d66e412cb82769f684d0e09378aab2d048b3949e029f3cd080ae6ac6242b5a47

Analysis

user interaction
yes
max time kernel
30s
max time network
65s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RealSetup_5bf91777d2986422ab315b3a1052600c5e8c055ab3768d7210bb56f900ba2d65.exe
Size 16.5MB
Sample260809-lsg9dscr5x
SHA256 d66e412cb82769f684d0e09378aab2d048b3949e029f3cd080ae6ac6242b5a47
MD5 cb6d01cb4f6fb371a8651d4a7348f3b6
SHA1 8c772bf169aaa32096b7768544050e87525eff03
SHA512 7e77b0aef98b99f931b6c4baff5aeaeaae57c76d4ec5ad0898c13157eb74b599ea59f151dade9b13320e5e609f602b859b5c753c05255c0c68bedc2968953c5f
SSDEEP 393216:htQDIqMgneq1R0qTwMa2ulncqk61FDiOUY+OUY:KUqlqin
TLSH
T1CF07BF69A6BC01D9E867C1BCC2965223EB72B41523B057CF5A609AF60F23AD41F7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5404	powershell.exe
912	powershell.exe
2204	powershell.exe
3660	powershell.exe
4344	powershell.exe
2204	powershell.exe
4344	powershell.exe
5404	powershell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RealSetup_5bf91777d2986422ab315b3a1052600c5e8c055ab3768d7210bb56f900ba2d65.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
62	discord.com
63	discord.com
65	discord.com
72	discord.com
84	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2660	msedge.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	RealSetup_5bf91777d2986422ab315b3a1052600c5e8c055ab3768d7210bb56f900ba2d65.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307425252978524"	RealSetup_5bf91777d2986422ab315b3a1052600c5e8c055ab3768d7210bb56f900ba2d65.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\projectreal	RealSetup_5bf91777d2986422ab315b3a1052600c5e8c055ab3768d7210bb56f900ba2d65.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\projectreal\ = "URL:Real Protocol"	RealSetup_5bf91777d2986422ab315b3a1052600c5e8c055ab3768d7210bb56f900ba2d65.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\projectreal\URL Protocol	RealSetup_5bf91777d2986422ab315b3a1052600c5e8c055ab3768d7210bb56f900ba2d65.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\projectreal\shell\open\command	RealSetup_5bf91777d2986422ab315b3a1052600c5e8c055ab3768d7210bb56f900ba2d65.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\projectreal\shell	RealSetup_5bf91777d2986422ab315b3a1052600c5e8c055ab3768d7210bb56f900ba2d65.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\projectreal\shell\open	RealSetup_5bf91777d2986422ab315b3a1052600c5e8c055ab3768d7210bb56f900ba2d65.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\projectreal\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Real\\Update.exe\" --write-deep-link \"%1\""	RealSetup_5bf91777d2986422ab315b3a1052600c5e8c055ab3768d7210bb56f900ba2d65.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
912	powershell.exe
912	powershell.exe
912	powershell.exe
2204	powershell.exe
2204	powershell.exe
2204	powershell.exe
2192	RealSetup_5bf91777d2986422ab315b3a1052600c5e8c055ab3768d7210bb56f900ba2d65.exe
2192	RealSetup_5bf91777d2986422ab315b3a1052600c5e8c055ab3768d7210bb56f900ba2d65.exe
3660	powershell.exe
3660	powershell.exe
3660	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4124	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	912	powershell.exe
Token: SeIncreaseQuotaPrivilege	912	powershell.exe
Token: SeSecurityPrivilege	912	powershell.exe
Token: SeTakeOwnershipPrivilege	912	powershell.exe
Token: SeLoadDriverPrivilege	912	powershell.exe
Token: SeSystemProfilePrivilege	912	powershell.exe
Token: SeSystemtimePrivilege	912	powershell.exe
Token: SeProfSingleProcessPrivilege	912	powershell.exe
Token: SeIncBasePriorityPrivilege	912	powershell.exe
Token: SeCreatePagefilePrivilege	912	powershell.exe
Token: SeBackupPrivilege	912	powershell.exe
Token: SeRestorePrivilege	912	powershell.exe
Token: SeShutdownPrivilege	912	powershell.exe
Token: SeDebugPrivilege	912	powershell.exe
Token: SeSystemEnvironmentPrivilege	912	powershell.exe
Token: SeRemoteShutdownPrivilege	912	powershell.exe
Token: SeUndockPrivilege	912	powershell.exe
Token: SeManageVolumePrivilege	912	powershell.exe
Token: 33	912	powershell.exe
Token: 34	912	powershell.exe
Token: 35	912	powershell.exe
Token: 36	912	powershell.exe
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeIncreaseQuotaPrivilege	2204	powershell.exe
Token: SeSecurityPrivilege	2204	powershell.exe
Token: SeTakeOwnershipPrivilege	2204	powershell.exe
Token: SeLoadDriverPrivilege	2204	powershell.exe
Token: SeSystemProfilePrivilege	2204	powershell.exe
Token: SeSystemtimePrivilege	2204	powershell.exe
Token: SeProfSingleProcessPrivilege	2204	powershell.exe
Token: SeIncBasePriorityPrivilege	2204	powershell.exe
Token: SeCreatePagefilePrivilege	2204	powershell.exe
Token: SeBackupPrivilege	2204	powershell.exe
Token: SeRestorePrivilege	2204	powershell.exe
Token: SeShutdownPrivilege	2204	powershell.exe
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeSystemEnvironmentPrivilege	2204	powershell.exe
Token: SeRemoteShutdownPrivilege	2204	powershell.exe
Token: SeUndockPrivilege	2204	powershell.exe
Token: SeManageVolumePrivilege	2204	powershell.exe
Token: 33	2204	powershell.exe
Token: 34	2204	powershell.exe
Token: 35	2204	powershell.exe
Token: 36	2204	powershell.exe
Token: SeIncreaseQuotaPrivilege	2204	powershell.exe
Token: SeSecurityPrivilege	2204	powershell.exe
Token: SeTakeOwnershipPrivilege	2204	powershell.exe
Token: SeLoadDriverPrivilege	2204	powershell.exe
Token: SeSystemProfilePrivilege	2204	powershell.exe
Token: SeSystemtimePrivilege	2204	powershell.exe
Token: SeProfSingleProcessPrivilege	2204	powershell.exe
Token: SeIncBasePriorityPrivilege	2204	powershell.exe
Token: SeCreatePagefilePrivilege	2204	powershell.exe
Token: SeBackupPrivilege	2204	powershell.exe
Token: SeRestorePrivilege	2204	powershell.exe
Token: SeShutdownPrivilege	2204	powershell.exe
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeSystemEnvironmentPrivilege	2204	powershell.exe
Token: SeRemoteShutdownPrivilege	2204	powershell.exe
Token: SeUndockPrivilege	2204	powershell.exe
Token: SeManageVolumePrivilege	2204	powershell.exe
Token: 33	2204	powershell.exe
Token: 34	2204	powershell.exe
Token: 35	2204	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
240	msedge.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 4124	2192	RealSetup_5bf91777d2986422ab315b3a1052600c5e8c055ab3768d7210bb56f900ba2d65.exe	89
PID 4124 wrote to memory of 2960	4124	msedgewebview2.exe	90
PID 4124 wrote to memory of 3168	4124	msedgewebview2.exe	91
PID 4124 wrote to memory of 3168	4124	msedgewebview2.exe	91
PID 4124 wrote to memory of 3168	4124	msedgewebview2.exe	91
PID 4124 wrote to memory of 3168	4124	msedgewebview2.exe	91
PID 4124 wrote to memory of 1908	4124	msedgewebview2.exe	92
PID 4124 wrote to memory of 1216	4124	msedgewebview2.exe	93
PID 4124 wrote to memory of 1216	4124	msedgewebview2.exe	93
PID 4124 wrote to memory of 1216	4124	msedgewebview2.exe	93
PID 4124 wrote to memory of 1164	4124	msedgewebview2.exe	94
PID 4124 wrote to memory of 1164	4124	msedgewebview2.exe	94
PID 4124 wrote to memory of 1164	4124	msedgewebview2.exe	94
PID 4124 wrote to memory of 1164	4124	msedgewebview2.exe	94
PID 4124 wrote to memory of 1164	4124	msedgewebview2.exe	94
PID 2192 wrote to memory of 912	2192	RealSetup_5bf91777d2986422ab315b3a1052600c5e8c055ab3768d7210bb56f900ba2d65.exe	95
PID 2192 wrote to memory of 2204	2192	RealSetup_5bf91777d2986422ab315b3a1052600c5e8c055ab3768d7210bb56f900ba2d65.exe	98
PID 2192 wrote to memory of 3660	2192	RealSetup_5bf91777d2986422ab315b3a1052600c5e8c055ab3768d7210bb56f900ba2d65.exe	100
PID 2192 wrote to memory of 240	2192	RealSetup_5bf91777d2986422ab315b3a1052600c5e8c055ab3768d7210bb56f900ba2d65.exe	103
PID 240 wrote to memory of 1952	240	msedge.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\RealSetup_5bf91777d2986422ab315b3a1052600c5e8c055ab3768d7210bb56f900ba2d65.exe
"C:\Users\Admin\AppData\Local\Temp\RealSetup_5bf91777d2986422ab315b3a1052600c5e8c055ab3768d7210bb56f900ba2d65.exe"
1⤵
- Checks whether UAC is enabled
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RealSetup_5bf91777d2986422ab315b3a1052600c5e8c055ab3768d7210bb56f900ba2d65.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2192.4236.12862885825168679413 /pfhostedapp:b88b1c7f46da9ec14508fd50ba4a0ff66820bee4
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView /prefetch:4 /pfhostedapp:b88b1c7f46da9ec14508fd50ba4a0ff66820bee4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff96a7d5fd8,0x7ff96a7d5fe4,0x7ff96a7d5ff0
    3⤵
    PID:2960
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView" --webview-exe-name=RealSetup_5bf91777d2986422ab315b3a1052600c5e8c055ab3768d7210bb56f900ba2d65.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1780 --field-trial-handle=1788,i,4081281440625417350,17621995370954555519,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:b88b1c7f46da9ec14508fd50ba4a0ff66820bee4
    3⤵
    PID:3168
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView" --webview-exe-name=RealSetup_5bf91777d2986422ab315b3a1052600c5e8c055ab3768d7210bb56f900ba2d65.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2276 --field-trial-handle=1788,i,4081281440625417350,17621995370954555519,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:b88b1c7f46da9ec14508fd50ba4a0ff66820bee4
    3⤵
    PID:1908
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView" --webview-exe-name=RealSetup_5bf91777d2986422ab315b3a1052600c5e8c055ab3768d7210bb56f900ba2d65.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2324 --field-trial-handle=1788,i,4081281440625417350,17621995370954555519,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:b88b1c7f46da9ec14508fd50ba4a0ff66820bee4
    3⤵
    PID:1216
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView" --webview-exe-name=RealSetup_5bf91777d2986422ab315b3a1052600c5e8c055ab3768d7210bb56f900ba2d65.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3552 --field-trial-handle=1788,i,4081281440625417350,17621995370954555519,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:b88b1c7f46da9ec14508fd50ba4a0ff66820bee4 /prefetch:1
    3⤵
    PID:1164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "try{ $ex=@((Get-MpPreference).ExclusionPath); $want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll'); $stale='C:\Users\Admin\AppData\Local\Temp'; $miss=$want | Where-Object { $ex -notcontains $_ }; if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1} }catch{exit 1}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll');$stale='C:\Users\Admin\AppData\Local\Temp';foreach($p in $want){ $ex=@((Get-MpPreference).ExclusionPath); if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }};if($stale -and @((Get-MpPreference).ExclusionPath) -contains $stale){ Remove-MpPreference -ExclusionPath $stale};$ex=@((Get-MpPreference).ExclusionPath);$miss=$want | Where-Object { $ex -notcontains $_ };if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAIABFAHgAcABhAG4AZAAtAEEAcgBjAGgAaQB2AGUAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAByAGUAYQBsAC0AbAB1AGEAdQAtAGwAcwBwAC4AegBpAHAAJwAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcgBlAGEAbAAtAGwAdQBhAHUALQBsAHMAcAAtAGUAeAB0AHIAYQBjAHQAJwAgAC0ARgBvAHIAYwBlAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/projectreal
  2⤵
  - Enumerates system info in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x358,0x7ff967c6c188,0x7ff967c6c194,0x7ff967c6c1a0
    3⤵
    PID:1952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,11209858088709516485,14222168602227706125,262144 --field-trial-handle=2484,i,6263400445889081607,14900802018441867399,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:2
    3⤵
    PID:1188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,16719798272891732826,14758376871049758230,524288 --field-trial-handle=2484,i,6263400445889081607,14900802018441867399,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2196,i,3045667878333338406,3962203379033800029,524288 --field-trial-handle=2484,i,6263400445889081607,14900802018441867399,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:13
    3⤵
    PID:5488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,17889081750805281310,4749843788913046793,2097152 --field-trial-handle=2484,i,6263400445889081607,14900802018441867399,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
    3⤵
    PID:4256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,11168390395624778859,5403579201634022449,2097152 --field-trial-handle=2484,i,6263400445889081607,14900802018441867399,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
    3⤵
    PID:1504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,1032552113152071892,10485956624318996723,2097152 --field-trial-handle=2484,i,6263400445889081607,14900802018441867399,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
    3⤵
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,1556040399303117655,3676655128112039379,2097152 --field-trial-handle=2484,i,6263400445889081607,14900802018441867399,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:9
    3⤵
    PID:3392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3900,i,111471668602335632,5648009789520942954,524288 --field-trial-handle=2484,i,6263400445889081607,14900802018441867399,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
    3⤵
    PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5560,i,11540923085673473514,5220907275758672657,2097152 --field-trial-handle=2484,i,6263400445889081607,14900802018441867399,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
    3⤵
    PID:904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,6301031674088110752,11127241958768436409,524288 --field-trial-handle=2484,i,6263400445889081607,14900802018441867399,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:14
    3⤵
    PID:4116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,2991435436603138627,2858645994331010224,524288 --field-trial-handle=2484,i,6263400445889081607,14900802018441867399,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
    3⤵
    PID:4224
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,7699259192254489229,11573879929975494767,524288 --field-trial-handle=2484,i,6263400445889081607,14900802018441867399,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
    3⤵
    PID:5896
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,7699259192254489229,11573879929975494767,524288 --field-trial-handle=2484,i,6263400445889081607,14900802018441867399,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
    3⤵
    PID:2496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,14859495651212138254,11745945266403568556,524288 --field-trial-handle=2484,i,6263400445889081607,14900802018441867399,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
    3⤵
    PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,11421534618742845132,9826469510685525321,524288 --field-trial-handle=2484,i,6263400445889081607,14900802018441867399,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
    3⤵
    PID:1704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,9618733360149923378,8590568922680879305,524288 --field-trial-handle=2484,i,6263400445889081607,14900802018441867399,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:14
    3⤵
    PID:7048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,4088177776553754426,5897969492662625869,524288 --field-trial-handle=2484,i,6263400445889081607,14900802018441867399,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:14
    3⤵
    PID:7056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,12428428719286821802,7092778585103533774,524288 --field-trial-handle=2484,i,6263400445889081607,14900802018441867399,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:12
    3⤵
    PID:6188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,15088355387299936967,12765004365504340669,524288 --field-trial-handle=2484,i,6263400445889081607,14900802018441867399,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
    3⤵
    PID:5012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3648,i,7552256673906045109,14244578490590622143,2097152 --field-trial-handle=2484,i,6263400445889081607,14900802018441867399,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
    3⤵
    PID:6572
- C:\Users\Admin\AppData\Local\Real\Update.exe
  "C:\Users\Admin\AppData\Local\Real\Update.exe" --processStart Real.exe
  2⤵
  PID:2996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll');$stale='C:\Users\Admin\AppData\Local\Temp';foreach($p in $want){ $ex=@((Get-MpPreference).ExclusionPath); if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }};if($stale -and @((Get-MpPreference).ExclusionPath) -contains $stale){ Remove-MpPreference -ExclusionPath $stale};$ex=@((Get-MpPreference).ExclusionPath);$miss=$want | Where-Object { $ex -notcontains $_ };if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4344
- - C:\Users\Admin\AppData\Local\Real\real-1.9.0\Real.exe
    "C:\Users\Admin\AppData\Local\Real\real-1.9.0\Real.exe" --real-launched-by-updater
    3⤵
    PID:4088
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4088.5496.8674383858936160750 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
      4⤵
      PID:4628
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView /prefetch:4 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x168,0x19c,0x7ff96a7d5fd8,0x7ff96a7d5fe4,0x7ff96a7d5ff0
        5⤵
        
        PID:6048
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1752 --field-trial-handle=1756,i,680061982837133181,679194615144616098,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
        5⤵
        
        PID:2704
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2180 --field-trial-handle=1756,i,680061982837133181,679194615144616098,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
        5⤵
        
        PID:1080
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2308 --field-trial-handle=1756,i,680061982837133181,679194615144616098,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
        5⤵
        
        PID:5032
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3276 --field-trial-handle=1756,i,680061982837133181,679194615144616098,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105 /prefetch:1
        5⤵
        
        PID:4416
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4472 --field-trial-handle=1756,i,680061982837133181,679194615144616098,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
        5⤵
        
        PID:6440
  - - C:\Users\Admin\AppData\Local\Real\real-1.9.0\bin\Real.exe
      "C:\Users\Admin\AppData\Local\Real\real-1.9.0\bin\Real.exe" --rbxversion
      4⤵
      PID:6536
  - - C:\Users\Admin\AppData\Local\Real\real-1.9.0\bin\luau-lsp.exe
      "C:\Users\Admin\AppData\Local\Real\real-1.9.0\bin\luau-lsp.exe" lsp --stdio --definitions:@roblox=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\roblox.PluginSecurity.d.luau --definitions:@real=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\real_executor_apis.d.luau --docs=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\roblox-api-docs.json --base-luaurc=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\base.luaurc
      4⤵
      PID:6584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://projectreal.gg/register?app_auth=1&state=9XHdEw-6WGPvA9pL0tpwOiWs7TBTJS6MzWTqmSZZaWE&loopback_port=58600&hwid=HWIDv5_7bb7c7d98b722bc62963b78eb30b6d37e9c281a94196b1937fed96b5b96bae5f
      4⤵
      PID:6604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5484

C:\Users\Admin\AppData\Local\Real\Update.exe
C:\Users\Admin\AppData\Local\Real\Update.exe
1⤵
PID:5172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll');$stale='C:\Users\Admin\AppData\Local\Temp';foreach($p in $want){ $ex=@((Get-MpPreference).ExclusionPath); if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }};if($stale -and @((Get-MpPreference).ExclusionPath) -contains $stale){ Remove-MpPreference -ExclusionPath $stale};$ex=@((Get-MpPreference).ExclusionPath);$miss=$want | Where-Object { $ex -notcontains $_ };if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84657e9d-6fd3-489e-8204-460941259800.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\84657e9d-6fd3-489e-8204-460941259800.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c6baa47c2b2670650e87d8a80c34c8393b0d8e526d08a2a13859e318348516aa
MD5 005a3a3f031fbaf040eaff311592a71d
SHA1 53b4d5dc4b95518258f74fbfe20e7966b17f34d3
SHA512 5ee7c9e3496b9641df6574b4330f55b8453ec4628638230e15c8bedb87cbeaa303e4352d9c8ad7e3e585f2821e05a968f89b1c34b67a872209bdce48af883574
SSDEEP 192:sxRbRrYl/fPshNssmZLzoA8plJ/g6+WNpg2/YxxJ3GOIgDUXJ:sxRb2l/fPshysX/51/2dY
TLSH
T11342EB16AD28A9378CCBD21DFB15BF53D2F91032A0D51E58AAFC961C05EB6DD231340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d17dd1c854ac2e4dd35188cecfc9db2cd5992679fa0b13dd2811826e60bc57f6
MD5 1f9e09d2935315087d49e27e56697943
SHA1 17e373a499f5101cd1fdb6713181d0c9555bc697
SHA512 272b9a1df5ca55652401c0bc0802ec019d661aa3c43176185b86853c7e25fc8185f01ff2940a8dc95f0bb0153cac7eb46568b3ba427efa9ef631d834185d268c
SSDEEP 192:sxRcRrYl/fPsINssmZLzoA8plJ/g6+WNpg2/YxxJ3GOIgVXJ:sxRc2l/fPsIysX/51/2dT
TLSH
T13E32DB166D28A9378CCBD21DFB16BF53D2F91032A0D51E58AAFC961C05EB6DD130340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b37ebaa114793c5a819336bf6dd43b4b178294c0ee5943c81b25ccbb4ebee7ec
MD5 f9d203f31f983e718c278304ad4ebd3a
SHA1 8a8e7aeb9b68165197bab8d3e923f987ead4848b
SHA512 86046713868a82ddf4ccd1d3860c60c24d1f7f70c9d30c87ef501290302ec59a5541afb8a0e87330be1b409287ce6471beae03f593086370232c69b7508668d6
SSDEEP 768:0YEy+s7pLuL7+jWgbrfp18F1+UoAYDCx9Tuqh0VfUC9xbog/OV6rVaMrolTAA:0YEy+QE7+jWgbrfp1u1jaFpaXlMA
TLSH
T1B6C2C97B740CCB7E4F804ADDA8197BDB7DA802CB96D8CD9047FA941C03C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 b362bc5f3a2b21ac7d07b05dd05cf72d026e06dd106936015ac11417a42f8d83
MD5 51a2fe2967a6170654f11b13427ce8d8
SHA1 d65a7e57cb6c030ac6a56ceb1be7c4c9683af4f7
SHA512 cb8f1d12995177289cf3fa1fe2d20b3e0a0d05779abadb474cb2f18a767a5b7e3030af57b47b5edfcf5959d51057f48cafaab80f98b8b01d3491e16cc4e4a0f1
TLSH
T1ACD0A79BE8622590D7FF46935F32146B47643D889486908C9507343C28B0742A623EF2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe597ab4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe597ab4.TMP
Size 138B
SHA256 d72bd95dbd195f9dd9433be403dc34d562f7fc1400779493e7a0406c97bab645
MD5 40439bf2315d1c07fc5db9d38711b2b9
SHA1 a4744a2e1a5e5e7deb7f4cd6f13655bdd7b85b7a
SHA512 e211b64f6e15583bc87a9dc574b35067b9442035a1bdddc29fd9efe7c5c6d11ebf01fa581adea8b7347c34b5bb7a7b40cd28528751a1662daa4e0fd596b018c2
TLSH
T102C02BB3F1400211CB2C42420732514E43412CCC588280CC7013307C24B0F137347EF1
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6f04ed56a0e6634485486b5e10802cc0ae776a589e8c8aa9040f50527881f787
MD5 492534e3f3639aacbdcfd4e48f40787c
SHA1 8baf2efa262abee1f5128fa46f5d93a87b5af90d
SHA512 6255ba6c0fd7a58c09506fa77d131e525caf6afe7f06285f745ea14ecb38cf5143b9d79d3503a888063eee997d98ac71a51f4011ff0511af85c1c7d007d150ff
SSDEEP 768:HA3NG9kKL2blGjF669yrqUjWiIwwxMtC2ewBKZO37:HA3N3kjF66INWZTM42evZm7
TLSH
T1A6F2CFB0AC685DB3C9FAEB45B21233C7AEB441A3E5D90F5CD6DDA30D04871C8274B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b4b9be2f96b56688ae6fa8fec1e93c7ba4048411b46d613ad791ed83eb1622c2
MD5 487182a672fc8cf0729c64ddb09976ce
SHA1 3cbb8579cf14112bffb4a241d669c062e548d06d
SHA512 120bae440c91f4e8b23379c1f7c77488863b225905fbaccc1f050d9ba0d19883b4e730ae1ba817266f9829d8ffc1a623d2875778bda253fa1a1ec9a7bd8e84ed
SSDEEP 768:arv+4UNbdl3dPkKL2bCjF669yrqUjWiIwwxMRToUiler:absbX3K2jF66INWZTMNoUsQ
TLSH
T11B03CE34AC585AB7CDF2C68672433783BFB4519396C50B98CADD270D869B0DD2347A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2bd439fd4e8fd10f4deb8d132a981d6845dbf44ea0a10c3557783e808737c2fe
MD5 76df3274119a0ae81baf085e99b4b29e
SHA1 6fd42889e29535cc934ef0934209a77f97585406
SHA512 95a33214a3e5a96116ecf0c95d89693d69d785a9c923bb5862e0fcbc45363d2b828f693f1bc065e77986d73d40e1260be5da6a05675e49bf3567fb884f90f2c1
SSDEEP 768:Rrv+4UNbdv3NG9kKL2blGjF669yrqUjWiIwwxMtC+:Rbsbd3N3kjF66INWZTM4+
TLSH
T13703BF70BC685AB3C9F6D785B21333C7BFB4009385C60B98DAD9A30D458B1D9274B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

56a2e650-5ee4-4af9-bdbe-a88fb97b91e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\56a2e650-5ee4-4af9-bdbe-a88fb97b91e0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe595ccc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe595ccc.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dc2947e3bcf8d52e027b9e9fdd90ae15687bc3bb0375d8c2633000f0d8b827f0
MD5 2689d5664d504292d029dd2484005194
SHA1 5c4a51a506af1789c31564e2cf3c67daa7c3b3c1
SHA512 231e6605ad55ca037a28d5bab72da25bbc469d4d2b4069bc947317318a69b17cfa6c2ad0428bf3b30eedcc6d72c6760c5f7dfb7aa921902bd02dae79963bea75
TLSH
T10D216837B3DD8614C89A413A10CDAD1036B6CBDB40DECE9B6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

.real-write-probe-5172-240731187.tmp

Path C:\Users\Admin\AppData\Local\Real\.real-write-probe-5172-240731187.tmp
Size 4B
SHA256 aa33996d60e89311b4d1a920dae03c6d7fa3ae1956c52662e273aad4683e577f
MD5 4bca24304861acde5770fdbe3cc2503b
SHA1 c9c64e071d2853bc7906c017a231ad1cc46ab630
SHA512 310070ab4092002aa33f550eb98680fa6662e7305fce227843430aba334fdfad1fe0dd4a6484264b59f9b02a780433a552ce3d5c3da643a77427463c06e47800
MD5 SHA1 SHA512

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\Real\Update.exe
Size 8.2MB
SHA256 d4a07f712ec40e4ab8bbb1245bee820d1294a4557af279c94402b33d0e451f77
MD5 516e2613ac7c08b18da590128cded6f5
SHA1 eb24a3d41ed2ef6d73d7077ed7f9e7022bcd51b3
SHA512 a17c7942162741a2bf9c68cce5179ea59abef0e41611a2cd442e9de9bfec0d96abadfea8d920348cb546a414f6fe1cdfc634e9c3affb861479ff683bcad84fb5
SSDEEP 98304:JXj9S0C2/bIa2ulkYfEqk6DdbIYis+kU0mwbEXev8wcFOvkSxMy5/Dn:N8w/Ua2ulkYcqk6DdbIYDrBwOUgBRD
TLSH
T15D86CF69A6BC01D9E867C2BDC2965227EB72B415237057CF1A609AF60F23AD41F7F700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4592d36999f1ca76c1592a75289e4eb1d058a24190ca6b2e54749ea2c04e5b8d
MD5 1228444323ae6e463ecff7174a80e5cb
SHA1 e575390d00489402b02222f71649d9b6fba74bc3
SHA512 5431aa684ded5b3d9d3b9553d2ef451711991ac8a497ec6ed3e56f9566768ff05b28cb0af9423f1f51c4827a354739b11f906ad6c03f56bc86929991e692261a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 00bb26ce4da6a67c38e3b0e2cc217877a6f0668cd6e64ee6c18bb7db06f62c97
MD5 bef8a57a8547bac018a3f780abd8aad8
SHA1 09dcc71d50d594bd458bf7368f30be75a7180a42
SHA512 e629a71331e52048b8c485c4227b972a7efff2dd698a65c5225c35c89b86b4dc61e163bba9e3a2c6ac7a4a56aaa20b293269a8d2d6ac3235f1043078e182104b
TLSH
T107D0123336020134C4102037003265481800C50B404581019429861D6A040A409038D1
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 15KB
SHA256 27db75549607d1b4b7e141c523d714acfb21b36578d81aabc984397c8f80bb89
MD5 838b5e191567c7d52cde153d5b839aa6
SHA1 db61b862380c0bc95b01cc6417d7498cf98c0e8c
SHA512 aee5c77a68ad752ea11bcc8f9464d855acd662dfecdeb67f1cd84f27d37ed2cb7fd3894ad886fc06bc7147e0e926f0627a6a53d65238d93c33c23c8462d1d448
SSDEEP 384:a+aQikB+z/xvxjg/qhE12NBSzsPYRQAVdpJ9z5:l/UxvxjgC+giQUJF5
TLSH
T189729E2799797E3396F3EA0579491B4BCAB8D4B290C17EB84ABC6F0D06D73D81302D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 2KB
SHA256 822747f6e1dfe6e22dfc6bfc31d2f8e3fa1dcf230255d2bb80938d2fbb5eb9fd
MD5 a343a044f2988b6afbd52a674c4afaec
SHA1 70b2d5ded1bc9fb1310e35c3a98debaeb7a6e39a
SHA512 324fcff96ac5630d307a02c6d20baf236c8315c5d5b9617cb6dd96348db304d920839b4ca0767bfc0d5bec329b5d20672355b1c043bd864217a86cb3b02d4683
TLSH
T17451A433BD10A7338BA28604794B2F278E79A0A299522F10D7EC1F1C01DB79D1B02C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 3KB
SHA256 8a53c94c904d3b461e89218fe2d47eb67eb087a2d0679fb45e797137dac6f1c9
MD5 acd3fe7f82c64a738e10f7535ed31352
SHA1 f01dcc9e357f6369e976407c9cc6748e8ae8afa1
SHA512 3c4f4f7870d8996a8859b8feca93c4b983e1aac2042ed498bd8c6530e387ba7a25fa47530229728ffb43f121688b6f2bb7fe8e240b0b5e9824842addb1aa8f4a
TLSH
T104618537A964A6378EF29A05B9872B1AABA56033D4853F98D6EC1F1C01DB38C1752C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe596632.TMP

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State~RFe596632.TMP
Size 1KB
SHA256 5dc25b9e6098b1f4468cf27523d68dca76274b641e29247c23678505cec6ee7a
MD5 a146cf2e23d7c08e0c33069c2b1c736f
SHA1 ae18c51432271869f6761e0bfb9a33bcb1d9f800
SHA512 57175aaaf33b815f3435bbcdb9c7c0d90c909a0b6940cddc24fff5556c29ffe0eedc82d71c50853ab9d90137054cdd9b3b456e8b17df9f48a4a12b6bfe985a4f
TLSH
T1162162B3E9646733AE95564632176B1B2E70606781015E04A2DD8A2806EB38D9F2BD33
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Real\data\config\settings.json
Size 207B
SHA256 e4f38f124eb821848eb57d6988c5ef865768188e54d1e8f0ae34c59e9f99dd21
MD5 2b4a40c8495d5ddf7adc222e092fa67c
SHA1 fe7029809ff12457b0e50b92e87b33188fd18848
SHA512 18ba17b46e89fbaad852262144a4399fc6ce616853e80d33e9ea7dae69c2d0f8d2d3853af908c0a78c6e671b30fffcf3983ae02ccfaa5dfd0055db3ba456b9d1
TLSH
T192D02250DCF40E7313DA902A082B0010F0366C67009E3D3C38EA031C9F4F630417D384
MD5 SHA1 SHA512 TLSH

Submit Download

current-version.txt

Path C:\Users\Admin\AppData\Local\Real\data\meta\current-version.txt
Size 5B
SHA256 7717cbf90c63a3b096008763a02066239916fa9916f98254d1aa3b2470830fcd
MD5 d16b8f0e3a892df62c1444dfc991ee4f
SHA1 57f75e869bf26cdb7eaddcd7bb1de6cfbb0594c3
SHA512 6ad82be153f790f779a5857af637db6bb94b2f3a54ad294dea9be74e8385266646317477320a0ea980c3313f94b1c521d42458b23b61f330b5d9455d93118406
MD5 SHA1 SHA512

Submit Download

Real.exe

Path C:\Users\Admin\AppData\Local\Real\real-1.9.0\Real.exe
Size 14.5MB
SHA256 7a4bdeadb0b251ac3219c84737618fdbafa682467e8d9635674fdec3cb8a6c19
MD5 d0abdd8a9a0459802bb49eb659ec26bd
SHA1 61ffb41d0d90bcb15fddc26f8414c2f23f6e8fb4
SHA512 1f865b77185ce2a76bfe6fa2059f64d693a0078b965739424b5749648a6cc2da5d48c2a84ec4aa7ca7479c96fd8303c8ac8ba28dd1b5b2df94b84d15acbb8721
SSDEEP 196608:XqqeVkBP4D6xMX9X7jBTwdnAxF4JJ2JTDEwKBFnzT:EV+4TXVZ+nAfCUCn
TLSH
T11AE69D07F35181E9C0ADC0B9835AA637EA32B8894735B2DF5BE40B112E16FD06B3D759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.dll

Path C:\Users\Admin\AppData\Local\Real\real-1.9.0\bin\Real.dll
Size 3.5MB
SHA256 868f61c55ab11b5da9b90693228a5275f477fc9a1e62470fcc7d6ad0b0260db8
MD5 9d24ff354d97baf48c24b072673fe62b
SHA1 81fef6b51bf95aa867b08b6fa19531e4f9909df8
SHA512 8165a0718c7d1d0706a1ce662c56a01219deadbd7cd928de0a9f9a51d213e128618d00f68326b3008e96e4fc12fa6190edc383d88c2b62811bebf2ba4df72f05
SSDEEP 49152:O3I1UbcWkn0J2Q91AmItrOdzuApdCdhKE2/5YRK+CUSkGMaKJvJTXKg22Qr8/frR:XKbynk2ubgApdCdEER9SK5TXJgkQI
TLSH
T18006CE2E05DDD39AFA6B937BA60933744F6343913C2D10B8327A3A8D17769E51BB2311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.exe

Path C:\Users\Admin\AppData\Local\Real\real-1.9.0\bin\Real.exe
Size 4.0MB
SHA256 9d316dc7a9d4a744ab5c0c24d0c494f43ebd77f08f585cf98299e8fac07ce515
MD5 ed30d14de85c9795be18b43e15f236e1
SHA1 c5069d4bcdd6fc548a09582a2eb3bab693f5e1a7
SHA512 c100159cf0633cd0e541f30db88b556c6a8485cfa00a769b2e3ee11e50f618af51fd266956e8fd7e74972dbffdab75a7761df16ed3b46bb831b52e1eb807b9a1
SSDEEP 98304:HIc8W7JtDL7kvynCMFPcT0MyAKSEJNsCJLnOOHE4vtIDnS:HIrWJtjkvyrWT0dAKSsmKqu9KS
TLSH
T13A1623167A9988BECE87C4B5E206DDB7C607788B1F71B9DF034016363D636E06B39612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spoofer.exe

Path C:\Users\Admin\AppData\Local\Real\real-1.9.0\bin\Spoofer.exe
Size 2.6MB
SHA256 f4927849fea9d5abd064ed5ec61c45785490a93d75258de466db74e1b70da51a
MD5 1f79f23e16f08c13d3d50cff49b287ac
SHA1 2893622bd2183579b631a14ff4a5015666bfd820
SHA512 9d1f41cef2d5d707b96ab5b35dde8b85164f6e8794b752f576fe192934a4a62b1512ad512d917b98969afd25adf29537cb8c7bdd46c261d2811972b296f76a93
SSDEEP 49152:iSBsRHoPtqamwxg4muCBfxz2MWPUnGJG//2/XmMj17GPwhm9SeD5bc4TH:Iok6dyBh2MbnGM//n+9hm8epL
TLSH
T117C533FA16C2EB38DC8E137B233F07169B4684FC5C5DA16B29E7876D8706539C84588E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

real-mcp.exe

Path C:\Users\Admin\AppData\Local\Real\real-1.9.0\bin\real-mcp.exe
Size 1.6MB
SHA256 1dd7738163b5266d78f30b04281b1d48927acfdd6879e7576f0862a1b6497e95
MD5 52f687164c175d24e9f4f22e6f17181c
SHA1 99b67fe1a7417616656cd9a34b31b1a0c5657bc1
SHA512 ec740a365519531208a5f536277043d71bd4995cc5c06cc65a4984f47bafcf67626e8218e2ba1823c7c88eb1184bdbddf369f48852af9434e9f45219b6ffc064
SSDEEP 24576:RXvDv4konyXJzOaNDOXDPiFBzmQJDXqZXxdOmOTFM3VIH06iyGdXQ:BDv4konMzBOGFBz3DXqZzuhYIU6ilJQ
TLSH
T18C857D03E69580ECC4ADC578C3579A36AA73B88D0A34B2EF67D04A513E2BF905F1D719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 399B
SHA256 da4b567fcb80dae1901a3c9fc675ba788cb51b362ce41318fb79e1849e4e274b
MD5 c3e790ee11d03378707b0fa309f002aa
SHA1 d68233cdd3fdb091f8897fbfaa06ff511d6c5280
SHA512 2f386a0bc0307dad5f12e01f05134f81bfe1f565a0a116cdc614be8e9d4b2d80a3d73caccd35e29adfb210c3eb19a3ca03739f95238c8f41879f9bf6898a11b3
TLSH
T181E0926A48FCB0B9FC02CE87903911C9C614B40909E2E460E741144C6FF0E677F5BF49
MD5 SHA1 SHA512 TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 1KB
SHA256 8578506731b1fe956125d39b98750a8583e16336fa0e1df1a728d5ef67389f36
MD5 4444588f2904fc8224ead0b41037cce9
SHA1 3cffa9af366e3020dd93ec336b6590d2c66ac3fc
SHA512 49ab47a71f66ec1c242fde40c0b2781f33f8c4a3f38a85bd0868bc0d90b31e4afb41ce0ac6608b401b5965633fee3b776a90bcc044fb780cf83325cb32f6fc7f
TLSH
T13D31C73B08FCF4BABD468E87953865CCCB48B40A4486FC94B391240417F0E2A6F2BF59
MD5 SHA1 SHA512 TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 2KB
SHA256 302417154f62f9d13a841b4b29f754d4df36c59de196305731e257ec1bfe666c
MD5 b541e382e2a73f01b58f4399923152f1
SHA1 20201441b9fffbc02844025e1d80fc40c01946ce
SHA512 26bc267c0df5c83d050ae573edde9aae062bf90789fe2e7e8429ca6d3b6083e39a4cc42c40b4b9b7f6cd90e9587f39e7f62cd01b862444004043994d24506b7a
TLSH
T1F451692B08FCB0BABD16CD8BD13856CCC608B00A4586A894F75168042BF0E267F2BE49
MD5 SHA1 SHA512 TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 4KB
SHA256 0c780d6dac52034bdff6a2f63fd32ec83ecc3fc592906e1113e5595bcf990e9c
MD5 dae4a1a936d2ef87888d504924cc4c20
SHA1 1a4fef3a3d3e8e9b09184be00e897ef3c5f1efb5
SHA512 411c3755cd64eddf7fc9eb00bd0dd8a674a4770fa6ef5c6b22285acf96c7c349bbbce793292b86e0a7eab218f9435d4cd3f32a9df713193069ede79aeb430a21
SSDEEP 96:o7oZrvYjOAZYDh7mJSkxremXr8ZYrxuJYk4A:n5RNmxK8oU0
TLSH
T10B914B2F04FCF4BA7D1ADD8F913CA58CCA48F00A594B6954F6C268442BF1E1A6E1BF45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4e11e0a71e655fa48bf25883e46485be60a90e44c55db5d11d6184995138744d
MD5 85b3522e28aa089c67a83e5910ce33ff
SHA1 7d98a857ce3978aa2a89844f3ab626dd3d2e00fb
SHA512 554984754696b18fe57b38d4c8e28898f12bd6e2c76a5115e3738927088fa76c60fc01b5a2a13f10b16fc106b2d6ea7eee23586859b8998f363b8ba42a2721d4
TLSH
T1F9D0121E32020239C8543033010672481500D11B8005810D6439855D5F188A24906443
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 56342362b595db65f400d1d03d6d501bc8283e941536eb9d43e536aab9745cc4
MD5 407c6227fabb851fde51e48def61782e
SHA1 451b042b80ec2d965f390c10e5127c6ff14b21b7
SHA512 ba674281e89b2c7922eb0c0b7ce1451ebf087bf5e4bb8493ae9fda96f00b7ac1b8c318b491afff6422ebee9196bd92c5030bcb5d8dc847e7ae0b757770c28080
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

08295694-2bab-4ef4-9e05-27794a6107e6.tmp

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Default\08295694-2bab-4ef4-9e05-27794a6107e6.tmp
Size 5KB
SHA256 9a27d07947efae2fe8e60fdfc15a085a7c6f1580cd066e567168e46282e895fc
MD5 a189002e4c6d9e4ed6a2047fe7d59d01
SHA1 3e04dc3c49b2c687a523f8379b43c366f69d4c72
SHA512 de7ded8408ab9008cd7db5ef63ab9f09fa5243a80783df06cf80cfd3e97a40f2f6b612ca27e41e2cb7512d589bf0872820397f0dd858aebb68d1f6d60bd41265
SSDEEP 96:rz/dKlCVB4Fb9GkPdo616ZZs7/x+6MhmuecmjevK+gj+I8XM1C7K:rrwpGeojsV+FijJ0g6K
TLSH
T1D7C185026E28797F4C86E508BA3A7B17D2F9602174D61E5CE7F84A2C08DB5CC631780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 30ed1af2bd82d207929a3bce7aae48a7e304165d58a9526ec38907b0d3e44621
MD5 454b35003ca4834f09378bbf1a6a2bde
SHA1 b23f75deffec525f9e166ad8927c3d816dcb40fa
SHA512 e19542b5f849796059e0d489e607e075dc4a38e5ea74e1dbe516b91233f7015e5ce9c3af16f0eb0e01db18681aa87b02898aa1802734091e212b7a77e712d3e7
SSDEEP 3:LstlNllkll/lt9l:LsX3lEtt9l
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 44a51378df0e743059b6c1e7a5d10949faac9b6101bf1a331259c8993b82125f
MD5 e58be4e0efdfd910c1cb0e0fe0d94797
SHA1 bb4fa476e06285202d3ff8e97a3a9a98c5e18699
SHA512 a67a5ef33938e812f432c2800371c2dafe00c645bef61cb470dd1b4c36d97b1afc42e5dbc15e6a98a72a2b8f8973e554e0b7d5e30087f6654de1d075aaf14ede
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Default\DawnCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Default\DawnCache\index
Size 256KB
SHA256 d23c4945e5b1b74c9679611e912f798273b31fcf89b67b11864e9fe818564655
MD5 28497dac5713648df23c373c78057775
SHA1 c83180dca0c940dab61caf64f6f1b6bff8a7da2d
SHA512 88312a01d8cb2787ee3ba1e0e79317aefcb9e8811e0f5a3b8521ee427899d64517a2926b78f6065ee3a1b703e720961a8c42809184fff744cf93ed0d14d72057
SSDEEP 3:LstlNllkll/lItl:LsX3lEtItl
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Default\Extension Rules\LOG
Size 367B
SHA256 5f250f740c895cfbe5bde220dcb6e94ec9edcd5391c9e6efb404842b93c65f90
MD5 768ef19a0eaa35439da15ad8274a7373
SHA1 106162700e3a1b1c5ca42607345b3b7b176c8467
SHA512 047a26372b3a4538c3de86afa2695a6779db557b68763e29e8f9749eae903d879fb99984a97313c5c9cfb182b43565ca24174258f030eb03128c8c389c41d73d
TLSH
T14CE068A76849952149D9BCA7C0F1970EC215780DB748B706CF4DC8813107B08F6C4BA3
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Default\Extension Scripts\000003.log
Size 38B
SHA256 1c43a1bda1e458863c46dfae7fb43bfb3e27802169f37320399b1dd799a819ac
MD5 51a2cbb807f5085530dec18e45cb8569
SHA1 7ad88cd3de5844c7fc269c4500228a630016ab5b
SHA512 b643a8fa75eda90c89ab98f79d4d022bb81f1f62f50ed4e5440f487f22d1163671ec3ae73c4742c11830214173ff2935c785018318f4a4cad413ae4eeef985df
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Default\Extension Scripts\LOG
Size 371B
SHA256 e36a94a1fd5c6ccaf6f9f1a8712b501edf9e6ce5d1ac31d6c170a308db00568a
MD5 45bddaaf3def0144d524c106fb31f332
SHA1 92a28b288e1398d0e8b0e06aad1f418b99dded78
SHA512 685f257586ab2a6fe82dbe4804067c1adb2368caa2e9aace92e81003c627239e60bd2336e7c0fd7ed667c5220939c5272882671d4539b551e60c584db54f127f
TLSH
T10FE068A9185A967146D9BDE7C5F2E70EC2543409B648F7028F4DCC81210BB04F9C0FA3
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Default\Extension State\000003.log
Size 114B
SHA256 e2610960c3757d1757f206c7b84378efa22d86dcf161a98096a5f0e56e1a367e
MD5 891a884b9fa2bff4519f5f56d2a25d62
SHA1 b54a3c12ee78510cb269fb1d863047dd8f571dea
SHA512 cd50c3ee4dfb9c4ec051b20dd1e148a5015457ee0c1a29fff482e62291b32097b07a069db62951b32f209fd118fd77a46b8e8cc92da3eaae6110735d126a90ee
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Default\Extension State\LOG
Size 367B
SHA256 f68bacf399609b8acace1eaa76522f2c6f2506cb154ccb17d854081925631770
MD5 98b908a190a58df3f3fbf04aa35d96e5
SHA1 f6f944c7dd035855a4b55fb2257c3f52faf1305b
SHA512 8512640e0f2db6da1a9d433c4684bc18725605a645d179f42fd512fc650ae4b9e43cf448e21d23fa4c6b4a13dbddbb23adceefecf86ecb8e5fde68a3de9bdabb
TLSH
T19DE0686544498521899ABCBBC1F2AB5ACA653809B64877028F5DD8402147B09F5C4763
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Default\Favicons
Size 20KB
SHA256 2db221a44885c046a4b116717721b688f9a026c4cae3a17cf61ba9bef3ad97f4
MD5 b40e1be3d7543b6678720c3aeaf3dec3
SHA1 7758593d371b07423ba7cb84f99ebe3416624f56
SHA512 fb0664c1c83043f7c41fd0f1cc0714d81ecd71a07041233fb16fefeb25a3e182a77ac8af9910eff81716b1cceee8a7ee84158a564143b0e0d99e00923106cc16
SSDEEP 24:LLiXxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:iBmw6fU1zBmI
TLSH
T1AA92EE075E383407DBA10E7D266B187A8E3FE26C5FA29C94347410618CF9482D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Default\GPUCache\index
Size 256KB
SHA256 5db57b4abc3d6ab574a82f4d1b45ed4e24f523f7ba5c85b87318c2a26abf59d1
MD5 41b57f198bbf7c7ce0950251f2d872bc
SHA1 74bd31ac580fa3f987139766c3ad61498a72e210
SHA512 ce0318893f972bdd3b9518e909b195a7b6b3bb90862b806c3bc3d6eaa16487cd8963715d504ba622d04d60a6e892f85848439508f3cc52df5e3c01159e1d11e0
SSDEEP 3:LstlNllkll/lnXtl:LsX3lEtXtl
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Default\History
Size 164KB
SHA256 deba77bc71479c2e98a7f985233a7dc3a386ebc0dce33a347c6ac21d9ee1c573
MD5 a52a55fd35156c4962d5056465aa9d95
SHA1 c22a74097d6717d550758cf6f7ac16c3a4bce1e8
SHA512 2683277a6451aec89c9e40cc554ec5d16f22cb44c12ff404ea6c13acd8306552861b279f9a4e6aea3b715ece2e0f1969ff4c37f4c2e4b67336c4aa07d0a2adc7
SSDEEP 96:MBaLqL/uejzH+bF+UIYysX0fxQp97sXEHt/DfLVVVN6zRk/E0:MBGqL/tH+bF+UI3iWGVsXWNVVV63
TLSH
T10FF3EA1E5F643722CDBD923668E745B3597CF03F876326856CA114B1CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps Icons

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Default\HubApps Icons
Size 28KB
SHA256 b776393bf73aad8773d92bcd6a515c865c850b00800144795153cf26f02d357a
MD5 8ce79cfe5162fc50d6a65babbc1cd81f
SHA1 a37fddb337313a892a02d3dc8a9d8b42f448007e
SHA512 327780168c5dbdad5c803eeb3f1b1b8b7c4a8b2fad6a3f8a1373321b7cf0abf381ea2f1ba66cca1acf73ddade2acdf919af8f248ba077fc8f7062eb761f8f68c
SSDEEP 12:TLMZly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TL6cjr0+Pdajk+FZH1W6UwccI5fBI
TLSH
T19FD28E5A5F04FB33C9794BBC90C305D65F79573E4F40CA5152F8A0686B804C8A26D92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Default\Local Storage\leveldb\LOG
Size 379B
SHA256 d5a5f7ffccc84c14868b7c028e196c5911c3d9068f466f8cc5ccc05ee900dfe6
MD5 bd734506791f57385a271286652a2cc5
SHA1 fc2d331346aaa8778492613b16c20f43b615fab2
SHA512 97860c72eab614fbb4aebc1158c1b8b7c806be545690f8b950da85d3c5949f0c108ce907fb6a8acc8af46eac4a88beb0baf0fcb6a0d4be2ea80c0318b82a200f
TLSH
T1F4E061B1844B4535479978AF90B2BB4FC734340EB54DAB438D4DE942354B908BAC07E3
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Default\Login Data
Size 42KB
SHA256 0c1c2e0223f73fea44686ae44f4e78411de421f7aef7d89617be3837d3fdbc11
MD5 cec405af1bb4df2029eacdcbc7e05fd6
SHA1 835e45888f49095a184a62a229a437399c9c62cd
SHA512 4ce266cc942447ac963f4652c058a28d7641e37a06a5cfa4b290e70d77efb80e00312363ee5adb9e502fa32ad1cf661c18ac9581d1fcb2f83e7cb6429325458e
SSDEEP 96:klpeymwACn8MouB6w9f/FlXqiEqUvJKLuyn:klrAG7Iw9ftFqidn
TLSH
T1B213350F2B682401C8AD8636ACB114B66E7CA13F4B639FD52CB104259D75C63B12D5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Default\Network\Cookies
Size 20KB
SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
MD5 91dbaf73c1a8c55254d90272f998e412
SHA1 2b86b31c8c00c937291e5ac3b1d134a5df959acf
SHA512 109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988
SSDEEP 24:TLWr6bXYFpFNYJqH1kwIY6UwpQ9YH8rwZ6HfB:T+6LopFS+awWUOh8B
TLSH
T126926B4E5F346221C0F48B36EDE1855B2F7C201CD3B32655DA5860F3DE9299BF10956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 10ce46995378459151b5a072d6ef1e54867ce57edcc1520ec6a0965b5ff432ff
MD5 5f080b35a2352f916d574e049ffa88c5
SHA1 bb4cdb42ea2c454bcb92fac028696d65b4b91697
SHA512 b9862a5ba6723d3859bb1baecc04df0bf14a3d6c06278fd7cfbbba2412fd0dc5dceca969a9e1fe967a8f29764cb800f475b3270f3d1c2868f56a2d1586125bea
SSDEEP 48:TkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:IIEumQv8m1ccnvS6
TLSH
T169F2149E0B1D3A10C4F89674EAC10DC37D7D141D8B96EFC45AEC06F2FF862A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Local State
Size 2KB
SHA256 0984e8224bd190a087a825e114d43866c26c41c737b34b595772803888db8275
MD5 921aaccc1af21776e1f03ca4c30863c2
SHA1 ac296104bce6acf2bccb2d7663e599f7806ea6f3
SHA512 6fa338652d0792b30ab059bd4b89ac1a60e15bb3a292344f2d5ed97db78517be8d69608f765a2b02d69624c189f3fce5f9cab58c23dd7c8445be465515238e5b
TLSH
T1CC519573B860BA378AA28A447D4B3F37DE7990A19A562F14DADC1F0C41DB69C1342C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Local State
Size 3KB
SHA256 b905c654fce94b20f60ebb7f4ffa8edcc0367220ec501974086a0df1a6511061
MD5 37a5702c1e214ea3a67b3445ec94c994
SHA1 efd24d0878c5a62b72c5cf629344a7a3efddab5f
SHA512 fef28a69b20e0e6740aede6b54da625c18d4d6e595cfaf8bfe956c7a921af1fc34855c3ed2deddae0b915000ad0515f9b1b1b3429cfa809a460ebf8a782a791e
TLSH
T13A618577A970B9374EE2DA047C863B27ABA55063E9963F68C9EC1E0C01D77D81352C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Local State
Size 3KB
SHA256 daaf1873006e246d10acf47e0c2f6db5afb896be54a0f9ea45853a67424b4916
MD5 f1f949da5309374e3be08c6fc02bc4da
SHA1 fea9a8f1e6105aa85452b74ed803b667d44e787a
SHA512 8101445c57d5604476d1f5b21a908f1c762cb86fabf07e4b24269a2addb9479ef22c92ec0bacc60d619649ac261bd7ff2247903088948a8153294c93b8771b0a
TLSH
T180716576A9B0A9374EB2DA047C463B17A7655063A9963F98C9EC0E0D01D73D91342C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Local State
Size 3KB
SHA256 0245dd9340945226ce705fcb571bcb9c0b19f722614bb8b6030b02476f46cc79
MD5 a47182a2d4984ad5f31ff46d0f1f43ab
SHA1 c39078a3e62c9463de443c1b29082c326de9f35a
SHA512 77f7bbb75902711890196c20fb9fe167473ad8031487734f9cc0c0ae9c85c272a62348c6e02460b4fd71e32a7b43b49bf0f0d9bb86c590cc116e966b8b1b4c76
TLSH
T18471857268B0B9374EF2D905BD863B17AB65906399867F98C9EC1F0D01D77D91342C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58c81d.TMP

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{DD829EEA-7550-407D-B5BA-5132EAE1349B}\wv2\EBWebView\Local State~RFe58c81d.TMP
Size 1KB
SHA256 d48511e90c3241d1224feceb942021878bbb244a04f5914464b43e03f7e6f856
MD5 3ee62e46952f8b46be14778d6a6f5572
SHA1 15cbe3795187aecc4b1c314a69d5b63678da0459
SHA512 e405f1bcf20991985446e103dc6926864191a9215cadd550323f617a6d9174bfbb509442b3e0f69c91d30ddb9599b12cc94b6636ed06978ee60862ee9837f00b
TLSH
T1B621B7F2E4A02B33AE81A74535437B7BAE3540AB41155E0490DD4A0C02AB7DD8726C33
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_b4r1r0vg.igz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b4r1r0vg.igz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ab6a215a-918a-40d1-a2a5-366bec2286ba.tmp

Path C:\Users\Admin\AppData\Local\Temp\ab6a215a-918a-40d1-a2a5-366bec2286ba.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

luau-lsp.exe

Path C:\Users\Admin\AppData\Local\Temp\real-luau-lsp-extract\luau-lsp.exe
Size 16.3MB
SHA256 0da4f09d474e41074f4ec52bfef01eb90c014928358eda88f6a5afad5319b537
MD5 be087717213e34f06e6198159d9c73dc
SHA1 60e2ca8a33531199a644061238b1605f78b8ae66
SHA512 fdc7b914eb7425bc17c23a7e52c7256f0263448ef4e0469302386a17b6ed3d5241bdc4cc2c43092c521368b9c09540ade980deffa16c201455b5a9a8650104b6
SSDEEP 393216:XdTfwgggjgzggsgTguwttbgNlggigggXsgJgUQLCgggggCNc/gggga4ggggcgggg:NRggjgzggsgTgugtbgNlggigggXsgJgB
TLSH
T132075B3A21AC01DCF1BBD0BD8BDB9E47D6B2340903319ADF0591569A1E1BDED4A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

real-luau-lsp.zip

Path C:\Users\Admin\AppData\Local\Temp\real-luau-lsp.zip
Size 4.9MB
SHA256 faea1b177f4761e4c34e0dab72009a2fdd00f21d61f3f7b7c1fe1ac3f38a05d2
MD5 1b284c21f9cd1359868016692ace2db2
SHA1 24792218a8d9d76b3f69a274ef6190cd33106f7e
SHA512 fadbb5db04d125e12a5d1e7153026efdf568d51a1b15afa6d732a75fdbfab87eb14a5e2b64364fd47b4ab4b9c4e5fed8ffe8d5e7e09fb8e396e302879f9f6c74
SSDEEP 98304:sBXd2Q4Jz8eM42l/+T/5/Wbv9z8LT6Eb7OuITvBFkF9ba9v:iXd2Q4u+iw92wLT6AOt7BFkF4N
TLSH
T1203633DCC801D7A32B91C32FF9DEE523338FC254CC30316556A85E453A9E578EABA586
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir240_745660837\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/912-192-0x0000022B6A9A0000-0x0000022B6A9BE000-memory.dmp

Download

memory/912-189-0x0000022B6A930000-0x0000022B6A952000-memory.dmp

Download

memory/912-193-0x0000022B6AA00000-0x0000022B6AAB2000-memory.dmp

Download

memory/912-194-0x0000022B6A9C0000-0x0000022B6A9CA000-memory.dmp

Download

memory/1164-123-0x00007FF98CD10000-0x00007FF98CD11000-memory.dmp

Download

memory/3168-26-0x00007FF98CD10000-0x00007FF98CD11000-memory.dmp

Download

memory/3660-226-0x0000023367B30000-0x0000023367B42000-memory.dmp

Download

memory/3660-227-0x0000023367AF0000-0x0000023367AFA000-memory.dmp

Download

memory/4344-497-0x0000023D74160000-0x0000023D74212000-memory.dmp

Download

memory/6536-1000-0x0000000140000000-0x0000000140A9D000-memory.dmp

Download

memory/6536-1003-0x0000000140000000-0x0000000140A9D000-memory.dmp

Download