b411b444682179bf2f4270fbc22d9a86263b659152f9611712ec40101a8f3aee

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 13:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RealSetup_df7bfc414b2d448aca148bb42b9e74e6c273357b8cbdc95fa3c951fb8423b6db.exe
Size 16.5MB
Sample261027-qv4bvset3j
SHA256 b411b444682179bf2f4270fbc22d9a86263b659152f9611712ec40101a8f3aee
MD5 d81c13e9063abe4687060d633ff1f701
SHA1 bb5bc882d52a5c342ab214df7de170e7d2f4769a
SHA512 d8e049c1d5212855fc61d13e81add838bd7131d4dbe6452f9259c1d9804c6ff59222069e8f6596e179d1991ef6137d463900531c9decfbeb4a9bd2a186c1cba7
SSDEEP 393216:8OtYCUkjbi+D014Buf8uKzYYlAbf4EOUYNOUY:NWqgQEY
TLSH
T12A07B069A6BC00E9E467C2BCC2965223EB72B415277057CF5A609AF60F23AD41F7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Real.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2720	powershell.exe
1996	powershell.exe
3992	powershell.exe
4684	powershell.exe
2720	powershell.exe
1996	powershell.exe
3992	powershell.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Real.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Real.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	RealSetup_df7bfc414b2d448aca148bb42b9e74e6c273357b8cbdc95fa3c951fb8423b6db.exe

Executes dropped EXE 5 IoCs

pid	Process
5612	Update.exe
5796	Update.exe
628	Real.exe
1620	Real.exe
6496	luau-lsp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RealSetup_df7bfc414b2d448aca148bb42b9e74e6c273357b8cbdc95fa3c951fb8423b6db.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Real.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Real.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
70	discord.com
71	discord.com
73	discord.com
77	discord.com
79	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
1620	Real.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_1214049071\crl-set	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_78570440\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_1214049071\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_5452_1965094491\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4628_1214049071\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5452_956735260\_locales\fil\messages.json	msedge.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4460	sc.exe

Queries registry keys for unique system GUIDs 1 TTPs 2 IoCs

Queries the MachineGuid or HwProfileGuid value from the command line, commonly used to create a unique victim ID.

discovery

System Information Discovery

T1082

pid	Process
2440	reg.exe
7104	reg.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	Real.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2800	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Update.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Update.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Update.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RealSetup_df7bfc414b2d448aca148bb42b9e74e6c273357b8cbdc95fa3c951fb8423b6db.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RealSetup_df7bfc414b2d448aca148bb42b9e74e6c273357b8cbdc95fa3c951fb8423b6db.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Update.exe

System Time Discovery 1 TTPs 5 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2800	cmd.exe
4468	net.exe
4444	net1.exe
5076	msedge.exe
6816	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe

Enumerates system info in registry 2 TTPs 14 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\projectreal\URL Protocol	RealSetup_df7bfc414b2d448aca148bb42b9e74e6c273357b8cbdc95fa3c951fb8423b6db.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\projectreal\shell\open\command	RealSetup_df7bfc414b2d448aca148bb42b9e74e6c273357b8cbdc95fa3c951fb8423b6db.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\projectreal\shell	RealSetup_df7bfc414b2d448aca148bb42b9e74e6c273357b8cbdc95fa3c951fb8423b6db.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\projectreal\shell\open	RealSetup_df7bfc414b2d448aca148bb42b9e74e6c273357b8cbdc95fa3c951fb8423b6db.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{FB9FC714-3437-48BD-9E46-9B575AF93E1D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\projectreal	RealSetup_df7bfc414b2d448aca148bb42b9e74e6c273357b8cbdc95fa3c951fb8423b6db.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\projectreal\ = "URL:Real Protocol"	RealSetup_df7bfc414b2d448aca148bb42b9e74e6c273357b8cbdc95fa3c951fb8423b6db.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\projectreal\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Real\\Update.exe\" --write-deep-link \"%1\""	RealSetup_df7bfc414b2d448aca148bb42b9e74e6c273357b8cbdc95fa3c951fb8423b6db.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{D55146BD-FEB9-43F3-83FB-B31DC0488109}	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4684	powershell.exe
4684	powershell.exe
4684	powershell.exe
2720	powershell.exe
2720	powershell.exe
2720	powershell.exe
3280	RealSetup_df7bfc414b2d448aca148bb42b9e74e6c273357b8cbdc95fa3c951fb8423b6db.exe
3280	RealSetup_df7bfc414b2d448aca148bb42b9e74e6c273357b8cbdc95fa3c951fb8423b6db.exe
5612	Update.exe
5612	Update.exe
5796	Update.exe
5796	Update.exe
1996	powershell.exe
1996	powershell.exe
3992	powershell.exe
3992	powershell.exe
1996	powershell.exe
1996	powershell.exe
3992	powershell.exe
5612	Update.exe
5612	Update.exe
5796	Update.exe
5796	Update.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4560	msedgewebview2.exe
5624	msedge.exe
5624	msedge.exe
5624	msedge.exe
4628	msedgewebview2.exe
5452	msedge.exe
5452	msedge.exe
5452	msedge.exe
5452	msedge.exe
5452	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4684	powershell.exe
Token: SeDebugPrivilege	2720	powershell.exe
Token: SeDebugPrivilege	1996	powershell.exe
Token: SeDebugPrivilege	3992	powershell.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
5624	msedge.exe
628	Real.exe
5624	msedge.exe
628	Real.exe
628	Real.exe
628	Real.exe
628	Real.exe
5452	msedge.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
628	Real.exe
628	Real.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 4560	3280	RealSetup_df7bfc414b2d448aca148bb42b9e74e6c273357b8cbdc95fa3c951fb8423b6db.exe	85
PID 4560 wrote to memory of 4624	4560	msedgewebview2.exe	86
PID 4560 wrote to memory of 5656	4560	msedgewebview2.exe	87
PID 4560 wrote to memory of 5656	4560	msedgewebview2.exe	87
PID 4560 wrote to memory of 5656	4560	msedgewebview2.exe	87
PID 4560 wrote to memory of 5092	4560	msedgewebview2.exe	88
PID 4560 wrote to memory of 5816	4560	msedgewebview2.exe	89
PID 4560 wrote to memory of 5816	4560	msedgewebview2.exe	89
PID 4560 wrote to memory of 3520	4560	msedgewebview2.exe	90
PID 4560 wrote to memory of 3520	4560	msedgewebview2.exe	90
PID 4560 wrote to memory of 3520	4560	msedgewebview2.exe	90
PID 3280 wrote to memory of 2800	3280	RealSetup_df7bfc414b2d448aca148bb42b9e74e6c273357b8cbdc95fa3c951fb8423b6db.exe	107
PID 2800 wrote to memory of 4460	2800	cmd.exe	109
PID 2800 wrote to memory of 4468	2800	cmd.exe	110
PID 4468 wrote to memory of 4444	4468	net.exe	111
PID 3280 wrote to memory of 4428	3280	RealSetup_df7bfc414b2d448aca148bb42b9e74e6c273357b8cbdc95fa3c951fb8423b6db.exe	112
PID 3280 wrote to memory of 4336	3280	RealSetup_df7bfc414b2d448aca148bb42b9e74e6c273357b8cbdc95fa3c951fb8423b6db.exe	114
PID 3280 wrote to memory of 4684	3280	RealSetup_df7bfc414b2d448aca148bb42b9e74e6c273357b8cbdc95fa3c951fb8423b6db.exe	116
PID 3280 wrote to memory of 2720	3280	RealSetup_df7bfc414b2d448aca148bb42b9e74e6c273357b8cbdc95fa3c951fb8423b6db.exe	118
PID 3280 wrote to memory of 5624	3280	RealSetup_df7bfc414b2d448aca148bb42b9e74e6c273357b8cbdc95fa3c951fb8423b6db.exe	126
PID 3280 wrote to memory of 5796	3280	RealSetup_df7bfc414b2d448aca148bb42b9e74e6c273357b8cbdc95fa3c951fb8423b6db.exe	127
PID 5624 wrote to memory of 1048	5624	msedge.exe	128
PID 5612 wrote to memory of 1996	5612	Update.exe	157
PID 5624 wrote to memory of 5076	5624	msedge.exe	132
PID 5624 wrote to memory of 3400	5624	msedge.exe	133
PID 5624 wrote to memory of 1260	5624	msedge.exe	134
PID 5624 wrote to memory of 3400	5624	msedge.exe	133
PID 5624 wrote to memory of 3400	5624	msedge.exe	133
PID 5624 wrote to memory of 1260	5624	msedge.exe	134
PID 5624 wrote to memory of 5596	5624	msedge.exe	135
PID 5624 wrote to memory of 1436	5624	msedge.exe	136
PID 5624 wrote to memory of 5596	5624	msedge.exe	135
PID 5624 wrote to memory of 5596	5624	msedge.exe	135
PID 5624 wrote to memory of 1436	5624	msedge.exe	136
PID 5624 wrote to memory of 1436	5624	msedge.exe	136
PID 5796 wrote to memory of 3992	5796	Update.exe	138
PID 5624 wrote to memory of 4276	5624	msedge.exe	142
PID 5624 wrote to memory of 4276	5624	msedge.exe	142
PID 5624 wrote to memory of 4276	5624	msedge.exe	142
PID 5624 wrote to memory of 3860	5624	msedge.exe	144
PID 5624 wrote to memory of 1096	5624	msedge.exe	143
PID 5624 wrote to memory of 1096	5624	msedge.exe	143
PID 5612 wrote to memory of 628	5612	Update.exe	145
PID 628 wrote to memory of 4628	628	Real.exe	146
PID 4628 wrote to memory of 1724	4628	msedgewebview2.exe	147
PID 4628 wrote to memory of 2724	4628	msedgewebview2.exe	148
PID 4628 wrote to memory of 2724	4628	msedgewebview2.exe	148
PID 4628 wrote to memory of 2724	4628	msedgewebview2.exe	148
PID 4628 wrote to memory of 2468	4628	msedgewebview2.exe	149
PID 4628 wrote to memory of 2288	4628	msedgewebview2.exe	150
PID 4628 wrote to memory of 2288	4628	msedgewebview2.exe	150
PID 4628 wrote to memory of 5252	4628	msedgewebview2.exe	151
PID 4628 wrote to memory of 5252	4628	msedgewebview2.exe	151
PID 4628 wrote to memory of 5252	4628	msedgewebview2.exe	151
PID 5624 wrote to memory of 5452	5624	msedge.exe	152
PID 628 wrote to memory of 2440	628	Real.exe	153
PID 5452 wrote to memory of 4968	5452	msedge.exe	155
PID 628 wrote to memory of 5436	628	Real.exe	156
PID 628 wrote to memory of 1620	628	Real.exe	158
PID 628 wrote to memory of 6496	628	Real.exe	162
PID 5452 wrote to memory of 6816	5452	msedge.exe	164
PID 5452 wrote to memory of 1660	5452	msedge.exe	165
PID 5452 wrote to memory of 1660	5452	msedge.exe	165
PID 5452 wrote to memory of 1660	5452	msedge.exe	165

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\RealSetup_df7bfc414b2d448aca148bb42b9e74e6c273357b8cbdc95fa3c951fb8423b6db.exe
"C:\Users\Admin\AppData\Local\Temp\RealSetup_df7bfc414b2d448aca148bb42b9e74e6c273357b8cbdc95fa3c951fb8423b6db.exe"
1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RealSetup_df7bfc414b2d448aca148bb42b9e74e6c273357b8cbdc95fa3c951fb8423b6db.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=3280.4756.18078706934071360980
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffb3352b078,0x7ffb3352b084,0x7ffb3352b090
    3⤵
    PID:4624
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView" --webview-exe-name=RealSetup_df7bfc414b2d448aca148bb42b9e74e6c273357b8cbdc95fa3c951fb8423b6db.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1720,i,7285980034479287017,3548533443800334757,262144 --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
    3⤵
    PID:5656
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView" --webview-exe-name=RealSetup_df7bfc414b2d448aca148bb42b9e74e6c273357b8cbdc95fa3c951fb8423b6db.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2052,i,7285980034479287017,3548533443800334757,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:3
    3⤵
    PID:5092
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView" --webview-exe-name=RealSetup_df7bfc414b2d448aca148bb42b9e74e6c273357b8cbdc95fa3c951fb8423b6db.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2400,i,7285980034479287017,3548533443800334757,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:8
    3⤵
    PID:5816
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView" --webview-exe-name=RealSetup_df7bfc414b2d448aca148bb42b9e74e6c273357b8cbdc95fa3c951fb8423b6db.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3660,i,7285980034479287017,3548533443800334757,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
    3⤵
    PID:3520
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config w32time start= auto >nul 2>nul & net start w32time >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\system32\sc.exe
    sc config w32time start= auto
    3⤵
    - Launches sc.exe
    PID:4460
- - C:\Windows\system32\net.exe
    net start w32time
    3⤵
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:4468
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start w32time
      4⤵
      System Time Discovery
      PID:4444
- C:\Windows\SYSTEM32\w32tm.exe
  w32tm /config /manualpeerlist:"time.windows.com,0x9 pool.ntp.org,0x9" /syncfromflags:manual /reliable:no /update
  2⤵
  PID:4428
- C:\Windows\SYSTEM32\w32tm.exe
  w32tm /resync /rediscover
  2⤵
  PID:4336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "try{ $ex=@((Get-MpPreference).ExclusionPath); $want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll'); $stale='C:\Users\Admin\AppData\Local\Temp'; $miss=$want | Where-Object { $ex -notcontains $_ }; if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1} }catch{exit 1}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll');$stale='C:\Users\Admin\AppData\Local\Temp';foreach($p in $want){ $ex=@((Get-MpPreference).ExclusionPath); if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }};if($stale -and @((Get-MpPreference).ExclusionPath) -contains $stale){ Remove-MpPreference -ExclusionPath $stale};$ex=@((Get-MpPreference).ExclusionPath);$miss=$want | Where-Object { $ex -notcontains $_ };if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/projectreal
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffb1ec0c188,0x7ffb1ec0c194,0x7ffb1ec0c1a0
    3⤵
    PID:1048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,15989317868024761509,8987459395316654488,524288 --field-trial-handle=2040,i,9994889383430256547,14256339560830928988,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,5618072160598325799,8467579750965638543,262144 --field-trial-handle=2040,i,9994889383430256547,14256339560830928988,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
    3⤵
    PID:3400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,3700521002621589836,49166685887146123,524288 --field-trial-handle=2040,i,9994889383430256547,14256339560830928988,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:8
    3⤵
    PID:1260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,2697146195230451642,8188555411411996517,2097152 --field-trial-handle=2040,i,9994889383430256547,14256339560830928988,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:5596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,16013375911363445798,12680371819008312801,2097152 --field-trial-handle=2040,i,9994889383430256547,14256339560830928988,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:1436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4856,i,13486621462088960633,14596450901057292795,2097152 --field-trial-handle=2040,i,9994889383430256547,14256339560830928988,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
    3⤵
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,8284444923718557128,8412498953454494090,524288 --field-trial-handle=2040,i,9994889383430256547,14256339560830928988,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:8
    3⤵
    PID:1096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,636681749087769860,12235798584193230415,524288 --field-trial-handle=2040,i,9994889383430256547,14256339560830928988,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
    3⤵
    - Modifies registry class
    PID:3860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Program Files directory
    - Checks SCSI registry key(s)
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb1ec0c188,0x7ffb1ec0c194,0x7ffb1ec0c1a0
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1724,i,12151176440477254450,497406289067890252,524288 --field-trial-handle=2448,i,17851453321603037351,5039774710460734885,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:3
      4⤵
      System Time Discovery
      PID:6816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,12711285606776704158,3106804881048895749,262144 --field-trial-handle=2448,i,17851453321603037351,5039774710460734885,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:2
      4⤵
      PID:1660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,12062530527914532992,15710810962324872407,524288 --field-trial-handle=2448,i,17851453321603037351,5039774710460734885,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:8
      4⤵
      PID:5484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,6395888575798774899,3438338570399586627,524288 --field-trial-handle=2448,i,17851453321603037351,5039774710460734885,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
      4⤵
      PID:6056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,6395888575798774899,3438338570399586627,524288 --field-trial-handle=2448,i,17851453321603037351,5039774710460734885,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
      4⤵
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4992,i,15827698461858829278,11985382315081794605,2097152 --field-trial-handle=2448,i,17851453321603037351,5039774710460734885,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:1
      4⤵
      PID:6388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=5000,i,14970866553882907492,16393056929997759691,2097152 --field-trial-handle=2448,i,17851453321603037351,5039774710460734885,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
      4⤵
      PID:1900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,12736154517419520914,6604455242097421892,524288 --field-trial-handle=2448,i,17851453321603037351,5039774710460734885,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:8
      4⤵
      PID:4368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,3826147996596060629,11542966376284580353,524288 --field-trial-handle=2448,i,17851453321603037351,5039774710460734885,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:8
      4⤵
      PID:4208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6020,i,14276337452513866650,2930776180610486377,2097152 --field-trial-handle=2448,i,17851453321603037351,5039774710460734885,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:1
      4⤵
      PID:1088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5932,i,10812607128381544424,13012745809178104384,2097152 --field-trial-handle=2448,i,17851453321603037351,5039774710460734885,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:1
      4⤵
      PID:448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6912,i,9925070877178856303,924634598029366187,524288 --field-trial-handle=2448,i,17851453321603037351,5039774710460734885,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:8
      4⤵
      PID:6924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,14967567198290479269,17595858476040278858,524288 --field-trial-handle=2448,i,17851453321603037351,5039774710460734885,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:8
      4⤵
      PID:4372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,16848214931750768295,10797096559714988273,524288 --field-trial-handle=2448,i,17851453321603037351,5039774710460734885,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:8
      4⤵
      PID:6508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6956,i,4417500304555658211,2071659981109749380,524288 --field-trial-handle=2448,i,17851453321603037351,5039774710460734885,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:8
      4⤵
      PID:5276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6964,i,15446468224955015550,2381623615952434910,524288 --field-trial-handle=2448,i,17851453321603037351,5039774710460734885,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:8
      4⤵
      PID:5536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,13061505960757329752,362627474928772653,524288 --field-trial-handle=2448,i,17851453321603037351,5039774710460734885,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:8
      4⤵
      PID:6452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,9656093670140878695,3429713552375158651,524288 --field-trial-handle=2448,i,17851453321603037351,5039774710460734885,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
      4⤵
      PID:2840
- C:\Users\Admin\AppData\Local\Real\Update.exe
  "C:\Users\Admin\AppData\Local\Real\Update.exe" --processStart Real.exe
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll');$stale='C:\Users\Admin\AppData\Local\Temp';foreach($p in $want){ $ex=@((Get-MpPreference).ExclusionPath); if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }};if($stale -and @((Get-MpPreference).ExclusionPath) -contains $stale){ Remove-MpPreference -ExclusionPath $stale};$ex=@((Get-MpPreference).ExclusionPath);$miss=$want | Where-Object { $ex -notcontains $_ };if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3992

C:\Windows\system32\wermgr.exe
"C:\Windows\system32\wermgr.exe" "-outproc" "0" "1208" "2284" "2244" "2288" "0" "0" "0" "0" "0" "0" "0" "0"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:5868

C:\Users\Admin\AppData\Local\Real\Update.exe
C:\Users\Admin\AppData\Local\Real\Update.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$want=@('C:\Users\Admin\AppData\Local\Real','C:\Users\Admin\AppData\Local\Temp\Real.dll');$stale='C:\Users\Admin\AppData\Local\Temp';foreach($p in $want){ $ex=@((Get-MpPreference).ExclusionPath); if($ex -notcontains $p){ Add-MpPreference -ExclusionPath $p }};if($stale -and @((Get-MpPreference).ExclusionPath) -contains $stale){ Remove-MpPreference -ExclusionPath $stale};$ex=@((Get-MpPreference).ExclusionPath);$miss=$want | Where-Object { $ex -notcontains $_ };if($miss.Count -eq 0 -and $ex -notcontains $stale){exit 0}else{exit 1}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1996
- C:\Users\Admin\AppData\Local\Real\real-2.7.10\Real.exe
  "C:\Users\Admin\AppData\Local\Real\real-2.7.10\Real.exe" --real-launched-by-updater
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Direct Volume Access: Opens a physical disk for reading
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:628
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=628.644.10675006368831455581
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4628
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x16c,0x170,0x174,0x148,0x40,0x7ffb3352b078,0x7ffb3352b084,0x7ffb3352b090
      4⤵
      PID:1724
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1984,i,12169045053698987865,16356494617265506023,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:2
      4⤵
      PID:2724
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1616,i,12169045053698987865,16356494617265506023,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:3
      4⤵
      PID:2468
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2336,i,12169045053698987865,16356494617265506023,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:8
      4⤵
      PID:2288
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3468,i,12169045053698987865,16356494617265506023,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
      4⤵
      PID:5252
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4284,i,12169045053698987865,16356494617265506023,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:8
      4⤵
      PID:6076
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView" --webview-exe-name=Real.exe --webview-exe-version=2.5.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2872,i,12169045053698987865,16356494617265506023,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:8
      4⤵
      PID:1140
- - C:\Windows\system32\reg.exe
    "reg" query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    - Queries registry keys for unique system GUIDs
    PID:2440
- - C:\Windows\system32\reg.exe
    "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
    3⤵
    PID:5436
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1996
- - C:\Users\Admin\AppData\Local\Real\real-2.7.10\bin\Real.exe
    "C:\Users\Admin\AppData\Local\Real\real-2.7.10\bin\Real.exe" --rbxversion
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1620
- - C:\Users\Admin\AppData\Local\Real\real-2.7.10\bin\luau-lsp.exe
    "C:\Users\Admin\AppData\Local\Real\real-2.7.10\bin\luau-lsp.exe" lsp --stdio --definitions @roblox=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\roblox.PluginSecurity.d.luau --definitions @real=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\real_executor_apis.d.luau --docs=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\roblox-api-docs.json --base-luaurc=C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\base.luaurc
    3⤵
    - Executes dropped EXE
    PID:6496
- - C:\Windows\system32\reg.exe
    "reg" query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    - Queries registry keys for unique system GUIDs
    PID:7104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://projectreal.gg/register?app_auth=1&state=Vuu8lt2jLjJiF6nTtqbYAH1VVLqgGszJPMz9djhneVQ&app_auth_protocol=3&login_attempt_id=L0x_FRVMvQkzYqBn8g-Q9ObeVHPi9coPdZ-1TKM0CFw&code_challenge=oHYmx1NhdlK49bHQPMv72jNFCpd8cZ3SLTeChdymL7E&code_challenge_method=S256&loopback_port=58600#real_app_auth_v=2&hwid=HWIDv6_def0ef32b1b77d41e4b25d325223c38f03f756f4cde796162dd6ff78b119c4f0&hwidCoverage=30&anchors=%7B%22machineGuid%22%3A%22present%22%2C%22machineSid%22%3A%22present%22%2C%22permanentMac%22%3A%22present%22%2C%22storageSerial%22%3A%22present%22%2C%22tpmEk%22%3A%22missing%22%7D&devicePublicKey=MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE5W-hrKd05W7-2yEHED6fx58g3JO8m4_lxWwvZfbBChuuDoVO809tZ9aCVR_7W8UCU6EMdmm1DdSQBb9EyrYdTQ&deviceProof=MEUCIQDLHVVOVLAcfjH3uPnZ7a2IKPmXC3Kkwzv5K3loZ2nb0wIgIyncnZkMBkTkrAFeEgJrFqb1R4RS1TW-e_R-ulfz0AY&proofTs=1793108288732&proofNonce=WQgT_apj5ZKVr75DvlAdrK4qi4DOqMRijM6efLcoqcY
    3⤵
    PID:408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://projectreal.gg/register?app_auth=1&state=Vuu8lt2jLjJiF6nTtqbYAH1VVLqgGszJPMz9djhneVQ&app_auth_protocol=3&login_attempt_id=L0x_FRVMvQkzYqBn8g-Q9ObeVHPi9coPdZ-1TKM0CFw&code_challenge=oHYmx1NhdlK49bHQPMv72jNFCpd8cZ3SLTeChdymL7E&code_challenge_method=S256&loopback_port=58600#real_app_auth_v=2&hwid=HWIDv6_def0ef32b1b77d41e4b25d325223c38f03f756f4cde796162dd6ff78b119c4f0&hwidCoverage=30&anchors=%7B%22machineGuid%22%3A%22present%22%2C%22machineSid%22%3A%22present%22%2C%22permanentMac%22%3A%22present%22%2C%22storageSerial%22%3A%22present%22%2C%22tpmEk%22%3A%22missing%22%7D&devicePublicKey=MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE5W-hrKd05W7-2yEHED6fx58g3JO8m4_lxWwvZfbBChuuDoVO809tZ9aCVR_7W8UCU6EMdmm1DdSQBb9EyrYdTQ&deviceProof=MEUCIQDLHVVOVLAcfjH3uPnZ7a2IKPmXC3Kkwzv5K3loZ2nb0wIgIyncnZkMBkTkrAFeEgJrFqb1R4RS1TW-e_R-ulfz0AY&proofTs=1793108288732&proofNonce=WQgT_apj5ZKVr75DvlAdrK4qi4DOqMRijM6efLcoqcY
      4⤵
      PID:2900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Direct Volume Access

T1006

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4628_1214049071\manifest.fingerprint
Size 66B
SHA256 7ad6d17bd7b1bf49425f7efe322f4a9065446eca71d3ea1ebe0a838efcb08e95
MD5 fa32cf839f99432676ca9acccd8a0550
SHA1 9a869d2475f9840495188509e12ce9ca5a9e7189
SHA512 b1e901d92adecc46f96f52ac38954688f0a2514710041109785656ffe694766448cdbafcda397e9edb196763997d952537ebfefb4e5d128954576024f8856c04
TLSH
T1C5A00216AEA0E812F29486DEC4254B6A14372BF9AE76008979E8E4819C87260815B8D5
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5452_78570440\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5452_78570440\_metadata\verified_contents.json
Size 1KB
SHA256 c9e76a313bb06d9d761611d7cb8c2ab8de59eb9959b77458138630dacebaeb0e
MD5 243afa1f565d5789d05d9762162cfa32
SHA1 7c7b6757be9b6ae391a59b940ddfb646cf6ce732
SHA512 671b53dd21e4566df6fb4ef811fb95382447f57a82d497de029ce1528aaaa47f26277615f6ca91ffe4834598b2a0b5b78ec2f2dabed2ef704581cbb990ad67a2
TLSH
T11F3119B8380E324F90A7E30425BB9D33534570BE13E0A517B1C26A4E5598A40B2732FA
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

5659e52d-82e6-4621-bf50-48a0632008fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5659e52d-82e6-4621-bf50-48a0632008fc.tmp
Size 25KB
SHA256 ea3d7efb70777b8c2000dec40f152cb79876f1505279b5e6897d23d6c7da3fdf
MD5 2c8747dd9cc927c0afb3da4df5ed7152
SHA1 e18d9451d19d1f193744540986ecc23d25634895
SHA512 93004fb86c7180306a1d9f431bc8053a348fb867255c65bd7a3bd60c82dfd6137295a4ef5c05f98310cc00bba673387c395099266819d650db53d0768e242f56
SSDEEP 384:nliFgQkUSvWsNT8TUNTUlI4c5mgb8qKzfMBVgrCioFl/si3XF7Iz5OIIl/:sFIWCwg+zSBVgwFui4OLl
TLSH
T128C23975E8A5DDB7A9EB8A95B34A3683DEE05163C9CC8EC4DAC95E1C00C72CD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e9b7407-20fd-4898-98da-f3f4a09c57dd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6e9b7407-20fd-4898-98da-f3f4a09c57dd.tmp
Size 25KB
SHA256 dbd05adf946f003d23050ddfa6423994dece68a905a4665bda55da5e1cb7a556
MD5 ecb94b80fd33d67277ebbc307a630787
SHA1 2850322285830182aebe7a8ea909b9fee991f544
SHA512 1848af601ed8a6071647af84109a2fa0cc6e9b4d0e89f4bd4a1963ca8a3ff28454f9f6556e6cd317a59a154625ec515d23e7bec7fc77c3fa50037d2c52cca496
SSDEEP 384:nqiFiZcI63sNg8TUNTUlIm25mg5PnKzfMBVgrCioFlSJE7O6R2Feo9rgL/7IzBor:hFQ63RwgSEvBVgwFkJE7TRoVs
TLSH
T186C25B75EC94DABBEDEB8F9AA74A7A07EEF00163819C89C0D9C85E1D00976DD0707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

722671d9-fa36-4fb6-8585-ec6d5abe6988.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\722671d9-fa36-4fb6-8585-ec6d5abe6988.tmp
Size 25KB
SHA256 caf3cd202aa954d909bb224a77fb34e15789f8b232d4d614330faef170e13264
MD5 36296055b3c9e061312f9b3706cc68b1
SHA1 243ed5911db35b2dd449a54d0c90eb2ca32d4d88
SHA512 8da7e3274608185514c589497206de2781f25a44429c42093315f75a7dead35e9f91e2cb84200a3622e1f8d3a8fa02ecd6f7071ff284e34c5e495da88cfbdbcc
SSDEEP 384:nqniFgQkUSvWsNT8TUNTUlI4c5mgb8qKzfMBVgrCioFl/si3XF7Iz5OIIl/:FFIWCwg+zSBVgwFui4OLl
TLSH
T1DBC23975E8A5DDB7A9EB8A95B34A3683DEE05163C9CC8EC4DAC95E1C00C72CD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91940f91-6d1b-4408-9bbb-3ab1275dca94.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\91940f91-6d1b-4408-9bbb-3ab1275dca94.tmp
Size 26KB
SHA256 a96a3c70478a2b773c0acff4819c84645f2d4a158607b129ae4dbed5643b68ff
MD5 b5b7ea0747b4407436bd56b8052c3ab2
SHA1 18b171d45a23544cf5b477c3195660d26784b820
SHA512 00576ff20d242bb9e2140aee8cd3bef5ceff2d6e9c84d0ce6cd32e2e8170e0355203c9fa8cd1fd7f23cef7c53c0aef99a08c5ebdf5bfc5501b3ea942aad062b5
SSDEEP 384:nSiFiZcI63sNj8TUNTUlIm25mgTrrKzfMBVgrCioFl/TJW7O6R2Feo9rgL/7IzBs:ZFQ63GwgSgzBVgwFBJW7TRoVs
TLSH
T1E3C25B71E8A5DDBBECEB8AA5A74A7647EEF01163C58C8AC0D5C85E2C00D76DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94f4d3fd-13eb-4ecb-847d-e479a1c768d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\94f4d3fd-13eb-4ecb-847d-e479a1c768d9.tmp
Size 30KB
SHA256 04e3535f1518f4d1fd4e72eb67c135d5e85830bd8ddb6613ec9c1814c304f040
MD5 d9162055d43ce0f8e7cd78158631e47b
SHA1 8867a0ddb890ae1cb83c1e04bd47c5c54a69ab90
SHA512 8c7aba9022424e7d2779cc7c29efbfc90edc3bcda65fd400a066ca592173e3dd65c35fe4b5a62451dc6b7dcbafe87f0e4cd970dde3e8380da7fc6860774dba38
SSDEEP 384:nqziFgQkUSvo9sNT8TUNTUlI4c5mgbyVo++tqKzfMBVgrCioFl/ci3XF7Iz5OIIl:5FI2Cwg+LVo++tSBVgwF6i4OLl
TLSH
T1E1D2A3F198D79977D9DE4B53A37E2E429ABCC153B5884A84F7844D1CCC862BFC70A806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 15b36af2befe35fe915a838fe373ddadc995b04c807ecc30b4341d10033a6db1
MD5 092938ca57c95aad4824564030700ed5
SHA1 503fe833f028578d12ad3657fe13fa1f19816e4e
SHA512 02d0ea2b81625af46652104f4f757f01ff62f80f9fa25da516572b1ddb1968b36176ac8e6a8d640ca5e12bd56e534b35750e329e0fea9615e29267e2cc412087
TLSH
T1E1D0C0049DE83FF4F439303E13280100B0884E930B03204042520A444C503D300D4CD1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0a71db49c4da563a4456ac4e4589083c6b0d8cdf0c9ca288edd9513f979b0813
MD5 d98a4eb28a4062e1202dee1e9952a540
SHA1 a5f8bf00eb31015c82054301b278859df56e1438
SHA512 e02550a8eb44df65c4816340b20981d082ecae40bb1969dd381f4b79792c523b8d35fe429508c64267b0d869700f9f40dbc10803a095ab5b9c8456cbdcecba99
TLSH
T1CDD0C0003D533FFDD29E7136114C9580B000CF630703045003030D084D502B218D0EC8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

03f666e5-da80-4c46-bd93-6bbae843a5a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\03f666e5-da80-4c46-bd93-6bbae843a5a5.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

10ab03e0-39d8-4219-a82f-eeca819267fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\10ab03e0-39d8-4219-a82f-eeca819267fe.tmp
Size 414B
SHA256 c6018c2145c7e0f53f1c84e8f3d5a4dc4822dad066b2a781b49f509d6f145c4e
MD5 1d9daa345afc68fc3f8e4781980230f4
SHA1 54f863bb9c3e65acd4c5221e531c73247a95f5ad
SHA512 dac7b2bfb2193e9442e9e821a6b3cffb8e8d24e8394909b2c3e30f35b69399fd7c59876d9c694856bd821a286a6da5c540674e525778b1b86825beb87c9813b9
TLSH
T140E02BF5C919AC3709FC475850540645EB4113472A81848B7B3C910D8FB1A7A458BD6C
MD5 SHA1 SHA512 TLSH

Submit Download

24f82d2d-7948-4e7b-a212-30f7ca39acef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\24f82d2d-7948-4e7b-a212-30f7ca39acef.tmp
Size 13KB
SHA256 6006590e701770c6e33ddce9c7c5513e463fd37af8db1f6b3664e29f691855a8
MD5 0c43da3bf3f32ffc16bfc0f1a9d6041e
SHA1 e0066b59e3298c4ca7cfd25b1222542d2acb6292
SHA512 9dbbb06c084c444abc84dde7f73f15c1b7b7b2343a878492cc01b4cee24b5baf9606547c3dbc580ef92d70f1c9345157cce6f089c6db59171b5ff86035d2c612
SSDEEP 192:sxZcRpj7/fosMWpVAQZZNIN1qzodp+6HW6+WNr7Nj/Y7IaFYDgIIgZNJ:sxZc37/fosMWvAOZN6RVHbx/JwYD/ZX
TLSH
T14252C615AD28A97F9CC7D21DFA5A7F53D3F9503290D51E44AAFC8A2C14EB6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

44ecab6e-095d-4023-bb22-693d69c5d049.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\44ecab6e-095d-4023-bb22-693d69c5d049.tmp
Size 32KB
SHA256 525a809bfc185ed885e60c1660e735efaeac650b728d609a4f016dc835ce9df7
MD5 1a7e19b438caea8c700d0a507f042873
SHA1 39377d51f28c9716eedc9e1d236fec53c206ed32
SHA512 bcf3222e0ef2313afc0117021c57eb7de7b75f7a2e70760aa8b196d04bdef3c644d8bf19254e24f8352953eb45223c19354d41ebd9be9bdbae353a06592f1d9e
SSDEEP 768:0RyktjU7pLuLbvnWvDBtt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvwLWLlMC7fnroo:0RyktjYEbvnWvDBttu1jaKwLWLywf0L0
TLSH
T186E2EA3F780CCB7E4FC04E9DDD6A7F8B6DA802CB9698894047FA945C02C67EA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

491ca582-43ae-4054-8bd5-ad1121911edc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\491ca582-43ae-4054-8bd5-ad1121911edc.tmp
Size 14KB
SHA256 756aa001b7358a901e37997d47b46dfde1a5482a74342cc4fd30dc60fb75d66e
MD5 a05690fe2a4f1741e763cab56d210105
SHA1 ce302718b5ab4cd23d612adb911c52d8e0049c04
SHA512 90eb20d86c5bbdbe3a2eeb549f4815e0d2c09f7694309de15af3d156b73b17418b5fe7065ce2617c01df0b4aa11d748de18944916f4d057e21bda8107f78bcef
SSDEEP 384:sxZce7/fos6WvuOZN6RiHbxSXlaYDdnKNC:s0e7/fWYuVoHbKlaiJv
TLSH
T16862D855B928697F9CC7D219FA56BF63D3F9503290C11E84EAFC8A1C00EB6DD220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5816ee74-e315-47a3-b812-01fe44b0f84e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5816ee74-e315-47a3-b812-01fe44b0f84e.tmp
Size 13KB
SHA256 0186d8901638ba3d09c339123c5f596ada99d3c73c277010e6a60c776c54dcf9
MD5 5d64583bd890aa3e305ceb7d00f89053
SHA1 b89952c1ef875a56c31e604d9fab23b4fb05043d
SHA512 303d1f909c4002a3226e3d35aca061310fe20fd90177f5fc0a16fd0ee0be5949879d8aca4c89de71d11b6df527e214df3bb97f23e5e0bf027e7ff4ea86603412
SSDEEP 192:sxZcRpj7/fos6WpVAQZZNIN1qzodp+3tHW6+WNr7Njao3/zY7ISa2YD4eIgZNJ:sxZc37/fos6WvAOZN6RiHbxh/lQYDdZX
TLSH
T1A152D855AD24A97F9CC7D219FA56BF52E3F9503290D11E84EAFCCA1C14EB6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

802a7f22-fa4b-468e-ba3a-3593d3a1aaf7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\802a7f22-fa4b-468e-ba3a-3593d3a1aaf7.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

9fc2a625-f2e7-442f-952f-18f58851ca5f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9fc2a625-f2e7-442f-952f-18f58851ca5f.tmp
Size 13KB
SHA256 c08080737a784a4daa421774fb0c1c6635c348de2b1ba7da90e0edd88e2f9e63
MD5 cf249de22125cf353fa9f85f06a95181
SHA1 f3c3104d99c9ea36112de7fc7a711733e5d99c87
SHA512 04d9e22050ae5bf79afb0034fb2a609edf283491edf8b67a259d95b7508a2ea3dbcb5ffaa6ccc28f840f802decadbbe514e28927d3e55838fef2c45db600d46e
SSDEEP 192:sxZcRpj7/fossWpVAQZZNIN1qzodp+6HW6+WNr7Nj/Y7Ia2YD4eIgZNJ:sxZc37/fossWvAOZN6RVHbx/JVYDdZX
TLSH
T14C52D715AD28A93F9CC7D21DFA5A7F53D3F9503290C51E84AAFC8A1C14EB6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 9KB
SHA256 8358f711324247ee1dcc9d867fa28dead626644407ae53f60826f46c6480d5d2
MD5 086e2726adc5c9eaca93680e50738b23
SHA1 d84159eaf2083f34ae50f773d7aa9b8e98c16379
SHA512 c9b303d9c309e8d0366f2f79eee9841a3d20107ff2885e9b32defbcd2ffcbc1ac8ae4edd493e66f80551f8c874b87ee4678256fe8a1264ec8c7136b5dfa22739
SSDEEP 192:8tEmSzrV27HK/ZI4hGeBDFBOtqPwvVrAXWuEgDrMilnzIiaqi4S2z6eF60yFaj0x:8u5PYqsCGJqTcXb9
TLSH
T18E126346B840B8BAEF9660B155FA38CF333A15F359870D714B6FD4BDA70A790E80505E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 9KB
SHA256 b632f1699efa21ad59e487d7b9606c46d0612840066511ead270f07b1abb39e2
MD5 08659f3440dfd258c5ea1cc9f804dce6
SHA1 42aeddcc46b857da378f1395a9743bf6c49d83c4
SHA512 15c608b26757001a61ecc091c534ee222897d749850e41e21700c906d48433a3a6619917073b0fae94ad30ad9f433ff7feec985cd8284860bbbf5227011e3f95
SSDEEP 192:M1vWe/CKXAyVqswnZy8tAXnA8STFpvSAwZ3pD0zYQKy8Rq8ObJ/puiDg6vQ9+msN:M1QOK6oW9OFn8zt6
TLSH
T16A227256B841B8BAEF8A60B145EA39CF373A11F359970E714B2FD0BDA706790E80505E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0c0b8da38fdeca5fa2d669968609f71f850306534f1485ad0a9eafdbae18148b
MD5 9d2f3836b32e6f53530f399289e960fb
SHA1 06ae63aa5f4d0778940188b997a134d5c161e8f8
SHA512 41b664ba48b370dabbd4a283bfbcb96769324c7c7e719342c88405b81dfb3d5948849a4d7079b8898d4d3fd12332b9c1a459a1cfbd6f68bcf49af9e631276018
TLSH
T1B1615E86DC80B8D6F765B07199FB7D4F363325F059835D4290ACE8FD87463A571080A3
MD5 SHA1 SHA512 TLSH

Submit Download

5faf30b9-af33-4c7c-8824-3c8038bf887c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\5faf30b9-af33-4c7c-8824-3c8038bf887c.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

4cda798e-277b-43cf-a243-76961d81c2c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4cda798e-277b-43cf-a243-76961d81c2c0.tmp
Size 1KB
SHA256 324b87cd6a0652c8621d9bfe9f851d8cc4729344d28b8983e88b117f1b7be188
MD5 6b3e3d8207084a892afff2f8b23a3b9c
SHA1 6bcfa4549e6e03cde6f1d2d5331671558c741400
SHA512 1c2b7f1db27787cdaa11abb5508fd350249b51794f3b74f7cabda38bad3878b89ded1537efb8ff4e2856e253494839303e279663ab0c5c16a65f68b3a83945cb
TLSH
T18641BFF787F4866E8A1196F0AA18AE2FCF2D0514431C3D69C4E4AE5BD3E3172E14169F
MD5 SHA1 SHA512 TLSH

Submit Download

5a017c08-6500-44bf-921b-688e86fd8a3c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5a017c08-6500-44bf-921b-688e86fd8a3c.tmp
Size 4KB
SHA256 c51b0c87b695eaf1b357e348083ca9380d5350c5ea9d0f1983a6733c3fbc0707
MD5 eeea1bd0519eb92ae8d6ceef42bd2669
SHA1 01ee61a6955a59560f6ad722c57dc6ee083a0d2d
SHA512 3ad9778c21c7770741a7e1440bb93e199a70d34cc05c32007d38268ed2af3761c727f9336e4a383b6853a317604d320c062d39398529321138fb5e89ad411dc7
SSDEEP 96:D1OOuHFBtiaiVzduroIoFRyjC2iCwjHawJ:D19KFriaiVpYoIoFRyjLiCwbaW
TLSH
T139A1AFF3C7E48A2EC91152F067186E1BCE5D1919532C3D6BCAE4EE4B63E2471E14164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 138B
SHA256 8f909e690afb193e0365a398c6620254fc2b2faf2b39ad32c506a086603331f1
MD5 1f371365ea8535d5628fa931a971c15e
SHA1 2325a51d37aa35cca7508fe82748ee502f09c5ce
SHA512 03a73811a210175502e52dc7c1b87ce489307105ba4fe05a9d5e996dbe9674dd74b8daad60202d503ea1f9b20aca58a21a09c2260b5f3632b6a583d87d920b4d
TLSH
T159C08CA3E041042286AB0A620222625C870A2C8C08C2C48C610338149074F232202FD1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 226B
SHA256 55d59c7da46ad9d32fb23fdcad8db3a13a84b0429d1c726fb99f5cc1bebc86ec
MD5 ea75217e997b4dbb7be2a3c88d065c6b
SHA1 e3514791e08324ff91e567249f97c0ebb520cdc1
SHA512 ac9ad3fbbb3c8ffc28f7e24301b6147324b5d497625020468137d7a27ec1f631c7e71ad4b3c7d5a141152466a748ce0be2af83cd5d3d126bc09966a33aa9b53e
TLSH
T12FD0972FE04100A0A6FB0FA006B2219E82693C8C58C6A08CA0030414C844B576203F92
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 233B
SHA256 59306836ef11d18e960349743a70f9f970e9f13040df4b5fd0421857c4d1a9b2
MD5 ab46cff5d5403a9304e3d504b7146973
SHA1 1f7ec6a92caea15e5a65b7e14ddc7ac441ef00c4
SHA512 c0875daa3cd07ca0a60b48a7019c8bb469c7633ec0f806c698a1ea6dff7f064d856b38d7ddd6d1a0a6b0579afb1daf6d71c0af536a9ecf3d2daf81529ec4f81f
TLSH
T10DD0972FE05200A0EBFB0EA106B2218E82693CCC58C2A08C90032418C476B47A213F92
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 bc113c6c31009fa58517aba003216a8707ed4b8203e27dbd7dedee020444e2dc
MD5 cf58ee25b35bf1bac64fe952fb020fac
SHA1 9a1edebd7ea36a12b9a78972ba9a7fb964e5974c
SHA512 a40054953af04389b238f77b682c22972e14460c705538836dbfe4087ae523b00fb8cf270ac11711386d4a73a354c4c5a5c99791dd0ac2c30733f88999442034
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvX0vvAb3H:OtfFvpopPxrB4Rhf0XA7H
TLSH
T12CC2331471BA021138FE390881B68B2F064231773259E66B7FBD55A69E6BF085CFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.10.12.1\keys.json
Size 3KB
SHA256 b0724d5592e6441a840c6622d7ad51caad2564a3746e563ce1f1bbde30944b2b
MD5 a86e3ddeb60db5984686f5bd89a95646
SHA1 e5f417a8f70c34b293ee20bb9f54a423a07982ec
SHA512 f3df95b51940a12ffd2d58648c302fbd649dc3097e0961a86da65e324690488d1b3d80c6267a6a0685f220a89c279ba54cb56fc02f19860e99ffcd6448cf0db5
TLSH
T19971D6BF14A40082CF3BD16A8F0735A78FB23C0623C67AC3965FE94A04425AC276F475
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.10.12.1\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

a888bbf0-1ec6-40c4-b294-a718c3f82cd0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a888bbf0-1ec6-40c4-b294-a718c3f82cd0.tmp
Size 29KB
SHA256 4811dea8e74886d5b83f43e2d3eabb87b011bb60457f1b0d5ab6a66096e8dad2
MD5 9d6b59b85781feaf406ef37858bb5321
SHA1 50e9633034d32cf950d581f182efbcd6972a0211
SHA512 09a34a85d34688bbd95d4ce29dd5eccba2545ccf4bc73082c70b55482f3c4ddfa88b2a4607e2902789f67bb999a58e0787de4e092c47618dad99127f060ad848
SSDEEP 384:nliFnZcIlsNf8TUNTUlI4z5mgWLqKzfMBVgrCioFl/XTEASV/iskOr+Ly3XgL/7r:sFPl2wgF5SBVgwF1vSgskOr+WDw
TLSH
T1A8D20775D8949DE7A8E6CAD5964AF602AEE40133829C898CD5F4BD3C209F5FD0707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba9bcec2-b571-4f91-bc8a-858f0a0d54c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ba9bcec2-b571-4f91-bc8a-858f0a0d54c7.tmp
Size 24KB
SHA256 87bf4d493c3a6e4c0be5b24b9b0171cf961dfa5574144b35f992cd13b732bf48
MD5 c2a6b26ab31eb8f9fa6ff7cafb0954d1
SHA1 e5f1c7add9abace999d044c5b5517d27b4080ea5
SHA512 5677fbec45b3e62ad18f47ce253098ce3f4f4120456ed0490a6002b3dfac60aacdd22ab058d7718dc4c05ecd5dc957ee8da12dd3b4a50c07a8e4f37d286f838b
SSDEEP 384:nliFYQkUSvgsNT8TUNTUlI485mgWFqKzfMBVgrCioFl/Oi3XF7Iz5OIIl/:sFQgCwg8/SBVgwFEi4OLl
TLSH
T173B23975E8A5DDB7E9EB8A95A34A3683DEE05163C9CC8EC4DAC95E1C00C72CD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

024fd188-2eb1-45a7-9a81-73106b63844b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\024fd188-2eb1-45a7-9a81-73106b63844b.tmp
Size 2KB
SHA256 981abde6553c08ef285f856cde825c447a963ac6af2a950b6f488a26b434dd83
MD5 4b8583e56526433856d0ed077e214f73
SHA1 9a8d3fd11d4b63427ac00cb0f48b10405519a337
SHA512 3f7933e176c965d963550ff02c33f0d95a73e659fe4d172b1477faba48635a1ea98ccb596f5aaf901f01f866c94641862be0bb0334e8e635e2db51afee6da4b6
TLSH
T14D410EE05C3D6AD1D0BD0E6EA49725FC90EC9322F4A4343D3898ED9C4A7A50A614083F
MD5 SHA1 SHA512 TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6fef3465-92ae-4c72-b08b-a1c6408ea9d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6fef3465-92ae-4c72-b08b-a1c6408ea9d9.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 e89ad586ef881dc10f8c2b5e3e6311f3d1ecf971b35655deb3e0c078cb27a749
MD5 c58e5ea85a22b1f8d2cf42a76a29f32e
SHA1 324f2aab48d66d2a04dc84f45a9d8796b2f7d01e
SHA512 1e9af06639ef953808d682145889f7d6d340caa31514bbc1f123636cf269251f61493f7018f2ea5a56284d8b61de9715f60d8a82da839b26719e30135fc124cf
TLSH
T155112223F38C8A60CC96163A509DAC5172B586CB81AEDF9F7BC0C210A5BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

.real-write-probe-5612-240745515.tmp

Path C:\Users\Admin\AppData\Local\Real\.real-write-probe-5612-240745515.tmp
Size 4B
SHA256 aa33996d60e89311b4d1a920dae03c6d7fa3ae1956c52662e273aad4683e577f
MD5 4bca24304861acde5770fdbe3cc2503b
SHA1 c9c64e071d2853bc7906c017a231ad1cc46ab630
SHA512 310070ab4092002aa33f550eb98680fa6662e7305fce227843430aba334fdfad1fe0dd4a6484264b59f9b02a780433a552ce3d5c3da643a77427463c06e47800
MD5 SHA1 SHA512

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\Real\Update.exe
Size 8.2MB
SHA256 b42d62f0e5275ed85cb8451973f6d3b953ab024c685cf9bb90bf10dbf48ad3b2
MD5 6da042cfa6cd298b107a3a566a4d7442
SHA1 4d80fe0351fd54c988ab1c7b5c2d155fbfa804d2
SHA512 96eaf98adfb939873b7ac35d9be63536b0db96ecad11b00195e0ffcf93857b549aef6c170cc03b3602d20f9f20240a8953a323ff3f947a6a6bb3f352bca81bfc
SSDEEP 98304:JpOiSOCJxUf8Y/KzYYlA51fSn+LpjFOEXev8wcFOvkSxMy5/Dn:GhBxUf8uKzYYlAbf4kpxOUgBRD
TLSH
T1D586BF69A6BC01D9E877C2BCC2965223DB72B415277057CF1A609AF60F23AE41E7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

account-vault.dpapi

Path C:\Users\Admin\AppData\Local\Real\data\account-vault.dpapi
Size 298B
SHA256 1c244a9136e4e1996ac46f846320285ad5cdd8ff58d4ffdcf42c0f12e81bdd73
MD5 201aa68436793cbc5f0a9953807ab028
SHA1 800f24a51cfa6685fb39d5533e7553f6dbe88e18
SHA512 55913a15c728de5993c15d813df3b4d8c6f72e5ebd6ce99ea2c71857030b8a2dba8d7a5834c7e5c86b93cad50e5ebf65c6c55b6f934ae7d3787464391de3290e
TLSH
T1E1E072C7462648C0CCAB8B38FACF5812AA93F88111B11B880A9A9009A603A25B58AF01
MD5 SHA1 SHA512 TLSH

Submit Download

base.luaurc

Path C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\base.luaurc
Size 290B
SHA256 b7ca1b4299ba80b129481ce4382a520f0e3901ced321e61c15270f09bf15737f
MD5 cfe6c40e114bdf7c9a59dbb4a17692e7
SHA1 2b9fc23f2b247612f96ecea919f54c1278886b38
SHA512 8d5610ab7da3e63aad4ff277ec3d6fb234881f322ce0916e933f2848ea943b122ba0e364056b95f72ea8fa0f884c231971c1a04a0ec6e1b158433196065778ea
TLSH
T192D0E228D1995CBC2CB1819EA0A99212D5200BAB71592C2FB0FA03092F79E2D3468D80
MD5 SHA1 SHA512 TLSH

Submit Download

real_executor_apis.d.luau

Path C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\real_executor_apis.d.luau
Size 62KB
SHA256 2f319bc1492cd848400369bd48801b810d11bf5a3e8f34b59ee1d877361e12b9
MD5 e83887f9aba9ebe82c54154ddd82541c
SHA1 02e24a99465670883fbe0ea7bfd9a745c715b20c
SHA512 5a7e8454671edb706ba3a1f6d98a704a381759e71dc28a561fca5c8a4fd88ec70a78a2894962248b28421e1f4b431ce4cb1ea7e3d31a6e782cd7f492982f3e6b
SSDEEP 1536:ZtZDKL9gUZoCKvp1/xKGFbbOTjrTEMtECxYmGwx:9Dg9gUOC6/xhh04kECxYmGS
TLSH
T11353C7C9FB063371A95393A3F22F614AED399A01221530FCD4E892ED252916D42FFD9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

roblox-api-docs.json

Path C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\roblox-api-docs.json
Size 6.8MB
SHA256 3d7a6491104fae44dd1220682576ec3e0e74511fc20938de4a1467132f38e3ff
MD5 59824996542925ca4ec7b689ada4a48c
SHA1 b5bcba77f0e2296f32f790478c03cdd8204b02a6
SHA512 df0f4fd7eab21f904bd4117d680df1fdbc7aa43f0dfb3111184f5dca815b4ae55a71ec3320500ea309638149156321cb2e2a770cfa84bfd065917251f5348416
SSDEEP 49152:8cn1/u/6WaxKN5yPkyC/T+V0g+8sH9em2Dv:/
TLSH
T19E66DD33D9901D5726B2574DF8B9435AF82802EF204D188EBABC732C6F6197B1516BCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

roblox.PluginSecurity.d.luau

Path C:\Users\Admin\AppData\Local\Real\data\cache\lsp\definitions\roblox.PluginSecurity.d.luau
Size 649KB
SHA256 1004c54683ce0a383d8818865c15f1e226415e415a47a0ed16f90d54cb4c35f4
MD5 727ee8c43f5982d44ac3a2abc3b20e74
SHA1 17764bf21deb2e647c9bf203c5c72c3390a284ee
SHA512 552ee7427a984e28747852be7f62434dd24366681e28a34e2ba893e66440a05562ea2d1af856a86accb1aaeb2765d7bd9656689bf52eaa3988e8f27cc69bd8ac
SSDEEP 6144:Udpk1ZUqK4kqM2CZIzBXlxvHbtGxQc3zVvDXryRGyCLFY/OSRlXA+APpl+m3TU24:sxQc3zVvDXwDnaXKX
TLSH
T1AAE4451DB604A130498F53F56F9F8884EC75D2C5625C90B490FCBB461B7F83E26A6AEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

241ebfae-f306-4f9c-af87-066f18ec096f.tmp

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\241ebfae-f306-4f9c-af87-066f18ec096f.tmp
Size 1KB
SHA256 69ee74c0e4008ff180ce5d74060d58ea4925fd42e02627d92a0837100f9951b2
MD5 f19ca4959c9a1555d1e006a1bcd878bd
SHA1 84b0848ddcf4c71228791f54429ebdbd1411cc2d
SHA512 6ebbaadac738fa6503f06d390742b38a07eaf1a762e166c49f921203f53b8470b6d5e8fe3881ae8c1f8ba0201a182d727aa95b4803ea5e2adb2c5680d799c980
TLSH
T161312372E4A43B37BAD19586B5422A57BA20907581118F88A5DE9B1C02F76CCA53AD23
MD5 SHA1 SHA512 TLSH

Submit Download

8e66a81a-1469-4718-862f-69431c7868ff.tmp

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\8e66a81a-1469-4718-862f-69431c7868ff.tmp
Size 16KB
SHA256 dbb7e97a12a46849831d29aa0aedf05db1c7afc9d6f365f78ed342af19ef2f04
MD5 f6028d38c359b6a75f621479c3b7aa6c
SHA1 7f2409c6ea2c2520f0c68d0aa8fdfccc9008a16e
SHA512 078c4e60a535adc4ea130f99abefe428fba23b274ecd194e9ff82e521fe0898c9a0adea8aa2330a7710f9cce81dd7fb8a44497a7c0b6157d207af864aedda58b
SSDEEP 384:zI+OBqImmJvGBLx3NaFMJFFNbUOAEXg6rJ:VcvGtlNhvFt
TLSH
T1D872BF7628796A233CEBC54AF98E2747D76151A3C0D17BE9DCED8F0E016F1841316D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\CertificateRevocation\6498.2026.10.20\crl-set
Size 13KB
SHA256 b85327be29f5d0a5be4a47da5bf5062f5115bda5e9827db40ac4776d829ccd18
MD5 5111ab39b220749a299b5bb7cd25c730
SHA1 970c9013ee629ded1b5d2a058cd147950c3544ab
SHA512 37caae776f5d9365367e12a6ca13e07761f09b3cf6d1f9ea9523af89e6f2579afdd148d3942822358a49ac597a544c30bdf070aee051d69d8a0adab6f6af708a
SSDEEP 384:oeYPnEDMU2kk0yu7uCnglcJUoCzL4pv2W9cBTgE:ojPEoMk67R1UoCwV2W0cE
TLSH
T16152AF4FDDC4A62AF03911AE982262A412794A8552554B731B6C3A64BCFB28D4E38C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\CertificateRevocation\6498.2026.10.20\manifest.json
Size 118B
SHA256 cc33e26f3b2efe862336389207db045cc7a916940213b9d33d845c82c12c8712
MD5 acb0c12cc7e5345764763e37bcebbec8
SHA1 4147b2615955c51a6054c807c2397e4d7d10ee03
SHA512 6777da8af66a77c28049eaf1b49ba7cdfaa08a8f381c27dad4af0e980e8d5a7ea0df0c3f1fd0cbc0cbe93a83a07d130ae24dc4057471de830fac60036b1c2f3a
TLSH
T10EB09222DC80D832697693A84E2246D0F238234B2568AA493630048C0B2E2F182A2721
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d0e095ba2b54526ef36ee982f0811f722b22a84b7b335384bf7010643543a7a2
MD5 4f6e4e6382c1fe636e461ad6c91c9387
SHA1 fcb9bba63181f450c8512afb0fe12d58c1449306
SHA512 91d175f83c49e7debf1881f30aacfeaa95de8b9d2d0f885e60a79f3d0faf1944ef81d54e409fbfad0fe77c7e90fb30051e4dfe0b0f1e2e4cf0f4eb991e531ace
TLSH
T1ABD01212FA614134C01022731113AB480841F90B91264100593CE55D2F480940902441
MD5 SHA1 SHA512 TLSH

Submit Download

1d3ca490-19a4-4a36-91d2-96f37d8397b4.tmp

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\1d3ca490-19a4-4a36-91d2-96f37d8397b4.tmp
Size 6KB
SHA256 080114415446e012bf00677bfa8527ad00a8019d15feeaa21125da6e2b4a9a6f
MD5 5e18175cac22f131e1d982de08b784d9
SHA1 2636f1ce79545158c8ff6116bbcfaf8540314a6d
SHA512 ea76938576b627a3a1f22ef02b3bb412355c452b59fc5befe223d9cff8166a12628e2bc0111e3315e2fecd42290d7998bfbb76748f55d304c5b8c53803e127c6
SSDEEP 96:st2e05FdPGHKb9hXyffkFZ8i0vhElgkt2/m/7qx+WVHMSm+uecJ2GfjMdQjLn+gx:stB0PSfwZ8paRv/S+WiT3fodyQeMC
TLSH
T18DE1B9026E2869779CCBF6197A36BB12E2F9506261C10ED4EFFC861C05E66CD5207D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b634615-f628-432f-bae5-112d05d0fd3e.tmp

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\4b634615-f628-432f-bae5-112d05d0fd3e.tmp
Size 6KB
SHA256 44e9dd606cbb7781a6b8284b5815aeed18ab9fb10acf9e785d54a55c3937874d
MD5 e8650fcb86a4bab65dc1b98d23b23f0f
SHA1 ba29969693cf8ce85128c9061e3d8c7e8386c2c1
SHA512 42d46800260fe31fdf4a7fa2710404ad3e79477d7c544370be360a29844ea9bee4a99e0ac0bed170b5dd9cb9bd7fd874e0d87aa01dfa977cc4527fce42f7ed74
SSDEEP 96:st2e05FdPGHKb9ayffkFZ8i0vhElgkt2/m/7qx+WVHMSm+uecJ2GfjMdQjLn+gjy:stB0P9fwZ8paRv/S+WiT3fodyTeM8
TLSH
T17DD1BA02AF28A9774CCBF2197A36BB12E2FA506161D50ED4EFFD861C08D66DD5207D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 576B
SHA256 20fd413709e0eae3f45cb8660b403f231253ac77edb325857ff0c9d9def0fa3f
MD5 b42a1da59124fce1b82eabef87c75c1d
SHA1 b2a42ed315486c2933c59ccc9081101178c8e77f
SHA512 2b709a75f3194f9c997851d10acc88d20d41781a91ac868796524379df43a0f1177b62f2bf82d51eb53597c7549f0fc29a376f9886cbf234493f8a8904a41585
TLSH
T1B8F0C0555C6D0038C704B57C98D408DCFD30481813C71FB56360267A8805300F213C4F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 1c5240f9a9fb31f44b69bcf0413a66828ac95896dc95393b63d7f2a791aaf7f8
MD5 344dd31fdb1c52558b775b128a49e156
SHA1 1fe4fe63f36790fe52a5b1aa85da011983196d99
SHA512 ac61f08d358c32fd7b07ee0d26b4d003a0d40ce466ef9c6f4f9f15245877dd18e0ede094c8b3136540660df50e34c0e990da2f0185b980eb018c46d86bf70cb7
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\DawnWebGPUCache\index
Size 256KB
SHA256 d9e9f0291182c09220437c757d5bb3206c2760ea8b7182b0689ea25174470fa0
MD5 a65d22c482f10414670ee317aacad33d
SHA1 3ecff1a0bd1c444bbc26c0627a8367026ede6377
SHA512 ed2596b5403dcb2514683ce6df41a6cecb88bbed577bcf9f22104216f2e0a8845a209698fe216c88ad6ddc1cd41e1eb8c263a81975293ad5e074127c09c0eefd
SSDEEP 3:LstlNllkll/lRgl:LsX3lEtO
MD5 SHA1 SHA512 SSDEEP

Submit Download

e8f2019b-8982-4496-8674-260e6f344b5d.tmp

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Default\Network\e8f2019b-8982-4496-8674-260e6f344b5d.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 1KB
SHA256 dfbd2ab9074b5990ff0c8674de9a86d331a2101691e10bfc6bb94bfb49ac4928
MD5 a198c7998f5926a2a37f60f473c2a8af
SHA1 ead4cdba6072658f526ec99b00c9e6f3a1f013b3
SHA512 fac82d89ceef4f60398946ac5706ae26272049b18fef33d175189e0872434b0b0a37d45da401ea2f82bba30c2b17ab138ccfa091abac669b07e353d0d3620c80
TLSH
T119214273D4A93A37BAD19886B5423A4ABE2080758111CF48A5CF971C02EB6DCD63BC23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\Local State
Size 3KB
SHA256 b45c3107e1193bb6d2171ba3a6665847a0ce5f7cc3cca3e7704608fd56b90331
MD5 69da8f5a625cf6ce72698658cb4a3647
SHA1 9a4a24be2e656b987bb09f6d7b7b90804fa929e6
SHA512 5133e692982735f3bac233fa44b7c93699ec51efe336876bc0ea453a53f77457fbab413cbe3a3bf96c42c32898657e55643ba2556c4fef401380695444c7acb8
TLSH
T15F71A626A868A93B5EE3D945B8862F16F7659032D1817FD8D9ED0F0C02EB7C82352C07
MD5 SHA1 SHA512 TLSH

Submit Download

ba4302b3-4a62-40ce-a0a3-f9b2146f7109.tmp

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\ba4302b3-4a62-40ce-a0a3-f9b2146f7109.tmp
Size 2KB
SHA256 851b68d007face86360b3357cacdd97e74577b73c1e963d968d2eff8dff110ea
MD5 ef5cf81c6882af676b8a1ddaa4faeddf
SHA1 81729bf2eb4ee204b67260d343bc53760dcab16d
SHA512 3eda7758c51adaa86cb257e460b1e07802d463b0fb01d5935b082a55e8158d6c26ce91ac260e1cd024c91f50246bbcaa435f53b4d9f640aa7a1a93d7c60bf22d
TLSH
T1BE51B773B8187A37A6E3C945B8463F13EB35906195525FD4D9DE1B1C01EB68C2313C27
MD5 SHA1 SHA512 TLSH

Submit Download

ed67b46d-188d-4e1e-8547-d89b1f9693af.tmp

Path C:\Users\Admin\AppData\Local\Real\data\cache\webview\EBWebView\ed67b46d-188d-4e1e-8547-d89b1f9693af.tmp
Size 16KB
SHA256 69bcf8cb374bb5de133bf1528f71d1e6efa07d4fdfd72b9c91d5e6ab69b43785
MD5 c3f1547b608215b3a8bbef97ea5c45a5
SHA1 36549139507f119c1d45c9f315f227ea42f428a9
SHA512 fa42c5d05dcaad8e92a1c9aee4711422452dfc26cfaa4ead7aaae1c990d6eb9ca83bf23cdb31384a08f5864b0e1ec80a1b429d318fb2b17eca66ac09e21ede8d
SSDEEP 384:zV+OBqImmJvGBLx3NaFMJFDNbUOAEXg6rJ:UcvGtlNXvFt
TLSH
T1FC72AE7668796A233CEBC94AF98E2747D7315193C0D16BD9DCED8F0E01AF1842326D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Real\data\config\settings.json
Size 228B
SHA256 8792491684557930c6a1330096a245f393cef2953a52a21360caacc6abef8508
MD5 df57e8c5349ebac4872b91900d59a536
SHA1 fc02eb24fe70375603d7d5bff94335d0cce607ff
SHA512 9c3e4ca8a02358b5ec34d4f6bd6366bc832301b99c508f45d778ef32e60a3139f994f2edc34a109c513e36251f4d1cb5174e47cdee8df77c0da7f0be42b8df01
TLSH
T123D0A960ECF80EB213DA902E086A4012E4366C6B409D3D3C78EA420CAF4E630417A784
MD5 SHA1 SHA512 TLSH

Submit Download

current-build.txt.tmp

Path C:\Users\Admin\AppData\Local\Real\data\meta\current-build.txt.tmp
Size 3B
SHA256 bfa7634640c53da7cb5e9c39031128c4e583399f936896f27f999f1d58d7b37e
MD5 4c5bde74a8f110656874902f07378009
SHA1 58f0744907ea8bd8e0f51e568f1536289ceb40a5
SHA512 c228d3ec487d7b75f03545e010f4d508e84a3d92aec4cfe9cdfa50beab7b5a48b1893380e2aff38ea7a951bec4762bf6ceb757bc59fff370602264c92683673c
MD5 SHA1 SHA512

Submit Download

current-version.txt.tmp

Path C:\Users\Admin\AppData\Local\Real\data\meta\current-version.txt.tmp
Size 6B
SHA256 87ccd03f1d763e21d127d5ab0a7a9c67d6c7e94e63b8940218d7e88290c8522a
MD5 298f6b9b22faa2970a9603f427895524
SHA1 d55168255aa04b62d234cc7484cbe6a6ae8b8d1a
SHA512 824da0fb7c4e23d69505890d7511c96878e198314311091942c6f048ea05dd7bc671e487eec3e1128c5e75d346d008fc99c128b3a939f2274828681388b0f654
MD5 SHA1 SHA512

Submit Download

real-taskbar-dark.ico

Path C:\Users\Admin\AppData\Local\Real\icons\real-taskbar-dark.ico
Size 38KB
SHA256 884cae569dc6d4b82eece32755b3567ce082867c266b27cf6d2fb649e1e91c5f
MD5 c961ca2ee661749cd51f300372f3cfe1
SHA1 08c4023fdf1d08400886727fc9efa4ac4adcc3f4
SHA512 a71e8c56165e469c23f33ad79018550f27601c5a66eb51b66c3ba185f7b58b892147ba5d98e903091547de3a915cc776f1f393faffc4412750d4b2b082da429f
SSDEEP 768:gOBgSA/dH8/TX+tSgNyAoiALUIpFqC2of2M2fYiQ/3AIhdOBRD0NJ+h:9SSA/leTX+QgNyAH8qC2ZvYiIN00Gh
TLSH
T1FE03F1FFE6B8F93EC281543DC0984A60FE564261F7EB278A06568310467B72CF1AD493
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

real-taskbar-light.ico

Path C:\Users\Admin\AppData\Local\Real\icons\real-taskbar-light.ico
Size 34KB
SHA256 8f41b1702485181d73b6a5f6a074b6715df7bbac1317182600e361a7de7e9423
MD5 17e6cc820352f4ef9d5af72879a5a2cc
SHA1 2ac67632fa494708516b9f30fdda169492fd6c80
SHA512 ff9d42872b850261840a8db874a51889278899796e1e6973ad977dddc072dec6edd47caf5f4dec5f26bf1e287b85c856aa049a189badf84ae5837c17cf68f9ea
SSDEEP 768:C6cKta3EhN0AohZSQmn9V2flcf/gv38XnlfYG71OxA92GuUi7J:Nta3iN7LQmnXs2hVfYw992GuUMJ
TLSH
T10BF2F1E363F6AA33D82D2331270F51B67CBB60A50527FDCC91D4EC230A0B49559AB615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.exe

Path C:\Users\Admin\AppData\Local\Real\real-2.7.10\Real.exe
Size 16.2MB
SHA256 0a1a6a6aad2e3f25339a2397f52865794f1a84eb7e6f13628804f40527731c16
MD5 675175e0fec5d2976990c36c40d16e13
SHA1 e4541a1a06cdb861742bce0edaad6b9520fa1842
SHA512 5f894fd4992905ed42252bdb97f5149bbea82145ee3748c0f948b4f2ee8d474f89103737b2921deda03e53383e1168c4f5bf4193f634c821c588b14de23bace3
SSDEEP 196608:YHk4UXpuWxxExEMxCi2WV82kBNuKRC4JJqwK3T5zlh+Q7qh8:m3QuWsECIwCatr/7q
TLSH
T18F079D07F35181E9C0ADC078835AA637EA31B8894735B2DF1BE44B512E26FD06B3D769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.dll

Path C:\Users\Admin\AppData\Local\Real\real-2.7.10\bin\Real.dll
Size 4.3MB
SHA256 a845b6adc5dee578562ace568c012c620a030cbe14286b36e7707fc69625f71a
MD5 ebde87f7a38b99a2e6dd92ab97dc4ed7
SHA1 c2b132c9b6d5baf6a11ec3de447c259c3ba64dbf
SHA512 3faa2305940d40210522d725acf6b514008d78133e54028a4b4abe64298e28e842d1e853465a4034ef1d682b67f6e0f0720817fb79c8c206abcd37db25ce96cd
SSDEEP 98304:B2KOmeR8dn2nhrW3zh0SgvLBjG8FWr8/unrU3A7e1D1/1AT1+V81DjTs5KsPIvax:beCihrW3tgzRGuWr8/unA91nnIv5Yh
TLSH
T1B426D0C0CD1745F0A84F7424220B5BA3947EA9AE78547D36CEE8237B67A53218FC635B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Real.exe

Path C:\Users\Admin\AppData\Local\Real\real-2.7.10\bin\Real.exe
Size 5.8MB
SHA256 d385e0ea08a211144a392e3230937ea1b52c517bd62a88bf171ef87b46e80c0b
MD5 a7674c7925e02c5f9909b61722dd61cb
SHA1 946bc41fa71474b4185f78772a880fe678d27e11
SHA512 4705b5407ace00015780e01b42a055b56449fb4b3ce3e3e089abda6f2e97c78549144435fee8154ad3b590d1802417ec954d177413a805e6fcc50388cdec9415
SSDEEP 98304:rjMhoQ6kVFeFH09gBCIhHRv9T4UYc8PXXfINpkHhqq1rac9Gya95quvhP:rjkbjVFv9iHl9sUYpfgNpeWNtvhP
TLSH
T1F85633A53F54DEBCD2D8223EECE0AF2DD2EECB02C5FE54452438201FF68B0945659666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spoofer.exe

Path C:\Users\Admin\AppData\Local\Real\real-2.7.10\bin\Spoofer.exe
Size 3.1MB
SHA256 38a0c331f536e3f3b6dd2fb9ecf88c98a8ded1290c8476f15d84d9c232a2f266
MD5 b48375cdcbf4a7f1d6751ae00c3809d8
SHA1 6579e5addf860fd607b9ffca58f685dc7dd3a633
SHA512 83a802d047a5ea20416093f464864788a633fff8a126db7da714c47d29f1596b9c76f3dc6ff114bce1ba76c5749844c7986afb407317e2ece25a7e0c953d98b2
SSDEEP 98304:yr9QVgssoNlxOK/4jn+k/bAxWY6Vh7nxk:tgtMOK/4jn+kUxWY6Vhtk
TLSH
T1A3E533143733080DD6D70E72F3BB9A1487915B2040DEE2E96A9EE7C1DB267832599DEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

luau-lsp.exe

Path C:\Users\Admin\AppData\Local\Real\real-2.7.10\bin\luau-lsp.exe
Size 16.1MB
SHA256 9e85ce9370f208c97f1dfc1b8fcf7185fe64386f23130a65fc834f5323a0d653
MD5 0e14d186ed05911115868aec341ca13c
SHA1 525708cd63fbcaa2bd68225aa2411b0f46c3e9fb
SHA512 e3acd3aad750e35cf9993384fc274db9ffdfd18099d4fd90a39ad0c039410d4e451baa6a2e1a5b1fd2658281bed8d33a2a3d2403675ef3976f10322ec5d5d029
SSDEEP 393216:E4BgLVggOglggqgTgXi17gCFggqgggocgQgejM9gggggdvFBggggjCggggoggggg:KBggOglggqgTgXi17gCFggqgggocgQgP
TLSH
T188077B3A21AC10DCF1BBD0BD8BCB9E47D6B2340903319ADF0591569A1E1BDED4A7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

real-mcp.exe

Path C:\Users\Admin\AppData\Local\Real\real-2.7.10\bin\real-mcp.exe
Size 1.6MB
SHA256 a281001f9ebd6c6f4776db34f883186c069bec4eaf878d7d940ff354ad14e6de
MD5 c0059a0fefe35c6e9ac590c3d65b0dae
SHA1 5206673918e5d8f44e31784d34eaf69271455a73
SHA512 3eeed550deb6789740f04e14ec44ea5f14da993eb156951fc466b0b1da2b93e5d35f72fefd06f7f5e529dd9a2269d438e0153e3a2f172ca54a0cb1a05f28a4c7
SSDEEP 24576:ST047HfKdlWJ3WuHz48PZGItULwv5YdOmPFM3VIH06iyq:o0TWJGibGIUwvWdYIU6i
TLSH
T144757C03E25580E9C4AEC5B8C357D536AA32BC8D0A34B1EF2BD49A553E3BF806B1D715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 399B
SHA256 5787846df0dfcca52e48347daab099d0584006b19b48c7fdf9456464a655adb3
MD5 9f59371505779d437558e7b89ac1b3da
SHA1 5ee2d64fdf62e54e45001eba9421813747236d70
SHA512 88a14f06eedd77b6e3d5dc1c6b332db47de5b7f23538ea4454789338463df2a9af15ec75eea1fea37860b4da80c6c973a60b1bcbc8228d69d6ef8faa206b82d9
TLSH
T1C1E0925C787C683D3C55C6C12A591A828D22E57E0AC8ACE0A50182FCDD4BA6E3E3E385
MD5 SHA1 SHA512 TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 1KB
SHA256 3ac6ea22e0e6712ad2953b9c80198fde0e010b43db2073053a7ba166bf7b96de
MD5 743c1fa20ea4fbff49374430a1570599
SHA1 551a3fb50cab2d37d7c90ecccedc5e3df11b5d00
SHA512 287274772cd5410c404e85cb33fb7daa595149b2cbe6df1b4f6490d2aca3fa18de70f04013718dcb4d37e494b2ff18ba4bae493b219952799d60ed3f278a72ea
TLSH
T13231181D287CF83E291BC5E163186D408D62E47B47C9BCC5215283FC8E6BA3E6D3A785
MD5 SHA1 SHA512 TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 2KB
SHA256 bf70c9a0d752df57670b8d1841f7ae0f28e562a469ba6ba40c274895b40e4393
MD5 01a2424741c18ffa7ac28c1da3e0e001
SHA1 315b83a2ddbae5e6506a35171a7afed5c8a8281a
SHA512 1d5055e9dc12d44042325a3ede6a2c1b9ec51dff6123add48ed506c79e70c419df36a02b99576a88e652a44068139274f9cb05cd67224e3e65d83804e50e5f33
TLSH
T14851480D287CF43F1D67C6D153182A804962E47B4BC8BCD8619183FC9D6BA3E6D3EA85
MD5 SHA1 SHA512 TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 3KB
SHA256 49b142d394331eedb5d61ebcf386b774531250a3feef3b2f458ebf7933fda844
MD5 fcefc5dcb1ecd5ff636bdcdaaba02d55
SHA1 97dacda04d088fde2ff51bceb6e4847be2964be4
SHA512 77c88d8934153c11258156324ee97dce8d2e29a7ddcdd67209809ca3040c722b850529c35fb9d27bb5af9f72fbffd4764207987cba295efe7fb09ef9a08ac014
TLSH
T14A818F1C24BCF43F1D2683D153186A514662A07F47C8ECD8658182FC5E7BA2F6E2EBD5
MD5 SHA1 SHA512 TLSH

Submit Download

setup.log

Path C:\Users\Admin\AppData\Local\Real\setup.log
Size 4KB
SHA256 65e84b9bd33c595d46d7e6f1657c77516b655f259c9a59411eefd8941ad94b13
MD5 da6324437d8bb470ae06465045df5e97
SHA1 2825c7a2cedb88a1a3511041fd6887741f58c6f0
SHA512 17d5c4195ec3ffdd0fe62be8ee821a267f217bf6d42b5967801af35106d86d986a1f34c3ee7e228465958452ff19b2e98fedddfcca20b0e6de7891d69bc8f316
SSDEEP 96:oYKIr9YEjtHORDAoyz6zrwTYCHpLSqyrTtYE:h7Rc7yoUPYH/
TLSH
T17D91A21C24BCF43F1D2A83D1531C6A510662A07F4BC9ECD8558182FC5A7BA2F6E2EBD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13537b64-7dd1-4db8-8524-08f02bf79f13.tmp

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\13537b64-7dd1-4db8-8524-08f02bf79f13.tmp
Size 4KB
SHA256 ef041871927c16611288d268e914f59a5c204b2824b17dd25f95b352dc623da9
MD5 ee0afc92fd3703870350d8d67b5e85d7
SHA1 e26e66b7cb63deee1c32bc76438822193bfb3d93
SHA512 32623d40fa2d013d22047e4b01aae6861908480f9309974eed17c8a5a21cfa3d6a66cab351e640b111a933b7c2a04657d6a3969a7192e39a4e50aa7cbd6a73b4
SSDEEP 96:zuJiF3NkCb1wfnYA4dP58Frh/cInURoDotoT21fD2x5BYmZ+n64neKZyppzTf6lQ:zBF3NbvHQooDU4yCZZ2nev7
TLSH
T1FD919522A8B4A9374CF7D945B98A3F12BA618163E5D57F98D9ED0F0C01DB2CD1342D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

475cff33-2c24-4f3f-b165-4a8e3d6269ab.tmp

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\475cff33-2c24-4f3f-b165-4a8e3d6269ab.tmp
Size 4KB
SHA256 d1e56659f0d9fa185f259f9fe7cdb7e68eb741bf0671afa30ab9c555361dc49b
MD5 2da33b59c793c0c417a2747af614830d
SHA1 789fe36c900b97abc20774b9dc43384ccc96fc39
SHA512 3d838038227c0313bfd0b67968c301a5bb970f1253bbf4b419a6150a484cb7bda6c58c8e82eab9aff5cec8d05694767870a9c4ae016c34f6c41e328ce4efb045
SSDEEP 96:zuJibNkCb1wfnYA4dP58Frh/cInURoDotoi21fD2x4BYmZ+n64neKZyppzTfi9lQ:zBbNbvHQooDUDyZZZ2nev5
TLSH
T187819322A878A9374CF6D945B98A3F13BA608167E1D57F98D9ED0F0C01DB2C81342D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1e115a7065fd9de41f0207e897436a72d79dfd630465321c2f4346c8cf5c2f49
MD5 b1e350c7d55d0adb5ac6b28ce382f8b9
SHA1 158405ab44142743a10f2d04f2784926ae82965b
SHA512 7ac2f8d7be2fdbb2ce2fd64b7bcac51d92625e94c34aa31de98cd1d79d36b70df2c51d638c9b70a1c4047df54adba9aa8653292135b7349ffbdcf836735f3c4d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e11af5cfe10bd613667a7cea599258b089ca0bbbed184bdedb714802697726dd
MD5 b5de152127f00ce7fce4d521f51c0a21
SHA1 d927aacdda6aee6a9f068fe767f38627d2af8e43
SHA512 ea9cdc4e7872495632ba046c44869968881ff040f19b2d0c1658843065db8158a644f81895854d79709606cc063faa59dab57e437e1ded6f611f37205635cf52
TLSH
T170D01216334101B8C4113073070271082840D12B810A44406428851D1E25C651903443
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 59f14171154716ae13324c688bc0668072bd08c85e0395a5aad09e403e6999d4
MD5 203836e1260e3fce032fd1c3835b4645
SHA1 c00f2eceebdc63e85ac525edc53bbed3eba5ce12
SHA512 227059a79861e440fd01b3afc56ab04a52b5ef9ef11f41e7a340d84f8fb086dd1cb20d281306ae2a70501b6df3ae42f96587c66a0ad12e43bd1c383a63b61990
SSDEEP 3:LstlNllklkXlJvqn:LsX3lPh
MD5 SHA1 SHA512 SSDEEP

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 b7ffaf0d5334f6548edc3d9ce834b7d6b465f836cd38dd8449cd229b2fb1bfd0
MD5 163a5337e99f6d8fa9359efedb8edb4a
SHA1 f940526fca3369781ba4b2603dafa13f53ad1a21
SHA512 84d80ac8e0543f86f09486636de0546c968d1996ddcfc5c94006f31df56427b84d47f8aa2654c58a019c971dca8ced04ec34e173cb2757041d879522bcbc078f
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 559a0a5752b6291d94a4716360921f5b7c57c9e7b4b0c2f44ab21dc829d396da
MD5 ca8eb6661af86b4acbdc803a14a97eed
SHA1 e6b79d9fc2ecf01807d3c710d051c6163d4862fb
SHA512 85dabad16786ad132d083a92f0c2448502fbe2e3c0f7362159593bbf5a988405eeea57ff337dec91f99a6ed0abe5e50f7390ede536cb6fa793554c3cf72beea7
SSDEEP 3:LstlNllkll/lR:LsX3lEtR
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Default\Extension Rules\LOG
Size 369B
SHA256 b9e8fb7841b8c4e274a39b241e5ab29656d96a9d2e34aa9863848fb97fd1e655
MD5 07837fc4368fc3e4d8e59f4692384278
SHA1 b2277eaf7f1748d02c45d167a7c046f78bc4aab2
SHA512 e21a9b25273bfb937187cfdce6ba32344ee4e7913fcb0360dbaaa2f65621ee435da897551a11c9516ef30f1a6f71933fc3a82903c1385a36565dccd3de6b6e54
TLSH
T131E092436489C526C98ABDD79DB14B4ECA1319297F4937189F09CE85312360975C2347
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Default\Extension Scripts\000003.log
Size 38B
SHA256 1c43a1bda1e458863c46dfae7fb43bfb3e27802169f37320399b1dd799a819ac
MD5 51a2cbb807f5085530dec18e45cb8569
SHA1 7ad88cd3de5844c7fc269c4500228a630016ab5b
SHA512 b643a8fa75eda90c89ab98f79d4d022bb81f1f62f50ed4e5440f487f22d1163671ec3ae73c4742c11830214173ff2935c785018318f4a4cad413ae4eeef985df
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Default\Extension Scripts\LOG
Size 373B
SHA256 29019488af899669d09370b2826e1326037cc753634e423992b4ef6d7b3e322e
MD5 07c8b21670f3dc6ae1953b12548bff53
SHA1 7e5c06f63cd1fefe82338dddfec856758d941e56
SHA512 b096f7f84ecc135bf65f59ccd10fa03563abb03aa0ae7d50ecdb2e0c7acd26a7e2f95764f635706a886cced493d344350e8ddb5ba5ad8c2e9afbcefce44e0f53
TLSH
T12DE06807288DC532C98ABDD78C725B0FCB4329357F48B718AF05CE80212760975C1347
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Default\Extension State\000003.log
Size 114B
SHA256 e2610960c3757d1757f206c7b84378efa22d86dcf161a98096a5f0e56e1a367e
MD5 891a884b9fa2bff4519f5f56d2a25d62
SHA1 b54a3c12ee78510cb269fb1d863047dd8f571dea
SHA512 cd50c3ee4dfb9c4ec051b20dd1e148a5015457ee0c1a29fff482e62291b32097b07a069db62951b32f209fd118fd77a46b8e8cc92da3eaae6110735d126a90ee
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Default\Extension State\LOG
Size 367B
SHA256 d510c5cb26372a8e2b88a23a64582d5861546d3b574ac39ed21cba0b4ea525f6
MD5 ed74b9daabd3c49621d5aa320d388e64
SHA1 688786ca9349d0f5e180e371257d26f49d48e9b0
SHA512 90081167039836935821fbb6a5ce8c0086696a7ee2f97583b4ccdcfe91eb971b3404e68502b6de5edeb6b0b9137f76fe742b02ecb76cb07d990fc6c37fa34c0c
TLSH
T11BE06806208AC522C889FCE38D321B0FCF532A347F4437186F18DA80211360935C6343
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Default\Favicons
Size 20KB
SHA256 46b5ecada4edb2585f87953f7847aefc938be2404b9d9455c772b97295b7b1cb
MD5 babd43551f1b29eb82e221460676126a
SHA1 e9bff307613a14b35830893bdb6d1ecc931b425d
SHA512 5ab681c170dbd1d374bd66edd02cbe21272819ef7389ad1e886bcba112deb91eb68fa930747986da5ca794881939570013e38edd9f8e6f718f7d202e74a82f41
SSDEEP 24:LLipxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:UBmw6fU1zBmI
TLSH
T1C292EE075E383407DBA10E7D366B18768E3FE26C5FA29C94347410618CF9482D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Default\GPUCache\index
Size 256KB
SHA256 ac03f3415db4f87964994f5da54b6e2d35ae023fd040d52aeb73adc01be606e8
MD5 12b0c70603a7afbd0d3e810fe15e42aa
SHA1 3b1d436dd5c4ae59d798f06926845bfc585f333a
SHA512 3b7ca06f6150f619dd61a499b6b83435d2fe7c445af14fca7b923655cd7833304387621f6e3f8d0488301cbe7dfae5f68fb387b2e423d717482f40a334f348cb
SSDEEP 3:LstlNllkll/l4KK:LsX3lEt4
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Default\History
Size 184KB
SHA256 7ac0739f534f89ae63c46cd41f0cffaf0335fe348933e3e3d660044351f2a746
MD5 c77e3d0b59e286bc3b50eff7cb8f464c
SHA1 b260bf6f86fb9aff5b2396bfb49dea658a6f05e5
SHA512 e9d95b19019dda281d5cdc16315ae5368b3bab7786955354de93dabe5885c958c556a09e4b57a707244e0052cbabb00029619deba1810677bf9ea06e7287e8fb
SSDEEP 96:xhBttejzH+bF+UIYysX0fxQp97fEHt/DfLjLqL/hbgI4VgNr2jWRk/E0:xhBqH+bF+UI3iWGVfWN3qL/8VgZQW3
TLSH
T1AA04EC1E5F743612CDBD513668E745B3597CF03F8B636AC62CA114B1CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Default\Local Storage\leveldb\LOG
Size 381B
SHA256 65e36a584b4929aa87b854523f93cb3177236d53cdbf38e947b8fdb18000f7b6
MD5 fceee8c573fe790baaa80eca49376f66
SHA1 2b467e29dce06a0af332acf6c96ca8dde06e2ba7
SHA512 97a10ffc1f2b703b97f7b0877762bc0f8814af41991dda20f33948772c8ec582d30b03527b0272f46a2cff449ec4a82bf93e202c68e5165d6d95198dc0e9f30a
TLSH
T179E06163604BC536C649FCDB49316B0FCF221A397F4827185F40DE41315750876C6383
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Default\Login Data
Size 42KB
SHA256 a5c1d3aad1ea6dfa8484d39b4b6239529889661a0a4d9643175df4d5915c7afa
MD5 cf0d378139d518ac262a5cb0979f238d
SHA1 94a24d2046879c9b26347909eb02cae09d40fabf
SHA512 d856b2d705188592828b2f277967f269ed46e5154d9e20b955b0e131d8de964b400672d167043be454104429be2bb5f285a3c084cd578aff2ffeb5363099bb4f
SSDEEP 96:ALlpeymwACn8MouB6w9f/FlXqiEqUvJKLuyn:ALlrAG7Iw9ftFqidn
TLSH
T17613350F2B682401C8AD8636ACB114B66E7CA13F4B639FD52CB144259D75C63B12D5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Default\Network\Cookies
Size 20KB
SHA256 e87b3d155c7582d4c1d889308b58f84e8fe90a1581014b21b785d6694bd156cc
MD5 a156bfab7f06800d5287d4616d6f8733
SHA1 8f365ec4db582dc519774dcbbfcc8001dd37b512
SHA512 6c8eeab3ae6fb0d5be7758cca521665b216f31aed1aeeeaf121c99dc9f0192b385de0da36e94f90dd4a9bbbac6be2c5a55d2f284a24ccb7dec2c5302fb9b027c
SSDEEP 24:TLekLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T66LopFMatSaw/auUOt8B
TLSH
T101928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE929ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 951ea521116baf347ce89b628eabc22479fb8e3edfb7597659db2174fbb59804
MD5 fa739570350b78ef09e5d8ca61d0d71f
SHA1 d4e932ca96e76aeb84d3a151d847658df6a5555e
SHA512 8dc44c2f20c0a051568e7479e4553dbbf8ad4ee6b4d5474d8493c4b957f563f858918d862621ff7ccb190be693877dfb0a1245998925f47f9976d431a007ac86
SSDEEP 48:TqIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:+IEumQv8m1ccnvS6
TLSH
T1BDF2149E0B1D3A10C4F89674EAC10DC37D7D141D8B96EFC45AEC06F2FF866A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Default\Preferences
Size 5KB
SHA256 d100e2629c6989d22b5e1499fbe40d24c37c97f87b4c7d8e8dd3523689561d9e
MD5 b27e3cb57fe11f9a142a43c8a92186d5
SHA1 1634dda0dd74386fffc8670bff295500f7dac321
SHA512 f35be6dd934fb93dff92d6d0f9c6ef2286bf9f5c908b6194d764ccdcca75c98e332253b7230458750f2b0f1352f2670fbfb07800cd12255ef201383656699eb5
SSDEEP 96:st2D05kdUGB5b9s+ffkWdZ8i0oElzklm/7qx+WVHMSm+uecadQjLO+gS1g4MEB:st40C2+fPZ8pFb/S+Wi8dvk7M8
TLSH
T1A8C1A9026F68697B4CC7F21D7A36BB42D2FA506125D50E98EBFC865C08D66CC530B90F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

d755fc48-c9f8-4f94-931f-7dfec40769ca.tmp

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Default\d755fc48-c9f8-4f94-931f-7dfec40769ca.tmp
Size 6KB
SHA256 8df5711c275fdb852f5fad9ce8b4502a077d1df6010a27afc589cbe9cc3b65b6
MD5 315211c58230712544fadc9c75b39898
SHA1 31e6d506cee6db69aca80300256f1f1a027cb285
SHA512 1b2dcfffe8a10e1b2a779bdc527b2f5dc1cc61f8b01f363930bfe06d7e32f0398a62b4bf840a52335c1406d8660329876b24f72fc228de02cb52fd6c0e6ba021
SSDEEP 96:st2D05kdUGB5b9R36+ffkWdZ8i0oElzklm/7qx+WVHMSm+uecadQjLO+gS1g4MEB:st40Cm+fPZ8pFb/S+Wi8dvs7M8
TLSH
T1C2D1A8026F6869774CC7F21D7A367B42E2FA506225D50E98EBFC865C08D66CC530B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\Local State
Size 1KB
SHA256 68377b87c81652703f35aed89532ea3d22e6ff6308d93752b8bd39fe86104b26
MD5 1828924ad96209ade05a8fc113301270
SHA1 e13cb1246df878bea0fc46837d9c38f1f4d7fa2b
SHA512 595e2c260f6f4089eefc28530d4b5a03775f72fbda6d1019932522b1c9ab918e643b9e3acc58b6aec31a6c789d0d3fcccb4cf6a0e2bd9a2e3ea324808f31921c
TLSH
T16C217073D0987A3278B5D545B2AABA472E5081B6A2808E08E0EE031D10EB0CC663AD27
MD5 SHA1 SHA512 TLSH

Submit Download

bb1c186b-6759-4736-8dfa-44986a7270f5.tmp

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\bb1c186b-6759-4736-8dfa-44986a7270f5.tmp
Size 1KB
SHA256 12fa07afd8ea4e3fcdc5f084c6795e669782245b58d3e613ba7f732d6d9dc005
MD5 e5fbc0ff87e04029bd7255ad1347b8de
SHA1 4f066792ea99d2775cf8721f51e3ab5822ef6a4b
SHA512 cdf747b702a194eab608d19c0a849785906a91b6a288bd8f6e2b70607c91085a9cbd6c99dd0556fcc97d421e21ae9cb1364cbbe565d0db70e1d228e45ceeec36
TLSH
T1C4319573E0943A336CB5E245729ABE53AE2140B6D1818E48E5DE0B1D00EB1CC653ED27
MD5 SHA1 SHA512 TLSH

Submit Download

c5f4a5f5-28e8-4b47-a4cb-4f12062cbf94.tmp

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\c5f4a5f5-28e8-4b47-a4cb-4f12062cbf94.tmp
Size 2KB
SHA256 3079fa8edac783bb55d380b0934e398f8c0f0655a3549d03e0060e165db441be
MD5 f34e8af6c8851dfcdf45514324d54670
SHA1 c27fa27943dbe6514acebffd340d120af5edc60b
SHA512 a105060f53bfc54f47e875381a4e8823b33b4b6f2659a40c199c567780eff49690bdd392129879c10616ad3623e32eedcdb16febf2144c29b66561aecee0b042
TLSH
T11951CA73B4587A3758F3D54479DA7F23EE3191A295911F90D9DE0B1C00DB18C2316D2B
MD5 SHA1 SHA512 TLSH

Submit Download

e0e2356d-41ca-47a0-bcd3-799f9f29665b.tmp

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\e0e2356d-41ca-47a0-bcd3-799f9f29665b.tmp
Size 3KB
SHA256 1338103d9b198c37123b4080b4af3a078fbd19dc4e94fbe3ae231a90b9f62ba4
MD5 b0d321d7f0ab0bd8a3b4d34939637bd3
SHA1 2c52a663cacab9db3c8c046867a7a011c2b8d6d8
SHA512 240e77397c4b36477a91ab4ef3ff323a69a715ed684d4841fe78bdf22263009b66f21991040601d67f870b5f4b2bafc1cea5d322f00c74f0c7e6b444c53ad6ff
TLSH
T1C0717322A468A9374DF2DA44B9CA2F16BB619163E1D57F98D9ED0F0C01DB2C82352D1B
MD5 SHA1 SHA512 TLSH

Submit Download

ea1ca973-81c8-442d-a6c2-eedc58060aa1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{D69A068C-C5CD-460D-858B-CF6419541A5E}\wv2\EBWebView\ea1ca973-81c8-442d-a6c2-eedc58060aa1.tmp
Size 4KB
SHA256 b38ab47fd42ac049f9605e24f1f34651f292cd6159a7ad1e7de6761ec4baea78
MD5 bb3265e6f236e090b1625b83a9c16fd6
SHA1 3c5740b5af76890f7f7a94290dd5a5e2294f9c3a
SHA512 12914ceff4e6e0b7d3b9a2eab44e835dd204a99e9e05ff2a4d233e237e5ad0a29bf81d77e654f4c9ffad2d4fcb745a109fb41f58ea1610ecc7e0121e6658c9c5
SSDEEP 96:zuJibNkCEwfnYA4dP58Frh/cInURoDotoi21fD2x4BYmZ+n64neKZyppzTfi9l5a:zBbNbiHQooDUDyZZZ2nev5
TLSH
T17E818222A878A9374DF6D945B98A3F13BA608163E5D57F98D9ED0F0C01DB2C81352D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_p50hqu0f.x1s.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p50hqu0f.x1s.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5452_1597791791\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Real.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Real\Real.lnk
Size 2KB
SHA256 31c668d8467d5b4f1ad7aba127ec7a19fb638d78c62918335ae8b5389c4700ea
MD5 edfd4186bb222952593af3c088fd1f3e
SHA1 21e9dfedee595aa8b8e392add1df651ec429c50f
SHA512 8f2d0017b08fdfd25ac9214cbdb10759c5b0b65dc4b0f38b95d929a5aa81ead51f4fff1f7cb428bd5fdcd48cc8929d0f30f90bb2c4597ae4e4ad1016c5d0a5d4
TLSH
T15741C945EAE22B10E3B79C79FDF612658AF1B421FA014E4D0080818F0C39B818964F4B
MD5 SHA1 SHA512 TLSH

Submit Download

Real.lnk

Path C:\Users\Admin\Desktop\Real.lnk
Size 2KB
SHA256 28a83a03cd66020e9aef18f5a6e12b4ee0ffef1809737004b826331ab4a25dce
MD5 5d772e45b58aa3bb9c4bfc066bfd4643
SHA1 41d7f4ae539dd81bb7d2b1131556009530cad3d0
SHA512 41223bbeaac6a8ca794f8e0bff40a8ef37e4365afd3c5841877437327b6fdabf8c2f5912d174f3a9c2a7ef9113901d51abac63fa5d945848346cf52798cbd494
TLSH
T17541CE41EAE72760E3BB9CB9FDF716158AF5B421AA014D4D4080854F1D79B80DE64F4B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1620-1451-0x0000000140000000-0x00000001410C4000-memory.dmp

Download

memory/1620-1537-0x0000000140000000-0x00000001410C4000-memory.dmp

Download

memory/1620-1538-0x0000000140000000-0x00000001410C4000-memory.dmp

Download

memory/1620-1540-0x0000000140000000-0x00000001410C4000-memory.dmp

Download

memory/3520-156-0x00007FFB4DFA0000-0x00007FFB4DFA1000-memory.dmp

Download

memory/4560-201-0x0000024A407C0000-0x0000024A417C0000-memory.dmp

Download

memory/4628-1622-0x000001EA80000000-0x000001EA81000000-memory.dmp

Download

memory/4684-257-0x000001DF0DCC0000-0x000001DF0DCE2000-memory.dmp

Download

memory/5656-26-0x00007FFB4DFA0000-0x00007FFB4DFA1000-memory.dmp

Download

memory/5816-52-0x00007FFB4EDD0000-0x00007FFB4EDD1000-memory.dmp

Download

memory/5816-53-0x00007FFB4DDE0000-0x00007FFB4DDE1000-memory.dmp

Download