b411b444682179bf2f4270fbc22d9a86263b659152f9611712ec40101a8f3aee

Analysis

user interaction
yes
max time kernel
24s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 02:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RealSetup_9cc1e0d51f6387bbbafd1ffda6957ebd157c35ea6b326ea4b1a105f614d79951.exe
Size 16.5MB
Sample260820-cwt8pa1thy
SHA256 b411b444682179bf2f4270fbc22d9a86263b659152f9611712ec40101a8f3aee
MD5 d81c13e9063abe4687060d633ff1f701
SHA1 bb5bc882d52a5c342ab214df7de170e7d2f4769a
SHA512 d8e049c1d5212855fc61d13e81add838bd7131d4dbe6452f9259c1d9804c6ff59222069e8f6596e179d1991ef6137d463900531c9decfbeb4a9bd2a186c1cba7
SSDEEP 393216:8OtYCUkjbi+D014Buf8uKzYYlAbf4EOUYNOUY:NWqgQEY
TLSH
T12A07B069A6BC00E9E467C2BCC2965223EB72B415277057CF5A609AF60F23AD41F7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
452	powershell.exe
5036	powershell.exe
5108	powershell.exe
452	powershell.exe
5036	powershell.exe
5108	powershell.exe
1500	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	RealSetup_9cc1e0d51f6387bbbafd1ffda6957ebd157c35ea6b326ea4b1a105f614d79951.exe

Executes dropped EXE 2 IoCs

pid	Process
4220	Update.exe
2576	Update.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RealSetup_9cc1e0d51f6387bbbafd1ffda6957ebd157c35ea6b326ea4b1a105f614d79951.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
100	discord.com
106	discord.com
83	discord.com
84	discord.com
86	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2432	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4800	cmd.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4800	cmd.exe
4208	net.exe
1708	net1.exe
2088	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	RealSetup_9cc1e0d51f6387bbbafd1ffda6957ebd157c35ea6b326ea4b1a105f614d79951.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316663862088066"	RealSetup_9cc1e0d51f6387bbbafd1ffda6957ebd157c35ea6b326ea4b1a105f614d79951.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Update.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Update.exe

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\projectreal\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Real\\Update.exe\" --write-deep-link \"%1\""	RealSetup_9cc1e0d51f6387bbbafd1ffda6957ebd157c35ea6b326ea4b1a105f614d79951.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\projectreal	RealSetup_9cc1e0d51f6387bbbafd1ffda6957ebd157c35ea6b326ea4b1a105f614d79951.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\projectreal\ = "URL:Real Protocol"	RealSetup_9cc1e0d51f6387bbbafd1ffda6957ebd157c35ea6b326ea4b1a105f614d79951.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\projectreal\URL Protocol	RealSetup_9cc1e0d51f6387bbbafd1ffda6957ebd157c35ea6b326ea4b1a105f614d79951.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\projectreal\shell\open\command	RealSetup_9cc1e0d51f6387bbbafd1ffda6957ebd157c35ea6b326ea4b1a105f614d79951.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\projectreal\shell	RealSetup_9cc1e0d51f6387bbbafd1ffda6957ebd157c35ea6b326ea4b1a105f614d79951.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\projectreal\shell\open	RealSetup_9cc1e0d51f6387bbbafd1ffda6957ebd157c35ea6b326ea4b1a105f614d79951.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1500	powershell.exe
1500	powershell.exe
452	powershell.exe
452	powershell.exe
740	RealSetup_9cc1e0d51f6387bbbafd1ffda6957ebd157c35ea6b326ea4b1a105f614d79951.exe
740	RealSetup_9cc1e0d51f6387bbbafd1ffda6957ebd157c35ea6b326ea4b1a105f614d79951.exe
4220	Update.exe
4220	Update.exe
2576	Update.exe
2576	Update.exe
5036	powershell.exe
5036	powershell.exe
5036	powershell.exe
5108	powershell.exe
5108	powershell.exe
5108	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1208	msedgewebview2.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1500	powershell.exe
Token: SeDebugPrivilege	452	powershell.exe
Token: SeDebugPrivilege	5036	powershell.exe
Token: SeDebugPrivilege	5108	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 1208	740	RealSetup_9cc1e0d51f6387bbbafd1ffda6957ebd157c35ea6b326ea4b1a105f614d79951.exe	89
PID 1208 wrote to memory of 1864	1208	msedgewebview2.exe	90
PID 1208 wrote to memory of 3760	1208	msedgewebview2.exe	91
PID 1208 wrote to memory of 3760	1208	msedgewebview2.exe	91
PID 1208 wrote to memory of 3760	1208	msedgewebview2.exe	91
PID 1208 wrote to memory of 3516	1208	msedgewebview2.exe	92
PID 1208 wrote to memory of 2768	1208	msedgewebview2.exe	93
PID 1208 wrote to memory of 2768	1208	msedgewebview2.exe	93
PID 1208 wrote to memory of 4324	1208	msedgewebview2.exe	94
PID 1208 wrote to memory of 4324	1208	msedgewebview2.exe	94
PID 1208 wrote to memory of 4324	1208	msedgewebview2.exe	94
PID 740 wrote to memory of 4800	740	RealSetup_9cc1e0d51f6387bbbafd1ffda6957ebd157c35ea6b326ea4b1a105f614d79951.exe	96
PID 4800 wrote to memory of 2432	4800	cmd.exe	98
PID 4800 wrote to memory of 4208	4800	cmd.exe	99
PID 4208 wrote to memory of 1708	4208	net.exe	100
PID 740 wrote to memory of 2508	740	RealSetup_9cc1e0d51f6387bbbafd1ffda6957ebd157c35ea6b326ea4b1a105f614d79951.exe	101
PID 740 wrote to memory of 3236	740	RealSetup_9cc1e0d51f6387bbbafd1ffda6957ebd157c35ea6b326ea4b1a105f614d79951.exe	103
PID 740 wrote to memory of 1500	740	RealSetup_9cc1e0d51f6387bbbafd1ffda6957ebd157c35ea6b326ea4b1a105f614d79951.exe	105
PID 740 wrote to memory of 452	740	RealSetup_9cc1e0d51f6387bbbafd1ffda6957ebd157c35ea6b326ea4b1a105f614d79951.exe	107
PID 740 wrote to memory of 3980	740	RealSetup_9cc1e0d51f6387bbbafd1ffda6957ebd157c35ea6b326ea4b1a105f614d79951.exe	118
PID 740 wrote to memory of 2576	740	RealSetup_9cc1e0d51f6387bbbafd1ffda6957ebd157c35ea6b326ea4b1a105f614d79951.exe	119
PID 4220 wrote to memory of 5036	4220	Update.exe	120
PID 3980 wrote to memory of 664	3980	msedge.exe	122
PID 3980 wrote to memory of 2088	3980	msedge.exe	124
PID 3980 wrote to memory of 4544	3980	msedge.exe	125
PID 3980 wrote to memory of 4544	3980	msedge.exe	125
PID 3980 wrote to memory of 4544	3980	msedge.exe	125
PID 3980 wrote to memory of 220	3980	msedge.exe	126
PID 3980 wrote to memory of 220	3980	msedge.exe	126
PID 3980 wrote to memory of 4756	3980	msedge.exe	128
PID 3980 wrote to memory of 1500	3980	msedge.exe	129
PID 3980 wrote to memory of 4756	3980	msedge.exe	128
PID 3980 wrote to memory of 4756	3980	msedge.exe	128
PID 3980 wrote to memory of 1500	3980	msedge.exe	129
PID 3980 wrote to memory of 1500	3980	msedge.exe	129
PID 3980 wrote to memory of 396	3980	msedge.exe	130
PID 3980 wrote to memory of 3192	3980	msedge.exe	131
PID 3980 wrote to memory of 396	3980	msedge.exe	130
PID 3980 wrote to memory of 396	3980	msedge.exe	130
PID 3980 wrote to memory of 3192	3980	msedge.exe	131
PID 3980 wrote to memory of 3192	3980	msedge.exe	131
PID 2576 wrote to memory of 5108	2576	Update.exe	132
PID 3980 wrote to memory of 5236	3980	msedge.exe	135
PID 3980 wrote to memory of 5236	3980	msedge.exe	135
PID 3980 wrote to memory of 5364	3980	msedge.exe	136
PID 3980 wrote to memory of 5364	3980	msedge.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\RealSetup_9cc1e0d51f6387bbbafd1ffda6957ebd157c35ea6b326ea4b1a105f614d79951.exe
"C:\Users\Admin\AppData\Local\Temp\RealSetup_9cc1e0d51f6387bbbafd1ffda6957ebd157c35ea6b326ea4b1a105f614d79951.exe"
1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:740
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RealSetup_9cc1e0d51f6387bbbafd1ffda6957ebd157c35ea6b326ea4b1a105f614d79951.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=740.4868.10380040369160836966
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ff86da3b078,0x7ff86da3b084,0x7ff86da3b090
    3⤵
    PID:1864
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView" --webview-exe-name=RealSetup_9cc1e0d51f6387bbbafd1ffda6957ebd157c35ea6b326ea4b1a105f614d79951.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1680,i,12078570466282283968,15971799585048391815,262144 --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:2
    3⤵
    PID:3760
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView" --webview-exe-name=RealSetup_9cc1e0d51f6387bbbafd1ffda6957ebd157c35ea6b326ea4b1a105f614d79951.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2028,i,12078570466282283968,15971799585048391815,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3
    3⤵
    PID:3516
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView" --webview-exe-name=RealSetup_9cc1e0d51f6387bbbafd1ffda6957ebd157c35ea6b326ea4b1a105f614d79951.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2364,i,12078570466282283968,15971799585048391815,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:8
    3⤵
    PID:2768
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView" --webview-exe-name=RealSetup_9cc1e0d51f6387bbbafd1ffda6957ebd157c35ea6b326ea4b1a105f614d79951.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3608,i,12078570466282283968,15971799585048391815,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:4324
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config w32time start= auto >nul 2>nul & net start w32time >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Windows\system32\sc.exe
    sc config w32time start= auto
    3⤵
    - Launches sc.exe
    PID:2432
- - C:\Windows\system32\net.exe
    net start w32time
    3⤵
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:4208
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start w32time
      4⤵
      System Time Discovery
      PID:1708
- C:\Windows\SYSTEM32\w32tm.exe
  w32tm /config /manualpeerlist:"time.windows.com,0x9 pool.ntp.org,0x9" /syncfromflags:manual /reliable:no /update
  2⤵
  PID:2508
- C:\Windows\SYSTEM32\w32tm.exe
  w32tm /resync /rediscover
  2⤵
  PID:3236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "try{ $ex=@((Get-MpPreference).ExclusionPath); $want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll'); $stale='C:\Users\Admin\AppData\Local\Temp'; $miss=$want | Where-Object { $ex -notcontains $_ }; if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1} }catch{exit 1}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll');$stale='C:\Users\Admin\AppData\Local\Temp';foreach($p in $want){ $ex=@((Get-MpPreference).ExclusionPath); if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }};if($stale -and @((Get-MpPreference).ExclusionPath) -contains $stale){ Remove-MpPreference -ExclusionPath $stale};$ex=@((Get-MpPreference).ExclusionPath);$miss=$want | Where-Object { $ex -notcontains $_ };if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/projectreal
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ff86af2c188,0x7ff86af2c194,0x7ff86af2c1a0
    3⤵
    PID:664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,8970651730580153573,11495685375054050904,524288 --field-trial-handle=2428,i,14887531031092276619,10116304647844506587,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,14754965549116266852,14005374581919977290,262144 --field-trial-handle=2428,i,14887531031092276619,10116304647844506587,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:2
    3⤵
    PID:4544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,15123771263041079561,719646198521047577,524288 --field-trial-handle=2428,i,14887531031092276619,10116304647844506587,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:8
    3⤵
    PID:220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,14267059696176641882,12574650067045935548,2097152 --field-trial-handle=2428,i,14887531031092276619,10116304647844506587,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:4756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,3680626096320571015,3240448899492796731,2097152 --field-trial-handle=2428,i,14887531031092276619,10116304647844506587,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,17725929864805901946,4191586905215808956,2097152 --field-trial-handle=2428,i,14887531031092276619,10116304647844506587,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
    3⤵
    PID:396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,13277905445988721168,13348714223797663836,2097152 --field-trial-handle=2428,i,14887531031092276619,10116304647844506587,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
    3⤵
    PID:3192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,1962891615355677142,283856728182283883,524288 --field-trial-handle=2428,i,14887531031092276619,10116304647844506587,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
    3⤵
    PID:5236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,17845367456529621788,8737266961970429343,524288 --field-trial-handle=2428,i,14887531031092276619,10116304647844506587,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
    3⤵
    PID:5364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5452,i,15066202405967493429,12456734553430941588,2097152 --field-trial-handle=2428,i,14887531031092276619,10116304647844506587,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
    3⤵
    PID:5616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,1744928674504573374,13037326510217322624,524288 --field-trial-handle=2428,i,14887531031092276619,10116304647844506587,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
    3⤵
    PID:5816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,13984185257054741879,2417512389011216355,524288 --field-trial-handle=2428,i,14887531031092276619,10116304647844506587,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
    3⤵
    PID:5824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,13834474211140578389,15450664003710381655,524288 --field-trial-handle=2428,i,14887531031092276619,10116304647844506587,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
    3⤵
    PID:1856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,7516978323181662851,14987375769773985597,524288 --field-trial-handle=2428,i,14887531031092276619,10116304647844506587,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
    3⤵
    PID:5988
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,4559926626467085672,8825677378405761999,524288 --field-trial-handle=2428,i,14887531031092276619,10116304647844506587,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
    3⤵
    PID:7116
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,4559926626467085672,8825677378405761999,524288 --field-trial-handle=2428,i,14887531031092276619,10116304647844506587,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
    3⤵
    PID:7136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,10695436318190255596,2933427547224386665,524288 --field-trial-handle=2428,i,14887531031092276619,10116304647844506587,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
    3⤵
    PID:6252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7084,i,13787894816500283202,11059272623452473096,524288 --field-trial-handle=2428,i,14887531031092276619,10116304647844506587,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
    3⤵
    PID:6336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,11563430134874110920,15260445602561644686,524288 --field-trial-handle=2428,i,14887531031092276619,10116304647844506587,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:8
    3⤵
    PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,15841865517320846684,15508154711062435068,524288 --field-trial-handle=2428,i,14887531031092276619,10116304647844506587,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
    3⤵
    PID:5628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,17544470396222569656,4683013051111063142,524288 --field-trial-handle=2428,i,14887531031092276619,10116304647844506587,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:8
    3⤵
    PID:1108
- C:\Users\Admin\AppData\Local\Real\Update.exe
  "C:\Users\Admin\AppData\Local\Real\Update.exe" --processStart Real.exe
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll');$stale='C:\Users\Admin\AppData\Local\Temp';foreach($p in $want){ $ex=@((Get-MpPreference).ExclusionPath); if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }};if($stale -and @((Get-MpPreference).ExclusionPath) -contains $stale){ Remove-MpPreference -ExclusionPath $stale};$ex=@((Get-MpPreference).ExclusionPath);$miss=$want | Where-Object { $ex -notcontains $_ };if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5108

C:\Users\Admin\AppData\Local\Real\Update.exe
C:\Users\Admin\AppData\Local\Real\Update.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll');$stale='C:\Users\Admin\AppData\Local\Temp';foreach($p in $want){ $ex=@((Get-MpPreference).ExclusionPath); if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }};if($stale -and @((Get-MpPreference).ExclusionPath) -contains $stale){ Remove-MpPreference -ExclusionPath $stale};$ex=@((Get-MpPreference).ExclusionPath);$miss=$want | Where-Object { $ex -notcontains $_ };if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5036
- C:\Users\Admin\AppData\Local\Real\real-2.1.0\Real.exe
  "C:\Users\Admin\AppData\Local\Real\real-2.1.0\Real.exe" --real-launched-by-updater
  2⤵
  PID:4308
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4308.6136.1582779896383359805
    3⤵
    PID:5264
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ff86da3b078,0x7ff86da3b084,0x7ff86da3b090
      4⤵
      PID:816
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1856,i,17411461603297278030,189982786006229449,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1852 /prefetch:2
      4⤵
      PID:5772
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1324,i,17411461603297278030,189982786006229449,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:3
      4⤵
      PID:5420
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2272,i,17411461603297278030,189982786006229449,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:8
      4⤵
      PID:3176
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=1.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3456,i,17411461603297278030,189982786006229449,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
      4⤵
      PID:5788
- - C:\Users\Admin\AppData\Local\Real\real-2.1.0\bin\Real.exe
    "C:\Users\Admin\AppData\Local\Real\real-2.1.0\bin\Real.exe" --rbxversion
    3⤵
    PID:872
- - C:\Users\Admin\AppData\Local\Real\real-2.1.0\bin\luau-lsp.exe
    "C:\Users\Admin\AppData\Local\Real\real-2.1.0\bin\luau-lsp.exe" lsp --stdio --definitions:@roblox=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\roblox.PluginSecurity.d.luau --definitions:@real=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\real_executor_apis.d.luau --docs=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\roblox-api-docs.json --base-luaurc=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\base.luaurc
    3⤵
    PID:6684

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 827bd3ac99a6bbdafc6fc1659b1437d88acba26c2ae8d706dc4fea11018638a4
MD5 ebfe5c7ac8283e8a0bd07517d77e41ea
SHA1 706ba3ce8ec460246966026f300d38cd31e784d1
SHA512 9317fdb75f186df3dee68eba2de0e5b776b2ebf87d981e681a0d99294b32a343c0579cca976ec7046835f1b85dd57edc519523d2f53763e8ac10f482e00458d5
SSDEEP 192:sxZjHPR+yyM/jK1Ml8MjOi/fuEs55CVfjZl4EdpEjHHW6+WNzjiPM/YzD+YjUIgO:sxZTr7X/f3sGVffeHbZ/XO
TLSH
T1A142E8126A346977CCDBD209FA417B53D6F50562D2940E44AAFC8A1C04E6BDD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 375dc465bb8f80abb909c4948b34a9cff13cf4892d001a8afbed7fef599d5bf5
MD5 8fa6bd74b7201a5523f75fc1dfdd4a69
SHA1 5f273310d04ffb0d47df3dd71510baf817a8014d
SHA512 97f2412fde0f3b48b04c624f4595825acb7ab2cda5090b15578801ee8ea108d6779dff9ce98bf12e5f632bf43330e2eefece5b2f8f1418e1bb381860dd31b316
SSDEEP 768:iJW7k+0Wvqina8F1+UoAYDCx9Tuqh0VfUC9xbog/OV05LlWYSjJroIrYlBYt:iJW7k+0Wvqinau1jaX5LA3jiat
TLSH
T1B9E2FA3B680CCB7E4F841E5CEC266F966ED801CB66988D5487FA884C03CB6EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 14911be3a3284e6675a4d7517c544c8747fa079075b79dcc3a38df2140294783
MD5 e3d753959a6e8c285f97d0e235426276
SHA1 07ce2f6a217c0d3e31b7efd467ae91c86b519b4d
SHA512 5ad4b1b9d66fe9c2156c45892cf144dd599f1122adc0fabd4b362a8ea7acc44388946307a725727ae13cc61efdc0763f19880b446877357fd7f0608d31a8ea0c
TLSH
T1D7D097A3E4594094CB664AD1273205498B743C8824C1D08CC2133A2C6872A42C292FB3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58a8fd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe58a8fd.TMP
Size 138B
SHA256 0bf4b644d0832bad6e775366fa18e60fc9156361fc1193ed251278c27042777d
MD5 5808dd635bb9c1aaeac206a1cf559143
SHA1 2a434917267a79c96ccfc5c64d165865aa4aa7b3
SHA512 bfb099da77731c790be695086ee2a1d7af603d8f116a6d8805ef682bc5758b68e751045a47c3b7528db3e2f5f920b2df8d7310b54ff25c2240a6e07ba8855543
TLSH
T19BC08CE3A1480514CB1006910332120887122CCC1882C09CA22330142072E13A102FA2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a64ba6d65512dd0fa43f40e36275f54e7e11ad658948c1652138a94539a7f208
MD5 98020c6064d9c90c8312e5a27865332e
SHA1 ce47869126b4b8ee3d02fcf4b24fc1289f3653dd
SHA512 d3a8d1930be9dff4bdae99fa9f6cc817d4764df95d40030181b1c1c5d8186d82c25ce79f237d9879d9c94268af36863ae1925299306ecc9f98d8565582d8d95d
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTbwIbKxK0nyNHIhKEIcIQI/KlOcjyD:KIbCKcbwQKxKmmH6KEI3QAKlOig
TLSH
T163A1B919317B1A913C7E2849A25586365F8231733204B4AF3FF805674EABE128DFD5DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e07ae56ca336f5f024039cf415733d09bd84bd7fadc2cc815911f04c91d97530
MD5 5fc6197633d61c1ceda8fce6eee2dd5c
SHA1 7b0746413d9e74944e82ff19348f0737e167cfb5
SHA512 8eb62d29c4bfde6fd8e08c2a3a119add051efe0d3245dfbb46986578f3aae5b881a8f87df5a50ed6c6ca67d0ef1c4146aac5c90a5ed5c6b5d39320d1e991467a
SSDEEP 192:MONH64BAQmiUyjLq1jRW5GBPKpcCsmZaDswFU6:MONH6eAkqzW9smSNU6
TLSH
T1D8021B34AC796CBB9EB3BE05F48637175FD8112FA5946F44EAE81B1C00D724C234252B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 f333af4c7eeaf3cbc9ec45e4bad1b0f5348e28a369a0d3231f918de78e568a84
MD5 d27daf2535ab9d7073c5990b5e7d4d74
SHA1 1d9eda77997caa276fbf5f4474d5f95f40d438ec
SHA512 8984ae7e04261bb3bee87c861d0b6ad8597e7cbcde9fbec00210790927d2c0f1944d9a89b03ad83c5a4e968206b9628dd225b9f9b15887d6aa75e1f32d01cd62
SSDEEP 192:zExmsN525Q3LD2xBbtmEIQmiU1jLQVj1UJxZaGBPKpcCsmdb+23MWNsLq0ukoES5:zzsNY53bWZQEtCsmF+237HF
TLSH
T1E1423B71AC79AC3798E7B245F48A3B674FB800BBAD845F40EAD95B2C04D738C270A417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6a6d47be60f584635ae17482f1e41f87dc8bc92eef1efff4f8d4dcfe39d72d48
MD5 8bd9ec6194e494ff43f97e24e89671cf
SHA1 25f7c3fc03d6a01abbd53972b95f55bc0dec1da3
SHA512 ee577e3425cb0576a8dfb870859ba22a8cce49ac3c3f4eee24284ed78fe2fbf639ffaa2115dc5496485454f39d34111f9d8a5649c9ba58d308ad5b829a7a006c
SSDEEP 192:J+ONNz64BCmQmiUyjLkyjRJ65GBPKpcCsmdb+23YWwsLq0uU6:YONZ6eVkkU89smF+23+HU6
TLSH
T195120874AC69EC2B5DA2B550F4CB37575FE4117BA9849F40EAE82B2C04DB74C3B0A41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d53ebcee-57fc-47fd-b94b-6c588dac08dc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d53ebcee-57fc-47fd-b94b-6c588dac08dc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 14f378322cea87e3b57cdfd5b1f204f9dbe6861179cd8004f4c9d37e2d3888ba
MD5 7a6fd8aeb72efb70b5643ffa0e82c743
SHA1 ffef9def636c9edec0782e5251744316a299835a
SHA512 6c2f3ce07224f94d31bec464b4d24d4147a9cd3099c4e4bab2f688dc92bb11f0b658e3146cc3099f656f87aa11b48f4a2fb222aaa8f7af2e2ced736d57694b71
TLSH
T1AA114523F38D8920CC96163A509DAC5172B586CB91EEDF9F7FC0C210E1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 0025a82d5c9ef9b1786333fb007e72601dfbf9340d75230f8a3e687e6a107889
MD5 3b8ef11aff69e43d47f234d5ee0a72b3
SHA1 3869fe51c123c88c1be43b11044b580097466f26
SHA512 b46facc11d98c50dacbbd9f36d4715402356d95eed1c073615fcd680bfb142b39830311915fba16a7d8ec0e71640c5d4e9f78930916b8f6432a0f0c203f6fc2b
TLSH
T118112223F38C8921CC96163A509DAC5172B586CB81AFDE9F7BC0C210A1BF585CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

.real-write-probe-2576-240685359.tmp

Path C:\Users\Admin\AppData\Local\Real\.real-write-probe-2576-240685359.tmp
Size 4B
SHA256 aa33996d60e89311b4d1a920dae03c6d7fa3ae1956c52662e273aad4683e577f
MD5 4bca24304861acde5770fdbe3cc2503b
SHA1 c9c64e071d2853bc7906c017a231ad1cc46ab630
SHA512 310070ab4092002aa33f550eb98680fa6662e7305fce227843430aba334fdfad1fe0dd4a6484264b59f9b02a780433a552ce3d5c3da643a77427463c06e47800
MD5 SHA1 SHA512

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\Real\Update.exe
Size 8.2MB
SHA256 b42d62f0e5275ed85cb8451973f6d3b953ab024c685cf9bb90bf10dbf48ad3b2
MD5 6da042cfa6cd298b107a3a566a4d7442
SHA1 4d80fe0351fd54c988ab1c7b5c2d155fbfa804d2
SHA512 96eaf98adfb939873b7ac35d9be63536b0db96ecad11b00195e0ffcf93857b549aef6c170cc03b3602d20f9f20240a8953a323ff3f947a6a6bb3f352bca81bfc
SSDEEP 98304:JpOiSOCJxUf8Y/KzYYlA51fSn+LpjFOEXev8wcFOvkSxMy5/Dn:GhBxUf8uKzYYlAbf4kpxOUgBRD
TLSH
T1D586BF69A6BC01D9E877C2BCC2965223DB72B415277057CF1A609AF60F23AE41E7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 34a3ea5caa22cf552bd1699c21d7cd39b8ac236f21ba5835fe80508c607c5b09
MD5 0971f4af67edb0479a25d0fe14cd8ae6
SHA1 0bd245a5dfd78df2766c14e77cd699bb54ed6ad1
SHA512 a6e46daa072241a0eb4837cd8ae782aeb2d3cd311e12f01dc61be368ba0644684f5e18e8a730a83cff49a998f7c0514f3bd120e2dd0a12bc1b155e88d07a1df7
TLSH
T10FD0122236010AB4C0212033141376090480D22F8105405A683DC76D1E4C4B00E22841
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 0b0c4600f00abb2194f560cc88c1b83dc99b137f228adaf2e4f159c3edd63aaf
MD5 79704c700efd6f0dd463c4052853b089
SHA1 c2c93c9884e6ea6488216b64b7a4f5c272441b4e
SHA512 539fe5dafd603ecffcde481aeeb6c1c6fef213e8576d6e60ae500d15e0afcfe1d7c0391e24efa44f461bca712b304dba37aece688021dca58673f24b79615a59
SSDEEP 3:LstlNllkll/laDYt:LsX3lEt
MD5 SHA1 SHA512 SSDEEP

Submit Download

73a557bb-7903-4a64-817b-db72b19735b2.tmp

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Network\73a557bb-7903-4a64-817b-db72b19735b2.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 1KB
SHA256 9103898c6fbf073c087893842fd91d649e8f211dfecdcc4e0c23fc39b84d582c
MD5 235af7e64802d6c9e0f6d6ba8732d403
SHA1 0002fdd73ada3e4c0758918509f8cbd0a89555b7
SHA512 cce2bf7dc99c9493edd07fe7f9ca6118ec8935801762e34bc987c8384829c4411059e61666c9220e8e46b75f9ea821375925e41edaed642939bdc34a402e687a
TLSH
T163315033A8F4773398D2B686F0457A972F30516A81144F40E9FD4B1812A31AD5A26822
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 2KB
SHA256 34c490c5281d9b30d3b8dc9216cd45e780620db6d50c2b137c568a0e718e993f
MD5 16d62474a063c8f7451d6e2208f04791
SHA1 8991a3a349f70c6448cbe23a85246724981e5aa6
SHA512 9e6637f8df2a5c6a21496b064723a99a40afc3e97b015b8b41d3c70837f3d7c9c80afdb657be0221d4c2425b1ec3f08440cad6b5b72af65a4de14ec8c32078ed
TLSH
T1E3518333BC68B63789E3AB85F8493F239F7152A695612F90DDED0B1C01D726C2712C26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 3KB
SHA256 eb39c18f0be64a92508a9c5fcecb930f00a9f2fd11d5570cafbe267131050b43
MD5 3f2e775fa54a3dc5b184926d4d569ccf
SHA1 14f671ed4ef4b717d5d2e6b44eed9f8d0b62b5b0
SHA512 e518649d75ab4a1acb8507c55382e8c15b020dfecb1a57d3bb494f6293c6df121105ed24d822dca897a42c73f61066de8d5b04c73ce1d93d1584a3a1b94035f0
TLSH
T107716236A8B8B62B8DE3AA45F8852B16BBB15237D5943F94DDFC0F0C01D72A81352C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 16KB
SHA256 753cd42482f6874f9ca7b2a91feb4dde20d6257f7d16df3339a3621930a56357
MD5 41cad8c223239c1f42e4ac23f9f898ea
SHA1 268c857fd9d92304b87493976c315f6c8bc902aa
SHA512 c172eb48804abd0a07976a4edda631783586339710de0efb5dbf95e1ae56843c134da249ade73ae21e243474cd61db47eeb42827a9182e923f63d09671324fe6
SSDEEP 384:zxs+aQikB+z/xvxjg/qhEnNbFooAEjlW+2U9O589zK:t/UxvxjgC+LblW+2U9O58FK
TLSH
T149728D3BA8783E23A8F3F905B94D1B4FDBB584B290812FB84DED1F0D06972D80302916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58b07f.TMP

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State~RFe58b07f.TMP
Size 1KB
SHA256 e5097b5f6f47f3145e211bfa230cee8a6ac9362518360b1c75fe970cb0dff86d
MD5 db3af1678faac5840a50e2972f1d6f8d
SHA1 065f6120fe1404e3eeb03ebeed789e3633034d78
SHA512 08ca7f965b5b43a293ed1c26c5177b81254b462c6e14ef6d3da0fa930ff813562707b007e49c6ddaebda774caa2c3300e4da1338428fd3fe2c07ffc74577ba54
TLSH
T13C214033D8F87637A8927A86F0027A8B2F70516A81145F04E9FD461812A70AD8B37C32
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Real\data\config\settings.json
Size 207B
SHA256 e4f38f124eb821848eb57d6988c5ef865768188e54d1e8f0ae34c59e9f99dd21
MD5 2b4a40c8495d5ddf7adc222e092fa67c
SHA1 fe7029809ff12457b0e50b92e87b33188fd18848
SHA512 18ba17b46e89fbaad852262144a4399fc6ce616853e80d33e9ea7dae69c2d0f8d2d3853af908c0a78c6e671b30fffcf3983ae02ccfaa5dfd0055db3ba456b9d1
TLSH
T192D02250DCF40E7313DA902A082B0010F0366C67009E3D3C38EA031C9F4F630417D384
MD5 SHA1 SHA512 TLSH

Submit Download

current-version.txt

Path C:\Users\Admin\AppData\Local\Real\data\meta\current-version.txt
Size 5B
SHA256 8248f7772687aff0b103b36898908deb82126337f933e49a5ac04829093c58ff
MD5 5337810b0c500ace9c4cd745f4b8bcf5
SHA1 d1325bb186bd83303245e504f7c6eceae7f19e44
SHA512 5753b285d3f7881f06c35bb16931cf2a5408f13701855d5c7b2810f34e9bb266392d80ff15253a79f89d30a9ed0eec3be0e7e81677a7dbfa1e15a3907a50b02e
MD5 SHA1 SHA512

Submit Download

Real.exe

Path C:\Users\Admin\AppData\Local\Real\real-2.1.0\Real.exe
Size 14.4MB
SHA256 383891553fe7fef9231a027e4b989aded76fd0199526d60acede348b4c066614
MD5 b362afa8510296763c7ff79d0fdfa3b9
SHA1 6353522c8e40d9bf497f6eeaccdf142df3b4b469
SHA512 2a12345a88c5a746efaf6e67bb1fa5d6f6661def71dd7e721de6ca64f96ed06d8b21513b73f1f99f867d649a70bed6bd0b3e192ac1220c08b157bf49c0d658dd
SSDEEP 98304:uLDEg8Kwead1pST1Qvn2zwR8TiRbwZeNnDO9RRJ7c41uCGkqgSXh/4jbLXkKPU4K:ZDeHQ0SAGkqviS4JJ+xNuxYwKz2D
TLSH
T178E68D07F35581E9C0AEC078835AA637EA31B889473572DF1BE44B112E26FD06B3D769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.dll

Path C:\Users\Admin\AppData\Local\Real\real-2.1.0\bin\Real.dll
Size 4.0MB
SHA256 5b0f9069ff7fecd6827952e70a5ea8c82e68b8b30a80f5595508f7fb939c5c33
MD5 c24b27661b7cdac89ed8287c337c1ccf
SHA1 43de60c0cd9644be669fdec3b59cf688c43d993d
SHA512 e0668e41872a81b76f5df8c547baee4f2a3df43677f98b503e88ed78a374b27fcfdc96a29d8716f655ed6c0cefd49cdbcfb7c2c2b1047958e33b7e51c42b540e
SSDEEP 49152:HOGC/fOAUGdaxfCa5sIz1nQySP0kEFfyMmmYPjtW9PPpzrd5uoSXFzsxReYxyjEg:fh6UsIz1QySPR+1RSXpSSK5c
TLSH
T14216CFE74147B460B8132856EF15FE3010C62A96EBA95087EB4FCB871A60D7DF894F93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.exe

Path C:\Users\Admin\AppData\Local\Real\real-2.1.0\bin\Real.exe
Size 4.0MB
SHA256 34efd1797caa81f2f5a22c3dd74bc500081eefccca837e1284f2ec838603f456
MD5 26b587558386b644eff14335979fcf49
SHA1 595a67f693bb3827a9153639c2ff87240a3cb088
SHA512 abd3a1fdb44face4385ada5a103b7568d6e678d9dc3357b5a36b5c1b17868bb91f7fd4c7de6e2c0b6ab331b19fe8e2f3e48db32d3c7d85ad03e85ffee50c455c
SSDEEP 98304:YyLo5+VVg/lRQks/0QjGQzN6flL8V2J5Y8lb8r:nowHgvQ5/NGQzOL8Vw5YBr
TLSH
T1E6162327B16AE4BDC946D374960BDE678A1B3CC90F3139EB0B455A663D32AF01B34712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spoofer.exe

Path C:\Users\Admin\AppData\Local\Real\real-2.1.0\bin\Spoofer.exe
Size 2.6MB
SHA256 f4927849fea9d5abd064ed5ec61c45785490a93d75258de466db74e1b70da51a
MD5 1f79f23e16f08c13d3d50cff49b287ac
SHA1 2893622bd2183579b631a14ff4a5015666bfd820
SHA512 9d1f41cef2d5d707b96ab5b35dde8b85164f6e8794b752f576fe192934a4a62b1512ad512d917b98969afd25adf29537cb8c7bdd46c261d2811972b296f76a93
SSDEEP 49152:iSBsRHoPtqamwxg4muCBfxz2MWPUnGJG//2/XmMj17GPwhm9SeD5bc4TH:Iok6dyBh2MbnGM//n+9hm8epL
TLSH
T117C533FA16C2EB38DC8E137B233F07169B4684FC5C5DA16B29E7876D8706539C84588E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

luau-lsp.exe

Path C:\Users\Admin\AppData\Local\Real\real-2.1.0\bin\luau-lsp.exe
Size 16.1MB
SHA256 9e85ce9370f208c97f1dfc1b8fcf7185fe64386f23130a65fc834f5323a0d653
MD5 0e14d186ed05911115868aec341ca13c
SHA1 525708cd63fbcaa2bd68225aa2411b0f46c3e9fb
SHA512 e3acd3aad750e35cf9993384fc274db9ffdfd18099d4fd90a39ad0c039410d4e451baa6a2e1a5b1fd2658281bed8d33a2a3d2403675ef3976f10322ec5d5d029
SSDEEP 393216:E4BgLVggOglggqgTgXi17gCFggqgggocgQgejM9gggggdvFBggggjCggggoggggg:KBggOglggqgTgXi17gCFggqgggocgQgP
TLSH
T188077B3A21AC10DCF1BBD0BD8BCB9E47D6B2340903319ADF0591569A1E1BDED4A7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

real-mcp.exe

Path C:\Users\Admin\AppData\Local\Real\real-2.1.0\bin\real-mcp.exe
Size 1.6MB
SHA256 1dd7738163b5266d78f30b04281b1d48927acfdd6879e7576f0862a1b6497e95
MD5 52f687164c175d24e9f4f22e6f17181c
SHA1 99b67fe1a7417616656cd9a34b31b1a0c5657bc1
SHA512 ec740a365519531208a5f536277043d71bd4995cc5c06cc65a4984f47bafcf67626e8218e2ba1823c7c88eb1184bdbddf369f48852af9434e9f45219b6ffc064
SSDEEP 24576:RXvDv4konyXJzOaNDOXDPiFBzmQJDXqZXxdOmOTFM3VIH06iyGdXQ:BDv4konMzBOGFBz3DXqZzuhYIU6ilJQ
TLSH
T18C857D03E69580ECC4ADC578C3579A36AA73B88D0A34B2EF67D04A513E2BF905F1D719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 393B
SHA256 9f3729051450e7bc8eb4a8afb8c685a42e195c26d455a64b4b5480cdeb6fb25d
MD5 d4e08647161f37c0bb80d495a603167b
SHA1 273fc4d5e27e1c5466fd949388dfb1d17fd238fd
SHA512 3dd04d9f550ff0781010d5f3846998fd504d685670f3cbdc56e8b6c6fca9e95020bad655bce3af2f38bc3f55c451efd9c10820c68b4295be0b7a34df0ba8f190
TLSH
T1B9E0926F79FC70391C41C687DB7589D695B53144B88068727741841CDDA8E07CEC3B45
MD5 SHA1 SHA512 TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 1KB
SHA256 1422a459dafe71341f81b587a545bfdb02011d3772ce764551291282eb217024
MD5 a4d914237d73c9ee5cd6ac2ff77266c1
SHA1 d3d70546f4390b34dd382c7474259a237e3742ba
SHA512 a2624d60be62d7a16cdfbeeed569dd6bc5953226afcdf17a23d9594b369d6ef54022e1609ec0e9c3f6b243e774e36cf7c4a48e835b5097c812ab29995a0a4c78
TLSH
T1CB31CB3F29FCF43B0D42C997DBA09DEA66B8304678C678A63351941896D8E0BC9D3F41
MD5 SHA1 SHA512 TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 2KB
SHA256 8990a1e3084ca639781de81ac394c414124674b8c66a75d1042ce167eec10737
MD5 d8318035497b4e12f327e364037ef20c
SHA1 67a400dca1830124c5d86497da06262bb908cba0
SHA512 be8ee64de57337b01c8f4088f5a7293a98380c2e491168c7ad92933a4a5e534275c17e87674f04ac4400b52dfae80272be93d875b760f9cad755965b494f09fc
TLSH
T1DE512E2F29FCF03B0D42C99ADB909DE6A5B8304579C538A63351941C96D9E0BDAC3F41
MD5 SHA1 SHA512 TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 3KB
SHA256 b3687b5108083b196742a07e719f4bfb781e413114afb95c209d485677ef2e17
MD5 46669f780f3c688aa9c3327e5eaceb9e
SHA1 b427666eca70cb8ab4cbdc8f26de80fbec03cf9b
SHA512 dd0fe8bcbe6ea268900302ce22d91b91eaa454d98181d5d2a5f877ffadb770570367c0e2674161c124d6ee82edadf8786604d67d9c7f799aa08838bf01947f60
TLSH
T1B981403F19FCF07A0D06C9DADBD49DE1B5B93056389528D633A1500C9AE9E0BDAC3B52
MD5 SHA1 SHA512 TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 4KB
SHA256 4ce43cdd416efa37b2089e6facc421e23c7eac2ac069b751f025d82c18d23574
MD5 fe88e7b4b43ec97ce7131d21205db316
SHA1 ca7aa8a1e86759813c772cc1e66435c6b0d608c3
SHA512 66c2dfa503815cce26546085b1bf7b98ae152151e65f843f7949a2a8182022bbfb04605cb9cbc98c35c0ac340ff833ca5b2280dc87f318aa41131ffb6eca8e9b
SSDEEP 96:o6ASrNYepcUZD/CLoO/rk1Y1+AVKHlGrvzYSA:DrDGL5gxCTo
TLSH
T1A7910A3F19FDF07A0D46C9CADBD49DE1A5B93056388528D632A1500CDBE9E0BDAC3B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 5KB
SHA256 81df38f082b2ba9e83a58f09bf993ef3d931063dacfb54d752ccd42e91400db0
MD5 467f973b27cdc9bf770bcd0455c843fd
SHA1 69771e78f46dd033643dc0db0c9249eaf2e9f56f
SHA512 59f5ac61a7317667af3c637a9d8397682e5dae13081e86a7397d2776605423d10e0c56c0aac2c075e10a44c7f4ca7b2d221981f2c538161cba6851a50fff1dac
SSDEEP 96:o6ASrNYepcUZD/CLoO/rk1Y1+AVKHlGrvzYSP1aD:DrDGL5gxCTX0
TLSH
T1ACB12E3F1AFDF07A0D06C9CBDB949DE1A5B9304638C928D532A15008CBE9F0BDAC6B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

423ff0c5-cf24-4caf-8e22-9a2ffbac14c9.tmp

Path C:\Users\Admin\AppData\Local\Temp\423ff0c5-cf24-4caf-8e22-9a2ffbac14c9.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 662af4b3eb3d6c278a7b93f50567116321d4445e11e6412b252d831dbb96d5b2
MD5 c803a60b4a0df0440ea9fd0c1090d344
SHA1 f30f5757bab5eba4232e5260cb51745277725f8e
SHA512 bd92e18b4c8ee45a9e6078c3909f87231c295e9c8738587645cac55565ef7b0ad77ee557ebf1e2f0ce22aab1179a26996124305ff2517fd4613ed64a347c1f85
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b3a99c3e284a46f3e479ea2924dc5a55ae6bc31b3156af9470d28bb2de02b99b
MD5 fa8ca85c4121500d7febea9394965d80
SHA1 1dfad73a008b9002ec3efb19f56f051ecbbea0fc
SHA512 fe8e9231ecb49a59b95950f301f497e174b0b7f8f603285fe55aa609279a064eb6d3311995efb977bb11aae009f25493ab181d5c42816189928a0d8954573f53
TLSH
T13FD0122233434134C02021330872610818C0C61F404541049428856D3A040781A02841
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

00850c9e-6d98-4a87-8c14-e4ab51507997.tmp

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Default\00850c9e-6d98-4a87-8c14-e4ab51507997.tmp
Size 6KB
SHA256 dd867af5a25d8cb71116c3340e4be52a280e1d53d9e6e1ed659254e1314c6524
MD5 9c6880e619db07270068711760596ac6
SHA1 fe12aa01dc4979588e9b98e9049297e7139dc8d7
SHA512 e0c9f58fdd7e6b9c0642a3fd37877eecc151ce59d8adc38dbe0343cdcbe669732990b47035aeb2eb9d87b0e73818334fadbbe92f71cc83fe2beb87bbbac718c9
SSDEEP 96:stC05klIYib9hZffWdZ8i0oEuklm/7qx+WVHMSm+uecadQj/+ghmovKEB:stC0CQfgZ8pFQ/S+Wi8dO6ovK8
TLSH
T169C197125E38697B4CC7F65CBA36BF42D2FA502265D41E58EBFC861C09E66CC530790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 47e7289df13675bace55ee011ab694a001b53daa9f78b99ecf565d7f7c238ce8
MD5 f3380d9bee15a1bfc8fdd7e9fcfc107d
SHA1 51563f8276e4114e50af54574f27c4f09c52b38a
SHA512 3670fcadff99fcb32f756592925502d15865f9cd04804420d292ff6c1dd70bca21dbab2366e98821ca66f642a0810b769edfcd99e5f8a7f96199aedf327407f8
SSDEEP 3:LstlNllklkXlEi1//:LsX3lPEO
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 b674823ee0b42beade483b80c5e4a88bf0d9e7c7d0d1ef0e77fa0699349ac1ab
MD5 b504e7875330156b73cc624a9481bfcf
SHA1 f0938a9852dca5b7c7aa44cdb5d16dca364ccc70
SHA512 950d5fe818028077a9006f01e36e33384d5e865329fef0c67137c5694dc3e62ea1965dcc702dbad8bff80050d954b0415a205366ea91ad9c716457c2c9003cbc
MD5 SHA1 SHA512

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Default\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Default\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 fc413382e8fcefe64a1b379a99fa3bc72aca6c7214131a5a4ac5bca505455740
MD5 3bbc71b02dababe2f3a05f98340f7264
SHA1 5d5443c0f829e47c68130b9e7fa85be4a3330e08
SHA512 a8e54dec648aac5356806b1eb8f5b68c29e7584dd6396f2a7a1f8c67b51306eac5c161aceeb3e619023d8a2101daca30169e00f0fa25eb57e2c484d47fc07d64
SSDEEP 3:LstlNllkll/l5zIX:LsX3lEtBI
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Default\DawnWebGPUCache\index
Size 256KB
SHA256 3fc955b8480c0287504432427a8b95935861aa836ea9061701122b5cedcd98d9
MD5 2d7d7c7709ea4db8b82dc33c6b51c0b4
SHA1 6d2d4cbda052229f15e4aa6073e290d098afcf19
SHA512 9729fcb642bf1ba9a3159e0ec17c28009ca5d2923bf73fef9db08bfb88c37bb887ae2b7e973e3e6ee3f2c68234b78c108315b4da43a17e12feb84a6af6af6169
SSDEEP 3:LstlNllkll/ln5iF:LsX3lEt5
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Default\Extension Rules\000003.log
Size 38B
SHA256 1c43a1bda1e458863c46dfae7fb43bfb3e27802169f37320399b1dd799a819ac
MD5 51a2cbb807f5085530dec18e45cb8569
SHA1 7ad88cd3de5844c7fc269c4500228a630016ab5b
SHA512 b643a8fa75eda90c89ab98f79d4d022bb81f1f62f50ed4e5440f487f22d1163671ec3ae73c4742c11830214173ff2935c785018318f4a4cad413ae4eeef985df
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Default\Extension Rules\LOG
Size 367B
SHA256 85032c9a503c7fbc61deb12f0ee9c810300f298dbacb15a6f1756403e1bd90cc
MD5 6bd7f88592b43f38b5e60941d1c10278
SHA1 e310221bcfe4860964f0b9e740ba8e2c59d84e44
SHA512 9ff442475fce8177aa19857fde247a2ead933d9fdf8722129277921fa65ec3c7fa808f422b3b4d09f92f65301a352b94c167e4e562d8e8ea12c3b401429502e8
TLSH
T1E2E023228489C26705647ED7DEB04385C6917809758467405F5C894930039497384713
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Default\Extension Scripts\LOG
Size 373B
SHA256 75bedc1692ecb6a4c87f2bc64aedb7778224f169675c2a3d5fb1ebad81d6cedd
MD5 e9ff1347af989d5432e558cd78373df2
SHA1 1960b6ea9b4420850195ff30d69a95bfb001425e
SHA512 8a2452e35c1d2eaded2e16382b2d7787edb9ff0ba7060188170831a766effe6f7199741b1ea3be655a03bb56fcfcbc5fe81b75bc553b1794c1fe59c19c1164a3
TLSH
T1B6E02B26888EC2B70664AEEBDD71538AC6E13806B584B7405F55CE483017946B280B23
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Default\Extension State\000003.log
Size 114B
SHA256 e2610960c3757d1757f206c7b84378efa22d86dcf161a98096a5f0e56e1a367e
MD5 891a884b9fa2bff4519f5f56d2a25d62
SHA1 b54a3c12ee78510cb269fb1d863047dd8f571dea
SHA512 cd50c3ee4dfb9c4ec051b20dd1e148a5015457ee0c1a29fff482e62291b32097b07a069db62951b32f209fd118fd77a46b8e8cc92da3eaae6110735d126a90ee
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Default\Extension State\LOG
Size 367B
SHA256 d4edca8b0f8d429c12246cebbca500505034b12b77305edcbae608c20efdd8fd
MD5 9c24b5390008d5a146c0c04aeae19d60
SHA1 b3c56e6f753c8d8f9e6cf21b836136ad78912b75
SHA512 e9ef23b11142e99696d2b2eed70896cda21724bfa14dba9c472f17ca579148147b8880a1e9eca6d2be0773554f8bda13b971320a6ae00c4f18c084fa4a08da20
TLSH
T109E02B21858EC2B74A74ADEBDD75034A8BE23805B584A7445F5589483013D47B284723
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Default\Favicons
Size 20KB
SHA256 46b5ecada4edb2585f87953f7847aefc938be2404b9d9455c772b97295b7b1cb
MD5 babd43551f1b29eb82e221460676126a
SHA1 e9bff307613a14b35830893bdb6d1ecc931b425d
SHA512 5ab681c170dbd1d374bd66edd02cbe21272819ef7389ad1e886bcba112deb91eb68fa930747986da5ca794881939570013e38edd9f8e6f718f7d202e74a82f41
SSDEEP 24:LLipxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:UBmw6fU1zBmI
TLSH
T1C292EE075E383407DBA10E7D366B18768E3FE26C5FA29C94347410618CF9482D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Default\History
Size 184KB
SHA256 7ac0739f534f89ae63c46cd41f0cffaf0335fe348933e3e3d660044351f2a746
MD5 c77e3d0b59e286bc3b50eff7cb8f464c
SHA1 b260bf6f86fb9aff5b2396bfb49dea658a6f05e5
SHA512 e9d95b19019dda281d5cdc16315ae5368b3bab7786955354de93dabe5885c958c556a09e4b57a707244e0052cbabb00029619deba1810677bf9ea06e7287e8fb
SSDEEP 96:xhBttejzH+bF+UIYysX0fxQp97fEHt/DfLjLqL/hbgI4VgNr2jWRk/E0:xhBqH+bF+UI3iWGVfWN3qL/8VgZQW3
TLSH
T1AA04EC1E5F743612CDBD513668E745B3597CF03F8B636AC62CA114B1CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe588f2b.TMP

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Default\Network\Network Persistent State~RFe588f2b.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Local State
Size 1KB
SHA256 37c6ccc64e4b760a7bb85d13a95e445a7ebfadd78d5d7f851a198f1eed391dd5
MD5 1525167e0e1c8b8d4c502aecebb1e48a
SHA1 8c10be9f7092d164a9731401dc4bcf63a2d691dc
SHA512 222a3707cf60f84ae8edcc4949a6f403918d9289d17ef6b68db3774074a3fdb00cecf7652b482defcf6e9f6a66d301d9c7a02a717213a11e8e224132a8528120
TLSH
T150318572E5A42F7328826986B2057A576F70602791514F54B9EDCB3C23E32DE962BC32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Local State
Size 2KB
SHA256 1d2a3d9bca527e8f63f2a5611e96e0c3126b2d5c6ccb9da9a393f98220c329b6
MD5 2b0e787b03ccf4f049ae72c0734855b4
SHA1 1cde2083e2a1dca96914568bbe2ab1e13696ab54
SHA512 e9cac5ced0f821ac193f1e4e22595a89df888c99639927f4549aace537ca1f765f643a36d8aaea3d18872d846de989bd2f7fd8ea2e27c1ecd5002d5cddd4c692
TLSH
T1C551A773BC686B7758E35984B9493F13EB71516299522FA0BEEC0B1C11DB29D2306C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Local State
Size 3KB
SHA256 1e95abe413427ff248f8e568ba337d507030d68e1060cd6168d97441c2c29c45
MD5 f79e0c89d2345731c4f457518d344bbe
SHA1 cc0ad47ea27c69daf24356233a7d908702779a46
SHA512 30c6c8a27a61b101c8fd2bd5a4caa4cb619cd54aa262d6a1ffd1092080f16e0a7cca1ff9396668eb33e08a943ac76b3b2fcb32f45aa9a65f66d62ca99fda01d4
TLSH
T11B719532A9B8AA370DE39D44B8853B16B7A15123E4953FA4EAEC0F1C02DB3D81302C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Local State
Size 4KB
SHA256 9b8e48b126d9a22fc829e50b3ae3bd183f4164df069e9cf81d6bbc0466f64e69
MD5 033187728461640da1b84e016c23aa50
SHA1 2579bb01a85c64492b094ff3aff4b208b9792dfe
SHA512 aec289fa18ee31b0cc0a9f8c5a76653972c33d8c956e3db34505710481f7c257a940de9d2a45caa64b876828e1bceb903ae25dd3ef1e56e42863f2d23cbe04eb
SSDEEP 96:zu6bNkCEjfVaNN58Frh/cInURoDotoi81DsBxgZY6I9eZbWljOwTClwa:zDbNb6a+ooDUDcg6ZG7lj/s
TLSH
T1B9818532A974AA275CF3D985B9853F06A7A15023D4957FE8E9EC0F1C02DB29D1352C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Local State
Size 4KB
SHA256 5d5d9a0ebd1dcce486e63c7396114b471023aadf7b7f6c6f292cc8c9420910b3
MD5 859327761251b7a370ec3d7a2e8b90bd
SHA1 02dcce0240a906b9afbd574c97ace4e44eb25ff9
SHA512 f74a30d489d70ee1dd3c58131dcf1b7b1f368112c3f19351abd830201d1bc9ca8b1acd17141984adbd1a742ef0c1c1d208a919e9c3a48fc0694e75f676277145
SSDEEP 96:zu6F3NkCEjfVaNN58Frh/cInURoDotoT81DrvBxgZY6I9eZbWljOwTsQlwa:zDF3Nb6a+ooDU4crZ6ZG7lj/sS
TLSH
T1BA919232A974AA274CE3D989B9463F16ABA1502394957FA8E9EC0F1C02DB29D1342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe583e7b.TMP

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{1E625861-9072-462A-852B-680212F559AA}\wv2\EBWebView\Local State~RFe583e7b.TMP
Size 1KB
SHA256 4860e9a7bb3fb4eb7f3badeb05554ed3690ec7c9f32af85a40ddb080f743da19
MD5 f2e912ab4ef76b51979b4fa4c2473df0
SHA1 21120dadf2715b2855d79df8ce886b7542b477df
SHA512 7d535b8e61f04cf55813e80efbe7133e3d529aee925eecbd67b6dda98a8b461a44d8d0f2ac89094e4952f95f0404af13a14a1038f39bba5bccec0cb226c84384
TLSH
T136216572D5A86E7338825895B2117B4B2FA0506791115F18F9EDC73C23D719E872BC33
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_m05hldww.rpj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m05hldww.rpj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

b360c75b-d0ac-4f70-8605-4b678606e64f.tmp

Path C:\Users\Admin\AppData\Local\Temp\b360c75b-d0ac-4f70-8605-4b678606e64f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

c80877b3-78df-4f11-8e68-c9d7c1ef24e5.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3980_1177141140\c80877b3-78df-4f11-8e68-c9d7c1ef24e5.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3980_837100267\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/872-1321-0x0000000140000000-0x0000000140A6F000-memory.dmp

Download

memory/872-1339-0x0000000140000000-0x0000000140A6F000-memory.dmp

Download

memory/1500-212-0x0000014FB1D90000-0x0000014FB1DB2000-memory.dmp

Download

memory/2768-80-0x00007FF889260000-0x00007FF889261000-memory.dmp

Download

memory/2768-82-0x00007FF888900000-0x00007FF888901000-memory.dmp

Download

memory/3760-330-0x00000204CE770000-0x00000204CE80E000-memory.dmp

Download

memory/3760-249-0x00000204CE770000-0x00000204CE80E000-memory.dmp

Download

memory/3760-25-0x00007FF88A550000-0x00007FF88A551000-memory.dmp

Download

memory/4324-119-0x00007FF88A550000-0x00007FF88A551000-memory.dmp

Download

memory/4324-250-0x0000025AE7940000-0x0000025AE79DE000-memory.dmp

Download

memory/5772-2028-0x000001CD81940000-0x000001CD819DE000-memory.dmp

Download

memory/5788-2029-0x000001E76FD40000-0x000001E76FDDE000-memory.dmp

Download