b411b444682179bf2f4270fbc22d9a86263b659152f9611712ec40101a8f3aee

Analysis

user interaction
yes
max time kernel
16s
max time network
51s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 15:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RealSetup_0ce96862be5233d4684ab8b7aaf3734a64037097ad2f753138729d33f406cabf.exe
Size 16.5MB
Sample261020-szhbasfv4k
SHA256 b411b444682179bf2f4270fbc22d9a86263b659152f9611712ec40101a8f3aee
MD5 d81c13e9063abe4687060d633ff1f701
SHA1 bb5bc882d52a5c342ab214df7de170e7d2f4769a
SHA512 d8e049c1d5212855fc61d13e81add838bd7131d4dbe6452f9259c1d9804c6ff59222069e8f6596e179d1991ef6137d463900531c9decfbeb4a9bd2a186c1cba7
SSDEEP 393216:8OtYCUkjbi+D014Buf8uKzYYlAbf4EOUYNOUY:NWqgQEY
TLSH
T12A07B069A6BC00E9E467C2BCC2965223EB72B415277057CF5A609AF60F23AD41F7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4644	powershell.exe
5312	powershell.exe
252	powershell.exe
4884	powershell.exe
4884	powershell.exe
4644	powershell.exe
5312	powershell.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RealSetup_0ce96862be5233d4684ab8b7aaf3734a64037097ad2f753138729d33f406cabf.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
65	discord.com
67	discord.com
72	discord.com
56	discord.com
57	discord.com
60	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3716	sc.exe

Queries registry keys for unique system GUIDs 1 TTPs 1 IoCs

Queries the MachineGuid or HwProfileGuid value from the command line, commonly used to create a unique victim ID.

discovery

System Information Discovery

T1082

pid	Process
6636	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4608	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RealSetup_0ce96862be5233d4684ab8b7aaf3734a64037097ad2f753138729d33f406cabf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RealSetup_0ce96862be5233d4684ab8b7aaf3734a64037097ad2f753138729d33f406cabf.exe

System Time Discovery 1 TTPs 5 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4608	cmd.exe
5132	net.exe
4144	net1.exe
3836	msedge.exe
7092	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
252	powershell.exe
252	powershell.exe
252	powershell.exe
4884	powershell.exe
4884	powershell.exe
4884	powershell.exe
4764	RealSetup_0ce96862be5233d4684ab8b7aaf3734a64037097ad2f753138729d33f406cabf.exe
4764	RealSetup_0ce96862be5233d4684ab8b7aaf3734a64037097ad2f753138729d33f406cabf.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
6116	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	252	powershell.exe
Token: SeIncreaseQuotaPrivilege	252	powershell.exe
Token: SeSecurityPrivilege	252	powershell.exe
Token: SeTakeOwnershipPrivilege	252	powershell.exe
Token: SeLoadDriverPrivilege	252	powershell.exe
Token: SeSystemProfilePrivilege	252	powershell.exe
Token: SeSystemtimePrivilege	252	powershell.exe
Token: SeProfSingleProcessPrivilege	252	powershell.exe
Token: SeIncBasePriorityPrivilege	252	powershell.exe
Token: SeCreatePagefilePrivilege	252	powershell.exe
Token: SeBackupPrivilege	252	powershell.exe
Token: SeRestorePrivilege	252	powershell.exe
Token: SeShutdownPrivilege	252	powershell.exe
Token: SeDebugPrivilege	252	powershell.exe
Token: SeSystemEnvironmentPrivilege	252	powershell.exe
Token: SeRemoteShutdownPrivilege	252	powershell.exe
Token: SeUndockPrivilege	252	powershell.exe
Token: SeManageVolumePrivilege	252	powershell.exe
Token: 33	252	powershell.exe
Token: 34	252	powershell.exe
Token: 35	252	powershell.exe
Token: 36	252	powershell.exe
Token: SeDebugPrivilege	4884	powershell.exe
Token: SeIncreaseQuotaPrivilege	4884	powershell.exe
Token: SeSecurityPrivilege	4884	powershell.exe
Token: SeTakeOwnershipPrivilege	4884	powershell.exe
Token: SeLoadDriverPrivilege	4884	powershell.exe
Token: SeSystemProfilePrivilege	4884	powershell.exe
Token: SeSystemtimePrivilege	4884	powershell.exe
Token: SeProfSingleProcessPrivilege	4884	powershell.exe
Token: SeIncBasePriorityPrivilege	4884	powershell.exe
Token: SeCreatePagefilePrivilege	4884	powershell.exe
Token: SeBackupPrivilege	4884	powershell.exe
Token: SeRestorePrivilege	4884	powershell.exe
Token: SeShutdownPrivilege	4884	powershell.exe
Token: SeDebugPrivilege	4884	powershell.exe
Token: SeSystemEnvironmentPrivilege	4884	powershell.exe
Token: SeRemoteShutdownPrivilege	4884	powershell.exe
Token: SeUndockPrivilege	4884	powershell.exe
Token: SeManageVolumePrivilege	4884	powershell.exe
Token: 33	4884	powershell.exe
Token: 34	4884	powershell.exe
Token: 35	4884	powershell.exe
Token: 36	4884	powershell.exe
Token: SeIncreaseQuotaPrivilege	4884	powershell.exe
Token: SeSecurityPrivilege	4884	powershell.exe
Token: SeTakeOwnershipPrivilege	4884	powershell.exe
Token: SeLoadDriverPrivilege	4884	powershell.exe
Token: SeSystemProfilePrivilege	4884	powershell.exe
Token: SeSystemtimePrivilege	4884	powershell.exe
Token: SeProfSingleProcessPrivilege	4884	powershell.exe
Token: SeIncBasePriorityPrivilege	4884	powershell.exe
Token: SeCreatePagefilePrivilege	4884	powershell.exe
Token: SeBackupPrivilege	4884	powershell.exe
Token: SeRestorePrivilege	4884	powershell.exe
Token: SeShutdownPrivilege	4884	powershell.exe
Token: SeDebugPrivilege	4884	powershell.exe
Token: SeSystemEnvironmentPrivilege	4884	powershell.exe
Token: SeRemoteShutdownPrivilege	4884	powershell.exe
Token: SeUndockPrivilege	4884	powershell.exe
Token: SeManageVolumePrivilege	4884	powershell.exe
Token: 33	4884	powershell.exe
Token: 34	4884	powershell.exe
Token: 35	4884	powershell.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 6116	4764	RealSetup_0ce96862be5233d4684ab8b7aaf3734a64037097ad2f753138729d33f406cabf.exe	89
PID 6116 wrote to memory of 3260	6116	msedgewebview2.exe	90
PID 6116 wrote to memory of 1220	6116	msedgewebview2.exe	91
PID 6116 wrote to memory of 1220	6116	msedgewebview2.exe	91
PID 6116 wrote to memory of 1220	6116	msedgewebview2.exe	91
PID 6116 wrote to memory of 1220	6116	msedgewebview2.exe	91
PID 6116 wrote to memory of 2140	6116	msedgewebview2.exe	92
PID 6116 wrote to memory of 300	6116	msedgewebview2.exe	93
PID 6116 wrote to memory of 300	6116	msedgewebview2.exe	93
PID 6116 wrote to memory of 300	6116	msedgewebview2.exe	93
PID 6116 wrote to memory of 2380	6116	msedgewebview2.exe	94
PID 6116 wrote to memory of 2380	6116	msedgewebview2.exe	94
PID 6116 wrote to memory of 2380	6116	msedgewebview2.exe	94
PID 6116 wrote to memory of 2380	6116	msedgewebview2.exe	94
PID 6116 wrote to memory of 2380	6116	msedgewebview2.exe	94
PID 4764 wrote to memory of 4608	4764	RealSetup_0ce96862be5233d4684ab8b7aaf3734a64037097ad2f753138729d33f406cabf.exe	95
PID 4608 wrote to memory of 3716	4608	cmd.exe	97
PID 4608 wrote to memory of 5132	4608	cmd.exe	98
PID 5132 wrote to memory of 4144	5132	net.exe	99
PID 4764 wrote to memory of 3480	4764	RealSetup_0ce96862be5233d4684ab8b7aaf3734a64037097ad2f753138729d33f406cabf.exe	100
PID 4764 wrote to memory of 1776	4764	RealSetup_0ce96862be5233d4684ab8b7aaf3734a64037097ad2f753138729d33f406cabf.exe	102
PID 4764 wrote to memory of 252	4764	RealSetup_0ce96862be5233d4684ab8b7aaf3734a64037097ad2f753138729d33f406cabf.exe	104
PID 4764 wrote to memory of 4884	4764	RealSetup_0ce96862be5233d4684ab8b7aaf3734a64037097ad2f753138729d33f406cabf.exe	107

C:\Users\Admin\AppData\Local\Temp\RealSetup_0ce96862be5233d4684ab8b7aaf3734a64037097ad2f753138729d33f406cabf.exe
"C:\Users\Admin\AppData\Local\Temp\RealSetup_0ce96862be5233d4684ab8b7aaf3734a64037097ad2f753138729d33f406cabf.exe"
1⤵
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RealSetup_0ce96862be5233d4684ab8b7aaf3734a64037097ad2f753138729d33f406cabf.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4764.3300.3930469885594769007 /pfhostedapp:01f4bb2307f363e2bc64a15d8abb329c3984623a
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:6116
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView /prefetch:4 /pfhostedapp:01f4bb2307f363e2bc64a15d8abb329c3984623a --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x108,0x7ffb5f715fd8,0x7ffb5f715fe4,0x7ffb5f715ff0
    3⤵
    PID:3260
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView" --webview-exe-name=RealSetup_0ce96862be5233d4684ab8b7aaf3734a64037097ad2f753138729d33f406cabf.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1760 --field-trial-handle=1764,i,13505615710732203820,10626437541172672244,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:01f4bb2307f363e2bc64a15d8abb329c3984623a
    3⤵
    PID:1220
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView" --webview-exe-name=RealSetup_0ce96862be5233d4684ab8b7aaf3734a64037097ad2f753138729d33f406cabf.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1860 --field-trial-handle=1764,i,13505615710732203820,10626437541172672244,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:01f4bb2307f363e2bc64a15d8abb329c3984623a
    3⤵
    PID:2140
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView" --webview-exe-name=RealSetup_0ce96862be5233d4684ab8b7aaf3734a64037097ad2f753138729d33f406cabf.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2304 --field-trial-handle=1764,i,13505615710732203820,10626437541172672244,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:01f4bb2307f363e2bc64a15d8abb329c3984623a
    3⤵
    PID:300
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView" --webview-exe-name=RealSetup_0ce96862be5233d4684ab8b7aaf3734a64037097ad2f753138729d33f406cabf.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3532 --field-trial-handle=1764,i,13505615710732203820,10626437541172672244,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:01f4bb2307f363e2bc64a15d8abb329c3984623a /prefetch:1
    3⤵
    PID:2380
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config w32time start= auto >nul 2>nul & net start w32time >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Windows\system32\sc.exe
    sc config w32time start= auto
    3⤵
    - Launches sc.exe
    PID:3716
- - C:\Windows\system32\net.exe
    net start w32time
    3⤵
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:5132
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start w32time
      4⤵
      System Time Discovery
      PID:4144
- C:\Windows\SYSTEM32\w32tm.exe
  w32tm /config /manualpeerlist:"time.windows.com,0x9 pool.ntp.org,0x9" /syncfromflags:manual /reliable:no /update
  2⤵
  PID:3480
- C:\Windows\SYSTEM32\w32tm.exe
  w32tm /resync /rediscover
  2⤵
  PID:1776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "try{ $ex=@((Get-MpPreference).ExclusionPath); $want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll'); $stale='C:\Users\Admin\AppData\Local\Temp'; $miss=$want | Where-Object { $ex -notcontains $_ }; if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1} }catch{exit 1}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll');$stale='C:\Users\Admin\AppData\Local\Temp';foreach($p in $want){ $ex=@((Get-MpPreference).ExclusionPath); if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }};if($stale -and @((Get-MpPreference).ExclusionPath) -contains $stale){ Remove-MpPreference -ExclusionPath $stale};$ex=@((Get-MpPreference).ExclusionPath);$miss=$want | Where-Object { $ex -notcontains $_ };if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/projectreal
  2⤵
  PID:3336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x320,0x7ffb5af1c188,0x7ffb5af1c194,0x7ffb5af1c1a0
    3⤵
    PID:2252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1660,i,14239527313666545698,5247435053499490244,524288 --field-trial-handle=2376,i,16104400154768616167,9300188256376585117,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,11182747519525030982,1301607913764500608,262144 --field-trial-handle=2376,i,16104400154768616167,9300188256376585117,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:2
    3⤵
    PID:1080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2208,i,15874986853334636553,3019327514796943874,524288 --field-trial-handle=2376,i,16104400154768616167,9300188256376585117,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:13
    3⤵
    PID:2868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,15287702572216762694,5225226795590988026,2097152 --field-trial-handle=2376,i,16104400154768616167,9300188256376585117,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:4564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,10929245431570105043,14536978334517543392,2097152 --field-trial-handle=2376,i,16104400154768616167,9300188256376585117,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,18158570981721247532,15165292005239559066,2097152 --field-trial-handle=2376,i,16104400154768616167,9300188256376585117,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:1
    3⤵
    PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,13979167577209869843,3853915398210824433,2097152 --field-trial-handle=2376,i,16104400154768616167,9300188256376585117,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:9
    3⤵
    PID:5812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3876,i,8496379867710266053,9973428003284472332,524288 --field-trial-handle=2376,i,16104400154768616167,9300188256376585117,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:14
    3⤵
    PID:1344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5504,i,7998754809658871300,1841547118373112456,2097152 --field-trial-handle=2376,i,16104400154768616167,9300188256376585117,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
    3⤵
    PID:2808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,11691713340668256435,12608757140069328294,524288 --field-trial-handle=2376,i,16104400154768616167,9300188256376585117,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
    3⤵
    PID:2832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,17997279032020565386,12572774337056013384,524288 --field-trial-handle=2376,i,16104400154768616167,9300188256376585117,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
    3⤵
    PID:3524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    PID:6764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x268,0x26c,0x270,0x264,0x290,0x7ffb5af1c188,0x7ffb5af1c194,0x7ffb5af1c1a0
      4⤵
      PID:6796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,4509389032906222483,9076125285471895133,524288 --field-trial-handle=2708,i,17495585431257572149,8699826248014833969,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:11
      4⤵
      System Time Discovery
      PID:7092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,7155290326275799882,2469113908206631678,262144 --field-trial-handle=2708,i,17495585431257572149,8699826248014833969,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:2
      4⤵
      PID:7100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,4503361322252591305,3817654850634470703,524288 --field-trial-handle=2708,i,17495585431257572149,8699826248014833969,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:13
      4⤵
      PID:7108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,12034528202771608691,12240645333035780877,524288 --field-trial-handle=2708,i,17495585431257572149,8699826248014833969,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:14
      4⤵
      PID:4476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,12894554946439939931,16988702585802679034,524288 --field-trial-handle=2708,i,17495585431257572149,8699826248014833969,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:14
      4⤵
      PID:6480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,12894554946439939931,16988702585802679034,524288 --field-trial-handle=2708,i,17495585431257572149,8699826248014833969,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:14
      4⤵
      PID:4200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,347514426550396388,9722979939064681593,524288 --field-trial-handle=2708,i,17495585431257572149,8699826248014833969,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
      4⤵
      PID:5148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,8718385601023941557,3735941342332834084,524288 --field-trial-handle=2708,i,17495585431257572149,8699826248014833969,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
      4⤵
      PID:4160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,15859149762840766007,909842415932640051,524288 --field-trial-handle=2708,i,17495585431257572149,8699826248014833969,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
      4⤵
      PID:1824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,2546392898871210587,13549619221628378836,524288 --field-trial-handle=2708,i,17495585431257572149,8699826248014833969,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:14
      4⤵
      PID:3936
- C:\Users\Admin\AppData\Local\Real\Update.exe
  "C:\Users\Admin\AppData\Local\Real\Update.exe" --processStart Real.exe
  2⤵
  PID:5576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll');$stale='C:\Users\Admin\AppData\Local\Temp';foreach($p in $want){ $ex=@((Get-MpPreference).ExclusionPath); if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }};if($stale -and @((Get-MpPreference).ExclusionPath) -contains $stale){ Remove-MpPreference -ExclusionPath $stale};$ex=@((Get-MpPreference).ExclusionPath);$miss=$want | Where-Object { $ex -notcontains $_ };if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5312
- - C:\Users\Admin\AppData\Local\Real\real-2.7.9\Real.exe
    "C:\Users\Admin\AppData\Local\Real\real-2.7.9\Real.exe" --real-launched-by-updater
    3⤵
    PID:6360
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=6360.5756.420733811177768458 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
      4⤵
      PID:2580
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView /prefetch:4 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x190,0x194,0x198,0x16c,0x124,0x7ffb5f715fd8,0x7ffb5f715fe4,0x7ffb5f715ff0
        5⤵
        
        PID:5820
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1760 --field-trial-handle=1740,i,10968976755309483414,13053680774163097711,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
        5⤵
        
        PID:6552
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2124 --field-trial-handle=1740,i,10968976755309483414,13053680774163097711,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
        5⤵
        
        PID:5840
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1596 --field-trial-handle=1740,i,10968976755309483414,13053680774163097711,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
        5⤵
        
        PID:6572
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3460 --field-trial-handle=1740,i,10968976755309483414,13053680774163097711,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105 /prefetch:1
        5⤵
        
        PID:5616
  - - C:\Windows\system32\reg.exe
      "reg" query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
      4⤵
      Queries registry keys for unique system GUIDs
      PID:6636
  - - C:\Users\Admin\AppData\Local\Real\real-2.7.9\bin\Real.exe
      "C:\Users\Admin\AppData\Local\Real\real-2.7.9\bin\Real.exe" --rbxversion
      4⤵
      PID:4420
  - - C:\Users\Admin\AppData\Local\Real\real-2.7.9\bin\luau-lsp.exe
      "C:\Users\Admin\AppData\Local\Real\real-2.7.9\bin\luau-lsp.exe" lsp --stdio --definitions @roblox=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\roblox.PluginSecurity.d.luau --definitions @real=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\real_executor_apis.d.luau --docs=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\roblox-api-docs.json --base-luaurc=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\base.luaurc
      4⤵
      PID:2872
  - - C:\Windows\system32\reg.exe
      "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
      4⤵
      PID:4256

C:\Users\Admin\AppData\Local\Real\Update.exe
C:\Users\Admin\AppData\Local\Real\Update.exe
1⤵
PID:4600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll');$stale='C:\Users\Admin\AppData\Local\Temp';foreach($p in $want){ $ex=@((Get-MpPreference).ExclusionPath); if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }};if($stale -and @((Get-MpPreference).ExclusionPath) -contains $stale){ Remove-MpPreference -ExclusionPath $stale};$ex=@((Get-MpPreference).ExclusionPath);$miss=$want | Where-Object { $ex -notcontains $_ };if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4644
- C:\Users\Admin\AppData\Local\Real\real-2.7.9\Real.exe
  "C:\Users\Admin\AppData\Local\Real\real-2.7.9\Real.exe" --real-launched-by-updater
  2⤵
  PID:2876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

533a2a99-e1d5-4aab-82c8-7c06b57f425d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\533a2a99-e1d5-4aab-82c8-7c06b57f425d.tmp
Size 44KB
SHA256 981618c3163ff1672006477af72e368ebd2c70fc83459cb3a6c65acc92bde4d6
MD5 d003af9437f53781a2ec6d56d3a7a143
SHA1 39a47b7a6a5724e7739a9e031e69f58d2a1afdec
SHA512 14eb301fe12f50b82df7e512a979945aade98fa8f7a5a8e7304c4f1530db7259d965fe7ef7bf327535d68094bffcc59ed54abd1abc26f5afbd72539eec02dc55
SSDEEP 768:1/UxvxjgC+U31Rgm1IuBJ1DmGA5b65Q92RQMPbCB9aVDS:YZj3+U3L/AF65dQ32VDS
TLSH
T14213BF3D9C60AD7F48FDB740224F622A6E684233D1E454A4C7D96F0CC5B7A9DF306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e8ebf0e-b942-48a7-9b64-88fc4cd3fa1a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6e8ebf0e-b942-48a7-9b64-88fc4cd3fa1a.tmp
Size 39KB
SHA256 c5c99dfa807c5d09d5f89ae4461171e773129e064ed59fa4b5b6723021f8ae96
MD5 d09c1e41b16b44b06fc79e3178b3f007
SHA1 71ea93d0bb8b54eae143dc4c89f7521ad6dcdea4
SHA512 d5fee46817a30394a67b135bac9c40b26ac324896f911143b64ba5067cd61db3aaf0c14c6cf858d0c911a87f377307efa0abc78b0e5dfbf40bd1ce9026b7e822
SSDEEP 768:q/UxvxjgC+B3nN7gm1IuBJFDmGA5b65Q92RQMPqTFj0O:vZj3+B3dPAF65dQjFQO
TLSH
T1E103C031EC95EDB39CF96280369BB39AAFF8457384C546A049F56F1D058378D070B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 84008e1469627cb4093232f4804bdd66e4ec134b6c5cfd3954f47a2c08da0a1a
MD5 f4ef72cb96cdd191595a320a0e432a6a
SHA1 d09d73fb6a5cc5e5d22e0a69dc1141c4e57964c4
SHA512 6c46da93fc11bc3892647a319799058970cd3cc6b9dd9b1e26d84523bc6fe2e5bd8244ba977dcfae72c45220eeef0d957d4b87ee7aec70148ba4d1cca8d955de
TLSH
T1EBD080325979ADF1E176117D01D1455065BD7553EE0502887711C8054C742465671F9E
MD5 SHA1 SHA512 TLSH

Submit Download

3712a137-4453-4cfd-acd7-b540177fba80.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3712a137-4453-4cfd-acd7-b540177fba80.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

618159ea-fcbe-439b-9185-20b33f435841.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\618159ea-fcbe-439b-9185-20b33f435841.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

80661609-537b-4bf9-b1ec-2601c4ab04d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\80661609-537b-4bf9-b1ec-2601c4ab04d8.tmp
Size 27KB
SHA256 e5edebf14537614ece3725e48a657834efeb28fe45ea51e1059884f6c1820a20
MD5 5f92507f3d8ea786f4bf0a35dce85677
SHA1 96f3b672aa2911147889f24e1d513b712dc8e097
SHA512 11db98f7aabe22ca897b486d9dd4842def8648db794d29deeded3c9020ada88dc23f02dc232a52d378c569d7d20f0ce97c3dd2bc78dcd924751be0d1f98152c0
SSDEEP 768:L7aa4W7pLuLb6DWgptfvD8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJdNMGroHs:L7aa42Eb6DWgptfvDu1jaKrM9M
TLSH
T1D1C2DB7B640CCB7F4F900ADD9C197E9F6D6802CB9698CD8047FE945C02C6BEA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 0391912e8b9aa1ebaefcd96cd1d388401b4a3015ca3cfdd567ed16de9dd6188c
MD5 f247ede51bcdb571e08e62fec2b9d651
SHA1 b6b64bbeb80b4ba0099bb73c20fa35d2e643ecad
SHA512 776d20eb0cc7754a03388eec48b10c31cff516eb9097f567592cb57bae4cc3d9c83e6e92cf09e2727495e0ccd92c82018fa873268b0e79038d55b37e6d85b58d
TLSH
T10D51AB64979BEB54FBA616B143C490A7FA348F899FCF5F033450FC7861463D44A420C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 425b54f7214a2f38b3914742bbd2907e4abcbe614beb14817e8f5faf205d07be
MD5 92bc1532733e18f38a318ae5f88d7559
SHA1 c48ac58038de34044b6dad65ef5763407106fea4
SHA512 f46e76527d2e6f30d6c6992838999c66e65accb9587791c188457355d09a7fd15aeb004df9913019339e2873c85575b1045306f72a7c3632dda32ca7bacf68a2
TLSH
T1535189A4979BEB54FBA616B143D4A1A7FA348FC99FCF5F033464EC78614A3D44A420C4
MD5 SHA1 SHA512 TLSH

Submit Download

45b38128-8364-488a-8703-254634204f34.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\45b38128-8364-488a-8703-254634204f34.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

65380ddc-1d26-4f47-ae7b-c5b762fb5ae5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\65380ddc-1d26-4f47-ae7b-c5b762fb5ae5.tmp
Size 2KB
SHA256 54c1139813a2bd1c5938a54521fa36ab8d663d4c810110b3caa64540e8fe40ff
MD5 39dfb2abe91d9c0ff88b058b499f890b
SHA1 25f809fe125190f76e0d8f4b034805f08295e617
SHA512 bd0039ca5ee981709c52c9086aaf21e0e362f74252d5384228a845a961ab8074cec5ffe5bdd3c39f8db77a9d4296fd3e12b6b3cae92cc9f5bf7d05d9605a3677
TLSH
T163418DF783F4853D9A1196F4AB086E1FCE2C0915432C7C6AC5E45E2B93E34B1E181A9F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d20d2b05d784c8f2c24a849beacd9921256d3b2de2e15178f0d9b15f8649ecf7
MD5 6063674c675d0a70b87fc0179ce94397
SHA1 f579473a6f396bb846dcc18fc4b15a2372b76012
SHA512 807c167f63d2fafce9a54b0d3b19b44bbfa09143d657500deaa2d9c9d471adcea9bd6a345e3aae674eac89abc62ae60653cdd1f5463cdc57346fe1d0b58c4d23
SSDEEP 48:K0RAthrvzMb/KXIS5MK9Z1zMxxcYKbRRy1rIlKEE4piBWSYkQkgkvPIvqkKeB2wP:KE+QK76O+rSKEEnz+K8AW1
TLSH
T1E7914444763A82503DFE260841BAC91F51E630727664E66FBB6893B34F2EE440DFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b521bc42-a0c9-4bba-934e-82e1c2795412.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b521bc42-a0c9-4bba-934e-82e1c2795412.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

b77352d3-38ef-4c11-983f-36d7ffb6f64b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b77352d3-38ef-4c11-983f-36d7ffb6f64b.tmp
Size 12KB
SHA256 ff0fbab4655bcf696fd6ac6438fbe35b209843924474f38d4f03d0bb260961f0
MD5 b7cf1de1868be0de2c1f2ef9a5b8f7f4
SHA1 566bb168fec222b7e297a94353d7c121ae4526e1
SHA512 3798820a85233a9515e15418e22233e8ff34dd9bd3e4ddf9c80c24f4d2c88fb3d3d10b3b01cc666116f41c4a8d866b4661ad464753d04db10c31187c913aa331
SSDEEP 192:sxRDRzC3/fsUsmWpVByYh3zoA8plD/g6+WNytTp/Yaec1gOIgVfJ:sxRDw3/fsUsmWvBbeN/5s/JJL
TLSH
T1D8429615A928A97B8CD7D61DFB65BF23D6FD503664D02E44A6FC8A1C04EB6DD2203C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e188697d-5250-4b64-af06-d1e4f05e8d71.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e188697d-5250-4b64-af06-d1e4f05e8d71.tmp
Size 12KB
SHA256 852192ad8dd519c7e4559b4638e55f518e4c3a0147d25e4aad894063d4e7cad5
MD5 1c571933d5cdfd950e00d16c99074ef2
SHA1 15f12a91f4eebb1e381b8b61b0f3cb1713b32314
SHA512 5086928f3e747606f8f66aaaa6b32e3fd4f5e5746f5dcd130deb448322bfba81e98fd8d8d84315bd22a11ec81c9f93c6d73250f2ee55efd8c5943c7ee694d6cb
SSDEEP 192:sxRDRzC3/fsUs4WpVByYh3zoA8plD/g6+WNytTp/YaecqGOIgVTaJ:sxRDw3/fsUs4WvBbeN/5s/JQg
TLSH
T146429615A928A97B8CD7D61DFB657F23D2FD503664D02E48A6FC9A1C04EB6DD2203C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ade7055a-c486-449e-8f14-a1bc65e1513c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ade7055a-c486-449e-8f14-a1bc65e1513c.tmp
Size 39KB
SHA256 9d08db3d9bedcd9c8ac856d0901f64babe4239c1233b40ea265b12d7bc533b27
MD5 eb2a34e4fddeb9c0955f698760a28256
SHA1 9b4752e9aa186fd2b51f9581f81d1e8a1bf0a9d4
SHA512 701390ef57ab2153858af8a519e17ed3084809b13c3e4f0e6c2a50837058bdf41d90a8fd1138b8e5334fd8caa8eb2096cef9da69de5d56be072e64a7e9690baf
SSDEEP 768:U/UxvxjgC+B3iNWJgm1IitDmGA5b65Q92RQMPbPFj0O:BZj3+B3EG3AF65dQMFQO
TLSH
T15C03C036EC94AEB3DCF95280364BA35AAFF84563D1C552E049F96E0D06C768C830B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b01f71ea-7417-4dfc-8833-036ffa250419.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b01f71ea-7417-4dfc-8833-036ffa250419.tmp
Size 33KB
SHA256 3ed2dc4dc3c72fbe94bbe08db2c4d338c090b6a44bb2a85ae6fadf3df52f9a93
MD5 6bb5ce8b714056b6b85ec8e2350aaaaf
SHA1 abd5908f2c613937b4c68af2a5f970b78f01fff5
SHA512 56c78ff46dca5871b420faa4207180749e02dbaf2bd089f6672a2ff4c7348c4c499be1a3adfd91ac6f3782f6a7c4fd0dffb67a465bb3f47cd9b8fc0271bd5416
SSDEEP 768:6w3yRgm1IuBJqDmGA5b65Q92RQMPQDCsLS:6w32KAF65dQZVW
TLSH
T16CF2AF71ACA2DEB34DB966817297729A7FB45223D4C84A90D9D5AF1C01C36CE130BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54f67289-9835-42f9-9b6c-6bf97931ab0f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\54f67289-9835-42f9-9b6c-6bf97931ab0f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4e81e838-16b8-46bc-b012-62c27ca26632.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4e81e838-16b8-46bc-b012-62c27ca26632.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

.real-write-probe-4600-240761656.tmp

Path C:\Users\Admin\AppData\Local\Real\.real-write-probe-4600-240761656.tmp
Size 4B
SHA256 aa33996d60e89311b4d1a920dae03c6d7fa3ae1956c52662e273aad4683e577f
MD5 4bca24304861acde5770fdbe3cc2503b
SHA1 c9c64e071d2853bc7906c017a231ad1cc46ab630
SHA512 310070ab4092002aa33f550eb98680fa6662e7305fce227843430aba334fdfad1fe0dd4a6484264b59f9b02a780433a552ce3d5c3da643a77427463c06e47800
MD5 SHA1 SHA512

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\Real\Update.exe
Size 8.2MB
SHA256 b42d62f0e5275ed85cb8451973f6d3b953ab024c685cf9bb90bf10dbf48ad3b2
MD5 6da042cfa6cd298b107a3a566a4d7442
SHA1 4d80fe0351fd54c988ab1c7b5c2d155fbfa804d2
SHA512 96eaf98adfb939873b7ac35d9be63536b0db96ecad11b00195e0ffcf93857b549aef6c170cc03b3602d20f9f20240a8953a323ff3f947a6a6bb3f352bca81bfc
SSDEEP 98304:JpOiSOCJxUf8Y/KzYYlA51fSn+LpjFOEXev8wcFOvkSxMy5/Dn:GhBxUf8uKzYYlAbf4kpxOUgBRD
TLSH
T1D586BF69A6BC01D9E877C2BCC2965223DB72B415277057CF1A609AF60F23AE41E7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.luaurc

Path C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\base.luaurc
Size 290B
SHA256 b7ca1b4299ba80b129481ce4382a520f0e3901ced321e61c15270f09bf15737f
MD5 cfe6c40e114bdf7c9a59dbb4a17692e7
SHA1 2b9fc23f2b247612f96ecea919f54c1278886b38
SHA512 8d5610ab7da3e63aad4ff277ec3d6fb234881f322ce0916e933f2848ea943b122ba0e364056b95f72ea8fa0f884c231971c1a04a0ec6e1b158433196065778ea
TLSH
T192D0E228D1995CBC2CB1819EA0A99212D5200BAB71592C2FB0FA03092F79E2D3468D80
MD5 SHA1 SHA512 TLSH

Submit Download

real_executor_apis.d.luau

Path C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\real_executor_apis.d.luau
Size 62KB
SHA256 2f319bc1492cd848400369bd48801b810d11bf5a3e8f34b59ee1d877361e12b9
MD5 e83887f9aba9ebe82c54154ddd82541c
SHA1 02e24a99465670883fbe0ea7bfd9a745c715b20c
SHA512 5a7e8454671edb706ba3a1f6d98a704a381759e71dc28a561fca5c8a4fd88ec70a78a2894962248b28421e1f4b431ce4cb1ea7e3d31a6e782cd7f492982f3e6b
SSDEEP 1536:ZtZDKL9gUZoCKvp1/xKGFbbOTjrTEMtECxYmGwx:9Dg9gUOC6/xhh04kECxYmGS
TLSH
T11353C7C9FB063371A95393A3F22F614AED399A01221530FCD4E892ED252916D42FFD9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

roblox-api-docs.json

Path C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\roblox-api-docs.json
Size 6.8MB
SHA256 3d7a6491104fae44dd1220682576ec3e0e74511fc20938de4a1467132f38e3ff
MD5 59824996542925ca4ec7b689ada4a48c
SHA1 b5bcba77f0e2296f32f790478c03cdd8204b02a6
SHA512 df0f4fd7eab21f904bd4117d680df1fdbc7aa43f0dfb3111184f5dca815b4ae55a71ec3320500ea309638149156321cb2e2a770cfa84bfd065917251f5348416
SSDEEP 49152:8cn1/u/6WaxKN5yPkyC/T+V0g+8sH9em2Dv:/
TLSH
T19E66DD33D9901D5726B2574DF8B9435AF82802EF204D188EBABC732C6F6197B1516BCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

roblox.PluginSecurity.d.luau

Path C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\roblox.PluginSecurity.d.luau
Size 649KB
SHA256 1004c54683ce0a383d8818865c15f1e226415e415a47a0ed16f90d54cb4c35f4
MD5 727ee8c43f5982d44ac3a2abc3b20e74
SHA1 17764bf21deb2e647c9bf203c5c72c3390a284ee
SHA512 552ee7427a984e28747852be7f62434dd24366681e28a34e2ba893e66440a05562ea2d1af856a86accb1aaeb2765d7bd9656689bf52eaa3988e8f27cc69bd8ac
SSDEEP 6144:Udpk1ZUqK4kqM2CZIzBXlxvHbtGxQc3zVvDXryRGyCLFY/OSRlXA+APpl+m3TU24:sxQc3zVvDXwDnaXKX
TLSH
T1AAE4451DB604A130498F53F56F9F8884EC75D2C5625C90B490FCBB461B7F83E26A6AEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74731f33-efb2-4fa3-a035-2a96cad34091.tmp

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\74731f33-efb2-4fa3-a035-2a96cad34091.tmp
Size 15KB
SHA256 2c9407cb54235f8c848b6e0631d833e0299b529179dfa7f0c58e6dd757ba108f
MD5 e9743b3c413be910f4e5aeb96b3c90db
SHA1 d9b3ee4e221f75364b4082f0eae9e664f6a61366
SHA512 3f2c31868460861be6fef1fbff82cb52fd41329a40c20ce08f5933a17db8150b78c52b859bb769757d6470a57185f2d4c5e7fcc8f1c85b19b8524ecb133f2ab7
SSDEEP 384:N+OBqImmJvGBLx3NaFMJFZNBSzhlpjDtack3Qvakg6rz:AcvGtlNOpHtpkaaaH
TLSH
T15772BF7A18762B632CE7C5097ACA274B8F71A247C0D53BD9CCEC9F0E115B1981342D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7fc9c570-8b23-4bd4-8d3d-7008d5d23931.tmp

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\7fc9c570-8b23-4bd4-8d3d-7008d5d23931.tmp
Size 2KB
SHA256 19741e7c33401a83c5efd76436b74a0a99a52c894412de4e36b49d65119aa41c
MD5 79010fdf6ddcaab134e4b57fac91fc4c
SHA1 f676b1479b977456d6718a3f96fee90b1c1e2bf8
SHA512 aa7d8467355349733066f8b3fbd3e777a6e3b7ff1e8dfadfe2bc80a18e254549fe34a9ebd831176765d61399c8e9b7427d621407a0c2ba894f4d4084c045b7ce
TLSH
T1EE519733B8259B778AE15604798A7F279E74D199DA922F5099DD0B1C00CB55D1342C3B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a8b44eb5102049ac39288a924a3c313ab779180e6d9eb34014e95eeb3f0f3da6
MD5 1170186e5a7c2699ef5a5c6c0f62b68d
SHA1 e49e8acdc57491936c4e203ac60109ba41e27b7d
SHA512 df0b47b0bbbbe28c01e23cd449d6d26222f6921eccfeaee122e92f4824aba37b3fa4c74e6cf6eeabc1a5cdc364ecfc706d1fa068245d329992ae1797f8046143
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0c122078d13f75fdbeb8fb191e6b0e497c712777079f7b997adf6702f3a296a1
MD5 407ebb399e9c77605a37bfa396dcca05
SHA1 2532b1e7572e5ea0ea780a7859ca14043d0ffa8d
SHA512 15b4c8737f44183cc15e3a86402559e4eb32c550d81fc5fed1b3ef01c560c88bfbf23a87a0c330e92f2870d425d6d4d9add80d0340a07b7af674229c1bae7135
TLSH
T191D01223B2010134C0242033121262081501C10B80058001D82C8B5DAE080541902455
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 1KB
SHA256 316d1e63ad50177f54ad497ec48d722d6e98ccfe8a155f1b58aea686eb4f75e5
MD5 76a120f3272e58f3c37ceb8e57917dfd
SHA1 243bbd7753956bef96f6d668789223b06e385e2e
SHA512 bc18a8eab0512f52ebd2edf82c01f816a1923a3c8fd429a9e36ab77b28d01b189ed732b53b7b35023e46b957573d745eb7d66fd97793f71fcc940874f8eb9a2f
TLSH
T1BF219572E4B55F72AD8022023146BB6F6F70D09FC2915E0455CD4B2C01DB14D536BD37
MD5 SHA1 SHA512 TLSH

Submit Download

f021dc72-7341-4b90-84f9-5c028d685ea1.tmp

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\f021dc72-7341-4b90-84f9-5c028d685ea1.tmp
Size 3KB
SHA256 27531584d7eb239df6b4cea48b3a7c7a016a663d09c1d2b7f1de801ba302fd1d
MD5 167f249f1b3af937cfcc46bbbc8f3a22
SHA1 bb882840726fc941cfcdc38b1d4c58e01b270b5f
SHA512 527c2b2d018231753e3eb008305f6d0912472997e1af4b0dc516913f01dff4abe153d5613e9eb0c122ff79ffee568db0639debe7f7984dd54c83df0d60a746fb
TLSH
T14C618737A975AA374EE29A0578C63B1ABBA4D12BE5D13F94C9EC0F1C01D729C1342C27
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Real\data\config\settings.json
Size 228B
SHA256 8792491684557930c6a1330096a245f393cef2953a52a21360caacc6abef8508
MD5 df57e8c5349ebac4872b91900d59a536
SHA1 fc02eb24fe70375603d7d5bff94335d0cce607ff
SHA512 9c3e4ca8a02358b5ec34d4f6bd6366bc832301b99c508f45d778ef32e60a3139f994f2edc34a109c513e36251f4d1cb5174e47cdee8df77c0da7f0be42b8df01
TLSH
T123D0A960ECF80EB213DA902E086A4012E4366C6B409D3D3C78EA420CAF4E630417A784
MD5 SHA1 SHA512 TLSH

Submit Download

current-build.txt.tmp

Path C:\Users\Admin\AppData\Local\Real\data\meta\current-build.txt.tmp
Size 3B
SHA256 7b69759630f869f2723875f873935fed29d2d12b10ef763c1c33b8e0004cb405
MD5 045117b0e0a11a242b9765e79cbf113f
SHA1 ec7f1f65067126f3b2bd1037de8a18d0db2ec84b
SHA512 1f748a9c15bdf0a5e3be241ac0b8ef75e4c0c339e9550c9f8fa342778c620ac88de6edd42b61398e72bea045b27649ef7992ae5ed0e0b162cd9f1aa71686a222
MD5 SHA1 SHA512

Submit Download

current-version.txt.tmp

Path C:\Users\Admin\AppData\Local\Real\data\meta\current-version.txt.tmp
Size 5B
SHA256 ea8c6b3d8d64d373d132bd39d234c5664ad9860d1444d21acd5766994d08edc3
MD5 74882107a1af709d6d84deff03c71f13
SHA1 14507aa9246588cbf1725303a1878c660615d91a
SHA512 0e688a12c3fd244e9890116755a78f322b325c1644983ec3ae665c2574820cab12a6c66632fd73e085a35275c1c0401533d3124d88b52fb7bbc224408b6575b6
MD5 SHA1 SHA512

Submit Download

real-taskbar-dark.ico

Path C:\Users\Admin\AppData\Local\Real\icons\real-taskbar-dark.ico
Size 38KB
SHA256 884cae569dc6d4b82eece32755b3567ce082867c266b27cf6d2fb649e1e91c5f
MD5 c961ca2ee661749cd51f300372f3cfe1
SHA1 08c4023fdf1d08400886727fc9efa4ac4adcc3f4
SHA512 a71e8c56165e469c23f33ad79018550f27601c5a66eb51b66c3ba185f7b58b892147ba5d98e903091547de3a915cc776f1f393faffc4412750d4b2b082da429f
SSDEEP 768:gOBgSA/dH8/TX+tSgNyAoiALUIpFqC2of2M2fYiQ/3AIhdOBRD0NJ+h:9SSA/leTX+QgNyAH8qC2ZvYiIN00Gh
TLSH
T1FE03F1FFE6B8F93EC281543DC0984A60FE564261F7EB278A06568310467B72CF1AD493
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

real-taskbar-light.ico

Path C:\Users\Admin\AppData\Local\Real\icons\real-taskbar-light.ico
Size 34KB
SHA256 8f41b1702485181d73b6a5f6a074b6715df7bbac1317182600e361a7de7e9423
MD5 17e6cc820352f4ef9d5af72879a5a2cc
SHA1 2ac67632fa494708516b9f30fdda169492fd6c80
SHA512 ff9d42872b850261840a8db874a51889278899796e1e6973ad977dddc072dec6edd47caf5f4dec5f26bf1e287b85c856aa049a189badf84ae5837c17cf68f9ea
SSDEEP 768:C6cKta3EhN0AohZSQmn9V2flcf/gv38XnlfYG71OxA92GuUi7J:Nta3iN7LQmnXs2hVfYw992GuUMJ
TLSH
T10BF2F1E363F6AA33D82D2331270F51B67CBB60A50527FDCC91D4EC230A0B49559AB615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.exe

Path C:\Users\Admin\AppData\Local\Real\real-2.7.9\Real.exe
Size 16.2MB
SHA256 0a1a6a6aad2e3f25339a2397f52865794f1a84eb7e6f13628804f40527731c16
MD5 675175e0fec5d2976990c36c40d16e13
SHA1 e4541a1a06cdb861742bce0edaad6b9520fa1842
SHA512 5f894fd4992905ed42252bdb97f5149bbea82145ee3748c0f948b4f2ee8d474f89103737b2921deda03e53383e1168c4f5bf4193f634c821c588b14de23bace3
SSDEEP 196608:YHk4UXpuWxxExEMxCi2WV82kBNuKRC4JJqwK3T5zlh+Q7qh8:m3QuWsECIwCatr/7q
TLSH
T18F079D07F35181E9C0ADC078835AA637EA31B8894735B2DF1BE44B512E26FD06B3D769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.dll

Path C:\Users\Admin\AppData\Local\Real\real-2.7.9\bin\Real.dll
Size 4.3MB
SHA256 33732c874f097a335eb14450a7e91accffa2617583571c6aac660a65fed04ff4
MD5 ab2434daaa929a774c90f90f38b803f7
SHA1 e5ea04936c94860beca2c93d0ea7698622a6f82f
SHA512 859c1767d7af79931ff0f512f9b4e26a3bcf8963efe689a8b78b911e26978c93624cd3a8a183620cb8d77fc80dc8f5e7f36141728cef6989ac68a9dbce9722e9
SSDEEP 49152:y8FHtkhQXgZKDjbGU08BaZH6itlMEpSvUFUCLhsY0ip0IOD4C8i859FqHO/d:hFHLQ1tlj+PfY0iKIskpuC
TLSH
T1C326CF71EEEE2B62B773A34D0E60A1500AA3B48CD7F047285BF4D437A45F662D2537A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.exe

Path C:\Users\Admin\AppData\Local\Real\real-2.7.9\bin\Real.exe
Size 6.8MB
SHA256 8b6aa7a3789bcbafea8fb91428f6611a1ca040ef139c886b92ef336413e2ff04
MD5 94dce102887d2eb6443b4f153b2d2182
SHA1 b76274f0481c8aa9b9b7332b664f6462d42c5ae3
SHA512 7a2962d6f3a20832c82b62005f14a9f58a3f8342c88e9532fd2ad2a1b179259c06cd11f5e6dddd855207c34ef625673b11dc1c9374dde51742368327cd8df5ad
SSDEEP 196608:P1HUju4vD+1I8v30nZ1mewSDqoWjnqzmqvOL5pD:lCVr0T01me4oWjnu3Odl
TLSH
T1DC7633390EA12AB7CB4D7936F138584CD76C5516C179B291BF1BAF87AD0284CD3F0AA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spoofer.exe

Path C:\Users\Admin\AppData\Local\Real\real-2.7.9\bin\Spoofer.exe
Size 3.1MB
SHA256 38a0c331f536e3f3b6dd2fb9ecf88c98a8ded1290c8476f15d84d9c232a2f266
MD5 b48375cdcbf4a7f1d6751ae00c3809d8
SHA1 6579e5addf860fd607b9ffca58f685dc7dd3a633
SHA512 83a802d047a5ea20416093f464864788a633fff8a126db7da714c47d29f1596b9c76f3dc6ff114bce1ba76c5749844c7986afb407317e2ece25a7e0c953d98b2
SSDEEP 98304:yr9QVgssoNlxOK/4jn+k/bAxWY6Vh7nxk:tgtMOK/4jn+kUxWY6Vhtk
TLSH
T1A3E533143733080DD6D70E72F3BB9A1487915B2040DEE2E96A9EE7C1DB267832599DEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

luau-lsp.exe

Path C:\Users\Admin\AppData\Local\Real\real-2.7.9\bin\luau-lsp.exe
Size 16.1MB
SHA256 9e85ce9370f208c97f1dfc1b8fcf7185fe64386f23130a65fc834f5323a0d653
MD5 0e14d186ed05911115868aec341ca13c
SHA1 525708cd63fbcaa2bd68225aa2411b0f46c3e9fb
SHA512 e3acd3aad750e35cf9993384fc274db9ffdfd18099d4fd90a39ad0c039410d4e451baa6a2e1a5b1fd2658281bed8d33a2a3d2403675ef3976f10322ec5d5d029
SSDEEP 393216:E4BgLVggOglggqgTgXi17gCFggqgggocgQgejM9gggggdvFBggggjCggggoggggg:KBggOglggqgTgXi17gCFggqgggocgQgP
TLSH
T188077B3A21AC10DCF1BBD0BD8BCB9E47D6B2340903319ADF0591569A1E1BDED4A7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

real-mcp.exe

Path C:\Users\Admin\AppData\Local\Real\real-2.7.9\bin\real-mcp.exe
Size 1.6MB
SHA256 a281001f9ebd6c6f4776db34f883186c069bec4eaf878d7d940ff354ad14e6de
MD5 c0059a0fefe35c6e9ac590c3d65b0dae
SHA1 5206673918e5d8f44e31784d34eaf69271455a73
SHA512 3eeed550deb6789740f04e14ec44ea5f14da993eb156951fc466b0b1da2b93e5d35f72fefd06f7f5e529dd9a2269d438e0153e3a2f172ca54a0cb1a05f28a4c7
SSDEEP 24576:ST047HfKdlWJ3WuHz48PZGItULwv5YdOmPFM3VIH06iyq:o0TWJGibGIUwvWdYIU6i
TLSH
T144757C03E25580E9C4AEC5B8C357D536AA32BC8D0A34B1EF2BD49A553E3BF806B1D715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 399B
SHA256 260897c1c02ea9b2d4202fd0dd40801ab3bad8af94acae628a059d94aba4869e
MD5 0a9dd106a18c9c2b2a1b753193031577
SHA1 e39b5a665fa033e2bd1167016da3cbd4d5ae4794
SHA512 4eb495d460571cd06f7d1b949f60f30b122f180eef0dca1a9d6f45665593a9d5afaf116ea5f3049a74e9e29514884c54c428a92b66bd8c8c69de6146ff897c5d
TLSH
T1E1E09B4C413DFA721F0B8282B6695605037D6215664094A0A7D1B2BD7E684EB2B8B3DA
MD5 SHA1 SHA512 TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 1KB
SHA256 fa0a523095106571e144ef4ed2b2301c33f3f2ea7e5d94dff4fc17e56f3e754e
MD5 1ce13aa9dd032b79b43cddaa8c2a3c4a
SHA1 7ed1e70fc6da00b358de3c8172055b1ce4ccbe10
SHA512 9ef6e3fa735943c124bfd1adf263804e2aad877781095b001878395e6282e20cb9489e759d49bc149ea41edfc54445330a346974cf7e32b0bb11aef5e1257d2a
TLSH
T119310F1D0179FDB30F0F4282B675D70403BC62265285948463F1B37937689EE69877AA
MD5 SHA1 SHA512 TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 2KB
SHA256 45582064df764a5bd64bea1f31deb820061e74d21a391fe9877d5b1c24df7f9b
MD5 251ae5b68a36b356ecc93d6f0ebb0cfe
SHA1 b3323c33bdaca2079902697dd4c4d232e91eaf5b
SHA512 a0c6a35e1e6d94d7b0c024e1635872d34836343eb0f74a833a2f4c88e401b5c63430ef8e05499604649ee09e7187b9a80054c5419010b984b0b76536d3744093
TLSH
T12E414F1D0179F9B30F5F0381EA35D704137C61156285948893F1B3B937689FE658B7EA
MD5 SHA1 SHA512 TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 2KB
SHA256 95a6b480b7f373259afd647acb3466ef8061366f2d64c73577351dc4c815f193
MD5 a7a67a1ebe211c59e4e3cf3223b8afad
SHA1 2500e7ef16ee879091a575a3b65070cbc4f9bddd
SHA512 9c597c16e6fdef8c71830a0076e7c14b7691242b6137c2e222eff560f2a7614e83b20577cc1350b3c93ef9d552883199c7c195fcc19931ba8907882378f7ec91
TLSH
T12251410D0279F9730F1F4381E6359709037C61255684989893F1B3B937A89EE698F7E6
MD5 SHA1 SHA512 TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 3KB
SHA256 4ed9c0f55dcae6c9b460950189e6e471c7cc55a24856731a2843cf46e2f44e96
MD5 c16bd1150ad4c900f55d341c0abf94ef
SHA1 17f1ee8e08033c526f1378ca0cb576f8959b11f8
SHA512 9e81fc6f0380e9ed65744012b57673fc9d7ea03002fde32880b71391e2ff250dfd0f08f06600bd66795596bb0e9fe6d1af73d9b2978803d52b9329e234e9e976
TLSH
T16B816F0D1239F6730E1E47C1A638FA0D027C612557C9989963E1A37C37989DF298F796
MD5 SHA1 SHA512 TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 4KB
SHA256 9e066d0583d60a1b3454a9772864b9aff3b2d4ea4084584185ca7d49c817ef55
MD5 1e3eb7cd5a26fa937baf80ed09b343fe
SHA1 2bdca52a167a1138493c43c95d790ea5922941f7
SHA512 97d4553d77d3b141ac5ea494424529e5d5d2d7a7e15b2870c7b96b68d7cf85fe89b7bcbe1e6dcb20ecc7e1184973f4ed4b6455cd6744a8156ca4e9e7c30b7ee1
SSDEEP 96:oOQ6rdYCdwtokDqXXv35SrTzhY/j7xhXVbjrQnYtA:v6BWXvQvK50J
TLSH
T1A3917E0D123AF6730E1E07C26628F50D037C212557C9988963E1A3BC37A89EF698F796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79e57ac8-0c85-47b6-ad88-96ff16f533a0.tmp

Path C:\Users\Admin\AppData\Local\Temp\79e57ac8-0c85-47b6-ad88-96ff16f533a0.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0d1a6289-7dc1-4357-9747-505f81bdd7f5.tmp

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\0d1a6289-7dc1-4357-9747-505f81bdd7f5.tmp
Size 3KB
SHA256 89af57453fd802cc69dc4cc0227bff3f2a30e63cb632db3b30e3ce78cdbc3e70
MD5 fa5065a5b3e25338bbb6ee207284de23
SHA1 e8d2d58a9f660fb2e06ea879b20bbe5403a8da20
SHA512 6a33c0e80ed337a9cede027f6f244bec9f4e445eadccf5af8755c6b55005e204b9e5ad074b06dfe7e8354f5fdaffbd76170adbdcc7e4e693044d395434c21b53
TLSH
T111719626A974BA374EF3DA447C8A3B17A764D067E9817F98C5EC0F1C41D72891382C27
MD5 SHA1 SHA512 TLSH

Submit Download

3a2bb81f-b926-4c97-a1b5-01ff0001f8b9.tmp

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\3a2bb81f-b926-4c97-a1b5-01ff0001f8b9.tmp
Size 3KB
SHA256 4e398ab1a0d338cb669f012b0631ef806f8801fa5df9387acece9239329845a8
MD5 ebd1af1d3bd996e466fe514e15b4c221
SHA1 7ee959e92464ec44990e38f2b14116006829e3dd
SHA512 48eceb7f5ec32eaacbd23d5caca0a38cb7c340e0edd747ccbe6bfddd7671d96b00c9a4e4c3d005aab721f09ab0a7efdd32490edc25bb51a4d1739af572e0c471
TLSH
T1B461A737A974BA3B8EE3DA44B8CA3B16A765D123E9813F94C5DC0E1C41D72881381C2B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 62f00aed40bddfb3da260247c052b79845194d031adf545cdf01c251b29cd5dc
MD5 b6b5f3f1f77dcc0b7ca8b8411bb206a6
SHA1 57347edb718caf26658795ab801f1814aa653fce
SHA512 2c6ee3b1f1c32e84f47fd9d590cd6fdeb3645f3e953f4cb0d97b3b2d7f353e21705fb18fa1fce39eefd4952e8e85a14ce85c967c138723751944f2f00e8c8604
TLSH
T199D0122736014578C41028730503610D0410E62F41054000EC38CA1D3A044901B06443
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1570c2f08387012e5fd30e9576edcbc2c6cec4b3b1a72ffca544274cef401c81
MD5 546aa4d370891e315380d4ac983db811
SHA1 f84cd7b467cdcfcc6e31efd70682587e61e38cb4
SHA512 137d27ab3c9cb51282e86ec07fd27c470a29e2679e0a645257c72bac5138a888c93b8f3d1c5d575fe810b54cf231a939e5a0ec57228374aff6031da379d301a3
TLSH
T119D0047575044454C4015C71051141054134FD3401010100DC70450C34404405345003
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

703f370e-32c7-4023-95ff-ce8959f277ff.tmp

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Default\703f370e-32c7-4023-95ff-ce8959f277ff.tmp
Size 5KB
SHA256 c0e33e65ee1a0313c9cb672a5071ca91e44aa5962396e29f34d561689701b5d1
MD5 73d41a3c60e2b9c93a4294891d0c6bcc
SHA1 c0c6d5aeb892553af525845d4ede3ee1678ee05d
SHA512 036b82b383ae86dc959e5df54534aa46dd6afdb44b3ad9d7e6382f7572478a2fa63c346a65a288ac5876b513cb602e2cb9b00b087ef3f5249607b8ec6edbceed
SSDEEP 96:rF/dKqMSb9Bjkodo616ZZs7/x+6Mhmuecmjeg5K+gpI8XM1C7K:r5wmBojsV+FijYDg6K
TLSH
T180C1A5066E28797B4C86F50CBA297B07D2F9913234D52D58E7F8862C08DB5DD6307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 c0030291aa8a7a927856ed77d2e0003a24448feb89aac1b772aa726d4d578649
MD5 cd134e7da784130946849a6b0dcf3060
SHA1 de6a45e1e47d980a0cc81523399162f9299855a8
SHA512 368a2651c2fad47dee1fb8f2c989870f57db5dd3990e8da0718749ec72d9c03deaf3a882a5d96f3d6bf9262d952c40a353bdd222d6685e3691b93e08087adbe5
SSDEEP 3:LstlNllklkXlLOZK/l/:LsX3lPz
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 7f3d1c69e15906b1db6428dd86e8895bf23bbbad1ea257820707c1af700c25b7
MD5 d14a78eca4fe33c3eb571402d08a40a8
SHA1 f3f423e98f4db4e8474f541353f4ea02d1682d77
SHA512 45b04113b70934f5c9f7407bef60f4e493d33c43fd891a2813202dd1c6358596c3d20a8f4e249dc3287ddb1f16f3f0a73e54930a8efee82612232950d6e19206
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 05690fc6977097c57a3a707933687ce342b7bd670fdfcef9ee255bf57c70b93b
MD5 69f78f9c97ac93d74118d4fc07c5e4bd
SHA1 6d37d1a7baff5320520a6ed60928da4be5a177bf
SHA512 9b097d0dc554530420d6f0ba72a0a1d115950bd127a014d60cdeb347b6f37b6f8478f902c250dfb8bf16c3975fea260d8204359c226279bebc4a2933bf5dfa1c
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Default\DawnCache\index
Size 256KB
SHA256 3f15b3d81771af8c4cae9aa8c411ace1b2e77b16aba19d13492f46315796b2ba
MD5 e99c2ab7bf921cd954a98bf56df5a579
SHA1 0d46cf28044f0480be8f919a794d251b87fb42de
SHA512 fbc8b0b73f6f080cf7deceb52c2bfe8ad1358c473218ed509c4c991209e10710691e8f4251d3963b9e9b002820e14c2755ef42b99fc97a2ba50f605a7a675a11
SSDEEP 3:LstlNllklkXlkW/:LsX3lPkG
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Default\Extension Rules\LOG
Size 369B
SHA256 7127bd4506df6c457cb2e688abdd0e1939aaa7eb7331f2923b186b66e8402cfa
MD5 1434d0f1a110b284a3d57cc9ad2db7cd
SHA1 95fa91c0e8c415c616e6b483928267acdc7f444b
SHA512 c4b442734297e85d6636e83293102799ed075d314fd01bf3769057b006667e8c403783663a6d3bd1214c2f1f2d198014ba8372bc9eebaad0743e9579d7cb0ecf
TLSH
T1A0E0D813184EC6B5889DACE696B2A71EC7526A0CAAC17B098F5AC5C7310714D7B88342
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Default\Extension Scripts\000003.log
Size 38B
SHA256 1c43a1bda1e458863c46dfae7fb43bfb3e27802169f37320399b1dd799a819ac
MD5 51a2cbb807f5085530dec18e45cb8569
SHA1 7ad88cd3de5844c7fc269c4500228a630016ab5b
SHA512 b643a8fa75eda90c89ab98f79d4d022bb81f1f62f50ed4e5440f487f22d1163671ec3ae73c4742c11830214173ff2935c785018318f4a4cad413ae4eeef985df
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Default\Extension Scripts\LOG
Size 373B
SHA256 f7add2a068fe1517d4afeaeee662abf36e24d64972efa46b72b86c17fdcea3a5
MD5 c1316b741e8c5da20a0855f761a31d2e
SHA1 3673225d4a4dc0eeccfd176a65b41c285a9b4b10
SHA512 765e4fd6f173494b75fb54ca9d243f175b40669e32301207a38e5a90d7ac2fc7a15cccff01eed3559bf16a174ca2519f867af6aea8b8386a25539807d57edd1c
TLSH
T1E1E0D806484ED6B5849DACE756B3F71EC7926905BA81FB098F1AC9C7310B24D7B94342
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Default\Extension State\000003.log
Size 114B
SHA256 e2610960c3757d1757f206c7b84378efa22d86dcf161a98096a5f0e56e1a367e
MD5 891a884b9fa2bff4519f5f56d2a25d62
SHA1 b54a3c12ee78510cb269fb1d863047dd8f571dea
SHA512 cd50c3ee4dfb9c4ec051b20dd1e148a5015457ee0c1a29fff482e62291b32097b07a069db62951b32f209fd118fd77a46b8e8cc92da3eaae6110735d126a90ee
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Default\Extension State\LOG
Size 369B
SHA256 f1a0eee2f24653103097ef996bad84d177e43cbb5b153a161d8195055ca3c909
MD5 a6cb068195db887ecbebb96da79dbac9
SHA1 c200259a2eb9b44d46a0019cda640addedfaa54d
SHA512 7f780c9e8bb6bd61bbce33e84f96dd4047dd77b62ba471eedf0e733956ee00eb506acf6f004f1d1c6f1647fbc7a9ce9f899104fef28994022878cfaa25f646a5
TLSH
T107E0D802044EC675C89DACE75677A71E8B9269047AD1BB198F5AC5C7310728E7B88342
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Default\Favicons
Size 20KB
SHA256 2db221a44885c046a4b116717721b688f9a026c4cae3a17cf61ba9bef3ad97f4
MD5 b40e1be3d7543b6678720c3aeaf3dec3
SHA1 7758593d371b07423ba7cb84f99ebe3416624f56
SHA512 fb0664c1c83043f7c41fd0f1cc0714d81ecd71a07041233fb16fefeb25a3e182a77ac8af9910eff81716b1cceee8a7ee84158a564143b0e0d99e00923106cc16
SSDEEP 24:LLiXxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:iBmw6fU1zBmI
TLSH
T1AA92EE075E383407DBA10E7D266B187A8E3FE26C5FA29C94347410618CF9482D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Default\GPUCache\index
Size 256KB
SHA256 2aa659da3b4cfab84229988c51aca1996cecf403fdd8d9bf9994d8cc3d808d9a
MD5 e5be40cf67ae10a038e71d00fcd32ce3
SHA1 555ce0491a02d072488d4cbed48434d2d244fd49
SHA512 925b2f207c56dfb071d7b20d7688210bde0c9c0850cb820c50bb64f73fb2b3140c4fe2d94714d50531fbc7ba5dd194e259a9aaa563b73554367504e10031083b
SSDEEP 3:LstlNllkll/l2u/:LsX3lEtH
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Default\History
Size 164KB
SHA256 deba77bc71479c2e98a7f985233a7dc3a386ebc0dce33a347c6ac21d9ee1c573
MD5 a52a55fd35156c4962d5056465aa9d95
SHA1 c22a74097d6717d550758cf6f7ac16c3a4bce1e8
SHA512 2683277a6451aec89c9e40cc554ec5d16f22cb44c12ff404ea6c13acd8306552861b279f9a4e6aea3b715ece2e0f1969ff4c37f4c2e4b67336c4aa07d0a2adc7
SSDEEP 96:MBaLqL/uejzH+bF+UIYysX0fxQp97sXEHt/DfLVVVN6zRk/E0:MBGqL/tH+bF+UI3iWGVsXWNVVV63
TLSH
T10FF3EA1E5F643722CDBD923668E745B3597CF03F876326856CA114B1CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps Icons

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Default\HubApps Icons
Size 28KB
SHA256 b776393bf73aad8773d92bcd6a515c865c850b00800144795153cf26f02d357a
MD5 8ce79cfe5162fc50d6a65babbc1cd81f
SHA1 a37fddb337313a892a02d3dc8a9d8b42f448007e
SHA512 327780168c5dbdad5c803eeb3f1b1b8b7c4a8b2fad6a3f8a1373321b7cf0abf381ea2f1ba66cca1acf73ddade2acdf919af8f248ba077fc8f7062eb761f8f68c
SSDEEP 12:TLMZly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TL6cjr0+Pdajk+FZH1W6UwccI5fBI
TLSH
T19FD28E5A5F04FB33C9794BBC90C305D65F79573E4F40CA5152F8A0686B804C8A26D92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Default\Local Storage\leveldb\LOG
Size 379B
SHA256 be5217e4f42f9e6fd2157a6b870a188802099e3baa39105daff2d49d0b6f0432
MD5 a8311d7a571d9a0c8a2bcdae63774c2d
SHA1 b912483533890c309c428275ae7005bf9f906889
SHA512 fa9aa8cc8d11a9ed04271273089865a4484387dcebae1f255135b8d028fc3c31dd2df5a039bf643624cc3d00ab0f53c051eca6f3a8a05044b7169e86bcc9c1a6
TLSH
T171E02B12044EC666964D59EE5236BB1ECB6069046980BB098E45D547310704C6B94383
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Default\Login Data
Size 42KB
SHA256 0c1c2e0223f73fea44686ae44f4e78411de421f7aef7d89617be3837d3fdbc11
MD5 cec405af1bb4df2029eacdcbc7e05fd6
SHA1 835e45888f49095a184a62a229a437399c9c62cd
SHA512 4ce266cc942447ac963f4652c058a28d7641e37a06a5cfa4b290e70d77efb80e00312363ee5adb9e502fa32ad1cf661c18ac9581d1fcb2f83e7cb6429325458e
SSDEEP 96:klpeymwACn8MouB6w9f/FlXqiEqUvJKLuyn:klrAG7Iw9ftFqidn
TLSH
T1B213350F2B682401C8AD8636ACB114B66E7CA13F4B639FD52CB104259D75C63B12D5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Default\Network\Cookies
Size 20KB
SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
MD5 91dbaf73c1a8c55254d90272f998e412
SHA1 2b86b31c8c00c937291e5ac3b1d134a5df959acf
SHA512 109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988
SSDEEP 24:TLWr6bXYFpFNYJqH1kwIY6UwpQ9YH8rwZ6HfB:T+6LopFS+awWUOh8B
TLSH
T126926B4E5F346221C0F48B36EDE1855B2F7C201CD3B32655DA5860F3DE9299BF10956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 10ce46995378459151b5a072d6ef1e54867ce57edcc1520ec6a0965b5ff432ff
MD5 5f080b35a2352f916d574e049ffa88c5
SHA1 bb4cdb42ea2c454bcb92fac028696d65b4b91697
SHA512 b9862a5ba6723d3859bb1baecc04df0bf14a3d6c06278fd7cfbbba2412fd0dc5dceca969a9e1fe967a8f29764cb800f475b3270f3d1c2868f56a2d1586125bea
SSDEEP 48:TkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:IIEumQv8m1ccnvS6
TLSH
T169F2149E0B1D3A10C4F89674EAC10DC37D7D141D8B96EFC45AEC06F2FF862A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Default\Network\TransportSecurity
Size 188B
SHA256 d12fb133b32f635ae45fbfda1227fff0e5d82ab38664624266ecee21eba92d07
MD5 cdd4bb2a2565bc9477b83d7a3f1890aa
SHA1 e08810ccee24bbef9545f0e5563f0f534cdc5f47
SHA512 9960ae172eb139d8b1baae988582d6c8084000daa7e08a74532107cbeb601c2cbb5c881b44ba41b92cd3242010599b956aed928024ec70d14cc35f7c1a12998f
TLSH
T187C022A110B9B03A6068452148C0AD02DE36A038104298E88182027870900EB9903593
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 2d4ccf8ac8ae4f5c6ec8e0566210ff56585b6ba0290501a1a11ed9b23bfc226e
MD5 7289d4bdfbd73ed571278f95cb4c1939
SHA1 7c911f54243d9777a34666f4526a49c7e7aea244
SHA512 6e7d48e18b0317449807c4ac2c377b3cccf5bd6121077d51152d7e188ba1ea3cf62372b7611036938986dd0c84465dbd747fe8580e3a699f8470229a6d57a749
SSDEEP 24:TLB3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T131DtX5nDOvyKDhU1cSB
TLSH
T1D8F2689BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\Local State
Size 1KB
SHA256 64e856b99ea1c3ca92ae3e757a88093d21b43aedd939e46f918deb07b4aa7b63
MD5 544fc2b95c2581012645a0f7b5e408e6
SHA1 96258ea21a3ae035cf83dd1ba87bcb2a131cd03f
SHA512 c27f90dbdfe7b171d0230d7862f725d180d80c555c484c65db62335d64fbe0c45e016ea105b9aea47e9a65ee6955e9d0e42f633c690b0c0edb534be560c009c6
TLSH
T100219572E4B46B37EE826391359ABB2B6E30E0B7D1008E0051CC8E18459708DA695C3A
MD5 SHA1 SHA512 TLSH

Submit Download

b2088db0-251e-4c04-88dc-08a31f47d9b4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\b2088db0-251e-4c04-88dc-08a31f47d9b4.tmp
Size 2KB
SHA256 a50ded986f20e9cb50d9e60c6d753c6f7378ffd6e3002c1b0f5768993d0b1ddb
MD5 8ca38b849865d410780c09d9750c185a
SHA1 3b030de9b1f1b89ee7252a55e77f81580cfa1591
SHA512 a8f3c586cd8430a0aba1253d771f5c254fedac2ba5169395eb97d80829cd62f716525681a809834213f27f99c0fe3e9ebb1b95586aac62011c280b0a9f12de3c
TLSH
T13A519533B824BB778AA38B44798B3F279A35D1A2EE122F5096CC4B18418715D2381C3B
MD5 SHA1 SHA512 TLSH

Submit Download

e453353d-a6c2-4401-9936-7349b6c924e6.tmp

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{FB7E36A6-16A2-4AF4-B700-EBD1A2566B11}\wv2\EBWebView\e453353d-a6c2-4401-9936-7349b6c924e6.tmp
Size 3KB
SHA256 0c57b3b586b6d393687cc74cc0980a22ca4b42f30f42f710f377294620c8436e
MD5 9d05bd4c51df4da9e9b5240778a45b7b
SHA1 dea41df0bbb40e742e254598f26f284d3e708c80
SHA512 aa595d1dae1640ffc4b3d9dd9d0f679d010ffac1424b28b139e17993f52e80283a2363254e94a5fa1cdf03a9ee6c96b6aaa8717dd1593659196fd048447ef8ee
TLSH
T1E5719522A8B4BA378EE3DA05B8863F17A764D023E5857F98D5EC0F1C41D72891382C27
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_hcx43fda.w4l.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hcx43fda.w4l.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6764_1577250476\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6764_1867046955\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Real\Real.lnk
Size 2KB
SHA256 b38e4e71e3412863647d5e083005684f19e5519f261042b453ca08b9a64b3b3d
MD5 59e6182522275a3d2d5720b5461ed0ef
SHA1 05839209ad8a610eb53b9900d5e1ff3bd5f52dde
SHA512 5a0276ababb990be7b887d7b3eea42838550c1dbe7cd477afae00caadf23cf171efbda226b0f6b0d801bcc9900df29cbdfcaa7894d23ab8c42e71144f5e25282
TLSH
T1FF41CB15DDE22B21E7BB9C79B9F6176A89F47422FB428F1E0040828E0D3A6518D54F2F
MD5 SHA1 SHA512 TLSH

Submit Download

Real.lnk

Path C:\Users\Admin\Desktop\Real.lnk
Size 2KB
SHA256 219ab3dea188f4b4c78966d4d782bddf776d649571ae7aa78c1630db23bf10b6
MD5 ef8404b4ddb0bab9d3cb395db4c59b14
SHA1 bc190236923dca43daf96945903706e01c684271
SHA512 45d4b3340ecb75a94bd0ec09a9d41c11b31fb58582c758c48e9d4fe9fefd7e659a05c9348fc9bca526a46abe7cd1fe67b506bc9c1a3e2079070268e5350a5939
TLSH
T1EC41DC11EDE22761D7FBDC79B9F6176AC9F47421AB028F1D4040C24D1D36A518D54B2F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/252-207-0x00000240EBF80000-0x00000240EBFA2000-memory.dmp

Download

memory/252-213-0x00000240EC290000-0x00000240EC342000-memory.dmp

Download

memory/252-214-0x00000240EBFD0000-0x00000240EBFDA000-memory.dmp

Download

memory/252-212-0x00000240EBFB0000-0x00000240EBFCE000-memory.dmp

Download

memory/1220-27-0x00007FFB7D4F0000-0x00007FFB7D4F1000-memory.dmp

Download

memory/2380-135-0x00007FFB7D4F0000-0x00007FFB7D4F1000-memory.dmp

Download

memory/4420-1133-0x0000000140000000-0x00000001413B9000-memory.dmp

Download

memory/4420-1126-0x0000000140000000-0x00000001413B9000-memory.dmp

Download

memory/4420-1125-0x0000000140000000-0x00000001413B9000-memory.dmp

Download

memory/4420-1123-0x0000000140000000-0x00000001413B9000-memory.dmp

Download

memory/4644-506-0x00000230C0960000-0x00000230C0A12000-memory.dmp

Download