bfda244fb5f84ea32252d78d0654c4b56738
SHA512 350b52883467ccbeaf3602b558ec5c1e5bff4d544a2ae505a11d1f95c2f29728230a7c84a664ae60052a257447c8abd142acc23c52bd870526ce19ceef92584c
TLSH
T16751C433B844AA7389EB9548BC892F53AE355171D9512FB495EF1B1C01DF19C2302E27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Local State
Size 3KB
SHA256 4355eaa437382ce9be29478776b0f7d18eba54188bbc460f893ac8ed7a25a67e
MD5 8069d704c30107729eb244b6b11b23c4
SHA1 1007d6d5503f35f8bfd7c9fc4d9e8c30515bb69b
SHA512 03ba353e357d4c960c9ac8a5a6b2418e8813b9cae9871e9ee5e99841bcd0bcd268b0f2d6541f3caf3f2ce58c373d7de93c25acde7a0f976dabe677ebba52390a
TLSH
T1CF719232A8A4A9274DE7D945B8892B07BAA15133D4843FE8C5EE0F1C01DB2982342D17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Local State
Size 4KB
SHA256 318567d3554920f9a2a612a55625e62f29f7be9fad09f570f4f55430f93df849
MD5 dfbb669ed5b441ec4794f594f62a4af8
SHA1 1f273e870d529a125fffbe055ded8f658e5e8f07
SHA512 934d9e1c2650bf8ceb89b51cfe42fd49ec326658a36a3a99b52b09d6740ecfed9f68e1860e6213306927d50fb732390d1de78b5880846a9a90f1ac2446fdf485
SSDEEP 96:zu0LbNkCErf1d9Jqw58Frh/cInURoDotoiawwDFBEZQ6iBuZxz9Tz9lga:z5LbNbKrYbooDUDk7EZD5zf
TLSH
T1B981B422A465AA374DFBD949B8892F03BAA19037D4953FE8C9EE0F0C01DB2DC1342D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Local State
Size 4KB
SHA256 f4db74ff54f9d2609d79bdae12038e2ee1cdcdb72e193b6df7f08fa4e89379bb
MD5 1bc151679b4f5b21669beb6b7ed11036
SHA1 7930657c06130be1e7d5545a95c7799fb104abd6
SHA512 a1be4319a598ffe7e637b35e44af6e94ae9180874be25af262d1f9149fda59b845b414441c5b3a43684bd1b2bd86a2813e4112dc27e222de8fd5fa012c8e0a01
SSDEEP 96:zu0LbNkCb1rf1d9Jqw58Frh/cInURoDotoiawwDFBEZQ6iBuZxz9Tz9lga:z5LbNbjrYbooDUDk7EZD5zf
TLSH
T1B481A4226465AA274DEBE949B9893F03BAA19037D4953FE8C9EE0F0C01DB2DC1342D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Local State
Size 4KB
SHA256 5bff3218b4064eef92a14d766aeb0f46b54541e8c41cbb704b548e7d421310a4
MD5 ec6e6da96e924f9dd3c542d08e2dc125
SHA1 3700319c346eb2476261bd521527a862012484d0
SHA512 1240e3eb27ce02e406007336c2af6243b6a828ad2c0c2fa35bc92c8fbf232c551d33086ee35be0de5db4f7c790ea3bf3ff649b1261c00cb9ffe9ee46a64fdc6b
SSDEEP 96:zu0LF3NkCb1rf1d9Jqw58Frh/cInURoDotoTawwD9BEZQ6iBuZxz9Tllga:z5LF3NbjrYbooDU4kjEZD5X
TLSH
T15391B4226460A9238CEBE945B9893F03BAA19133D4943FE8C9EE0F1C01DB2DC1342D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5839b8.TMP

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{F3FFA27C-D014-4900-BE65-1D9237D882D4}\wv2\EBWebView\Local State~RFe5839b8.TMP
Size 1KB
SHA256 8cf90614f9b1f44712785b53566bf74f4aa19b79e3b5ac2ce6687d5b80bca939
MD5 0ff7adec30fcfbf104148e6986f9836d
SHA1 ba7f41f32b4990ec188040443268b674611ccb25
SHA512 18f55a06e52c2d3549f049da71b0daa34925e797e8cf1f13cf14d7e8547eb2e253d49b9a20e7ea09c2a4766d06ac904710f3e9f32f6e25c1a0db9e492e0f85e7
TLSH
T19B216233D094AA726CCA9089F545AFC72D505276C1044FAC90EF562812EF4DC963BE73
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_cfrrcmfd.fuf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cfrrcmfd.fuf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/340-891-0x0000019D507B0000-0x0000019D507BA000-memory.dmp

Download

memory/340-890-0x0000019D50A90000-0x0000019D50AA2000-memory.dmp

Download

memory/3044-634-0x0000015A1FD10000-0x0000015A207D1000-memory.dmp

Download

memory/3432-46-0x00007FFCD53C0000-0x00007FFCD53C1000-memory.dmp

Download

memory/3432-47-0x00007FFCD6490000-0x00007FFCD6491000-memory.dmp

Download

memory/3672-25-0x00007FFCD6F90000-0x00007FFCD6F91000-memory.dmp

Download

memory/4436-518-0x000001F26A920000-0x000001F26B3E1000-memory.dmp

Download

memory/5008-127-0x00007FFCD6F90000-0x00007FFCD6F91000-memory.dmp

Download

memory/5696-1238-0x0000000140000000-0x0000000140A9D000-memory.dmp

Download

memory/5696-1228-0x0000000140000000-0x0000000140A9D000-memory.dmp

Download

memory/5972-212-0x00000245EC120000-0x00000245EC142000-memory.dmp

Download