Analysis
- user interaction
yes - max time kernel
900s - max time network
886s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
03/10/2026, 19:00
General
- Target RealSetup_5e9bd097024746f9f70e822b7656bcdc8ba027d1ce33e3aa7d6fb7d9a6aa8ecc.exe
- Size 16.5MB
- Sample261003-xnylcsvfqc
- SHA256 b411b444682179bf2f4270fbc22d9a86263b659152f9611712ec40101a8f3aee
Score
9/10
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Run Powershell and hide display window.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 6 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs
- Drops file in Program Files directory 64 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Queries registry keys for unique system GUIDs 1 TTPs 3 IoCs
Queries the MachineGuid or HwProfileGuid value from the command line, commonly used to create a unique victim ID.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Time Discovery 1 TTPs 6 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 15 IoCs
- Modifies registry class 64 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 43 IoCs
- Suspicious use of SendNotifyMessage 34 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\RealSetup_5e9bd097024746f9f70e822b7656bcdc8ba027d1ce33e3aa7d6fb7d9a6aa8ecc.exe"C:\Users\Admin\AppData\Local\Temp\RealSetup_5e9bd097024746f9f70e822b7656bcdc8ba027d1ce33e3aa7d6fb7d9a6aa8ecc.exe"1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RealSetup_5e9bd097024746f9f70e822b7656bcdc8ba027d1ce33e3aa7d6fb7d9a6aa8ecc.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{61E84EF1-A70A-4FB3-B51C-C19A2628B6B4}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=1580.744.131166832977298098272⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\RealLottie-{61E84EF1-A70A-4FB3-B51C-C19A2628B6B4}\wv2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\RealLottie-{61E84EF1-A70A-4FB3-B51C-C19A2628B6B4}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ff86818b078,0x7ff86818b084,0x7ff86818b0903⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{61E84EF1-A70A-4FB3-B51C-C19A2628B6B4}\wv2\EBWebView" --webview-exe-name=RealSetup_5e9bd097024746f9f70e822b7656bcdc8ba027d1ce33e3aa7d6fb7d9a6aa8ecc.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1748,i,11179205867325695808,16871521450437939651,262144 --variations-seed-version --mojo-platform-channel-handle=1720 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{61E84EF1-A70A-4FB3-B51C-C19A2628B6B4}\wv2\EBWebView" --webview-exe-name=RealSetup_5e9bd097024746f9f70e822b7656bcdc8ba027d1ce33e3aa7d6fb7d9a6aa8ecc.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2052,i,11179205867325695808,16871521450437939651,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:33⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{61E84EF1-A70A-4FB3-B51C-C19A2628B6B4}\wv2\EBWebView" --webview-exe-name=RealSetup_5e9bd097024746f9f70e822b7656bcdc8ba027d1ce33e3aa7d6fb7d9a6aa8ecc.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1644,i,11179205867325695808,16871521450437939651,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{61E84EF1-A70A-4FB3-B51C-C19A2628B6B4}\wv2\EBWebView" --webview-exe-name=RealSetup_5e9bd097024746f9f70e822b7656bcdc8ba027d1ce33e3aa7d6fb7d9a6aa8ecc.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3596,i,11179205867325695808,16871521450437939651,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:13⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c sc config w32time start= auto >nul 2>nul & net start w32time >nul 2>nul2⤵
- Executes a command shell one-liner
- System Time Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc config w32time start= auto3⤵
- Launches sc.exe
-
-
C:\Windows\system32\net.exenet start w32time3⤵
- System Time Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start w32time4⤵
- System Time Discovery
-
-
-
-
C:\Windows\SYSTEM32\w32tm.exew32tm /config /manualpeerlist:"time.windows.com,0x9 pool.ntp.org,0x9" /syncfromflags:manual /reliable:no /update2⤵
-
-
C:\Windows\SYSTEM32\w32tm.exew32tm /resync /rediscover2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "try{ $ex=@((Get-MpPreference).ExclusionPath); $want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll'); $stale='C:\Users\Admin\AppData\Local\Temp'; $miss=$want | Where-Object { $ex -notcontains $_ }; if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1} }catch{exit 1}"2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll');$stale='C:\Users\Admin\AppData\Local\Temp';foreach($p in $want){ $ex=@((Get-MpPreference).ExclusionPath); if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }};if($stale -and @((Get-MpPreference).ExclusionPath) -contains $stale){ Remove-MpPreference -ExclusionPath $stale};$ex=@((Get-MpPreference).ExclusionPath);$miss=$want | Where-Object { $ex -notcontains $_ };if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1}"2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/projectreal2⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x338,0x7ff86396c188,0x7ff86396c194,0x7ff86396c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,15070805393941019509,5625993131130751553,524288 --field-trial-handle=2268,i,11937643280035764386,414082524903347102,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,1607283552277250317,2071418832178688598,262144 --field-trial-handle=2268,i,11937643280035764386,414082524903347102,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,11394623114924989282,15662911704734125314,524288 --field-trial-handle=2268,i,11937643280035764386,414082524903347102,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,3353382596122448179,11915884974310335585,2097152 --field-trial-handle=2268,i,11937643280035764386,414082524903347102,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,13576160514259940155,11092443332835886743,2097152 --field-trial-handle=2268,i,11937643280035764386,414082524903347102,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4904,i,11602434569536212048,6588037600739560051,2097152 --field-trial-handle=2268,i,11937643280035764386,414082524903347102,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window3⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff86396c188,0x7ff86396c194,0x7ff86396c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,16543853768921384219,3098885495921570742,524288 --field-trial-handle=3340,i,9404303807349380931,6285300148188483896,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:34⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,11123136842723710425,12401943842478435555,262144 --field-trial-handle=3340,i,9404303807349380931,6285300148188483896,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,1039357706143701536,18161556037940896684,524288 --field-trial-handle=3340,i,9404303807349380931,6285300148188483896,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,602943590719573200,3369862519611486436,524288 --field-trial-handle=3340,i,9404303807349380931,6285300148188483896,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,602943590719573200,3369862519611486436,524288 --field-trial-handle=3340,i,9404303807349380931,6285300148188483896,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,1657504376668982645,3047164223033750937,524288 --field-trial-handle=3340,i,9404303807349380931,6285300148188483896,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,2897467550712650491,251743818711447078,524288 --field-trial-handle=3340,i,9404303807349380931,6285300148188483896,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,8051404246225678586,1452993511421119873,524288 --field-trial-handle=3340,i,9404303807349380931,6285300148188483896,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4660,i,13426065880276182309,4215699238763054578,524288 --field-trial-handle=3340,i,9404303807349380931,6285300148188483896,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,12292927461893702187,5599759198214788595,524288 --field-trial-handle=3340,i,9404303807349380931,6285300148188483896,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5088,i,9577055733489889318,3612097921079215757,262144 --field-trial-handle=3340,i,9404303807349380931,6285300148188483896,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,4120643908015794362,12897426812061852200,524288 --field-trial-handle=3340,i,9404303807349380931,6285300148188483896,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3936,i,8906603463639678734,5908157446775062000,524288 --field-trial-handle=3340,i,9404303807349380931,6285300148188483896,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3932,i,10438507764955390422,3395316550824884500,524288 --field-trial-handle=3340,i,9404303807349380931,6285300148188483896,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4056,i,6302560543219423385,426733638945368219,524288 --field-trial-handle=3340,i,9404303807349380931,6285300148188483896,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,3915116449846779505,213234672764721961,524288 --field-trial-handle=3340,i,9404303807349380931,6285300148188483896,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1036,i,15072754803972812038,962540760942894073,524288 --field-trial-handle=3340,i,9404303807349380931,6285300148188483896,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,14708663230790067299,9214695722776874085,524288 --field-trial-handle=3340,i,9404303807349380931,6285300148188483896,262144 --variations-seed-version --mojo-platform-channel-handle=1036 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3944,i,6637502122565370999,331862354134094994,524288 --field-trial-handle=3340,i,9404303807349380931,6285300148188483896,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,1601090808410689914,4699803189317284023,524288 --field-trial-handle=3340,i,9404303807349380931,6285300148188483896,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,12855096331650920047,12383707535661988116,524288 --field-trial-handle=3340,i,9404303807349380931,6285300148188483896,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,7652853896142030074,17459335775186015077,524288 --field-trial-handle=3340,i,9404303807349380931,6285300148188483896,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:84⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Real\Update.exe"C:\Users\Admin\AppData\Local\Real\Update.exe" --processStart Real.exe2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll');$stale='C:\Users\Admin\AppData\Local\Temp';foreach($p in $want){ $ex=@((Get-MpPreference).ExclusionPath); if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }};if($stale -and @((Get-MpPreference).ExclusionPath) -contains $stale){ Remove-MpPreference -ExclusionPath $stale};$ex=@((Get-MpPreference).ExclusionPath);$miss=$want | Where-Object { $ex -notcontains $_ };if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1}"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Real\real-2.7.4\Real.exe"C:\Users\Admin\AppData\Local\Real\real-2.7.4\Real.exe" --real-launched-by-updater3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Real\Update.exeC:\Users\Admin\AppData\Local\Real\Update.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll');$stale='C:\Users\Admin\AppData\Local\Temp';foreach($p in $want){ $ex=@((Get-MpPreference).ExclusionPath); if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }};if($stale -and @((Get-MpPreference).ExclusionPath) -contains $stale){ Remove-MpPreference -ExclusionPath $stale};$ex=@((Get-MpPreference).ExclusionPath);$miss=$want | Where-Object { $ex -notcontains $_ };if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1}"2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Real\real-2.7.4\Real.exe"C:\Users\Admin\AppData\Local\Real\real-2.7.4\Real.exe" --real-launched-by-updater2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Direct Volume Access: Opens a physical disk for reading
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=5196.1884.108804907880908905863⤵
- Drops file in Program Files directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x194,0x7ff86818b078,0x7ff86818b084,0x7ff86818b0904⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1816,i,13135903649710372120,12116653690147683098,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1812 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1792,i,13135903649710372120,12116653690147683098,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:34⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2332,i,13135903649710372120,12116653690147683098,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3588,i,13135903649710372120,12116653690147683098,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=760,i,13135903649710372120,12116653690147683098,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4268,i,13135903649710372120,12116653690147683098,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4232,i,13135903649710372120,12116653690147683098,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4672,i,13135903649710372120,12116653690147683098,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4368,i,13135903649710372120,12116653690147683098,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2832,i,13135903649710372120,12116653690147683098,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2308,i,13135903649710372120,12116653690147683098,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4996,i,13135903649710372120,12116653690147683098,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5004,i,13135903649710372120,12116653690147683098,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4992,i,13135903649710372120,12116653690147683098,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4384,i,13135903649710372120,12116653690147683098,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4412,i,13135903649710372120,12116653690147683098,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:84⤵
-
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid3⤵
- Queries registry keys for unique system GUIDs
-
-
C:\Windows\system32\reg.exe"reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Users\Admin\AppData\Local\Real\real-2.7.4\bin\Real.exe"C:\Users\Admin\AppData\Local\Real\real-2.7.4\bin\Real.exe" --rbxversion3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Real\real-2.7.4\bin\luau-lsp.exe"C:\Users\Admin\AppData\Local\Real\real-2.7.4\bin\luau-lsp.exe" lsp --stdio --definitions @roblox=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\roblox.PluginSecurity.d.luau --definitions @real=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\real_executor_apis.d.luau --docs=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\roblox-api-docs.json --base-luaurc=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\base.luaurc3⤵
- Executes dropped EXE
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid3⤵
- Queries registry keys for unique system GUIDs
-
-
C:\Windows\system32\reg.exe"reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"3⤵
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid3⤵
- Queries registry keys for unique system GUIDs
-
-
C:\Windows\system32\reg.exe"reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap8716:844:7zEvent17319 -ad -saa -- "C:\Users\Admin\AppData\Local\Real\Real"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8616cc728,0x7ff8616cc734,0x7ff8616cc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,974401261715593067,8465635791373755160,262144 --field-trial-handle=1908,i,5646568568309097233,11347747277547730644,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1904 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,204765580813210421,10873956769263953494,524288 --field-trial-handle=1908,i,5646568568309097233,11347747277547730644,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2264 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,14073324903192736550,9104201423883023614,524288 --field-trial-handle=1908,i,5646568568309097233,11347747277547730644,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2508 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,3040765500715520854,13437487233908579223,2097152 --field-trial-handle=1908,i,5646568568309097233,11347747277547730644,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3216 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,4133434244132100788,14227985474105488507,2097152 --field-trial-handle=1908,i,5646568568309097233,11347747277547730644,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3264 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4468,i,5967673899980672580,11621153224850701710,2097152 --field-trial-handle=1908,i,5646568568309097233,11347747277547730644,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4520 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4800,i,1856803337157340852,12859386670301222462,2097152 --field-trial-handle=1908,i,5646568568309097233,11347747277547730644,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4772 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5556,i,5082921279212164462,14991249124734226099,524288 --field-trial-handle=1908,i,5646568568309097233,11347747277547730644,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5564 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5620,i,4383537598656988641,2642074111763888566,2097152 --field-trial-handle=1908,i,5646568568309097233,11347747277547730644,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5896 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6096,i,3491471699784217628,4761420213916148475,2097152 --field-trial-handle=1908,i,5646568568309097233,11347747277547730644,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5984 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3444,i,9155913819432899328,13681521411321463955,524288 --field-trial-handle=1908,i,5646568568309097233,11347747277547730644,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3428 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3272,i,13389577372443698829,11998797035716352688,524288 --field-trial-handle=1908,i,5646568568309097233,11347747277547730644,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3456 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3428,i,11439919650272261072,8158679916103845034,524288 --field-trial-handle=1908,i,5646568568309097233,11347747277547730644,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3292 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3224,i,6949654515101659385,17569000062025764895,524288 --field-trial-handle=1908,i,5646568568309097233,11347747277547730644,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3976 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5772,i,10410274927240983406,2393928476448276841,262144 --field-trial-handle=1908,i,5646568568309097233,11347747277547730644,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5796 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3084,i,4367576891624297059,10802893760171948696,524288 --field-trial-handle=1908,i,5646568568309097233,11347747277547730644,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1304 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Defense Evasion
Debugger Evasion
1Direct Volume Access
1Virtualization/Sandbox Evasion
1Discovery
Browser Information Discovery
1Debugger Evasion
1Network Share Discovery
1Peripheral Device Discovery
1Query Registry
8System Information Discovery
8System Network Configuration Discovery
1System Time Discovery
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
Microsoft.CognitiveServices.Speech.core.dll
crl-set
manifest.fingerprint
manifest.fingerprint
manifest.fingerprint
Filtering Rules
Filtering Rules-AA
Filtering Rules-CA
LICENSE
Part-DE
Part-ES
Part-FR
Part-IT
Part-NL
Part-RU
Part-ZH
adblock_snippet.js
manifest.fingerprint
manifest.fingerprint
crs.pb
ct_config.pb
kp_pinslist.pb
manifest.fingerprint
manifest.fingerprint
LICENSE
verified_contents.json
keys.json
manifest.fingerprint
mini-wallet.html
miniwallet.bundle.js
notification.bundle.js
notification.html
notification_fast.bundle.js
notification_fast.html
tokenized-card.bundle.js
tokenized-card.html
wallet-buynow.bundle.js
wallet-buynow.html
app-setup.js
load-ec-deps.bundle.js
load-ec-i18n.bundle.js
wallet-drawer.bundle.js
wallet-drawer.bundle.js.LICENSE.txt
wallet-drawer.html
app-setup.js
bnpl.bundle.js
bnpl.bundle.js.LICENSE.txt
bnpl.html
bnpl_driver.js
buynow_driver.js
crypto.bundle.js
driver-signature.txt
edge_driver.js
hub-signature.txt
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
README.md
super_coupon.json
wallet-checkout-eligible-sites-pre-stable.json
wallet-checkout-eligible-sites.json
checkoutdata.json
merchant-site-info.json
wallet-eligibile-aad-users.json
wallet-notification-config.json
wallet-pre-stable.json
wallet-stable.json
wallet-tokenization-config.json
load-hub-i18n.bundle.js
manifest.webapp.json
runtime.bundle.js
shopping_iframe_driver.js
vendor.bundle.js
vendor.bundle.js.LICENSE.txt
wallet-crypto.html
wallet-icon.svg
wallet-webui-101.079f5d74a18127cd9d6a.chunk.js
wallet-webui-227.bb2c3c84778e2589775f.chunk.js
wallet-webui-560.da6c8914bf5007e1044c.chunk.js
wallet-webui-708.de49febeeb0e9c77883f.chunk.js
wallet-webui-792.b1180305c186d50631a2.chunk.js
wallet-webui-925.baa79171a74ad52b0a67.chunk.js
wallet-webui-992.268aa821c3090dce03cb.chunk.js
wallet.bundle.js
wallet.html
wallet_checkout_autofill_driver.js
wallet_donation_driver.js
webui-setup.js
typosquatting_list.pb
data.txt
english_wikipedia.txt
female_names.txt
male_names.txt
model.markov
passwords.txt
ranked_dicts
surnames.txt
test.txt
us_tv_and_film.txt
verified_contents.json
hyph-af.hyb
hyph-be.hyb
hyph-bg.hyb
hyph-cs.hyb
hyph-cu.hyb
hyph-cy.hyb
hyph-da.hyb
hyph-de-1901.hyb
hyph-de-1996.hyb
hyph-de-ch-1901.hyb
hyph-el.hyb
hyph-en-gb.hyb
hyph-en-us.hyb
hyph-es.hyb
hyph-et.hyb
hyph-eu.hyb
hyph-fr.hyb
hyph-ga.hyb
hyph-gl.hyb
hyph-gu.hyb
hyph-hr.hyb
hyph-hu.hyb
hyph-hy.hyb
hyph-it.hyb
hyph-ka.hyb
hyph-kn.hyb
hyph-la.hyb
hyph-lt.hyb
hyph-lv.hyb
hyph-ml.hyb
hyph-mn-cyrl.hyb
hyph-mul-ethi.hyb
hyph-nl.hyb
hyph-or.hyb
hyph-pa.hyb
hyph-pt.hyb
hyph-ru.hyb
hyph-sk.hyb
hyph-sl.hyb
hyph-sq.hyb
hyph-sv.hyb
hyph-ta.hyb
hyph-te.hyb
hyph-tk.hyb
hyph-uk.hyb
hyph-und-ethi.hyb
deny_etld1_domains.list
deny_full_domains.list
auto_open_controller.js
edge_tracking_page_validator.js
product_page.js
shopping.html
shopping_fre.html
shopping_iframe_driver.js
LICENSE
verified_contents.json
widevinecdm.dll
widevinecdm.dll.sig
0adb65c1-a57c-42e3-a411-f08e6912a21e.tmp
40668b69-68ed-4aab-bc98-00e209e46f06.tmp
455099cb-c055-4e5a-ad66-fe10c8d07a46.tmp
009e0daf-4f41-42cc-b471-19b05278e176.tmp
1fee2774-5ba7-4a0a-98cc-39a3933dae37.tmp
38475267-081c-4d51-971e-1973bc0723e1.tmp
temp-index
0104c833-d078-4fcd-9497-9669465bb2c8.tmp
686bde05-9e48-48bb-aff4-33bdffcd48ed.tmp
6cd55b94-6f42-4777-a193-665272618732.tmp
83d199c8-f09f-428a-a077-ae252b906050.tmp
temp-index
the-real-index
ed97b0ba-080e-4de6-b6d0-eb2df8cb44f7.tmp
f9e50ff9-b628-4c8e-9da5-f1d310d6f734.tmp
cd57df71-ca19-478a-bc99-c9d350bdc79f.tmp
e8ae0cd3-16af-4cae-b9f7-749b38af6513.tmp
powershell.exe.log
02ba4e04-e4e3-4cfb-af7d-45339aaaba74.tmp
1b794a4a-6b51-4207-b223-bbcb77bd4145.tmp
1cbc020b-01f9-48f1-9844-8bfbf78ee265.tmp
1f5c84e2-bef6-4d4b-8054-88ef88b2dbd1.tmp
settings.dat
settings.dat
settings.dat
455bb0c6-d445-4e3b-844a-4ff4b58eb1d7.tmp
5afe7a06-082b-460a-90d3-142b0729461e.tmp
68cfcc20-61ed-426e-9627-b3582643ee34.tmp
7b1be109-54e9-45f6-b33a-18a94bb73b0e.tmp
7db42526-abc4-4c79-b969-0beb49f4da7a.tmp
9898fee2-4276-43c7-bc1a-69c344012b76.tmp
LOG
LOG
2682f3b3-7bc0-4e4b-85c4-afe1a780ee28.tmp
History
b4b24459-b7cb-410e-a370-457c67e8a8fa.tmp
b5751739-8398-46a3-a9da-7d8634610bda.tmp
e9ab2414-3e5f-4b82-bab1-1ebc7956670d.tmp
LOG
LOG
LOG
sync_diagnostic.log
a2f8500e-4bc5-4ab8-b358-3f4c50d25273.tmp
e5f63ae0-ca84-4b35-9ccc-6fc2c1b4211d.tmp
manifest.json
manifest.json
notification_fast.bundle.js.LICENSE.txt
tokenized-card.bundle.js.LICENSE.txt
strings.json
manifest.json
Last Version
Local State
Ruleset Data
manifest.json
Variations
deny_domains.list
manifest.json
manifest.json
manifest.json
0bb0b636-b7ae-467d-8669-bff2150d09c9.tmp
179a9eda-9ff7-4213-8653-d61e4fa87391.tmp
88d47bdf-4534-4aef-a2f0-aa320ef84349.tmp
9ec7b307-1ba2-4630-81cf-8483d920083d.tmp
a1ec0953-d5f6-4a33-b721-58049a76bc23.tmp
bf869b05-4d4e-45c8-a1d5-a8c8f316e208.tmp
d0e26d0e-d318-4902-96df-795460e0ef0d.tmp
deb4138e-cdba-41bd-8762-6d946ead9d12.tmp
f55dbdff-04f3-4621-bf15-95a74b516680.tmp
f7a673b0-c87d-4814-847c-11448a8be58c.tmp
hyph-as.hyb
hyph-hi.hyb
hyph-nb.hyb
manifest.json
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
.real-write-probe-4168-240755750.tmp
Update.exe
base.luaurc
real_executor_apis.d.luau
roblox-api-docs.json
roblox.PluginSecurity.d.luau
64a56a1d-c1c5-4bbd-b2a6-e207de8352ab.tmp
703313b8-4543-44f4-b74d-00e258c71900.tmp
manifest.json
settings.dat
34d78279-7621-46b1-b88e-f1823a9fef32.tmp
temp-index
temp-index
f20d7b1d-cf62-4b2f-a480-e012d921c8e0.tmp
Local State
manifest.json
manifest.json
manifest.fingerprint
manifest.json
manifest.json
Other
manifest.json
b2eb9f91-e326-4de2-a4d9-e45d2017a144.tmp
b75caff2-2e6b-4bae-a163-c47c2e500ad1.tmp
fe7584f8-22b7-4d89-923b-2f6fa47c2ac7.tmp
settings.json
current-build.txt
current-version.txt
manifest-seq.txt
real-taskbar-dark.ico
real-taskbar-light.ico
Real.exe
Real.dll
Real.exe
Spoofer.exe
luau-lsp.exe
real-mcp.exe
setup.log
setup.log
setup.log
setup.log
setup.log
setup.log
setup.log
33725c3e-3908-4eda-adc3-75ef41fd160e.tmp
settings.dat
settings.dat
throttle_store.dat
098c9356-8766-4bba-b29d-4a3043cfc30a.tmp
index
index
temp-index
index
data_1
data_0
data_1
data_2
data_3
55487bd1-a6de-484c-bfee-8829d78d1780.tmp
Network Persistent State
SCT Auditing Pending Reports
Preferences
MANIFEST-000001
CURRENT
index
Local State
Local State
a5e591b8-6c22-468d-8f97-7c1d691039c3.tmp
bcb46f86-6bf5-452d-b8c2-1acc14a75dca.tmp
d2626e05-17d2-4e7a-bb4b-3e42d10449ca.tmp
__PSScriptPolicyTest_jxh1oxxj.2pe.ps1
Real.lnk
Real.lnk
Real.lnk
memory/1544-249-0x000001A0DEFC0000-0x000001A0DEFE2000-memory.dmp
memory/2152-66-0x00007FF883330000-0x00007FF883331000-memory.dmp
memory/2152-69-0x00007FF8838B0000-0x00007FF8838B1000-memory.dmp
memory/3064-1139-0x00000200F42D0000-0x00000200F468B000-memory.dmp
memory/3064-1149-0x00000200F42D0000-0x00000200F468B000-memory.dmp
memory/5324-26-0x00007FF883760000-0x00007FF883761000-memory.dmp
memory/5484-1085-0x0000000140000000-0x0000000141118000-memory.dmp
memory/5484-1080-0x0000000140000000-0x0000000141118000-memory.dmp
memory/5484-1086-0x0000000140000000-0x0000000141118000-memory.dmp
memory/5484-1088-0x0000000140000000-0x0000000141118000-memory.dmp
memory/5508-141-0x00007FF883760000-0x00007FF883761000-memory.dmp
memory/7020-1554-0x000001736D6A0000-0x000001736D6A1000-memory.dmp
memory/7020-1561-0x000001736D6A0000-0x000001736D6A1000-memory.dmp
memory/7020-1565-0x000001736D6A0000-0x000001736D6A1000-memory.dmp
memory/7020-1564-0x000001736D6A0000-0x000001736D6A1000-memory.dmp
memory/7020-1563-0x000001736D6A0000-0x000001736D6A1000-memory.dmp
memory/7020-1559-0x000001736D6A0000-0x000001736D6A1000-memory.dmp
memory/7020-1562-0x000001736D6A0000-0x000001736D6A1000-memory.dmp
memory/7020-1560-0x000001736D6A0000-0x000001736D6A1000-memory.dmp
memory/7020-1553-0x000001736D6A0000-0x000001736D6A1000-memory.dmp
memory/7020-1555-0x000001736D6A0000-0x000001736D6A1000-memory.dmp