d66e412cb82769f684d0e09378aab2d048b3949e029f3cd080ae6ac6242b5a47

Analysis

user interaction
yes
max time kernel
98s
max time network
102s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RealSetup_01582ad533a0b282ad237c308ba44f7caa0f65a22dd3c770bea0bd1533d97dc5.exe
Size 16.5MB
Sample260809-pd5ypaem3w
SHA256 d66e412cb82769f684d0e09378aab2d048b3949e029f3cd080ae6ac6242b5a47
MD5 cb6d01cb4f6fb371a8651d4a7348f3b6
SHA1 8c772bf169aaa32096b7768544050e87525eff03
SHA512 7e77b0aef98b99f931b6c4baff5aeaeaae57c76d4ec5ad0898c13157eb74b599ea59f151dade9b13320e5e609f602b859b5c753c05255c0c68bedc2968953c5f
SSDEEP 393216:htQDIqMgneq1R0qTwMa2ulncqk61FDiOUY+OUY:KUqlqin
TLSH
T1CF07BF69A6BC01D9E867C1BCC2965223EB72B41523B057CF5A609AF60F23AD41F7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Real.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4224	powershell.exe
6812	powershell.exe
2744	powershell.exe
6664	powershell.exe
7112	powershell.exe
7112	powershell.exe
6812	powershell.exe
2744	powershell.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Real.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Real.exe

Executes dropped EXE 6 IoCs

pid	Process
3544	Update.exe
2940	Update.exe
6952	Real.exe
6768	Real.exe
1224	Real.exe
2188	luau-lsp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RealSetup_01582ad533a0b282ad237c308ba44f7caa0f65a22dd3c770bea0bd1533d97dc5.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Real.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Real.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1224	Real.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3936_701503325\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3936_9093048\_locales\pa\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4396	msedge.exe
1444	msedge.exe
1416	msedge.exe

Enumerates system info in registry 2 TTPs 15 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	RealSetup_01582ad533a0b282ad237c308ba44f7caa0f65a22dd3c770bea0bd1533d97dc5.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307512635944447"	RealSetup_01582ad533a0b282ad237c308ba44f7caa0f65a22dd3c770bea0bd1533d97dc5.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Update.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Update.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Real.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\projectreal\shell\open\command	RealSetup_01582ad533a0b282ad237c308ba44f7caa0f65a22dd3c770bea0bd1533d97dc5.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\projectreal\shell	RealSetup_01582ad533a0b282ad237c308ba44f7caa0f65a22dd3c770bea0bd1533d97dc5.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\projectreal	RealSetup_01582ad533a0b282ad237c308ba44f7caa0f65a22dd3c770bea0bd1533d97dc5.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\projectreal\shell\open	RealSetup_01582ad533a0b282ad237c308ba44f7caa0f65a22dd3c770bea0bd1533d97dc5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\projectreal\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Real\\Update.exe\" --write-deep-link \"%1\""	RealSetup_01582ad533a0b282ad237c308ba44f7caa0f65a22dd3c770bea0bd1533d97dc5.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{9E73485D-F97C-4B63-8707-24122F5FBBEF}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{390507D1-C890-4F4A-8DD6-FB5C2724357A}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\projectreal\ = "URL:Real Protocol"	RealSetup_01582ad533a0b282ad237c308ba44f7caa0f65a22dd3c770bea0bd1533d97dc5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\projectreal\URL Protocol	RealSetup_01582ad533a0b282ad237c308ba44f7caa0f65a22dd3c770bea0bd1533d97dc5.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6664	powershell.exe
6664	powershell.exe
6664	powershell.exe
7112	powershell.exe
7112	powershell.exe
7112	powershell.exe
2536	RealSetup_01582ad533a0b282ad237c308ba44f7caa0f65a22dd3c770bea0bd1533d97dc5.exe
2536	RealSetup_01582ad533a0b282ad237c308ba44f7caa0f65a22dd3c770bea0bd1533d97dc5.exe
4224	powershell.exe
4224	powershell.exe
4224	powershell.exe
3544	Update.exe
3544	Update.exe
2940	Update.exe
2940	Update.exe
6812	powershell.exe
6812	powershell.exe
2744	powershell.exe
2744	powershell.exe
6812	powershell.exe
2744	powershell.exe
3544	Update.exe
3544	Update.exe
2940	Update.exe
2940	Update.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1512	msedgewebview2.exe
6932	msedge.exe
6932	msedge.exe
904	msedgewebview2.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6664	powershell.exe
Token: SeIncreaseQuotaPrivilege	6664	powershell.exe
Token: SeSecurityPrivilege	6664	powershell.exe
Token: SeTakeOwnershipPrivilege	6664	powershell.exe
Token: SeLoadDriverPrivilege	6664	powershell.exe
Token: SeSystemProfilePrivilege	6664	powershell.exe
Token: SeSystemtimePrivilege	6664	powershell.exe
Token: SeProfSingleProcessPrivilege	6664	powershell.exe
Token: SeIncBasePriorityPrivilege	6664	powershell.exe
Token: SeCreatePagefilePrivilege	6664	powershell.exe
Token: SeBackupPrivilege	6664	powershell.exe
Token: SeRestorePrivilege	6664	powershell.exe
Token: SeShutdownPrivilege	6664	powershell.exe
Token: SeDebugPrivilege	6664	powershell.exe
Token: SeSystemEnvironmentPrivilege	6664	powershell.exe
Token: SeRemoteShutdownPrivilege	6664	powershell.exe
Token: SeUndockPrivilege	6664	powershell.exe
Token: SeManageVolumePrivilege	6664	powershell.exe
Token: 33	6664	powershell.exe
Token: 34	6664	powershell.exe
Token: 35	6664	powershell.exe
Token: 36	6664	powershell.exe
Token: SeDebugPrivilege	7112	powershell.exe
Token: SeIncreaseQuotaPrivilege	7112	powershell.exe
Token: SeSecurityPrivilege	7112	powershell.exe
Token: SeTakeOwnershipPrivilege	7112	powershell.exe
Token: SeLoadDriverPrivilege	7112	powershell.exe
Token: SeSystemProfilePrivilege	7112	powershell.exe
Token: SeSystemtimePrivilege	7112	powershell.exe
Token: SeProfSingleProcessPrivilege	7112	powershell.exe
Token: SeIncBasePriorityPrivilege	7112	powershell.exe
Token: SeCreatePagefilePrivilege	7112	powershell.exe
Token: SeBackupPrivilege	7112	powershell.exe
Token: SeRestorePrivilege	7112	powershell.exe
Token: SeShutdownPrivilege	7112	powershell.exe
Token: SeDebugPrivilege	7112	powershell.exe
Token: SeSystemEnvironmentPrivilege	7112	powershell.exe
Token: SeRemoteShutdownPrivilege	7112	powershell.exe
Token: SeUndockPrivilege	7112	powershell.exe
Token: SeManageVolumePrivilege	7112	powershell.exe
Token: 33	7112	powershell.exe
Token: 34	7112	powershell.exe
Token: 35	7112	powershell.exe
Token: 36	7112	powershell.exe
Token: SeIncreaseQuotaPrivilege	7112	powershell.exe
Token: SeSecurityPrivilege	7112	powershell.exe
Token: SeTakeOwnershipPrivilege	7112	powershell.exe
Token: SeLoadDriverPrivilege	7112	powershell.exe
Token: SeSystemProfilePrivilege	7112	powershell.exe
Token: SeSystemtimePrivilege	7112	powershell.exe
Token: SeProfSingleProcessPrivilege	7112	powershell.exe
Token: SeIncBasePriorityPrivilege	7112	powershell.exe
Token: SeCreatePagefilePrivilege	7112	powershell.exe
Token: SeBackupPrivilege	7112	powershell.exe
Token: SeRestorePrivilege	7112	powershell.exe
Token: SeShutdownPrivilege	7112	powershell.exe
Token: SeDebugPrivilege	7112	powershell.exe
Token: SeSystemEnvironmentPrivilege	7112	powershell.exe
Token: SeRemoteShutdownPrivilege	7112	powershell.exe
Token: SeUndockPrivilege	7112	powershell.exe
Token: SeManageVolumePrivilege	7112	powershell.exe
Token: 33	7112	powershell.exe
Token: 34	7112	powershell.exe
Token: 35	7112	powershell.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
6932	msedge.exe
6932	msedge.exe
6952	Real.exe
6952	Real.exe
6952	Real.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
6952	Real.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 1512	2536	RealSetup_01582ad533a0b282ad237c308ba44f7caa0f65a22dd3c770bea0bd1533d97dc5.exe	90
PID 1512 wrote to memory of 6380	1512	msedgewebview2.exe	91
PID 1512 wrote to memory of 6384	1512	msedgewebview2.exe	92
PID 1512 wrote to memory of 6384	1512	msedgewebview2.exe	92
PID 1512 wrote to memory of 6384	1512	msedgewebview2.exe	92
PID 1512 wrote to memory of 6384	1512	msedgewebview2.exe	92
PID 1512 wrote to memory of 716	1512	msedgewebview2.exe	93
PID 1512 wrote to memory of 6604	1512	msedgewebview2.exe	94
PID 1512 wrote to memory of 6604	1512	msedgewebview2.exe	94
PID 1512 wrote to memory of 6604	1512	msedgewebview2.exe	94
PID 1512 wrote to memory of 6284	1512	msedgewebview2.exe	95
PID 1512 wrote to memory of 6284	1512	msedgewebview2.exe	95
PID 1512 wrote to memory of 6284	1512	msedgewebview2.exe	95
PID 1512 wrote to memory of 6284	1512	msedgewebview2.exe	95
PID 1512 wrote to memory of 6284	1512	msedgewebview2.exe	95
PID 2536 wrote to memory of 6664	2536	RealSetup_01582ad533a0b282ad237c308ba44f7caa0f65a22dd3c770bea0bd1533d97dc5.exe	96
PID 2536 wrote to memory of 7112	2536	RealSetup_01582ad533a0b282ad237c308ba44f7caa0f65a22dd3c770bea0bd1533d97dc5.exe	99
PID 2536 wrote to memory of 4224	2536	RealSetup_01582ad533a0b282ad237c308ba44f7caa0f65a22dd3c770bea0bd1533d97dc5.exe	101
PID 2536 wrote to memory of 6932	2536	RealSetup_01582ad533a0b282ad237c308ba44f7caa0f65a22dd3c770bea0bd1533d97dc5.exe	106
PID 2536 wrote to memory of 2940	2536	RealSetup_01582ad533a0b282ad237c308ba44f7caa0f65a22dd3c770bea0bd1533d97dc5.exe	107
PID 6932 wrote to memory of 4084	6932	msedge.exe	108
PID 3544 wrote to memory of 6812	3544	Update.exe	109
PID 6932 wrote to memory of 1152	6932	msedge.exe	111
PID 6932 wrote to memory of 4396	6932	msedge.exe	112
PID 6932 wrote to memory of 1152	6932	msedge.exe	111
PID 6932 wrote to memory of 1152	6932	msedge.exe	111
PID 6932 wrote to memory of 4868	6932	msedge.exe	113
PID 6932 wrote to memory of 4868	6932	msedge.exe	113
PID 2940 wrote to memory of 2744	2940	Update.exe	114
PID 6932 wrote to memory of 5628	6932	msedge.exe	116
PID 6932 wrote to memory of 2328	6932	msedge.exe	117
PID 6932 wrote to memory of 5628	6932	msedge.exe	116
PID 6932 wrote to memory of 5628	6932	msedge.exe	116
PID 6932 wrote to memory of 2328	6932	msedge.exe	117
PID 6932 wrote to memory of 2328	6932	msedge.exe	117
PID 6932 wrote to memory of 3936	6932	msedge.exe	120
PID 3936 wrote to memory of 2056	3936	msedge.exe	122
PID 3936 wrote to memory of 1192	3936	msedge.exe	123
PID 3936 wrote to memory of 1444	3936	msedge.exe	124
PID 3936 wrote to memory of 1192	3936	msedge.exe	123
PID 3936 wrote to memory of 1192	3936	msedge.exe	123
PID 3936 wrote to memory of 4944	3936	msedge.exe	125
PID 3936 wrote to memory of 4944	3936	msedge.exe	125
PID 3936 wrote to memory of 6008	3936	msedge.exe	129
PID 2940 wrote to memory of 6768	2940	Update.exe	131
PID 3544 wrote to memory of 6952	3544	Update.exe	130
PID 6952 wrote to memory of 904	6952	Real.exe	132
PID 904 wrote to memory of 6884	904	msedgewebview2.exe	133
PID 904 wrote to memory of 3672	904	msedgewebview2.exe	134
PID 904 wrote to memory of 3672	904	msedgewebview2.exe	134
PID 904 wrote to memory of 3672	904	msedgewebview2.exe	134
PID 904 wrote to memory of 3672	904	msedgewebview2.exe	134
PID 904 wrote to memory of 6344	904	msedgewebview2.exe	135
PID 904 wrote to memory of 2500	904	msedgewebview2.exe	136
PID 904 wrote to memory of 2500	904	msedgewebview2.exe	136
PID 904 wrote to memory of 2500	904	msedgewebview2.exe	136
PID 904 wrote to memory of 6496	904	msedgewebview2.exe	137
PID 904 wrote to memory of 6496	904	msedgewebview2.exe	137
PID 904 wrote to memory of 6496	904	msedgewebview2.exe	137
PID 904 wrote to memory of 6496	904	msedgewebview2.exe	137
PID 904 wrote to memory of 6496	904	msedgewebview2.exe	137
PID 6952 wrote to memory of 1224	6952	Real.exe	138
PID 6952 wrote to memory of 2188	6952	Real.exe	140
PID 3936 wrote to memory of 4636	3936	msedge.exe	143

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\RealSetup_01582ad533a0b282ad237c308ba44f7caa0f65a22dd3c770bea0bd1533d97dc5.exe
"C:\Users\Admin\AppData\Local\Temp\RealSetup_01582ad533a0b282ad237c308ba44f7caa0f65a22dd3c770bea0bd1533d97dc5.exe"
1⤵
- Checks whether UAC is enabled
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RealSetup_01582ad533a0b282ad237c308ba44f7caa0f65a22dd3c770bea0bd1533d97dc5.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2536.3412.17116448704934587514 /pfhostedapp:158db1be0cc91757082ea23715e9da67acc1b6be
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView /prefetch:4 /pfhostedapp:158db1be0cc91757082ea23715e9da67acc1b6be --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffc62ae5fd8,0x7ffc62ae5fe4,0x7ffc62ae5ff0
    3⤵
    PID:6380
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView" --webview-exe-name=RealSetup_01582ad533a0b282ad237c308ba44f7caa0f65a22dd3c770bea0bd1533d97dc5.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1784 --field-trial-handle=1788,i,16225378254592295519,16726647082296943692,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:158db1be0cc91757082ea23715e9da67acc1b6be
    3⤵
    PID:6384
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView" --webview-exe-name=RealSetup_01582ad533a0b282ad237c308ba44f7caa0f65a22dd3c770bea0bd1533d97dc5.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2148 --field-trial-handle=1788,i,16225378254592295519,16726647082296943692,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:158db1be0cc91757082ea23715e9da67acc1b6be
    3⤵
    PID:716
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView" --webview-exe-name=RealSetup_01582ad533a0b282ad237c308ba44f7caa0f65a22dd3c770bea0bd1533d97dc5.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2336 --field-trial-handle=1788,i,16225378254592295519,16726647082296943692,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:158db1be0cc91757082ea23715e9da67acc1b6be
    3⤵
    PID:6604
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView" --webview-exe-name=RealSetup_01582ad533a0b282ad237c308ba44f7caa0f65a22dd3c770bea0bd1533d97dc5.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3536 --field-trial-handle=1788,i,16225378254592295519,16726647082296943692,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:158db1be0cc91757082ea23715e9da67acc1b6be /prefetch:1
    3⤵
    PID:6284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "try{ $ex=@((Get-MpPreference).ExclusionPath); $want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll'); $stale='C:\Users\Admin\AppData\Local\Temp'; $miss=$want | Where-Object { $ex -notcontains $_ }; if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1} }catch{exit 1}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll');$stale='C:\Users\Admin\AppData\Local\Temp';foreach($p in $want){ $ex=@((Get-MpPreference).ExclusionPath); if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }};if($stale -and @((Get-MpPreference).ExclusionPath) -contains $stale){ Remove-MpPreference -ExclusionPath $stale};$ex=@((Get-MpPreference).ExclusionPath);$miss=$want | Where-Object { $ex -notcontains $_ };if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:7112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAIABFAHgAcABhAG4AZAAtAEEAcgBjAGgAaQB2AGUAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAByAGUAYQBsAC0AbAB1AGEAdQAtAGwAcwBwAC4AegBpAHAAJwAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcgBlAGEAbAAtAGwAdQBhAHUALQBsAHMAcAAtAGUAeAB0AHIAYQBjAHQAJwAgAC0ARgBvAHIAYwBlAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/projectreal
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x360,0x7ffc6057c188,0x7ffc6057c194,0x7ffc6057c1a0
    3⤵
    PID:4084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,9448686704267887608,2794163265372020195,262144 --field-trial-handle=2344,i,15635539993840457587,13515025989224810523,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
    3⤵
    PID:1152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1720,i,8821883666544081553,2563413793061024,524288 --field-trial-handle=2344,i,15635539993840457587,13515025989224810523,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2188,i,8129223150082337285,1984747450452107599,524288 --field-trial-handle=2344,i,15635539993840457587,13515025989224810523,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:13
    3⤵
    PID:4868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,12443488961367494532,4486604123766395609,2097152 --field-trial-handle=2344,i,15635539993840457587,13515025989224810523,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:5628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,8740944034550643829,10807561811066568511,2097152 --field-trial-handle=2344,i,15635539993840457587,13515025989224810523,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:2328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffc6057c188,0x7ffc6057c194,0x7ffc6057c1a0
      4⤵
      PID:2056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,15400849631794467108,4736892070773354494,262144 --field-trial-handle=2536,i,8576214018185704239,3833657628616512852,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:2
      4⤵
      PID:1192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,2443866742315954425,2201557407667584613,524288 --field-trial-handle=2536,i,8576214018185704239,3833657628616512852,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:11
      4⤵
      System Time Discovery
      PID:1444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,17305917166471468926,13921966758770754470,524288 --field-trial-handle=2536,i,8576214018185704239,3833657628616512852,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:13
      4⤵
      PID:4944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,12357010636359110328,18249774349348150006,524288 --field-trial-handle=2536,i,8576214018185704239,3833657628616512852,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:14
      4⤵
      PID:2724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,12357010636359110328,18249774349348150006,524288 --field-trial-handle=2536,i,8576214018185704239,3833657628616512852,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:14
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,17828616783781881161,17032659803001794041,524288 --field-trial-handle=2536,i,8576214018185704239,3833657628616512852,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:14
      4⤵
      PID:4636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,17324340735269453382,3074019935692476012,524288 --field-trial-handle=2536,i,8576214018185704239,3833657628616512852,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
      4⤵
      PID:2872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,14333511902149581977,17946810586372652671,524288 --field-trial-handle=2536,i,8576214018185704239,3833657628616512852,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
      4⤵
      PID:1416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,7480437963383117111,7947386035239585837,524288 --field-trial-handle=2536,i,8576214018185704239,3833657628616512852,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:14
      4⤵
      PID:2896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3876,i,16250049687339236457,7881281576469649282,524288 --field-trial-handle=2536,i,8576214018185704239,3833657628616512852,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14
      4⤵
      PID:6704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5028,i,458015354654224990,13823403119497783547,2097152 --field-trial-handle=2536,i,8576214018185704239,3833657628616512852,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:1
      4⤵
      PID:6632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5032,i,3119780577022887299,11964839882176952327,2097152 --field-trial-handle=2536,i,8576214018185704239,3833657628616512852,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
      4⤵
      PID:5644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,18409532856274094254,18012821004904074114,524288 --field-trial-handle=2536,i,8576214018185704239,3833657628616512852,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
      4⤵
      PID:3740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,15897824049648973286,15746828337905696831,524288 --field-trial-handle=2536,i,8576214018185704239,3833657628616512852,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
      4⤵
      PID:3048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      PID:4648
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2e4,0x7ffc6057c188,0x7ffc6057c194,0x7ffc6057c1a0
        5⤵
        
        PID:2200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1644,i,10476129872700852566,5671116133739254186,524288 --field-trial-handle=2288,i,5115010108917385009,7196930960632873133,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:1416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,15158713641429869590,13769491962205534855,262144 --field-trial-handle=2288,i,5115010108917385009,7196930960632873133,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
        5⤵
        
        PID:2356
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2200,i,12377234383943163283,8256056058702514882,524288 --field-trial-handle=2288,i,5115010108917385009,7196930960632873133,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:13
        5⤵
        
        PID:6416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,14864925885351258155,15167230930197321441,524288 --field-trial-handle=2288,i,5115010108917385009,7196930960632873133,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:14
        5⤵
        
        PID:6848
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,14864925885351258155,15167230930197321441,524288 --field-trial-handle=2288,i,5115010108917385009,7196930960632873133,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:14
        5⤵
        
        PID:1844
- C:\Users\Admin\AppData\Local\Real\Update.exe
  "C:\Users\Admin\AppData\Local\Real\Update.exe" --processStart Real.exe
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll');$stale='C:\Users\Admin\AppData\Local\Temp';foreach($p in $want){ $ex=@((Get-MpPreference).ExclusionPath); if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }};if($stale -and @((Get-MpPreference).ExclusionPath) -contains $stale){ Remove-MpPreference -ExclusionPath $stale};$ex=@((Get-MpPreference).ExclusionPath);$miss=$want | Where-Object { $ex -notcontains $_ };if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2744
- - C:\Users\Admin\AppData\Local\Real\real-1.9.0\Real.exe
    "C:\Users\Admin\AppData\Local\Real\real-1.9.0\Real.exe" --real-launched-by-updater
    3⤵
    - Executes dropped EXE
    PID:6768

C:\Users\Admin\AppData\Local\Real\Update.exe
C:\Users\Admin\AppData\Local\Real\Update.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll');$stale='C:\Users\Admin\AppData\Local\Temp';foreach($p in $want){ $ex=@((Get-MpPreference).ExclusionPath); if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }};if($stale -and @((Get-MpPreference).ExclusionPath) -contains $stale){ Remove-MpPreference -ExclusionPath $stale};$ex=@((Get-MpPreference).ExclusionPath);$miss=$want | Where-Object { $ex -notcontains $_ };if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6812
- C:\Users\Admin\AppData\Local\Real\real-1.9.0\Real.exe
  "C:\Users\Admin\AppData\Local\Real\real-1.9.0\Real.exe" --real-launched-by-updater
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:6952
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=6952.5232.1583320123434335371 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:904
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView /prefetch:4 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x19c,0x7ffc62ae5fd8,0x7ffc62ae5fe4,0x7ffc62ae5ff0
      4⤵
      PID:6884
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1780,i,3216519281657401728,18231179608168086498,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
      4⤵
      PID:3672
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2236 --field-trial-handle=1780,i,3216519281657401728,18231179608168086498,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
      4⤵
      PID:6344
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2544 --field-trial-handle=1780,i,3216519281657401728,18231179608168086498,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
      4⤵
      PID:2500
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3512 --field-trial-handle=1780,i,3216519281657401728,18231179608168086498,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105 /prefetch:1
      4⤵
      PID:6496
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4572 --field-trial-handle=1780,i,3216519281657401728,18231179608168086498,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
      4⤵
      PID:6172
- - C:\Users\Admin\AppData\Local\Real\real-1.9.0\bin\Real.exe
    "C:\Users\Admin\AppData\Local\Real\real-1.9.0\bin\Real.exe" --rbxversion
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1224
- - C:\Users\Admin\AppData\Local\Real\real-1.9.0\bin\luau-lsp.exe
    "C:\Users\Admin\AppData\Local\Real\real-1.9.0\bin\luau-lsp.exe" lsp --stdio --definitions:@roblox=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\roblox.PluginSecurity.d.luau --definitions:@real=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\real_executor_apis.d.luau --docs=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\roblox-api-docs.json --base-luaurc=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\base.luaurc
    3⤵
    - Executes dropped EXE
    PID:2188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://projectreal.gg/login?app_auth=1&state=F8vDi8XG6Y5I2Tt1_ONZAO-ZP7u8wB9lVChqO4KsNeU&loopback_port=58600&hwid=HWIDv5_53a97bf7889ea7e1a486356ce3316a912d22927a6084b0bdbb8be43becfc1fa2
    3⤵
    PID:5700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3540

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5856

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 428a51c002e6651b48b391f19837f66e073c8d0192bf55dc12c59b9d5f3bf3a9
MD5 1ac1ad9b704816c4cf78dacb5d1cfbbe
SHA1 3bde27345ac0b82fd92eba90509b8aae7701e9c6
SHA512 258e7b9302f1578e9b30c2919904256b80b43f64196c5ed5265391062f1dc86424da54ad411cc89fae899ac2b26f14034e52800075e2d2f41c6a47ff6cdc0486
TLSH
T161D023B0FE34A5D1E50C0130C0208900361B013321F7630351A0040CAD7006051DFDE9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 75310a3e5f22de378f05ea1e932639b4d7ef623aeb7af90693f13cd227c940fa
MD5 79dc87df886979fb5fe0c7c26fc0e1ef
SHA1 b88f3cc0153d4ce3839396ee4dc5b8620927284c
SHA512 401319607eccde7616182b962b751c0878c78d8a224aa1020897ce8a17cf5c6c48eace23cb1fc1d31da19e4412798077dae360b48abd3612c8fcc16b7b9e75a3
TLSH
T197D0A7B0F7149651D50945319451E6412A67413220FBAA2391A0544C69B547492DE499
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

5a7b836d-a492-45b1-ba80-69f9b8addab1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5a7b836d-a492-45b1-ba80-69f9b8addab1.tmp
Size 29KB
SHA256 9694d71c20310c6dff0dbd44ea54f5caed451b7ea510bcd4612226074ff751cc
MD5 5a1674459ee4cf0b0eddff3988454192
SHA1 ee12d678488b89fc3ebb6d061043e5d86a1a3abd
SHA512 fe202a00a7130fc8fa02dd9256c8dc2477d7cd8b7b5930e4635a66a54ae0217cc529962bb2fd997afcc4c68e31a4eed8fe2ef025424594823ce918f117989b5e
SSDEEP 768:O+WYbx7pLuL7+TWg1Nf9B8F1+UoAYDCx9Tuqh0VfUC9xbog/OVioDbDezro/a4m:O+WYbnE7+TWg1Nf9Bu1jaJoDHeA9m
TLSH
T1F8D2DA7B740DCB7E4F800ADDAC197A9F6DA802CB9698CD4087FE951C02C6BFA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 26ca3a2dff5e7464484fab2778e9d2b18f95b915cb0cc211185c74add676be19
MD5 c0302165e05e04a031f5861d13a36e6e
SHA1 e6ea7bd7091f7ed6493e2aac370828e5e7029262
SHA512 7ae4cfee36374b2c3d8646fd94c981357d971f5211cc6e3f42f3432652f2fa817510ea0b47b31e4a9222cf9f495a4091898997cf4605dffb6404cb1e4791c2fa
TLSH
T1B1E02B95C861BC3719FD5B1861644647E740232B3B50894B7B3C912C4FF163B578BC6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 266bdffb350614cfc6a8dc5f75d8690d98e776eb3430ed2bd6e7d873f1ba9753
MD5 3212f1f867870c555931c0cb6ca10fb2
SHA1 11093d952de7f80ce10f318961f913b883f9fed3
SHA512 05c20cf13235ab17c392db7d35f71d7ea618ea508e759672e63964a4bc71cffd230ba07088b999304f4840cc64ffb37a84c7c12cb449113f622d474d13cb784e
TLSH
T18D51D648532646E7E7AAE6B251E265C63BF4E0CE42071F5082301FF58A25F601AF0373
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f3f99184a67d242b5aafa1a34df46b0a7baa6e6603eb88c3ad54a11dd24b830b
MD5 0b500147278ed5aeb3f67923c2c6dfe0
SHA1 673dfd0053c355390a463cdf3d9fd399fb4493c9
SHA512 4f7f80b11a5f12e8a419d8c38acde84236d45bad08ed59e6f4cfcdba9223e97e10618a54ffe4d72826d8d7ac7dd3a7dd2947c288b53867a34e8f1f96a7d7e664
TLSH
T15C3180F743B4856EDA1196F0EA18AE2FCE1D0511432C7DAA85E0AE2793F3471E041B5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 25cafc3a69ff3a75bc6e1ff556f7a339dbb6b87dfed6b12874813b25d568eca6
MD5 ae3bbfed4604e4cd5c9d83ec3ac58975
SHA1 b4283ca0fba8fc630c9461e6f29bd5f14e6caf25
SHA512 837b0d5a202f6807648f6414bf64c9335c21cba2a63c0037a12efb676a502b6549d51831ad10beff609b93f3627671e3ffa0dd9f9a38edfa54c540d90836950d
TLSH
T1B9717DF3C3E8C92E992155F0AB186E1BCE1D0915532C7D5BC9E0EE5BA3F2871E24094B
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 1e423dcc4d4ef434f9c5690b2410e7d747147432499a0f4b317a5c1fa673c63a
MD5 34c612ab4e1f7874ea2dc647f0641993
SHA1 46021b75456980344139844bdee86e50fafd783b
SHA512 7ed5301bb604fdb59aeba2d7f1b75dba77a1628ac9de22f69ba251fd199eb3dd74a1a429dbcc74e4f66485c6a97b7160b39d06ec278066920fb252433d87ff98
TLSH
T12EC0221384F9E8B20024443D99C8A883BEB6D034000180A9C8EA833CA0821FB6A01039
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 781eff8888855e19b7fa2bd1f0a37fe3464757ee73fd09071e7a1d17461cbd5b
MD5 9557e47c90ad6fd65528e58208d75cbe
SHA1 fbddb3b51e4d7a7316c3e46046cbe375ae116abf
SHA512 ebdf856fa306fecfb47d8ca87044e96aba0182dfd04ad5d5ee0806ecaf85b0dc06ed4f5a7a0cf3c269f03384811b7aef4c39d24efe6fc91d03b5b603da1893f9
TLSH
T1A2F02BD384BAF43B1029557E0E44B8065A759130015298E9EED2C27CA0C26E73E11035
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 78e9284b77f8b6ec592ba8f79e086ea930af489f8edafe25a3a6dbccb91a6bde
MD5 8e8a07caedee59e7ec089c22660cb50f
SHA1 d5aea7889dc7ea7f45e6e23ccd77bb9df5070de5
SHA512 71c8691712b5e43c9b6461b9694b7ae92d5112f53826ef2860dc41dcad0c233c556f185b09d6d26a20432c791654f252763ec7aa5dc9b0738b466f932a0448c9
SSDEEP 384:sxRZ4Y/fJsuWv76o4N/RIuew/5IWqrsGQ4Cje:s94Y/fZY76oiWk/5IWqrsGQ4B
TLSH
T18752B7166D29993B9CC7D21DFB5A7F53D2FD113260916E58A7FC8A1C04EB6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6266f0e2322664ac3394b2d8bdf662de2170511f23e30f89ff6ab3064f651b68
MD5 6e21195a2247d3987a7747121078a8c0
SHA1 55a5fba1c31283380494432ada3f0cf7e16a3c48
SHA512 5cfbe4f26852e53973db195bfad5116b5fa503129dccc68f18621f86179babf21f9a2934906a7783866d7beb4d0774d5510a7d4c0aa8dee29d7e279533fbf16f
SSDEEP 384:sxRZ4Y/fJslWvbMN/RIuew/5IWqRsGQ4Ije:s94Y/fSYbmWk/5IWqRsGQ4z
TLSH
T1D452B6166D68993B9CC7D21DFB6A7F53D3FD113260916E58A6FC8A1C04EB6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 53835a6a505215a34c86f62a6d9f5ba26f41cf8e4bfff50b7ac7eb260b1f2525
MD5 101877e989d2888a442dcd5718839507
SHA1 1b39ba6ecf15d1d492e1e9cfd6995d9a77410cb2
SHA512 01c3a0480faee377872a9bc41f4ad0584951a6f8e136d29c899e50696d5c51ef695e61796cefd9c23fe9e316013047a6f7e50e6bad8922a2136d8c656b189e4f
SSDEEP 384:sxRZ4Y/fJslWvbeN/RIuew/5IWqIsGQ4IjB:s94Y/fSYbsWk/5IWqIsGQ48
TLSH
T1A652C716A969993B9CC7E61DFB5A7F53D3FD113260906E44E6FC8A1C04EB6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c3a5c4de7a15a5d4291dce2d179f5453049f1ab95ff7e062a6817b5e26acc0d2
MD5 50aa0ccf8dbce5bcd65594b91cce308b
SHA1 d9789082e1adc8d536e5d1d214ef0165d0d08869
SHA512 072f33eab276d6c531896f1e68018e724ea79f544582907ec9a9b14249577eb77ad3152153200199e4fbd2d3d04c30640c5f511491d1034b3f5c31fa24bd4be4
SSDEEP 384:sxRZCY/fJslWvbeN/RIaez/5m/10usGQ4PjB:s9CY/fSYbsWb/5810usGQ4N
TLSH
T18962D716A9289D3B9CC7E61DFA697F63D3FD113260905E54A7FC8A1C14E76DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 94525fc7c61ed6713e5228727d1baa701a9c0028cbfd6ef2266ce8de10d9407d
MD5 a9684c545064a272993a8455eabe3ee7
SHA1 5adfb68db4e902559a31e4df42ceb46a3954ec9d
SHA512 fa719d66c0b09976da1301f392a35a21e6073ed76f18907b1a533ed476a131d343297b180e67a0f9cd140856758533f8fe951ea1c3571eabed53b19fc0ccfb89
SSDEEP 384:sxRZCY/fJsJWvKeN/RIaez/5m/10usGQ4fjB:s9CY/f6YKsWb/5810usGQ49
TLSH
T1B062C616A9289D3B9CC7E21DFA697F63D3FD113260905E58A6FC8A1C00E76DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 dabc3d397a64236b6413ef86b96061d0ab1784886209aa22b6222268ac37ec70
MD5 d5407eacb2e5e4f8a3659fc25ac8117e
SHA1 7d13aa358a8f53eeea296e4f10fe0f5ea03fa0cc
SHA512 36d911ee4672ee4ab2af34bbee98abadc45eed3e1f0f39dc47b3b7a68eff7f6174712cfb3cdea87431545f2429dae388be201e79d568d39d9f70595388268a68
SSDEEP 384:sxRZ4Y/fJsAWvbMN/RIuew/5IWqRsGQ4Ije:s94Y/fPYbmWk/5IWqRsGQ4z
TLSH
T1D252B5166969993B9CC7D21DFB6A7F53D2FD113260916E58A6FC8A0C04EB6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 1c50bd3192c249756e62bfadb5d654208aa680fe73cd76f0de004720a22cc0f5
MD5 2df4cbed2c823fc5ebc97f6787d5d1c1
SHA1 bbeff1fd9dbe19e0c29361263d95dab0af1f7952
SHA512 8d895f35ffc7f0904944985f603b36e521dafefbbe9d3b563a3e53f3e927475bdaa84b59d72ee34fccc044d2fb1609e4fda0cdbdad45b3e742cee5bc18c43cd2
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9LD9:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRI
TLSH
T1ABB25B11713F5680383EB90C81B8D82F96C2B4637519E56F7BA801A65F67E039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f67b79d1-3dfc-47b9-b233-ba926c997274.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f67b79d1-3dfc-47b9-b233-ba926c997274.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 9e5dae8bdf93a6120b8b9ab8736ee50a8f8e6bcf7d0f829e2621d8bfbea6f1c6
MD5 b64428b0a5bf9ea7f774cc37aa84782f
SHA1 f478607f5e08d305a4a5428e57d7f34a1449b17a
SHA512 9be5c18b5051428a4e30357444e125bfab125c0d4f5dad5f47bfa446bfe669061c8520aa383316f80d48e1cef3a3e18cc75964146d2d4638238fdda043a9a030
SSDEEP 384:nXiFntNn/s3n9SW8NLD8TUNTUlIRQPvuTsSfEqf+GGrpjBslRc94y3mpMbLjhoOa:SFnj+93QDwgquP/Grl63pMbLjho29MF
TLSH
T182E2393DEC55CE7F98EEAF88620E7A169DE00277C0B85998E7C45F0C40A75ADE707825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 dd6ff01a1884ca064d1437aab1ed68ecf1d81fe19ed58b7c631d12d5d4058be8
MD5 e4cc56e9b70b5d846e987f8033b10886
SHA1 86b2f2cb9370d08236506071b496fa4979ee2f42
SHA512 136b54d20178bf7dab32aad0a4b2fda06ad5869cbd50a982de7cf0ca11a374e7203a5b4e03558d7f41bbb5493cbc834dc9ab9277a90212433d1f0f80bbdfdfaa
SSDEEP 384:nwiF1tNn/s3n9Sn8NgX8TUNTUlIRiPvuTuiREqf+GGrpjBslRYLpOObjI9G6w7hq:LF1j+9SXXwgUu/ZGrTp29M4
TLSH
T12AC25B36EC55CEB7EDE74F98B34A7A46EEE01267849C5AD8EAC85D0D00C71ED0707826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 48bd870343972089f6042b0dbcd4589536b944d3d28cde86ace572475f0f7b06
MD5 85a061ca7398edcbae0612e1fec9a935
SHA1 8e7238d5653ec0a48060b138c0e0f675673d502c
SHA512 cdeb9bccfea19f3879215b01532755f696d3e00e7b583017127684c9a1681856e532f36c9cd681f3152581f5f656a64f8559a0071ae7acfecc419b694f86b2a1
SSDEEP 384:nfiFgZcIU8NLc8TUNTUlIR7PvuTstfEqf+GGrpjBslRc/Km/NnTKwBODNZOCEKDh:qFeUQcwgtug/Grlym/NnewBKZOTQ
TLSH
T1C4D24B32EC64CEB7ADE69F88A60A7603DEE04263D5DC5AE8D6D95D0C00D71ED030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b93a2f875f8c3e61e2e21e0c550f1f9e8d3240a2ec0f4baf1c0d02848d99ef6e
MD5 a5befe94ca557ba8edbe9efc3ffab2b1
SHA1 22f756b1e184ae205b3fda55b6ebd0ed91c1f1e0
SHA512 a1904d343e650fa6b3640c12158bd904b416d5bbc46d38b490e9af6b8ed92bc08283e3b688c376cca9ec33caf84162fd365d9ca73ae4a46fc93ef43e149b5aef
SSDEEP 384:nXiFgZcIU8NLc8TUNTUlIR7PvuTstfEqf+GGrpjBslRc/Km/NnTKwBODNZOCEKDh:SFeUQcwgtug/Grlym/NnewBKZOTQ
TLSH
T15AD24B32EC64CEB7ADE69F98A60A7603DEE04263D5DC5AD8E6D95D0C00D71ED070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 36788de921f4a70c0333e99452ed1ac89d0ba89301076f734e4d884b9e516db5
MD5 a3dd7d5f0d6fb22bedb725eb6e9f5544
SHA1 3d9c6face877da211bd43fbe3fcd8c2aba442762
SHA512 c7d32136982db32083b00b4a21674b28f371829d4516555e993bb528f3c8b9216e7a6aad335517055311268a0afc8cbfae9de6d6b7b4e5c12c1b7d340020dca9
SSDEEP 384:nEiF1tNn/s3n9Sn8NgD8TUNTUlIRiPvuTPHfEqf+GGrpjBslRc9kVOObjI9G6w74:fF1j+9SXDwgUuD/GrlyV29M4
TLSH
T1E1C24B36E855CEB7EDE78F94B34A7A57EEE012A3848C5AD8E6D45D0D00C71AD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 d7c35a769a5d4a59e1dfaad88b5bc7c7229b4fbe568397ad51c486f3ac1f172a
MD5 ecc180c7e403aa7895ec402fa78af652
SHA1 da848313686e6ca4e6acecf3a529e6636ff56b8b
SHA512 aef129710dc9fa956bb337dfcc9d35c9945e764998e7361334f41826e8f567a101105382a1289b53bf558d05c1f0502b9949a82dd6b6049b0b631f4ed63d83da
SSDEEP 768:qF30QcwgDuA/GrlKawKRBmnynewBKZOTQ:E0Qgu/ZwKPmynevZeQ
TLSH
T13DE2383DAC64D97F98EEBF88660E79169DE40273D0B859A8D7D91F0C80B359DE306C21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e86ea29d5aaa9164cc3269e41b61e7ae574db7ed89ad3391ac83a29aee93c4ab
MD5 4f4141deb177e2882826a41b775aa5a5
SHA1 602ecf03a83d9c4835a7ae257fed6cd9aae1bfb6
SHA512 18a614a19c815d98632afd8ec9409c0ce4638e3c600766861bbb6998dd404c25c3e8faeea15e2b79cf31d45a46c148501eff6b36f5910e4762a339481f95db21
TLSH
T145219833F3CC8624C89A013A10CDAC1036B6C7CB40DECFAB6B80E659A43F698CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

.real-write-probe-2940-240744781.tmp

Path C:\Users\Admin\AppData\Local\Real\.real-write-probe-2940-240744781.tmp
Size 4B
SHA256 aa33996d60e89311b4d1a920dae03c6d7fa3ae1956c52662e273aad4683e577f
MD5 4bca24304861acde5770fdbe3cc2503b
SHA1 c9c64e071d2853bc7906c017a231ad1cc46ab630
SHA512 310070ab4092002aa33f550eb98680fa6662e7305fce227843430aba334fdfad1fe0dd4a6484264b59f9b02a780433a552ce3d5c3da643a77427463c06e47800
MD5 SHA1 SHA512

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\Real\Update.exe
Size 8.2MB
SHA256 d4a07f712ec40e4ab8bbb1245bee820d1294a4557af279c94402b33d0e451f77
MD5 516e2613ac7c08b18da590128cded6f5
SHA1 eb24a3d41ed2ef6d73d7077ed7f9e7022bcd51b3
SHA512 a17c7942162741a2bf9c68cce5179ea59abef0e41611a2cd442e9de9bfec0d96abadfea8d920348cb546a414f6fe1cdfc634e9c3affb861479ff683bcad84fb5
SSDEEP 98304:JXj9S0C2/bIa2ulkYfEqk6DdbIYis+kU0mwbEXev8wcFOvkSxMy5/Dn:N8w/Ua2ulkYcqk6DdbIYDrBwOUgBRD
TLSH
T15D86CF69A6BC01D9E867C2BDC2965227EB72B415237057CF1A609AF60F23AD41F7F700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 14d53e863947426896a8c89b5e8269ab8d1ad4f59b140e417bf61c90572ceac3
MD5 f54491b114ff648d00d3443c1c6acc33
SHA1 2f6c551f4276f18deb3afd99c1429f71bafaf11e
SHA512 4c8ddc664ecc3f1fdf571fc80ba1b12377b2d39995c5471c446fcad397d2cd3735a67ab4fb02822a1b3596282072659e8200c912e7e7d5ffdd11c6f7cc894e7f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 eb4088bf953a56304dc28144b5d0662e63328fd88645e3c0db42ce1f00bdfbee
MD5 425841f9e10964d75bd7e92e02e4a76c
SHA1 e602abd7907d68b08da25f66f1418ec8d52a75ab
SHA512 44c1cfef9abc00649b2f381b8dde2947407a3d270d7d98f4cb169c3731cb5a7f99a44c0b31e5021f71bbc78f08fcc7d3b1749a6784d02008e5a92aceab720a55
TLSH
T13DD0112232030A38E82022B30003A2080800C20F820AC088A82AEA2EBA088A80A028E2
MD5 SHA1 SHA512 TLSH

Submit Download

15eccc72-b7d0-45a8-b7c1-f12d4bbeee02.tmp

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\15eccc72-b7d0-45a8-b7c1-f12d4bbeee02.tmp
Size 6KB
SHA256 3d3902cd33db814812d11aa79e2bfedfa6280bbfa9a5516ff417d068d19ed55e
MD5 cbbee4c4e26aa38e973e9b4a458dc226
SHA1 470ae0ab9474a64450f90022d0da1139b09303f6
SHA512 a0c729f8b94334b3ddfc34f001a1603c07b818bbae8232d39fc7734b9055a9321a821ff5c1cbaa75ea2036cf7851f6d6a6d6147adb0aa8414c7e8fb2607a340f
SSDEEP 96:stD/dHJPbb9skso5h16Z0hs7/x+6MhmuecJJ2j0jeEyK+gj3O28XM1C7K:st75UTonhsV+FdJ24j7VkG6K
TLSH
T15FD195026E24797B4CC6E509BA357E13E2F9607275D11E58E7F88A2C04DB6DC2307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 576B
SHA256 53a1a2443556c50430a2b36d7b2c9ea19781f54715d46a43b9fe183506666d4f
MD5 3def4afaa35db31d7af1e125732083f3
SHA1 7b3d0dd62a177cc71d806f557e07a863a5905e5b
SHA512 c2bef968452fdbe795f479a0b853f714b451bf5cfc182bd7fd94e1d27f35ca1f26045c1c67eccfb4c16d32b1298d13393d61ad0b8e56694d29901525038c7cce
TLSH
T1E3F0DFBD4984008EFF14A1B0B5CB71ADB5345B9001331EADD7150FB8A8C93708B5040A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59eb21.TMP

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59eb21.TMP
Size 48B
SHA256 e635f0af3144ffb776e33e2f2d2ee88c53178bb377bd4c12ed3bd4aa5e452b33
MD5 1e5360c2a9993230e72dcb3d053fa8a7
SHA1 6821dcf23913afd028922965ddfa8f9ac7568ec5
SHA512 810b414c439d2b90e087df2ee71b86a0c0a0b754a56319dde1a3a58c9b6f8bd5ac460e7fcb4f7ba02007e97acca87749eadbb74294c2070ec528875d1038357a
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 15KB
SHA256 c2e01da3f694970f1387cfbf1ebade90a313dee1f5aa2dca5b0740e1493e444d
MD5 7fb081313a11b5c075d8a1858ca91a9d
SHA1 b44c10b4af0e6d6f0b4ec4b4682ca3e0d128aa3f
SHA512 133b826b0acaa382b4756fdbbe63d36d869247dee017725fb1139d0040771446ad9742d6a789026f061a37655d4ea84948ebd8d15502a205d71b409172658976
SSDEEP 384:5+aQikB+z/xvxjg/qhE9NBS5hDTx1AVdpy49zx:k/UxvxjgC+QBV1U9Fx
TLSH
T151729F2769797E33A5F3E604795D4B8BCBB884B255C16EB84EB99F0D02C729C1302C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 15KB
SHA256 dedf429fbefdf47e769ed79b2f540913ef2a4cd6ab03b4f7813ddbe6875a8151
MD5 24ad08596648255c9913d95b6c4ff9c2
SHA1 f74e7f431432e423fbe99a120a5da3bd05b39ef8
SHA512 b04e88baeecf9b329a3568a591559899e9143c9f96110d953e015b48d9946de380f91e3cfa17e7c007ce11f596fe73c0dee628100c707cd49a3d4c538b265e6b
SSDEEP 384:o+aQikB+z/xvxjg/qhERNBS5hDTx1AVdpy49zx:n/UxvxjgC+kBV1U9Fx
TLSH
T194729F2769797E33A5F3F604795D4B8BCBB884B255C16EB84EB99F0D02C729C1302C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 15KB
SHA256 cb345dd23ceecd57296804808c9ba5d227d79aafb42911ce6b76f90f742274b7
MD5 09fcdc8951156626925381fd25bfe8e0
SHA1 f5f3a5684a0799f1c3ac7ef3c0af294239d351d8
SHA512 2528d366de888d34d420e7559a838bacaf8040ee59a0c8dea2c4dfcecfc2efe5d9f79ca0f282246f5dc30338c9c01c188eb1e57ba036dcd55bd4106d497488c4
SSDEEP 384:8+aQikB+z/xvxjg/qhEANBS5/DTx1AVdpy49zx:b/UxvxjgC+xbV1U9Fx
TLSH
T19A729F2765797E33A5F3F604795D4B8BCBB984B295C16EB84EB99F0D02C729C1302C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 2KB
SHA256 cddb17665e8e7738d63c2da569a8f8d8d65c378b6b8ba4de9f8cff12fa6a6e54
MD5 5bd964e33e70f47bc5c1efc7779d6e8a
SHA1 a135477559e859f8d825b5f1772f0ee6fb4481aa
SHA512 d8763e053afe253d1fab4234fae8eeec9f5816f7ab647b79d140a3fa0873e51dafdc4d15903f554abb07e329e2ffb687b083dd463639f21359e18e1ca6d5e44f
TLSH
T1FD51743379749B3388A29608B94B2F179F7981A1AF912F60DAEC5F0C02DB54C2356C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 3KB
SHA256 b6a1e0526433941324f5245a4c7b50636ac0e6e63d85e21c5ce8f2bd61430ce0
MD5 6a1abf0f1d515d0d7b20af788dface8c
SHA1 d45e22d8c96232d54a470208dc0c7bd1186f6385
SHA512 9161d7e7efb58ae643ab47f245cd86d4bc335b52232026f96317ef1f99c3eec4673bc4448b95a0ae3ca9792d37e31122a55f1bccc3768ffeccb5427a71e4cb7f
TLSH
T16661773769B4DA378DF2D604B9862F06A7A54162E9D53FA5DAFC0F0C01D728C1352C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5997e1.TMP

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State~RFe5997e1.TMP
Size 1KB
SHA256 ea53da1630c19df66e058f7369dfa966cf010696c5aec316038020be26ecb9c8
MD5 bd96baff35f9974c1c3e1c31ae900d0b
SHA1 bfd1be0089b9896d1988c8b59d4f442c2014bfd3
SHA512 7a0d018e9925589760a7219279ba417e2e05c79eb4363d8b999154203767eb0cb8b14514319c77f869a5f38e46e93a3ddc390e05c379e60a6e6cde052e1e8312
TLSH
T146213272A5B49F33AC917209B2576F4B6F6540A686908F54A5ED8F0C03DA08DE73FC36
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Real\data\config\settings.json
Size 207B
SHA256 e4f38f124eb821848eb57d6988c5ef865768188e54d1e8f0ae34c59e9f99dd21
MD5 2b4a40c8495d5ddf7adc222e092fa67c
SHA1 fe7029809ff12457b0e50b92e87b33188fd18848
SHA512 18ba17b46e89fbaad852262144a4399fc6ce616853e80d33e9ea7dae69c2d0f8d2d3853af908c0a78c6e671b30fffcf3983ae02ccfaa5dfd0055db3ba456b9d1
TLSH
T192D02250DCF40E7313DA902A082B0010F0366C67009E3D3C38EA031C9F4F630417D384
MD5 SHA1 SHA512 TLSH

Submit Download

Real.exe

Path C:\Users\Admin\AppData\Local\Real\real-1.9.0\Real.exe
Size 14.5MB
SHA256 7a4bdeadb0b251ac3219c84737618fdbafa682467e8d9635674fdec3cb8a6c19
MD5 d0abdd8a9a0459802bb49eb659ec26bd
SHA1 61ffb41d0d90bcb15fddc26f8414c2f23f6e8fb4
SHA512 1f865b77185ce2a76bfe6fa2059f64d693a0078b965739424b5749648a6cc2da5d48c2a84ec4aa7ca7479c96fd8303c8ac8ba28dd1b5b2df94b84d15acbb8721
SSDEEP 196608:XqqeVkBP4D6xMX9X7jBTwdnAxF4JJ2JTDEwKBFnzT:EV+4TXVZ+nAfCUCn
TLSH
T11AE69D07F35181E9C0ADC0B9835AA637EA32B8894735B2DF5BE40B112E16FD06B3D759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.dll

Path C:\Users\Admin\AppData\Local\Real\real-1.9.0\bin\Real.dll
Size 3.5MB
SHA256 868f61c55ab11b5da9b90693228a5275f477fc9a1e62470fcc7d6ad0b0260db8
MD5 9d24ff354d97baf48c24b072673fe62b
SHA1 81fef6b51bf95aa867b08b6fa19531e4f9909df8
SHA512 8165a0718c7d1d0706a1ce662c56a01219deadbd7cd928de0a9f9a51d213e128618d00f68326b3008e96e4fc12fa6190edc383d88c2b62811bebf2ba4df72f05
SSDEEP 49152:O3I1UbcWkn0J2Q91AmItrOdzuApdCdhKE2/5YRK+CUSkGMaKJvJTXKg22Qr8/frR:XKbynk2ubgApdCdEER9SK5TXJgkQI
TLSH
T18006CE2E05DDD39AFA6B937BA60933744F6343913C2D10B8327A3A8D17769E51BB2311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.exe

Path C:\Users\Admin\AppData\Local\Real\real-1.9.0\bin\Real.exe
Size 4.0MB
SHA256 9d316dc7a9d4a744ab5c0c24d0c494f43ebd77f08f585cf98299e8fac07ce515
MD5 ed30d14de85c9795be18b43e15f236e1
SHA1 c5069d4bcdd6fc548a09582a2eb3bab693f5e1a7
SHA512 c100159cf0633cd0e541f30db88b556c6a8485cfa00a769b2e3ee11e50f618af51fd266956e8fd7e74972dbffdab75a7761df16ed3b46bb831b52e1eb807b9a1
SSDEEP 98304:HIc8W7JtDL7kvynCMFPcT0MyAKSEJNsCJLnOOHE4vtIDnS:HIrWJtjkvyrWT0dAKSsmKqu9KS
TLSH
T13A1623167A9988BECE87C4B5E206DDB7C607788B1F71B9DF034016363D636E06B39612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spoofer.exe

Path C:\Users\Admin\AppData\Local\Real\real-1.9.0\bin\Spoofer.exe
Size 2.6MB
SHA256 f4927849fea9d5abd064ed5ec61c45785490a93d75258de466db74e1b70da51a
MD5 1f79f23e16f08c13d3d50cff49b287ac
SHA1 2893622bd2183579b631a14ff4a5015666bfd820
SHA512 9d1f41cef2d5d707b96ab5b35dde8b85164f6e8794b752f576fe192934a4a62b1512ad512d917b98969afd25adf29537cb8c7bdd46c261d2811972b296f76a93
SSDEEP 49152:iSBsRHoPtqamwxg4muCBfxz2MWPUnGJG//2/XmMj17GPwhm9SeD5bc4TH:Iok6dyBh2MbnGM//n+9hm8epL
TLSH
T117C533FA16C2EB38DC8E137B233F07169B4684FC5C5DA16B29E7876D8706539C84588E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

real-mcp.exe

Path C:\Users\Admin\AppData\Local\Real\real-1.9.0\bin\real-mcp.exe
Size 1.6MB
SHA256 1dd7738163b5266d78f30b04281b1d48927acfdd6879e7576f0862a1b6497e95
MD5 52f687164c175d24e9f4f22e6f17181c
SHA1 99b67fe1a7417616656cd9a34b31b1a0c5657bc1
SHA512 ec740a365519531208a5f536277043d71bd4995cc5c06cc65a4984f47bafcf67626e8218e2ba1823c7c88eb1184bdbddf369f48852af9434e9f45219b6ffc064
SSDEEP 24576:RXvDv4konyXJzOaNDOXDPiFBzmQJDXqZXxdOmOTFM3VIH06iyGdXQ:BDv4konMzBOGFBz3DXqZzuhYIU6ilJQ
TLSH
T18C857D03E69580ECC4ADC578C3579A36AA73B88D0A34B2EF67D04A513E2BF905F1D719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 1KB
SHA256 8a2f237f549cc73625d80046562ad3d153c8a97aa41bed190588091e09fc5467
MD5 361f6e1cff72ebd411476de03a439c2a
SHA1 729f0d9fcefd13662e7f5ca99887456549ffb810
SHA512 26903c10dd11fc63998cd204fb91dcd0a79942696f084298eba5397f9f72d96b05ec5b7a41c2be94f08618ed001c5e9a2f5700042771267968a0f28a2f3d5b2a
TLSH
T14E31AB5D01BDF4F9298384A79734D50CEB8830EA74967690F1D385C4ABD8A2EDB02E59
MD5 SHA1 SHA512 TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 2KB
SHA256 cc771e9ef92cb78990b0e55a63b5976a21e4267c44ba4946bf0fc52807c16612
MD5 d09ca2029aac82da04a2b5934a534063
SHA1 c6115ced2bed91ffe7f5fed1d3df5f274a34902e
SHA512 2e06c8226011fb2d4bb2a9f7d7c0da3ddecfe6ddf579dc3886266b4b37bb446b61488f748cb4bdb525de035611b7a66c8043e6342a6ac67acdffac37b64de2bb
TLSH
T10C51409D00BDF0FD2D93C49BDA38D508E78830D9B5963550F29386C4ABDDA2E9B06D49
MD5 SHA1 SHA512 TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 4KB
SHA256 ceb29bde517f35921dabf92b28f5f5be399bfecd17b31f913b379f161cc66e48
MD5 5464b13bd4cfd90c5d13a35e27653a17
SHA1 0c19f3abf3a6aa4580fca1bb1d5449b66928e075
SHA512 eddc3d37f3ad21e283b3b57bee94b1ce7351ff1bd20d8c47522b8766b9468a0f4a81ecc47890532135e6f75ba600d3a3d32006d2d85e3557f10f7ae96160b258
SSDEEP 96:oi7Or1Yf0kPzKDsdUhYDrgHYNS3aNJtXr87YFsUe:25BWUI8vw4Ee
TLSH
T14C917B9D00BEF4FE3D5BC49BEA38E908D74830D654956950F68247C8A7C9F1F9B02E05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4c98e7e1-e878-4877-a292-0bc346bf127f.tmp

Path C:\Users\Admin\AppData\Local\Temp\4c98e7e1-e878-4877-a292-0bc346bf127f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1eafc4342ec3a46a96fc7e36353815872d752dd95489df0452d6f36ca3844a06
MD5 ed4c44c99b116444bca7d5d19f46c4b5
SHA1 b56d578575f71d862b6a685a056bb3cd9900d102
SHA512 d44051c1b97c2fc787cf3ca3a0d997ecad09debb60d60c09ce8c1138673efc86606edb82a62ca6d356990f8a09548f7bc750a9c4ae2d2a6780f38e380adfa998
TLSH
T1B7D0122333010274C21030B70502B64A0444D10F440949806938AA1E1A440502D12442
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 79603238119253cfed0db3502744a9a3bf95f3b15edcc107cf5c3179b16736c1
MD5 0f86fc918b2bea1984433d7f7af7616a
SHA1 4f990491a5fe5ffad68941ce248a60dfa8df2faf
SHA512 ca7737998d2189cdb76ff27998a933dc2d999fef9f573b18111c519084bb64fc35b89d0ef79f67887d456ff691980588a856831feb652cf0d27a6ffa1820879d
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

1d9d0d28-2ed0-464c-a763-6f0061a266d6.tmp

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Default\1d9d0d28-2ed0-464c-a763-6f0061a266d6.tmp
Size 5KB
SHA256 6e2ff3e0b4c32f9075567bcb8929d284551d415408a84bdd1e5ac292cae96ec7
MD5 574a47c28a8e680959c2ea9921b14128
SHA1 c88d0473307a67583a15f360704de1c1bad8c3c6
SHA512 fd9946daa942d1ecf7330ef526e71e42183206321feddfe76f1df2ceb2864ebb23b184c45432f2e6a9eaac67c35cef504e195d6d8e1e97d28423c8fdf4745fa6
SSDEEP 96:rE/dKCpbWb93kGdo616ZZs7/x+6MhmuecmjeDbK+gKI8XM1C7K:rIw2UTojsV+Fijxkg6K
TLSH
T1A6C186066E28B97B4C86F10CBA3A7A43D2FA603275D52D58E7F8466C08DB5CC6317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 38b910f2eb87d289e112bdfc6c346c2e13724ff86c774042a3ae03e8b6c9b1a6
MD5 e78bbf1619670ece444e2f4e5c8c9110
SHA1 09a22c10215267b633199c567b001dc864305995
SHA512 c2080e512a2e9242e1c39a5e184d2a8f32657be5cef08ab62b2f0246447d42890b63e0e64a4cfbd605cfdf8cf7967196658fb0ce9fe514105142d273bb536e92
SSDEEP 3:LstlNllklkXlFrl/l:LsX3lPFrtl
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 d67635334055ac8008b2ed9c026e13a49412457c81ec172d8c1450d922605ea4
MD5 2426c6f284f0f77a9c486bbc65d9b712
SHA1 8f71bd5a9eaff6f6dccbb63c56954e7df58eb39c
SHA512 52b8a7959978f7cc754c261d5f194a418d28d639501c4ccb4bb287104b8e63d68b6165d0211235733c9b7777cd7e2456b0fa01666763b987a9b03ab12b38f2ee
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Default\DawnCache\index
Size 256KB
SHA256 e4c6e028c8e1f01eeeb866517677fd4a337f783994a150ec99a5e663de5222ec
MD5 16c49b38dc0318ab527d04d057b97218
SHA1 df3c2ba5dfe16d856cf7b0612b8eb1ed03760bb8
SHA512 d6e0264a0ef191487849405d3a41313503f8a8ab46eebf399f73e13b8d18d64994102c77b6eba023108c04144daf1806078b4d67331cad57f8d02183cbedaf7e
SSDEEP 3:LstlNllklkXltCSql:LsX3lP2l
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Default\Extension Rules\LOG
Size 367B
SHA256 048342471ad37051d0bc9f6ccd94bac898e439a7506ce18b73693841c76b7b00
MD5 363a089dd2a975f52df81a1acc648d2e
SHA1 181c44574c97c3d1f4680c59f596c2f0098d4a2f
SHA512 21cf4f6242cd81ceef460c1b5bbb9c05f5b6fed83c56f4c1263da4668775c65296db092be0ba32aebf1a7f4121c727c12cec69c8fb246837dd6d1ddfdd197a88
TLSH
T169E02202084AC8A5AD92FAE6E1BD831AC342784DAB843A0E0E4C9995324314CB3C0BB3
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Default\Extension Scripts\000003.log
Size 38B
SHA256 1c43a1bda1e458863c46dfae7fb43bfb3e27802169f37320399b1dd799a819ac
MD5 51a2cbb807f5085530dec18e45cb8569
SHA1 7ad88cd3de5844c7fc269c4500228a630016ab5b
SHA512 b643a8fa75eda90c89ab98f79d4d022bb81f1f62f50ed4e5440f487f22d1163671ec3ae73c4742c11830214173ff2935c785018318f4a4cad413ae4eeef985df
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Default\Extension Scripts\LOG
Size 371B
SHA256 e66fe085eefc84a25303e430cb2a1529a2c33e54e675184c466cb4edf3c62bc5
MD5 20d219841a451c4d32b128de6ebd83d7
SHA1 290ed263105aebd9ff4f0d14a05a6d67317b3301
SHA512 e6b1e2b9d6f6637824b7e5f18882679a7986835b33a32699d4c6ef53827c4a6e56d9b336c15b3205fae34e29cb5f1ed4f135db2c892503c2cc3bce580f6a063e
TLSH
T167E02B04089EC8757D92FDE3C579934AC38278497A84BA0D0E599EA43203148A7C0BB3
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Default\Extension State\000003.log
Size 114B
SHA256 e2610960c3757d1757f206c7b84378efa22d86dcf161a98096a5f0e56e1a367e
MD5 891a884b9fa2bff4519f5f56d2a25d62
SHA1 b54a3c12ee78510cb269fb1d863047dd8f571dea
SHA512 cd50c3ee4dfb9c4ec051b20dd1e148a5015457ee0c1a29fff482e62291b32097b07a069db62951b32f209fd118fd77a46b8e8cc92da3eaae6110735d126a90ee
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Default\Extension State\LOG
Size 367B
SHA256 4be71e17dcd8180c1531169757540a17eb1eb6cc08033a85da7e0ad957761b6f
MD5 31121c6c8642e8a60c121c683e2809b7
SHA1 250a2ae13ba15955b0ca7abefe89cad9a1eb7b4e
SHA512 4ab4c8d781e7c607bea886cafb8c2cedb7109928286870a5111f1676e05eb7049e396457db9ba72d61dfcaec30af864ec62e06aec2e7e0d2e9ca97e7b95d0e16
TLSH
T124E06100044EC875BD92EEE3C63D4307C746784D7A803B0D0D5CA9543203149B3C0B73
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Default\Favicons
Size 20KB
SHA256 2db221a44885c046a4b116717721b688f9a026c4cae3a17cf61ba9bef3ad97f4
MD5 b40e1be3d7543b6678720c3aeaf3dec3
SHA1 7758593d371b07423ba7cb84f99ebe3416624f56
SHA512 fb0664c1c83043f7c41fd0f1cc0714d81ecd71a07041233fb16fefeb25a3e182a77ac8af9910eff81716b1cceee8a7ee84158a564143b0e0d99e00923106cc16
SSDEEP 24:LLiXxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:iBmw6fU1zBmI
TLSH
T1AA92EE075E383407DBA10E7D266B187A8E3FE26C5FA29C94347410618CF9482D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Default\GPUCache\index
Size 256KB
SHA256 e84ca61e27136bc67213c1afcc57b5c6745dd9fa785c3f2b28ca6b0bb7ef35bc
MD5 27a7dd0a790d4e3d13e9cef5a9f4e6fb
SHA1 3813418b6051fdd871b87550a357cb94b896f3e6
SHA512 076587c16280790cb204d2216c9105abb75cc9f082f33e4a411450398169e0cee4693045ebe28fc7fbeb641646ac8ca54bd266bf14b94fcc12b3327be9a7f9a9
SSDEEP 3:LstlNllkll/lVC+tl:LsX3lEtttl
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Default\History
Size 164KB
SHA256 deba77bc71479c2e98a7f985233a7dc3a386ebc0dce33a347c6ac21d9ee1c573
MD5 a52a55fd35156c4962d5056465aa9d95
SHA1 c22a74097d6717d550758cf6f7ac16c3a4bce1e8
SHA512 2683277a6451aec89c9e40cc554ec5d16f22cb44c12ff404ea6c13acd8306552861b279f9a4e6aea3b715ece2e0f1969ff4c37f4c2e4b67336c4aa07d0a2adc7
SSDEEP 96:MBaLqL/uejzH+bF+UIYysX0fxQp97sXEHt/DfLVVVN6zRk/E0:MBGqL/tH+bF+UI3iWGVsXWNVVV63
TLSH
T10FF3EA1E5F643722CDBD923668E745B3597CF03F876326856CA114B1CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps Icons

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Default\HubApps Icons
Size 28KB
SHA256 b776393bf73aad8773d92bcd6a515c865c850b00800144795153cf26f02d357a
MD5 8ce79cfe5162fc50d6a65babbc1cd81f
SHA1 a37fddb337313a892a02d3dc8a9d8b42f448007e
SHA512 327780168c5dbdad5c803eeb3f1b1b8b7c4a8b2fad6a3f8a1373321b7cf0abf381ea2f1ba66cca1acf73ddade2acdf919af8f248ba077fc8f7062eb761f8f68c
SSDEEP 12:TLMZly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TL6cjr0+Pdajk+FZH1W6UwccI5fBI
TLSH
T19FD28E5A5F04FB33C9794BBC90C305D65F79573E4F40CA5152F8A0686B804C8A26D92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Default\Local Storage\leveldb\LOG
Size 379B
SHA256 9f9c7df2eeaac7c6c82fd0c3d0095fe42dc022820aad6dbb402af81d03ba32e4
MD5 09e648fb27a0ee80a71e1e24b8b08b37
SHA1 f9478397b8b887b2db1ee3e4e81fe4a04678aff7
SHA512 c929248a64e808112202e3a57a35d7b932d986a2dd406e3a16dc54ee22d748fd799ca460c2a7759384f47fb825e1c7e5c1002987bb478f7236d6208cea31832f
TLSH
T194E02B60454EC9657E41AA9BE13D671AC361784DAA847F0E4D44BA553643048E3C0BA3
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Default\Login Data
Size 42KB
SHA256 0c1c2e0223f73fea44686ae44f4e78411de421f7aef7d89617be3837d3fdbc11
MD5 cec405af1bb4df2029eacdcbc7e05fd6
SHA1 835e45888f49095a184a62a229a437399c9c62cd
SHA512 4ce266cc942447ac963f4652c058a28d7641e37a06a5cfa4b290e70d77efb80e00312363ee5adb9e502fa32ad1cf661c18ac9581d1fcb2f83e7cb6429325458e
SSDEEP 96:klpeymwACn8MouB6w9f/FlXqiEqUvJKLuyn:klrAG7Iw9ftFqidn
TLSH
T1B213350F2B682401C8AD8636ACB114B66E7CA13F4B639FD52CB104259D75C63B12D5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Default\Network\Cookies
Size 20KB
SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
MD5 91dbaf73c1a8c55254d90272f998e412
SHA1 2b86b31c8c00c937291e5ac3b1d134a5df959acf
SHA512 109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988
SSDEEP 24:TLWr6bXYFpFNYJqH1kwIY6UwpQ9YH8rwZ6HfB:T+6LopFS+awWUOh8B
TLSH
T126926B4E5F346221C0F48B36EDE1855B2F7C201CD3B32655DA5860F3DE9299BF10956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 10ce46995378459151b5a072d6ef1e54867ce57edcc1520ec6a0965b5ff432ff
MD5 5f080b35a2352f916d574e049ffa88c5
SHA1 bb4cdb42ea2c454bcb92fac028696d65b4b91697
SHA512 b9862a5ba6723d3859bb1baecc04df0bf14a3d6c06278fd7cfbbba2412fd0dc5dceca969a9e1fe967a8f29764cb800f475b3270f3d1c2868f56a2d1586125bea
SSDEEP 48:TkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:IIEumQv8m1ccnvS6
TLSH
T169F2149E0B1D3A10C4F89674EAC10DC37D7D141D8B96EFC45AEC06F2FF862A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Default\Network\TransportSecurity
Size 188B
SHA256 e836e60c8e153d8f74a04318f505eda80fd9aa77bd343fe61961e2710bf3b4ee
MD5 6100de8d0e87ea3841b0b5c5e32bc157
SHA1 afffd2668fa43fae1c57b372b6f232f7bd0d1066
SHA512 752e50032452cb2eb586ea94920d1f8188210f6ae167ae6b9c38d29524a507c79d3b9620a40484f88042b497c202e685699e4a13f1f67152f614485bf591aebe
TLSH
T1E9C02263007BA136503806312880AD009E36B07400C2A8EAD2B205AD90800666503102
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Local State
Size 2KB
SHA256 81a91e479ab2a7af9b0dd964d7f18f85d41e75789f8376ccea209fa9f45f1a92
MD5 7e51d0147d2f9b7d5b980ddd58310dfd
SHA1 95aeb550fb1bc01c7c0691bd340d3234ad081b85
SHA512 0902d1687bc1a61495c38988e66357603579f2bd1c79c6a5b3573b2e09f823f85ecedb34e398ed68de2b0af1a1ed8131d87594209e9d5b72e72b4a8070f5337f
TLSH
T1C35175337424AB37CDA28649799A3E278F7650A5AB913F609ADD0F1841C714C1302C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Local State
Size 3KB
SHA256 0a9d2e1cd6898936a3482684afb746ced83c2549940ac20b8535e4bc6c7935b6
MD5 0112d60f5ad4d3c9565c71bfb4a4a63b
SHA1 3074074a20c98eb0997ad550bd0dc248f4622f18
SHA512 acf11a4eac395786abfcd44fb335d277713081aa9f34cb228589bfa96f4afe61321736020e32c2ff0807ecded48e1e681f33a24f29becf2b18091b414431a29d
TLSH
T1A06185366574EA3B8DF3DA45B88A2B17ABA55027E6C13FA4D6EC0F1C41D728C1342C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Local State
Size 3KB
SHA256 c617d713037bab3fb6b3198aeca311bca25c1f221138e27f8bc8553350694e73
MD5 00fa8631b9c3e4eff850c8780590109f
SHA1 e2aaecb4e2c50486ae9f3d919923a57278c1d6d2
SHA512 c8d9b791e57a5a4f20834faff8d46aa60e028ecf37983445770ec83595b957d3c06f88e602d70092970be709e23051e2796ab34adaefdc25b02eee5ad2e4f555
TLSH
T16C7187266574AA378DF3D649B9863B17A7655023A6C53FA8D6FC0F0C41D728D1342C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Local State
Size 3KB
SHA256 957607640a5768b1ed2843119a757bd0f62ae6cc18c174ff832b24e0b20012df
MD5 05376841f62a7e850c24b80aa0e3a2d9
SHA1 ca401b93fbedfe6b374b382516ba3fdf04979256
SHA512 c4cfdd33b50d0597371f4c4c53a07f409834cb31da2dc3d32072a08c70a245e3910fb55509cb2343de2aee684adfb3780fd0b53421b2fe0cf453f99a1480c0be
TLSH
T1D17177266574A9378DF3DA49B9863F17A765502396C53F98DAFC0F1C41D728D1342C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe591340.TMP

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{5F34DC93-A575-46D4-A73D-4E20F7F89920}\wv2\EBWebView\Local State~RFe591340.TMP
Size 1KB
SHA256 3823a94cf719e62ef0c4ccfd1cc5f1ab5235040a9750bd515596ecffc3aca2be
MD5 c0e81ae47585cd082f1d70755c090e37
SHA1 a0e7f9e4a4032541e0e72edde640de5c81e9209b
SHA512 ab28720f48d389084440ad6a434557d59f8a6c04fd8591f4d8f8825bb038b5f68caf02fbe49d3b8c7267c12d8cc705a900eeb61c19a48513e1bb40ec53cf27ca
TLSH
T1C3216572E1685F33EC92A68A61567E1B5F3150AA83915D40A1DD4F1C42D704D9625C33
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_p5qysh1p.nts.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p5qysh1p.nts.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

luau-lsp.exe

Path C:\Users\Admin\AppData\Local\Temp\real-luau-lsp-extract\luau-lsp.exe
Size 16.3MB
SHA256 0da4f09d474e41074f4ec52bfef01eb90c014928358eda88f6a5afad5319b537
MD5 be087717213e34f06e6198159d9c73dc
SHA1 60e2ca8a33531199a644061238b1605f78b8ae66
SHA512 fdc7b914eb7425bc17c23a7e52c7256f0263448ef4e0469302386a17b6ed3d5241bdc4cc2c43092c521368b9c09540ade980deffa16c201455b5a9a8650104b6
SSDEEP 393216:XdTfwgggjgzggsgTguwttbgNlggigggXsgJgUQLCgggggCNc/gggga4ggggcgggg:NRggjgzggsgTgugtbgNlggigggXsgJgB
TLSH
T132075B3A21AC01DCF1BBD0BD8BDB9E47D6B2340903319ADF0591569A1E1BDED4A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

real-luau-lsp.zip

Path C:\Users\Admin\AppData\Local\Temp\real-luau-lsp.zip
Size 4.9MB
SHA256 faea1b177f4761e4c34e0dab72009a2fdd00f21d61f3f7b7c1fe1ac3f38a05d2
MD5 1b284c21f9cd1359868016692ace2db2
SHA1 24792218a8d9d76b3f69a274ef6190cd33106f7e
SHA512 fadbb5db04d125e12a5d1e7153026efdf568d51a1b15afa6d732a75fdbfab87eb14a5e2b64364fd47b4ab4b9c4e5fed8ffe8d5e7e09fb8e396e302879f9f6c74
SSDEEP 98304:sBXd2Q4Jz8eM42l/+T/5/Wbv9z8LT6Eb7OuITvBFkF9ba9v:iXd2Q4u+iw92wLT6AOt7BFkF4N
TLSH
T1203633DCC801D7A32B91C32FF9DEE523338FC254CC30316556A85E453A9E578EABA586
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1224-876-0x0000000140000000-0x0000000140A9D000-memory.dmp

Download

memory/1224-879-0x0000000140000000-0x0000000140A9D000-memory.dmp

Download

memory/2744-471-0x000002636A190000-0x000002636A242000-memory.dmp

Download

memory/3672-997-0x0000018AD3C80000-0x0000018AD3FFC000-memory.dmp

Download

memory/4224-230-0x000001E726470000-0x000001E726482000-memory.dmp

Download

memory/4224-231-0x000001E726450000-0x000001E72645A000-memory.dmp

Download

memory/6284-173-0x000002057E980000-0x000002057ECFC000-memory.dmp

Download

memory/6284-102-0x00007FFC83FC0000-0x00007FFC83FC1000-memory.dmp

Download

memory/6384-171-0x000001D9BA000000-0x000001D9BA37C000-memory.dmp

Download

memory/6384-26-0x00007FFC83FC0000-0x00007FFC83FC1000-memory.dmp

Download

memory/6496-998-0x0000022C75C40000-0x0000022C75FBC000-memory.dmp

Download

memory/6664-191-0x000001741B9B0000-0x000001741B9D2000-memory.dmp

Download

memory/6664-194-0x000001741BA70000-0x000001741BA8E000-memory.dmp

Download

memory/6664-195-0x000001741BCF0000-0x000001741BDA2000-memory.dmp

Download

memory/6664-196-0x000001741BA90000-0x000001741BA9A000-memory.dmp

Download