darksiderat | 23a2058b0d3ab367d2f373aae34a99e98a4c08667ee0acdf3968af4cdb6858ce

Analysis

max time kernel
34s
max time network
26s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-de
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-delocale:de-deos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 20:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Real.exe
Size 16.2MB
Sample261022-y355esft4t
SHA256 23a2058b0d3ab367d2f373aae34a99e98a4c08667ee0acdf3968af4cdb6858ce
MD5 3db0ebba84004355f01c906ec2369b86
SHA1 09eb73c64b69de8db294e22b08662bfdfb90352a
SHA512 f864b52fff7e0c8a6165ba2831073ff335d7fadccb97c7586cd65f03d3ef777a5751d1245ef9e7e956f3cecab62c51666a100521e5cf801e957dc5a55c847e17
SSDEEP 196608:UHk4skpuWxxE1EM2WV82kBNuKPC4JJewKrT5zlh+Q7q88:63fuWIE6IGC2tr/7q
TLSH
T1AB079D07F35181E9C0ADC078835AA637EA31B8894735B2DF1BE44B512E26FD06B3D769
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 3 IoCs

resource	yara_rule
behavioral2/memory/2236-0-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/2236-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1724-217-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Real.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5440 set thread context of 2236	5440	Real.exe	89
PID 1008 set thread context of 1724	1008	Real.exe	112

Queries registry keys for unique system GUIDs 1 TTPs 6 IoCs

Queries the MachineGuid or HwProfileGuid value from the command line, commonly used to create a unique victim ID.

discovery

System Information Discovery

T1082

pid	Process
5832	reg.exe
5468	reg.exe
2504	reg.exe
4744	reg.exe
2884	reg.exe
3660	reg.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	Real.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Real.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Real.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\projectreal	Real.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\projectreal\ = "URL:Real Protocol"	Real.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\projectreal\URL Protocol	Real.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\projectreal\shell\open\command	Real.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\projectreal\shell	Real.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\projectreal\shell\open	Real.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\projectreal\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Real.exe\" \"%1\""	Real.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
6132	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe
5440	Real.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5440	Real.exe
5440	Real.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 5440 wrote to memory of 2236	5440	Real.exe	89
PID 5440 wrote to memory of 2236	5440	Real.exe	89
PID 5440 wrote to memory of 2236	5440	Real.exe	89
PID 5440 wrote to memory of 2236	5440	Real.exe	89
PID 5440 wrote to memory of 2236	5440	Real.exe	89
PID 5440 wrote to memory of 2236	5440	Real.exe	89
PID 5440 wrote to memory of 2236	5440	Real.exe	89
PID 5440 wrote to memory of 6132	5440	Real.exe	90
PID 6132 wrote to memory of 6052	6132	msedgewebview2.exe	91
PID 6132 wrote to memory of 2088	6132	msedgewebview2.exe	92
PID 6132 wrote to memory of 2088	6132	msedgewebview2.exe	92
PID 6132 wrote to memory of 2088	6132	msedgewebview2.exe	92
PID 6132 wrote to memory of 2088	6132	msedgewebview2.exe	92
PID 6132 wrote to memory of 5272	6132	msedgewebview2.exe	93
PID 6132 wrote to memory of 4544	6132	msedgewebview2.exe	94
PID 6132 wrote to memory of 4544	6132	msedgewebview2.exe	94
PID 6132 wrote to memory of 4544	6132	msedgewebview2.exe	94
PID 6132 wrote to memory of 3536	6132	msedgewebview2.exe	95
PID 6132 wrote to memory of 3536	6132	msedgewebview2.exe	95
PID 6132 wrote to memory of 3536	6132	msedgewebview2.exe	95
PID 6132 wrote to memory of 3536	6132	msedgewebview2.exe	95
PID 6132 wrote to memory of 3536	6132	msedgewebview2.exe	95
PID 5440 wrote to memory of 5832	5440	Real.exe	96
PID 5440 wrote to memory of 5468	5440	Real.exe	98
PID 5440 wrote to memory of 5052	5440	Real.exe	99
PID 5440 wrote to memory of 2504	5440	Real.exe	101
PID 5440 wrote to memory of 1224	5440	Real.exe	104
PID 5440 wrote to memory of 4744	5440	Real.exe	107
PID 5440 wrote to memory of 2884	5440	Real.exe	108
PID 5440 wrote to memory of 1008	5440	Real.exe	111
PID 1008 wrote to memory of 1724	1008	Real.exe	112
PID 1008 wrote to memory of 1724	1008	Real.exe	112
PID 1008 wrote to memory of 1724	1008	Real.exe	112
PID 1008 wrote to memory of 1724	1008	Real.exe	112
PID 1008 wrote to memory of 1724	1008	Real.exe	112
PID 1008 wrote to memory of 1724	1008	Real.exe	112
PID 1008 wrote to memory of 1724	1008	Real.exe	112
PID 5440 wrote to memory of 3660	5440	Real.exe	113

C:\Users\Admin\AppData\Local\Temp\Real.exe
"C:\Users\Admin\AppData\Local\Temp\Real.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5440
- C:\Users\Admin\AppData\Local\Temp\Real.exe
  "C:\Users\Admin\AppData\Local\Temp\Real.exe"
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=de-DE --accept-lang=de-DE --mojo-named-platform-channel-pipe=5440.5424.1472338311734243560 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:6132
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView /prefetch:4 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff859085fd8,0x7ff859085fe4,0x7ff859085ff0
    3⤵
    PID:6052
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1748 --field-trial-handle=1760,i,161675227215933913,14139408452902888152,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
    3⤵
    PID:2088
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2072 --field-trial-handle=1760,i,161675227215933913,14139408452902888152,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
    3⤵
    PID:5272
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2284 --field-trial-handle=1760,i,161675227215933913,14139408452902888152,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105
    3⤵
    PID:4544
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=de_DE" --mojo-platform-channel-handle=3516 --field-trial-handle=1760,i,161675227215933913,14139408452902888152,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:3f7977d597a643e3424ae09a27224fc5db4e3105 /prefetch:1
    3⤵
    PID:3536
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Queries registry keys for unique system GUIDs
  PID:5832
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Queries registry keys for unique system GUIDs
  PID:5468
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
  2⤵
  PID:5052
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Queries registry keys for unique system GUIDs
  PID:2504
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
  2⤵
  PID:1224
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Queries registry keys for unique system GUIDs
  PID:4744
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Queries registry keys for unique system GUIDs
  PID:2884
- C:\Users\Admin\AppData\Local\Temp\Real.exe
  "C:\Users\Admin\AppData\Local\Temp\Real.exe" --multi-instance-watcher
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Users\Admin\AppData\Local\Temp\Real.exe
    "C:\Users\Admin\AppData\Local\Temp\Real.exe"
    3⤵
    PID:1724
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Queries registry keys for unique system GUIDs
  PID:3660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

account-vault.dpapi

Path C:\Users\Admin\AppData\Local\Real\data\account-vault.dpapi
Size 298B
SHA256 8a70892871940beaae1b71a1ee71525018bae4fa81af46237dae63f4d50aa963
MD5 5fdc7d1270d3dd0ab863ca0c6c704d1c
SHA1 848d7060ad6d7da95a174cfc7350092e4f3a0d0a
SHA512 7a14860630dbab9da60d8319e79bb4fb0dfd8c1912affc51a2267c6d1736ee6493a3da41873e11be9f62e2ab82c88134451221c15ad375fc73c2270b42b41287
TLSH
T184E027D7926614C6D33D6A755DD6C7144FC3BD104337C047D816691E50799584456373
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f4da7376d3e09dfaf33cbdd0e5b43c76bc43c1037968bc6138ca9a346f58c99f
MD5 1c8e48240ef84dbe7476f9a7fd476a10
SHA1 14c774809799a9745f7ce83a6e7f7cf976e41241
SHA512 9d875e94719d5245bba399dc89cace663684e064f6d33234199a9ee6f92395202c631f7f4ad0d3dbbc31843ec83a6195010d2fec6de124ff7ad2b9814e810274
TLSH
T1D2D0121673815338C0103033110262480802C30F400A4004547C956DDA084E00D03841
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 caa4bf29ceb5cfe06e00a78bb7b2091de3f0b4224458c3e949dc7c1e079a5926
MD5 3003783d43c9c3a0ebfc79a6f1098c89
SHA1 3c20a08ab4ed31c537b7676c42c7c40131dbcd6e
SHA512 af60e47f3ec9009088de53f8e97fef53df58f29b976133940eaabb2fd7bd11a9237d0a0ad387e1adfa8c1587a42b8de8537a440bf40943b965f57b8de5f7a2b7
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 576B
SHA256 0e8426a372cc97690445b77bf12f2965cdba9f2734c852f5e62b39b766d318ff
MD5 2b2b4f108f372e839a97d56dd348cd4f
SHA1 572cb9b11429d3b46508c75b78fc78e6cd9af35e
SHA512 6e74203c62e543072420c75b149dd8f65367e36c67a2bcef0d6ed7622f36259c46447a21ba2084858e72fcbf56336e247f85132d4c89293813394e0b8460620d
TLSH
T153F026A598B0D488EB0081BD69C90D3CF4715C0913CB4F9ADDA77774CC06B21E63AB0A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 92d730efc49c9a2459b05dacb387d6cb9889c726cfa897872e104935eaf71edf
MD5 ce81e7628c22f320d620f2debe7d3e1c
SHA1 c9071b55ae63c733700e21f5d6ed6de0c01e109f
SHA512 5f7a5e540bfbba6f8e9096ad9f8c3f74e34aa5fc551aa5500e0a932b6d77614cc1ce6e1160baf04199c3c92a4c39d8ab40a2ccc08c0b039a191bd457c9d36449
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 1KB
SHA256 960ef4f9c4e641e7d9ea0f76904cb0c728bd5b2e8df6a065695f0482429aa645
MD5 b8988e3baf5820750b9b3b1f86a68189
SHA1 2d59fc40761e5bb07d15ee4d5125dd1515f509d1
SHA512 361d735082cbffaf61d4b4bacd970bcbf7ef0478edbe693a62d5fd6a953f98656f482a08783033369809e37b9f9073d72011ec29fd0416c726de69310dfbdd85
TLSH
T1782165B39464AB71ECA2534632033F579F30249786209E0475ED4B2E029714D6629D37
MD5 SHA1 SHA512 TLSH

Submit Download

d03a879c-fef0-432a-a909-02afb1bd440f.tmp

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\d03a879c-fef0-432a-a909-02afb1bd440f.tmp
Size 2KB
SHA256 0f2d5236f4cb31a53b48f2bdc474a36ecc3f4b375e8cec3b0962d8440d0d0ca6
MD5 b11d7649a8859766410e333cb0718ca6
SHA1 f3c3580702e6bc324834ed4ddeb0aae1579d0b66
SHA512 2826e5c17f29d1d5643cc15ade29dd373c41c3d789d55a91754705f9647b56cf5b74944d4100753759636edbcc9917b2911d1256459d3e77e0897de5ec3b55bd
TLSH
T13D5172736824EB72CDE3874579473F23DA7460D29A612F60AAED0B2D01C765D2342C37
MD5 SHA1 SHA512 TLSH

Submit Download

e1454c14-27ea-4415-b758-7f5be4e0f7df.tmp

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\e1454c14-27ea-4415-b758-7f5be4e0f7df.tmp
Size 15KB
SHA256 c4ff06dd73b79eaedb7906cb78c3d7284d7adde1f13334a21d48bbd5116f0776
MD5 0bb16a60e1de8ea190edde9c73879a95
SHA1 f9d68094bc42b7b844945f518efae03e30b7e02c
SHA512 de24339c5d52658b5ec8f5f43e21af7a454ae6e3dd0adfc892b11ceb92997c3e83748ae453fa119a222e4e92effcd01fb27e72622e354dd6fd6baf1b6354ff37
SSDEEP 384:U+OBqImmJvGBLx3NaFMJFSNBSvO+nozYg6rj:lcvGtlN4+ozWn
TLSH
T1C072BDB71965AF636CFBC609BA8A2757CBA56283C0C17BD5CCEC4F0F116B0902392A11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb7f241b-f212-4788-af5a-759606051058.tmp

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\fb7f241b-f212-4788-af5a-759606051058.tmp
Size 3KB
SHA256 83bb6f6fc86dc9b77d2d899b1611aa4a73d35423d949e5b5cd130cb6270a51f7
MD5 6537c9f4cc3d9a6ce44b2389603be9ac
SHA1 f1cd70719351ca3c6f1aef85b655297bf1d89eb3
SHA512 5ff2db4144121e3996f2cea24d33a7da96a5e1059809aa5e7fef581a884f7a5f133b37d4fd3ed912500c1cc586c572d179de805c16d0f8332a80f6537118e7d2
TLSH
T1A76182736974EA778DF3CB05B9862B26E7A46063D9913FA5D6EC0F1D01C72882342C27
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Real\data\config\settings.json
Size 179B
SHA256 87e67b74f2aab5b2d14aa59c63798423e12658d5042749ec0a905ac566164bf3
MD5 710be98a03bcf338011ea88663bb1b08
SHA1 e2f6e3ebe9ee719051fb297dfdc324b6af2fea15
SHA512 4e2360fceddb7c84a804661b6f919ff17995ccba1b741bde5144c5ccbaa606e4ec45164076a529f91b1ed644c52c96f43e20e606cde7ba54433978439721416e
TLSH
T138C01261ACF40AB227CAA12A086A9002A4324C0A549E6E3C3CAA431C9F1E235427A788
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Real\data\config\settings.json
Size 309B
SHA256 da90145649f6c035f3bef81db2019ee352f3eaf9e918032bf6bd5037fa5cc98c
MD5 0fe62bf71ae97336503f26dbc490fe4d
SHA1 0de24fa7b3519f78f537454ad677990800aa84e8
SHA512 b06afa23de810a2bfd7821ce2e79fe163d886556866bcb31705140a15f4cfb9d6f3a868a776b65975679236f340d51ec2613e2ff7a30e3fdd3d7a6ebdc94b4c4
TLSH
T1BFE0C251DDF84E7207E6902E446E1001A4322C6B85997D3C78EA421CAF0E771417A3C4
MD5 SHA1 SHA512 TLSH

Submit Download

real-taskbar-dark.ico

Path C:\Users\Admin\AppData\Local\Temp\icons\real-taskbar-dark.ico
Size 38KB
SHA256 884cae569dc6d4b82eece32755b3567ce082867c266b27cf6d2fb649e1e91c5f
MD5 c961ca2ee661749cd51f300372f3cfe1
SHA1 08c4023fdf1d08400886727fc9efa4ac4adcc3f4
SHA512 a71e8c56165e469c23f33ad79018550f27601c5a66eb51b66c3ba185f7b58b892147ba5d98e903091547de3a915cc776f1f393faffc4412750d4b2b082da429f
SSDEEP 768:gOBgSA/dH8/TX+tSgNyAoiALUIpFqC2of2M2fYiQ/3AIhdOBRD0NJ+h:9SSA/leTX+QgNyAH8qC2ZvYiIN00Gh
TLSH
T1FE03F1FFE6B8F93EC281543DC0984A60FE564261F7EB278A06568310467B72CF1AD493
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

real-taskbar-light.ico

Path C:\Users\Admin\AppData\Local\Temp\icons\real-taskbar-light.ico
Size 34KB
SHA256 8f41b1702485181d73b6a5f6a074b6715df7bbac1317182600e361a7de7e9423
MD5 17e6cc820352f4ef9d5af72879a5a2cc
SHA1 2ac67632fa494708516b9f30fdda169492fd6c80
SHA512 ff9d42872b850261840a8db874a51889278899796e1e6973ad977dddc072dec6edd47caf5f4dec5f26bf1e287b85c856aa049a189badf84ae5837c17cf68f9ea
SSDEEP 768:C6cKta3EhN0AohZSQmn9V2flcf/gv38XnlfYG71OxA92GuUi7J:Nta3iN7LQmnXs2hVfYw992GuUMJ
TLSH
T10BF2F1E363F6AA33D82D2331270F51B67CBB60A50527FDCC91D4EC230A0B49559AB615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1008-265-0x0000000140000000-0x0000000141050000-memory.dmp

Download

memory/1008-215-0x0000000140000000-0x0000000141050000-memory.dmp

Download

memory/1724-217-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2088-30-0x00007FF879310000-0x00007FF879311000-memory.dmp

Download

memory/2236-0-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2236-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3536-115-0x00007FF879310000-0x00007FF879311000-memory.dmp

Download

memory/5440-234-0x0000000140000000-0x0000000141050000-memory.dmp

Download

memory/5440-2-0x0000000140000000-0x0000000141050000-memory.dmp

Download