File scan report
Verdict Safe
Is Realm
Only McAfeeD flagged this unsigned executable, while higher-trust engines, observations from the test run, host checks, and malware-specific intelligence supplied no…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 71 flagged
- Flagged 1
- No detection 70
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 2d ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
McAfeeD was the only one of the 71 antivirus engines that checked it to flag the file, using a generic hash-style label; all higher-trust engines were silent. The test run recorded no named injection target or high-risk technique, and the complete contacted-host check found no known harmful destination, making the lone detection likely erroneous despite weak provenance.
The detection pattern strongly favors a false positive: only 1 of the 71 antivirus engines that checked it flagged the file, and that result came from a less reliable engine using a generic hash label. None of the higher-trust engines identified malware or a named family. The sandbox runs recorded ordinary application activity and no named injection target; the mapping lacked the artifact needed to show injection. Reputation checks covered every distinct sample contact and found no known harmful or suspicious host, while malware-specific rules and public sample intelligence supplied no supporting hit. Confidence is moderated because the executable is unsigned, was first seen on Oct 24, 2026, and has been submitted by only two sources.
What We Detected
Only McAfeeD flagged the file, producing a generic hash-based label. The other 74 of the 71 antivirus engines that checked it did not flag it, including every higher-trust engine, and no engine identified a real malware family.
Threat Behavior
The sandbox runs recorded no high-risk technique with a supporting artifact and no named process targeted for injection. The file contacted its apparent service domains, and the complete reputation check across those domains and associated non-background addresses found no known harmful or suspicious destination. No malicious child, persistence indicator, malware-specific community rule, or public malware-sample listing corroborated the detection.
What To Do Now
The lone alert is most consistent with a false positive. Because the executable is unsigned and has little submission history, obtain it from the developer's established distribution channel and keep security software enabled when testing or running it.
Where this verdict could be wrong2 caveats
- The executable is unsigned, first seen on Oct 24, 2026, and has only two submitting sources, so its provenance is weak.
- McAfeeD flagged the file with a hash-based detection, although no higher-trust engine corroborated it.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No higher-trust antivirus engine flagged the file.
- The sandbox runs recorded no named injection target or corroborated high-risk technique.
- The complete contacted-host reputation check found no known harmful or suspicious destination.
- No malicious file it created, malware-specific rule, or public malware-sample listing supported the alert.
- The executable shows no signs of packing or unusually high-entropy code.
- The executable has no verified publisher signature.
- It was first seen on Oct 24, 2026 and has been submitted by only two sources.
- McAfeeD produced one generic hash-based detection.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 4 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 4isolated sandbox runs
- 14sandbox rule tags
- 2spawned processes
- 4network contacts
- 17filesystem & mutex artifacts
What this file did when executed
This file was detonated in 4 sandboxes and its runtime behaviour was observed.
Techniques observed in the sandbox
14MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1036
- T1055· Process injection
- T1071· Application protocol
- T1082· System recon
- T1095· Custom network
- T1105· Network file transfer
- T1497· Sandbox evasion
- T1542.003
- T1553
- T1553.002
- T1573
- T1574· Execution hijack
Observed activity
Processes started
2Programs the file ran, with their command lines.
RealmBot_Exalted.exe"C:\Users\<USER>\Desktop\RealmBot_Exalted.exe"RealmBot_Exalted.exe"C:\Users\user\Desktop\RealmBot_Exalted.exe"
Network contacts
44 hosts, listed as 2 domains, 2 addresses, 3 links. Links show the host and path only.
- Domain
www.realmbot.xyz - Domain
realmbot.xyz - IP address
104.21.7.50 - IP address
172.67.135.195 - URL
http://www.realmbot.xyz/version/exalt.txt - URL
https://www.realmbot.xyz/version/exalt.txt
Show all 7 entries for network contacts
- URL
https://realmbot.xyz/version/exalt.txt
Files
14Files the file created, changed or deleted.
- Written
C:\Users\<USER>\Desktop\log.txt - Written
C:\Users\<USER>\Desktop\config.ini - Written
C:\Users\<USER>\Downloads\log.txt - Written
C:\Users\<USER>\Downloads\config.ini - Written
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\2155edb5-ffe4-4829-aa29-decd32a76a69 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\b7b5be3f-d562-43cf-8daf-4e01fcea9b28
Show all 14 entries for files
- Written
C:\ProgramData\Microsoft\Windows\WER\Temp\6eba75cd-5829-4efa-89ec-6bcf77f79635 - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\9e8901cd-6a30-490b-974d-938bf35e0542 - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER.33dec504-d2ca-44fc-916b-468919faa341.tmp.WERInternalMetadata.xml - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER.763f803c-d1a1-40cc-a205-89b9b22605e4.tmp.dmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\caed270e-af06-48eb-b1c4-78668a5bd8ff - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\ef261f88-31b3-4801-8f3b-5b3ca460ce9f - Written
C:\Users\user\Desktop\config.ini - Written
C:\Users\user\Desktop\log.txt
Registry and auto-start
15Settings the file changed, including ways to start again after a restart.
- Set
HKEY_USERS\S-1-5-21-4270068108-2931534202-3907561125-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithProgids\exefile - Set
\REGISTRY\A\{7dcdf07b-308b-de7f-ee88-45a411368a8a}\Root\InventoryApplicationFile\PermissionsCheckTestKey - Set
\REGISTRY\A\{7dcdf07b-308b-de7f-ee88-45a411368a8a}\Root\InventoryApplicationFile\realmbot_exalted|3568b1a71014279e - Set
\REGISTRY\A\{7dcdf07b-308b-de7f-ee88-45a411368a8a}\Root\InventoryApplicationFile\realmbot_exalted|3568b1a71014279e\ProgramId - Set
\REGISTRY\A\{7dcdf07b-308b-de7f-ee88-45a411368a8a}\Root\InventoryApplicationFile\realmbot_exalted|3568b1a71014279e\FileId - Set
\REGISTRY\A\{7dcdf07b-308b-de7f-ee88-45a411368a8a}\Root\InventoryApplicationFile\realmbot_exalted|3568b1a71014279e\LowerCaseLongPath
Show all 15 entries for registry and auto-start
- Set
\REGISTRY\A\{7dcdf07b-308b-de7f-ee88-45a411368a8a}\Root\InventoryApplicationFile\realmbot_exalted|3568b1a71014279e\Name - Set
\REGISTRY\A\{7dcdf07b-308b-de7f-ee88-45a411368a8a}\Root\InventoryApplicationFile\realmbot_exalted|3568b1a71014279e\OriginalFileName - Set
\REGISTRY\A\{7dcdf07b-308b-de7f-ee88-45a411368a8a}\Root\InventoryApplicationFile\realmbot_exalted|3568b1a71014279e\Publisher - Set
\REGISTRY\A\{7dcdf07b-308b-de7f-ee88-45a411368a8a}\Root\InventoryApplicationFile\realmbot_exalted|3568b1a71014279e\Version - Set
\REGISTRY\A\{7dcdf07b-308b-de7f-ee88-45a411368a8a}\Root\InventoryApplicationFile\realmbot_exalted|3568b1a71014279e\BinFileVersion - Set
\REGISTRY\A\{7dcdf07b-308b-de7f-ee88-45a411368a8a}\Root\InventoryApplicationFile\realmbot_exalted|3568b1a71014279e\BinaryType - Set
\REGISTRY\A\{7dcdf07b-308b-de7f-ee88-45a411368a8a}\Root\InventoryApplicationFile\realmbot_exalted|3568b1a71014279e\ProductName - Set
\REGISTRY\A\{7dcdf07b-308b-de7f-ee88-45a411368a8a}\Root\InventoryApplicationFile\realmbot_exalted|3568b1a71014279e\ProductVersion - Set
\REGISTRY\A\{7dcdf07b-308b-de7f-ee88-45a411368a8a}\Root\InventoryApplicationFile\realmbot_exalted|3568b1a71014279e\LinkDate
Mutexes
3Named locks a program uses so only one copy runs; malware families often reuse them.
\Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6580\Sessions\1\BaseNamedObjects\InventorySynchronizationInventoryApplicationFileMutex2540\Sessions\1\BaseNamedObjects\Global\c73acaa3-726d-4562-b346-c5d0206b643d
Sandbox background — not the file
2The analysis machine's own processes and connections, recorded in every run.
- VM process
WerFault.exeC:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6580 -s 1156 - VM host
8.8.8.8
Files this sample writes at runtime
This file drops 4 children at runtime. None are currently flagged malicious in our cache. 4 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 4fe9ea897911275d8528…60b9f7Not checkedno saved verdict
- 2686bbce70addf8b2dc7…200eb9Not checkedno saved verdict
- 5967411c2276cd975740…56819cNot checkedno saved verdict
- 290f6e4cd5179254b55c…0c5008Not checkedno saved verdict
Chapter 04
Technical details
1 of the 71 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- McAfeeDti!8A7334D7572E
File fingerprint
- Last analyzed
- Oct 24, 2026, 9:16 PM UTC
- SHA-256
8a7334d7572e100a2902f95f27e316dc1876bc93c5ac29f72b141792ff33e1cd- SHA-1
e9d433fdcb427bcf0711bd3c5829b07ebc7be73c- MD5
a4e8b018712497704a1444c64995d1fa
About this file
RealmBot_Exalted.dll is a Win32 EXE file of 8.6 MB.
- Claims to be
- RealmBot_ExaltedFrom the file's own version information, written by whoever built it.
- Original name
- RealmBot_Exalted.dllMatches the shared file name.
- Type and size
- Win32 EXE · 8.6 MB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 24, 2026On VirusTotal.
- Submitted by
- 2 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 6.53 of 8
First scanned
Antivirus consensus
1 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines1flagged
View all 75 engine results
- McAfeeDMalicious: ti!8A7334D7572E
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Barely seen in the wild and first surfaced recently. 1 antivirus detection make that low prevalence materially relevant, but rarity alone is not proof of malware.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is RealmBot_Exalted.dll safe?
What is RealmBot_Exalted.dll?
How many antivirus engines detected RealmBot_Exalted.dll?
What is the SHA-256 hash of RealmBot_Exalted.dll?
Is it safe to run RealmBot_Exalted.dll?
How up to date is this analysis of RealmBot_Exalted.dll?
Community
Member reviews and reports for this exact file hash.