ddbd930cf742882ea6cc10ea5495f8aec24003664b81257c1b3900f3627b6684

Resubmissions

25/06/2026, 15:00

260625-sdapbscx4s8

25/06/2026, 14:56

260625-sba73sc14n8

Analysis

user interaction
yes
max time kernel
36s
max time network
95s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-de
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-delocale:de-deos:windows11-ltsc_2024-x64systemwindows
submitted
25/06/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Real Executor_39936735.exe
Size 583KB
Sample260625-sdapbscx4s
SHA256 ddbd930cf742882ea6cc10ea5495f8aec24003664b81257c1b3900f3627b6684
MD5 7392e839c67ba537093c55353be265ba
SHA1 7c9bce283d6eb9b49dcdcc850e66e0148dc30d71
SHA512 07ccf85180c1d63cc03f9d0ff986d0c704f1ac7719e6f7bec56d32f397eb4400a623a19954914b1d391270ce0b08226ee48f92462c7ec2b6ee29500a36ca0617
SSDEEP 12288:w7yjhihTaVWs+OfaOp0XWgWasfMJo7WLrc7SrnTGf0TRz4hTB2eLsHjlsGk8y:yyjz99asfnyNrnTe0TShhLijlsGJy
TLSH
T132D49E123592C036C5B111B01929EFA690BEBD344F7245DBA7D41B2EDB346F26F31A3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
48	3240	chrome.exe

Executes dropped EXE 1 IoCs

pid	Process
3024	ContentI3.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Real Executor_39936735.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ContentI3.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3240	chrome.exe
3460	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\OperaGXStable	Real Executor_39936735.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaGXStable	Real Executor_39936735.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\OperaStable	Real Executor_39936735.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OperaStable	Real Executor_39936735.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings	Real Executor_39936735.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3372	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5884	chrome.exe
5884	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5884	chrome.exe
Token: SeCreatePagefilePrivilege	5884	chrome.exe
Token: SeShutdownPrivilege	5884	chrome.exe
Token: SeCreatePagefilePrivilege	5884	chrome.exe
Token: SeShutdownPrivilege	5884	chrome.exe
Token: SeCreatePagefilePrivilege	5884	chrome.exe
Token: SeShutdownPrivilege	5884	chrome.exe
Token: SeCreatePagefilePrivilege	5884	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe
5884	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 5172 wrote to memory of 3372	5172	Real Executor_39936735.exe	90
PID 5172 wrote to memory of 3024	5172	Real Executor_39936735.exe	92
PID 5884 wrote to memory of 1960	5884	chrome.exe	95
PID 5884 wrote to memory of 5904	5884	chrome.exe	96
PID 5884 wrote to memory of 3240	5884	chrome.exe	97
PID 5884 wrote to memory of 5904	5884	chrome.exe	96
PID 5884 wrote to memory of 2424	5884	chrome.exe	99
PID 5884 wrote to memory of 2424	5884	chrome.exe	99
PID 5884 wrote to memory of 2268	5884	chrome.exe	100
PID 5884 wrote to memory of 2268	5884	chrome.exe	100
PID 5884 wrote to memory of 6128	5884	chrome.exe	101
PID 5884 wrote to memory of 6128	5884	chrome.exe	101
PID 5884 wrote to memory of 4676	5884	chrome.exe	102
PID 5884 wrote to memory of 4676	5884	chrome.exe	102
PID 5884 wrote to memory of 1112	5884	chrome.exe	103
PID 5884 wrote to memory of 1112	5884	chrome.exe	103
PID 5884 wrote to memory of 4928	5884	chrome.exe	104
PID 5884 wrote to memory of 4928	5884	chrome.exe	104
PID 5884 wrote to memory of 3620	5884	chrome.exe	105
PID 5884 wrote to memory of 3620	5884	chrome.exe	105
PID 5884 wrote to memory of 3284	5884	chrome.exe	106
PID 5884 wrote to memory of 3284	5884	chrome.exe	106
PID 5884 wrote to memory of 5596	5884	chrome.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Real Executor_39936735.exe
"C:\Users\Admin\AppData\Local\Temp\Real Executor_39936735.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5172
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:3372
- C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
  "C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe" -c:1538 -t:InstallUnion
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x130,0x134,0x138,0x10c,0x13c,0x7ffa8719c728,0x7ffa8719c734,0x7ffa8719c740
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,15404788663340936543,17826797931646755101,262144 --field-trial-handle=1840,i,16786161685649527133,10364279082344201381,262144 --variations-seed-version --mojo-platform-channel-handle=1836 /prefetch:2
  2⤵
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2060,i,14013243041251877097,15735421628839910254,524288 --field-trial-handle=1840,i,16786161685649527133,10364279082344201381,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2296,i,905218836524150705,4014766407649343321,524288 --field-trial-handle=1840,i,16786161685649527133,10364279082344201381,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:13
  2⤵
  PID:2424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,9225513603166047291,8469782978319756538,2097152 --field-trial-handle=1840,i,16786161685649527133,10364279082344201381,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3124,i,17530410515159882563,794772029754929828,2097152 --field-trial-handle=1840,i,16786161685649527133,10364279082344201381,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4636,i,15415432551311348381,1085078936151083484,2097152 --field-trial-handle=1840,i,16786161685649527133,10364279082344201381,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4944,i,3998762080745207119,6457374745749159538,524288 --field-trial-handle=1840,i,16786161685649527133,10364279082344201381,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
  2⤵
  PID:1112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5084,i,12196853759040819851,12468827029190600540,524288 --field-trial-handle=1840,i,16786161685649527133,10364279082344201381,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4628,i,4627832484126509557,1332618025989043224,524288 --field-trial-handle=1840,i,16786161685649527133,10364279082344201381,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
  2⤵
  PID:3620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5056,i,1786272737282774559,11760392840050160817,2097152 --field-trial-handle=1840,i,16786161685649527133,10364279082344201381,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5872,i,11291446024479398229,11075558772333061934,524288 --field-trial-handle=1840,i,16786161685649527133,10364279082344201381,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
  2⤵
  PID:5596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5896,i,16985576731818825973,14232212088544297553,524288 --field-trial-handle=1840,i,16786161685649527133,10364279082344201381,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
  2⤵
  PID:5624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5952,i,1246224851585669012,6950178029748932303,2097152 --field-trial-handle=1840,i,16786161685649527133,10364279082344201381,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6012,i,18316330424325236744,14278547451455190236,2097152 --field-trial-handle=1840,i,16786161685649527133,10364279082344201381,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:5428
- C:\Users\Admin\Downloads\RealSetup.exe
  "C:\Users\Admin\Downloads\RealSetup.exe"
  2⤵
  PID:2772
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RealSetup.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2772.2736.18101489718548990505 /pfhostedapp:2b6f7c5215521b05810c8f11624f5f79b1668e4b
    3⤵
    PID:4736
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView /prefetch:4 /pfhostedapp:2b6f7c5215521b05810c8f11624f5f79b1668e4b --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffa74e95fd8,0x7ffa74e95fe4,0x7ffa74e95ff0
      4⤵
      PID:2280
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView" --webview-exe-name=RealSetup.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1724 --field-trial-handle=1728,i,12646494289991375860,16159314710869999378,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:2b6f7c5215521b05810c8f11624f5f79b1668e4b
      4⤵
      PID:3812
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView" --webview-exe-name=RealSetup.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2480 --field-trial-handle=1728,i,12646494289991375860,16159314710869999378,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:2b6f7c5215521b05810c8f11624f5f79b1668e4b
      4⤵
      PID:1980
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView" --webview-exe-name=RealSetup.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2540 --field-trial-handle=1728,i,12646494289991375860,16159314710869999378,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:2b6f7c5215521b05810c8f11624f5f79b1668e4b
      4⤵
      PID:2732
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView" --webview-exe-name=RealSetup.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=de_DE" --mojo-platform-channel-handle=3468 --field-trial-handle=1728,i,12646494289991375860,16159314710869999378,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:2b6f7c5215521b05810c8f11624f5f79b1668e4b /prefetch:1
      4⤵
      PID:3308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://projectreal.gg/download
    3⤵
    PID:1328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x368,0x7ffa7019c188,0x7ffa7019c194,0x7ffa7019c1a0
      4⤵
      PID:3228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1972,i,17510649482543731039,8028803479937010628,262144 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:2
      4⤵
      PID:6076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,2847317989256525828,6719038852690976969,524288 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:11
      4⤵
      System Time Discovery
      PID:3460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,7885074151638057618,12167792186362178406,524288 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:13
      4⤵
      PID:5164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,9127454967804374551,18418324349955920204,2097152 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
      4⤵
      PID:5596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,2948773014428132548,13936263679982078199,2097152 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,16038354741620008406,3016953143007905811,2097152 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
      4⤵
      PID:6036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,13981529795270252168,13105293137299981365,2097152 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:9
      4⤵
      PID:2816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=de --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,6120957381253021737,5786138576326837716,524288 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:14
      4⤵
      PID:6424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=de --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,9120947944428321244,9068212070159794329,524288 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
      4⤵
      PID:6708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,11299336007086643238,4613363122403637687,524288 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
      4⤵
      PID:6700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,3861887308382626545,18316278956136300832,524288 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
      4⤵
      PID:6820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,3861887308382626545,18316278956136300832,524288 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
      4⤵
      PID:6840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5936,i,10595949304025230745,2892064281362487951,2097152 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
      4⤵
      PID:7004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,14392639236330274378,14155197614274562283,524288 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
      4⤵
      PID:7108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6652,i,5883009571760596088,903374690783463489,2097152 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:1
      4⤵
      PID:6216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6272,i,4726266440301885192,7387219096119543249,2097152 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:1
      4⤵
      PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6912,i,4607150579049751574,3090822282355823639,2097152 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:1
      4⤵
      PID:2876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,9183614441241254963,15203924333159827905,524288 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:14
      4⤵
      PID:3480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3756,i,10146161167537508295,13052791528139220111,2097152 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:1
      4⤵
      PID:7024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3772,i,12846981256338776627,8776121186874530203,2097152 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:1
      4⤵
      PID:3216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6976,i,2283992966633908696,10372175914801028404,2097152 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:1
      4⤵
      PID:6460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6280,i,8773936443099470724,1011950038530554860,2097152 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
      4⤵
      PID:6564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6552,i,14916628041330696759,3295036494627267017,2097152 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
      4⤵
      PID:6908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7496,i,5677085122099269999,11010769319085491733,2097152 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=7480 /prefetch:1
      4⤵
      PID:7020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7728,i,4827158472530200020,8228021348157095799,2097152 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=7784 /prefetch:1
      4⤵
      PID:6364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,7091878434933109930,432336696315298055,524288 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:14
      4⤵
      PID:6244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=de --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,13280780241281051968,13359622362362291564,524288 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:12
      4⤵
      PID:6240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7448,i,114011360581090094,17493683588854872249,2097152 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=7460 /prefetch:1
      4⤵
      PID:5668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7744,i,212443518336706046,879176673503597240,2097152 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1
      4⤵
      PID:3808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6544,i,8875798877716490317,2901899917724161581,2097152 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:1
      4⤵
      PID:6228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8068,i,10781779810930907369,16279438333096178745,2097152 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:1
      4⤵
      PID:1820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8080,i,6339134458778381242,11812612297059135964,2097152 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=8108 /prefetch:1
      4⤵
      PID:7076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7388,i,11707910992190829727,1726777967029515241,2097152 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=8124 /prefetch:1
      4⤵
      PID:6412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,8699971930264671140,2199403205125194632,524288 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=1248 /prefetch:14
      4⤵
      PID:2468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,5387445052646467781,8497311623290933653,524288 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:14
      4⤵
      PID:2492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,18404724446597069934,18356630917862536043,524288 --field-trial-handle=2568,i,7693988475619684149,7772719240557776636,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
      4⤵
      PID:1608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6044,i,596888983301302650,13618910557846589986,2097152 --field-trial-handle=1840,i,16786161685649527133,10364279082344201381,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6428,i,25359623845768630,15579467797928293040,524288 --field-trial-handle=1840,i,16786161685649527133,10364279082344201381,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6832,i,4503089063224029030,11959297638043520458,2097152 --field-trial-handle=1840,i,16786161685649527133,10364279082344201381,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=7156,i,2624070136150454611,14198818647519849266,2097152 --field-trial-handle=1840,i,16786161685649527133,10364279082344201381,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=7260,i,7775223037419295433,11495902953811700281,2097152 --field-trial-handle=1840,i,16786161685649527133,10364279082344201381,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=7380,i,17171298970936897634,18219597881062654026,2097152 --field-trial-handle=1840,i,16786161685649527133,10364279082344201381,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=7240,i,8588433030154598859,10590040051863072078,2097152 --field-trial-handle=1840,i,16786161685649527133,10364279082344201381,262144 --variations-seed-version --mojo-platform-channel-handle=7260 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7436,i,16570904776600607502,696011067655433627,524288 --field-trial-handle=1840,i,16786161685649527133,10364279082344201381,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7440,i,12871337150388322935,8249901607365744462,524288 --field-trial-handle=1840,i,16786161685649527133,10364279082344201381,262144 --variations-seed-version --mojo-platform-channel-handle=7524 /prefetch:14
  2⤵
  PID:6032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5884,i,8300761068795063575,9594352046777741226,2097152 --field-trial-handle=1840,i,16786161685649527133,10364279082344201381,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=7048,i,4828857095218871091,13494591701191619561,2097152 --field-trial-handle=1840,i,16786161685649527133,10364279082344201381,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:9
  2⤵
  PID:1608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7348,i,9722351586830040795,7277717153156220963,524288 --field-trial-handle=1840,i,16786161685649527133,10364279082344201381,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
  2⤵
  PID:3896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5472,i,11363638781525655359,15325475839601321687,524288 --field-trial-handle=1840,i,16786161685649527133,10364279082344201381,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:14
  2⤵
  PID:2736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5484,i,7551174418554766483,8744570095079733646,524288 --field-trial-handle=1840,i,16786161685649527133,10364279082344201381,262144 --variations-seed-version --mojo-platform-channel-handle=7228 /prefetch:14
  2⤵
  PID:5936

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:460

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 af3d344edbb4026de6be3c8b2282f60ff584daa4c427dca609767e429ea3846a
MD5 a945c62f1e9ec6c001e91d464c3dec95
SHA1 161aff9b9a3061ef858d572070e64c38f9a078e8
SHA512 0588177990bfcb80481fca77d6e3475fc893025dcd56d9bb3cb7992ff5561bb924afcc11a498d45fe16f09d55b4e8fee006b3408407e11264f0d9d274dc256fe
SSDEEP 192:QRakL9mv7+vAPRp2O9mHhhb+WNnVa0pjecy8VyIsnAUge:QRakJS66XFQBU01e
TLSH
T18632756EAE20A93B5CCBD61AFA657753D6F1102132D42E84E6FC891C55DB9CC321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 8b9b047af400d6e6ec1c38726ffd23e6df8de0a04ffe31a6172fc25c6f100515
MD5 a2aae2ecaf5fe70c40f2d8b3b6d3188d
SHA1 c03e24203c5f1ee41a55395451435b84c988e119
SHA512 6d05a31325cd74bd26d69b092b4b1428ec874b62d1d51338e00574825698ad6f6dd4ddfaadd4766b884c5c8d5f6542668d608afe549c51329e7f80d0c3a80d57
SSDEEP 192:QRykL9mv7+vAPRp2O9mHhhb+WNnVa0pjecy8VyIsnAUge:QRykJS66XFQBU01e
TLSH
T12932856EAE20A93B5CCBD61AFA617753D6F1102132D02E84E6FCCA2C15DB9CC321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 b574e2dc9c65580db540223fe81c739945e8694eb01d9c6aa0858ba83bad315c
MD5 b4b58a4213cd964a2f95833edc72a3b4
SHA1 717a01d2f1d686fccd2050290cbee2b162e2bee8
SHA512 1b0a1888e8138232a8c61d3cafabd2e814e0bc548af0a16252adf165c834b482b2f3d60b6eaaf70531898f4d3f61868f14cd518082c7235469e3d98627176d7f
SSDEEP 192:e8z4K66Q7KxkXqK4I40pUZNCgVLHrKHfFKslEx0kSXzKD/tQ+ErUkKN9Do8CUXu1:ZzjlQ7KxkXqKf/pUZNCgVLH2HfgslcPE
TLSH
T16A32E827A58D9A7B0FD8E90DCC436F8B6CB5019776680C2492FF9D0403A5BCA114E5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 ec6bb3a13f1ef7ba5b840dab4aaae056bef2ab85e8b55c48d4f39ea8d79d66b5
MD5 4a103c487cfbf2f0891541e8cb03cea0
SHA1 5ac0f65bcbf88d25c22b6097946a8b4f0b3499c3
SHA512 b4a7ac61588605425ce9b583f16931021f2724f2ef731e62ea9d29ffd45dd526aa3f9f94f2990ea3aa8ac74784717a6f824df8845b90c15c708c06632d330c7f
TLSH
T13FA0022451C06E12CD00877070E349526391A83815554B03D4935C89EEAB5C04111565
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a6013.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a6013.TMP
Size 48B
SHA256 b4d689229226803bf0ee2e047ef606eaf391a24fd9dc3197d2e7dceb903cc448
MD5 13ee6b8ba602274d53cb9be9eaecdb74
SHA1 4e3521b4bc7078f9945352b5b85d268cc65a02d2
SHA512 2ba3c5551868767773e6c58685fd9fff5694c741d412afe7f03be9de6dd3759cb88426b9ba3ce907a97abe862ae229db5acc84e7753e8fcf866a936f5b16fd56
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 df2ebcec4ab696a4b45605b270b396204a4792db311fd35258deab547a802097
MD5 39e45648634e96853bc98a3493f1d19d
SHA1 0dfeac02b64239535900f5c198859941ed00fc85
SHA512 f46a4dc0701378aeed06f42b7627f38657aed49378889701f402786a32f74420c9f6ca47a17e788f4618de5ae6773d6543853cab227456a145f966a58a7daade
SSDEEP 3072:YgPRt5LkZWyuukrNpItsuFAZGJKr07cnUl:Ymt5LapPk/PZ/r07ca
TLSH
T11FC3121569AA1E3F98E40247198B1E0BDDF063D5CE4EE6F915FAEF8E1346855320F843
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 07e02b87e90758e1990d77721ce11b9f68aa08fbe64cfe5f5797974ac862852b
MD5 9ce525869dd7c2ff9f6d87d0e82c09e1
SHA1 547e4e179fe551921eb0eb3556ac59e6df5517b7
SHA512 6e34560f786fefbd02315f018434734ccebdecbac7353889e4bae02fd82f3a4d91a0fa1f3a8021c104eef92ccbdec20a51ac99aaae64c04f3005a7f5caf10fa4
SSDEEP 96:4C0d+kaO2Zqk3kfIbEOERDotok5ovDsB6iGyv0mEEsh1mbx4+v4a:4C0PGZqk3fYNDUD+gWmErh1mbx4g
TLSH
T1E6A12C32657ECD739471E5C6B5832F03CE686167A6929F84E9DE0F0C20A70EC1386637
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 925d70f932230ba6e37144749134f114bc7148184cdbe71cbe4ef67e5360bbce
MD5 8b6b66476e59bceb64f31b2cca9cff77
SHA1 3fc67d99e5c905cc22b183a8b0156d7e71b04bad
SHA512 5fc7adc774e620534ce6cc4f485a41797a051986fe741ac5f6b644668b182b4c12b6ace880cd2c3e15c3a545a844f6f764a6d7c947f8886349ccb8b40fc4871b
SSDEEP 3072:9gPRt5LkZWyuukrNpItsuFAZGJKr07cnUl:9mt5LapPk/PZ/r07ca
TLSH
T125C3121569AA1E3F98E40247198B1E0BDDF063D9CE4EE6F915FAEF8E1346855320F843
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5f46172781024fe58b7a7d87a406b81679d17de445e9e90110d33f5747ecc226
MD5 08a5ef0e8eb4590a7f0e6f821698071e
SHA1 1b756aceae48cf2649d310d7ab4883595c2e5bde
SHA512 95c72989df00c3caf1230ca41b6dcbc24f8a592c45202f7b16044b8d574fe569d4db8614652b0d1695d3fe1d795b07ea334de5b4fa9dcbb9d27de40a55592586
TLSH
T155D080757B467A11D58F0476D424E271A737455125D296057170C10E55602D1FFC90A7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ff19e848916f9346514f95113e3d80cd569935b36d785719b19d90f9f740fbd6
MD5 5ab41182d14eb22e7143c63d2e18b77b
SHA1 ca8c747e1a5e38b0f0a08b492fcea6d3a75865c2
SHA512 bbecb67f89826ee2bd219f14bbc8ca87fb260f8a22bd2d52b6ccdb72d47a4b58eeb897a42a6e591bd4e75fe870419162172353d5d3ec7f1fb0fbc7b5dc6adcf1
TLSH
T1AED080757B467B11D58F0472D424E271A737455135D296057170C10E55602D1FFCA0B7
MD5 SHA1 SHA512 TLSH

Submit Download

f_00009f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
Size 375KB
SHA256 431a3251deb71c9c6d19db7ece22c26583f9d8fdba96fdfbb6a5b27d4214e31f
MD5 a3e719f84f525e2c6689b3f6ac73c402
SHA1 e3e93bf2c5aa88529ea3c1e524d2350245e91515
SHA512 0816380a9e625ce2e34fef598104a90a2724096b4d627bbe790c58008eeb3c50c732aa24500caa54fdc46c7f63216533adfb46d119a74aff4ed421b9f381ddbc
SSDEEP 6144:bk02i6NJqyLQCeqg5Vici0bU4rCHA9Q9lkOmEeWxF9Mh+kLNYr7tHLh:bMNJqybeqYvxCHAmXmEevbK3Bd
TLSH
T1A4842368F4BFE4A2AE8449215E5E0D746F487EB21740540AFB7DE2BB2415C493B6F203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a4
Size 73KB
SHA256 5f66ef35f19e1bc8bfad52e2139ad510998e759dbb99d825f7876b8c3cdbdee6
MD5 3cacf51428fa145226351f4db893235d
SHA1 e65afd58ec5d9e1aada6996d71482ddcf9f9827e
SHA512 20df0266b4f3f351d860c174140c8f8f730a97b47f4e1fcf71e28503e03a460ff6df97614e48142bb52ff71e5d4d285da3c6401330287a50d7cdfa551448d23e
SSDEEP 1536:kkCI+9iACUcDsSByHXFtZiqVU3/+hnVVtRq+1z0hpTI+AuXkx+R+jy:W9BtcDRyVt8gnVVtRq+J8TI+XUxlG
TLSH
T1AF7302753BBF4E1A45D6FCC453E344184BF578AE6D65EE9F62A3C90EE831C46C00A292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000aa

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000aa
Size 21KB
SHA256 ef4c5e9635b505582679cc25cde3f8cf4a14f21cbbddc07068c80baab11505cf
MD5 c7322220ea09cf3eebd00b2404278191
SHA1 347394acb330099f24ed133a255bfb1eb40fac61
SHA512 937b50d3a68f2eea4623a93942aa0a887824aae826b5f988be08b977682e5df52686977873adce2a4084e6483131be0e1002dccf3b7a55e9f22f34e92c6d1281
SSDEEP 384:4XBiONZ+7DR0mLZmkgtL6ZI9F+Et4zfcRlsWvLYxRP5Vlsqcj1Whpw6MB42aa+Eu:+BiM+J1LZm8REtA6i2U/hVlFlyyDx
TLSH
T130A2D07FADBEFFC81EC624B4D88DE62CE2215710AA1C550FC386382F9154495A4AFC75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5362fbe3-78ac-41bc-9be6-81e479f52057.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5362fbe3-78ac-41bc-9be6-81e479f52057.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 21809d337159655440563e6bfab25df60354ba56d7cf88f09958e1d11c527f85
MD5 ffd9fee721b8f5ea72a15e2935fed448
SHA1 f416dca1ff5e17de13b2233b18bd21e12bb9c720
SHA512 e89ead0a6f067d08297a37f8cb6c688daab63f163e475bfcb5b43013060116b8fa5bf525f79b43c14792da0c0d4727877a6bfe8b91751e0f95cee67c45721dc0
SSDEEP 192:sxRY/yiGKOMl8wcs/fhs8gCZlVCzoA8pW3Hx2b/g6+WNcbU1r/eqBkAN2I9T6te4:sxRY5Cs/fhs8gEldz/5V/enTLW8
TLSH
T1B872C85BAA3449778DDBD22AF550FB27D2F50566B2D05E48AEFCCA0C00D7AEC2102C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4d1b1bac51adff207f4570ae488f70dc00bef1709bb5beb2827ad94653359e93
MD5 c82bae2fb46f3e88d5534a555dea148d
SHA1 084d615e5e70c118ccc2458872ec8b9760749349
SHA512 f3f93a7977e80c652b1ad164d74880cfc63897823bb7649b4f58e5b5e453d21e621a128a1ae54920e1a7e486984be3025a640373580d175ccf00a7e1139bf893
SSDEEP 192:sxRT/yiGKOMl8wcs/fhsygCZlXzoA8pTc2W/g6+WNcK1r/zm4pI4G+IgVQYJ:sxRT5Cs/fhsygEl+M/5P/H68
TLSH
T1AE62D916AA3459778CDBD219F951BF53D6F91573B2901E48AAFCCA0C00E6AED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 cebbb5f65a0d8eaee40c91a9a45713a2f311134f761b9698e6e01b4710a0a16a
MD5 b87b8d7debce2a23bfaa926ed4d14e37
SHA1 05024fbc36efc2d62fcb3f7fcc5bb7c7277e0e93
SHA512 6c7ce21fa3df803ab9676924fb14de73703dc140a2d10f827c3a9cc4610b69bed4eaa004fb380d3fa0085c804bfca67df15145b7508c2a657a5c5670e16fda57
SSDEEP 768:Nmyma/7pLkdL7YpWgvHf8v8F1+UoAYDCx9Tuqh0VfUC9xbog/OVLN3LxgDroRLd2:Nmyma5kJ7YpWgvHf8vu1ja4N3NgwRLd2
TLSH
T15CE2FD3B680CCB7F4F844AADEC29BD9A5D9801CF5A98CD5447EA840C03C6BEB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f8c65fc8bb9ea5a7ada00f3efbe5f7e7d88a3149d0fd23590d4155ea73976800
MD5 2710588406fa3f689b6eabeb80385d53
SHA1 b6aa449c0f1070018bbec189109f164a91e5d5f5
SHA512 d02f17cec97e05ac5ab28ee4c157254d474dce3bc01e176174dc85a0a8178ab54f720c26e5422c639508d06aa8317d0ee44cfe66ed1f846f54598f8240be1080
SSDEEP 24:KsydqIQIRKGhQ1SSPgtyX6texk9IfK5h61uSETsS3FScS3Ss4SJPSvSvSNaSLS1c:KQjIRKwQULy5CIfK/6YXNI1KWAI3yRz
TLSH
T162916301777F2240387E290CD590966F234234B7345BA93B7BAC11E26E66E815FFCAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 e93bd21d64f47f6712d1c1821b746db669713045bf4599228e16e3dd23334860
MD5 8a336d3c324f566adc384f61c2f05d07
SHA1 c526ab55a59d1552e7f27b45364bba1b8a0e4f9e
SHA512 21bca687fdbbce096140bdcc14768667db6ad6917c89e11290dca7882db32492c5681e901de90db47528dfea82e7f843e6aac1471046bd3e22597f6e641d0f1d
SSDEEP 768:NjaeqD4MlshiLdMmu3/8VfycfkbffCA7NpespIRM0UmkTziwjgzS7wn12bfkfTp:NqcjhIdMh3/CfHfGfzQsZ0UmYbKykV
TLSH
T10713CF72DC244DB38DB7E64A66463797AEA001A3D6D42A5CD8D98F0D05D33DC270BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 e20f2f6e2fd10f97b6f12f9d0ba0608ed9d14edd4ea061aa2a295a9e386e3dd6
MD5 ca02642a9f2ed5b66c8569e30881b65d
SHA1 5d31247a68f4aaad7f97aa08152d16fc11b451ac
SHA512 b67fbe58ae74443af10303905a972e5646a9d1c1379e2c1e7e7f839ae18e480fc73dbd513188007aa4393b6cc4c0947fddcf1612a2cd4276d54465e3f913f628
SSDEEP 768:3jaeqD4MlshiLdMmf3mhfycfkzA7NpespIRM0UmkTziwjgzGNnApXLPQTU:3qcjhIdMo3YfHfJQsZ0UmYVnKXD
TLSH
T10B03CF3698204DB78DB7E68A2643365B6FB00293D2D43EC8DCDE5E0D41876DD630B96B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 a5747874fd9d2889c07c6b54a9a676ed9832959c94d7b67e22ddcddb21a2fd4c
MD5 db215f0b41ebed05ff976f20768529d5
SHA1 4c0366580b6bd75f58c5c05d275e9bc3ebc8e66a
SHA512 a68789efc6e54439dcd9caea55456a8c69ee9bc6a8b57f64caafcf98c6248907a8b46ac91da38e0a81c4b1d6432ab33264a2bd42b9482d9624406ab27217e268
SSDEEP 768:Mj+9w3J8VfycfkbfDA7NpespIRM0UmkTziwjgzS7wn12bfkT:L9w3JCfHfGfmQsZ0UmYbKykT
TLSH
T1C6F2AE319C268D634DFBD68A7646374BAEE00263D6C41A58D8D98F0D45C779C270BE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69808ba0-3ef1-4fce-9b50-2d6f716408d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\69808ba0-3ef1-4fce-9b50-2d6f716408d7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ContentI3.exe

Path C:\Users\Admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
Size 3.8MB
SHA256 ef2734657b11113a433abb7ebac962e2bf6bf685f05c5f672997f01875430168
MD5 bf6eed6cdc17a0130189a33a55ef5209
SHA1 e337f5a0931f69c464f162385f1330b4d27b372f
SHA512 90d23fd84007343e85f9fc003cf826b112fd930216a24d8c1488468443ae2a4b0c3cc2426b91c81a8228e125050e922fce05672e010e65247709fc4a7b856f1d
SSDEEP 98304:QOlxyx1rYP44YaQqtGeIEAGoZXvFYfyCu:QOS7dqtGeIhGQXNYfRu
TLSH
T119166C02F6408039FAD201FAC3B64978EE789F141389A1D383D5B8F96B765D2783675B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 07f2ea06c256a08a922917aade86e5636c0c7900db56e53f5591a63cdc197af8
MD5 1cec1a6e95c9f39f5d013f555eeae97d
SHA1 848e2f158866ea2f0522c21c420995d0d60af492
SHA512 f266075b81a224b7530b5feae742a526d8da5a41d195d61d269d22537c7d802ef22662022e38262a4ec4b832a930e988340b382088f1af1b413bbac2618cf531
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 adb0b805ac104c7bb0af8959f3cf543e7e55a9fb6758b0c825601ffc7a301486
MD5 f551752310f9a126a7a8a23eb4effe85
SHA1 dfa9da5516265bfc8b9326d84c59a9a1a23af046
SHA512 9916bd70db87c56dee8ed1cd2f8d4b798778ac02f3b28a82a843a74b7e6e5110c71fa65b4c6bc82da1ff293ca3561e57f03f11ae8e646d4c4258fe95faecf6c4
TLSH
T145D01213334101B8C8103033090362080404C61B40098600642CE95D6E541E42906541
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 680bb246fe3e633ee260a9030283cc7db4abc27c9f5f8ddc1efedd0a2745c904
MD5 33e4e35b756ee0f18a2ab1da084827cd
SHA1 7791196df9dfcd43fb663c622876edf83c13b9e0
SHA512 09bf1102f5d66c51ccc922d0eb2283fab7093f8bc529d99e94f3f98ca7f108b0ce527ba56f7aa83c83bedc9ad1e8852941a53ab05c6679e07501df4a1edd0f01
SSDEEP 3:LstlNllkll/lcju5u:LsX3lEtc0
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 c7bcb2dd3d7304bfcb7a2b3625b97f649a826279a7e357eda7dc5c6e9e2b5f8e
MD5 93d31a366bad83515e03b9b4f0950a6b
SHA1 4a9e8bbee2c0924434a8f195f80279329bb1434e
SHA512 841b7a561429680f8b55bf25767b8423c9b239500e403ad022a53b637ed169b0368641313699d7e406565283396b80b057fcca787499da2815f343c57be11b53
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 a350f538f3f07c74cb8f31e1b615c0c7993001702391f2e10c8dbae1c38fa7f5
MD5 b7ccadc5cd4bae5d0e355ba20d88323b
SHA1 473d31f4004583f9d58c1a43821ffe36ef69b392
SHA512 0f3ab4bd19972fb08625fa18f31107fd48f835520372e65d1d1548c5c12ffd2cab67cb0f5bffd9adbec6ba3535c840ca487fb85d04ef1d41bfc11c2cacb6a7fb
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView\Default\DawnCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView\Default\DawnCache\index
Size 256KB
SHA256 8318c85eaba3e9b7347a232515a26d681e3e7b72a2111bffbdceb67dde344262
MD5 d84e9793032d6d3ee303b904a19c077a
SHA1 ea00d3bc0c83334b9f706114fc4ba75c0a46c670
SHA512 73419e7742393b107880ba8569461e3a09ac5d0ccc138fc65416999ba15f7aa81ea4f71c81808612b1abaf4f93426a3ba34c332244628eb1754c3320a84d9c96
SSDEEP 3:LstlNllkll/lpUlll:LsX3lEtG
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView\Default\Extension Rules\000003.log
Size 38B
SHA256 1c43a1bda1e458863c46dfae7fb43bfb3e27802169f37320399b1dd799a819ac
MD5 51a2cbb807f5085530dec18e45cb8569
SHA1 7ad88cd3de5844c7fc269c4500228a630016ab5b
SHA512 b643a8fa75eda90c89ab98f79d4d022bb81f1f62f50ed4e5440f487f22d1163671ec3ae73c4742c11830214173ff2935c785018318f4a4cad413ae4eeef985df
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView\Default\Extension Rules\LOG
Size 367B
SHA256 5be9faec4b57af9a920a7c19e0503dd797adfb3c5a49ff3685b2da9238bd7bcb
MD5 a0255984374d85e18ae5c1771b77b029
SHA1 f762f338fd0da89f8723ea9913dee483a1b55f9b
SHA512 6a351b91c18ba9b6cf586c2a7888d7896a60edb1a0323d1cc168307ae80ea868e3bc4344b8b7abb24dcef1e614060fe36a5e1352d501349b7cc23b37e7cafc23
TLSH
T1FBE09216989FC1669855FEF6D6B5475EC312680DB3862B06DEC9CCCAB01360D72C8352
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView\Default\Extension Scripts\LOG
Size 371B
SHA256 717aa67f5adf3e7515796fe24aae0fa2100bdf302e7c1725b5923fd401b7e284
MD5 5309a90661de097f163a3804be2469a5
SHA1 b0325be885e296a982e7e5f42698cec8575da9b9
SHA512 fa59402b50c75a813750abc826cd242e26783e8d7c5570e03feae4974454df1b998d150f5d4f0740fbe9a627bd58a8237f8efc8258fae8d9370decddabed3919
TLSH
T186E0221498AFC2625841EEFB8671931EC352680DB3817B06CEC6CCCAB00770C72C4702
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView\Default\Extension State\000003.log
Size 114B
SHA256 e2610960c3757d1757f206c7b84378efa22d86dcf161a98096a5f0e56e1a367e
MD5 891a884b9fa2bff4519f5f56d2a25d62
SHA1 b54a3c12ee78510cb269fb1d863047dd8f571dea
SHA512 cd50c3ee4dfb9c4ec051b20dd1e148a5015457ee0c1a29fff482e62291b32097b07a069db62951b32f209fd118fd77a46b8e8cc92da3eaae6110735d126a90ee
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView\Default\Extension State\LOG
Size 367B
SHA256 b78270171063ceeaf6be27af6e4c00e226109635d0df4b22bfc4361237835f69
MD5 6b9d76d95a75a9816a8f0891afd24baf
SHA1 6d0dace7f80258a3b900a648d2dfe32d4a07d1ee
SHA512 23ff76b7089d2a250e0c0d53a5e8389434275d2651a1c5edd136ab326362f0d2f1161d2478d8dad2e3e3b0c05a026b53a39f74e43db03d62dddcf9d81efecafd
TLSH
T1DCE09215849FC1629855EEF7CA76535E8752680DB7862B06DEC5CC8AB013A0972C8312
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView\Default\Favicons
Size 20KB
SHA256 2db221a44885c046a4b116717721b688f9a026c4cae3a17cf61ba9bef3ad97f4
MD5 b40e1be3d7543b6678720c3aeaf3dec3
SHA1 7758593d371b07423ba7cb84f99ebe3416624f56
SHA512 fb0664c1c83043f7c41fd0f1cc0714d81ecd71a07041233fb16fefeb25a3e182a77ac8af9910eff81716b1cceee8a7ee84158a564143b0e0d99e00923106cc16
SSDEEP 24:LLiXxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:iBmw6fU1zBmI
TLSH
T1AA92EE075E383407DBA10E7D266B187A8E3FE26C5FA29C94347410618CF9482D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

cd197dc1-676e-463f-8eab-33ed2997857a.tmp

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView\Default\cd197dc1-676e-463f-8eab-33ed2997857a.tmp
Size 5KB
SHA256 389847cad6d3bed4f8ad5633a68646cb62eff0e50d5bd9fb9ad8a646470eb146
MD5 2ab3deefc3887a113518149f58a786b4
SHA1 8e6d8db5a851b4e05d19d01a352521c914634b22
SHA512 d1d3d5d3c6d55adf45e0595303a89350193901f9b0a7da33ad88dbedd9a66a410e49c13deb07508f0063f5e8c5c9a1350deec81483c6b6850440a40b1403e0c5
SSDEEP 96:rd/d7kvg4b9Cksdv616ZZs7/x+6MhmuecmjeNK+gpI8XMFcC7K:rhP//vjsV+FijvLgfK
TLSH
T154C1A6066F28697B4C87E509FA3A7A03D2F9A07276D51D5CE7F8461C08DA9CD631780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView\Local State
Size 3KB
SHA256 098a1a8b878e2c4ab0ea7fc588aaa21d5dab6f35c3bef432350e495af6530734
MD5 0fb1c24f4e4452e028063306114472df
SHA1 15573c95d24341bffe92b0728ee9b17eb5ce80ec
SHA512 5d6a04fc36df8efb917d60481b355d4e20c394278231675c83d135897c57c6443e28f1e441f6a4bc394ab12f584830f1081b1003dc741f464ed6ff141e609d22
TLSH
T1E381A53B6D7499674EB3E505788A3B5267A49077BB863F98DAEC0F0C02C76D92342C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView\Local State
Size 3KB
SHA256 a6fc0e9a426085b9eb4bfbce106c197e7c4897efbaf549bcabc3f0c22a706ca5
MD5 e155c0e35660671bd7742418787e8f1e
SHA1 5cf69391e088c19f1aa6c9ea8b00b06c344bf416
SHA512 a38bfc29dbd6b84a287215122841102fa085f3dd51f4057c4a75e600936b9c9f667b518242aecebea56a0f65cad495c5a242bba17bc1a89b38bd81625214e71f
TLSH
T1D781943B5DB4A82789B3E505798A7F16ABA49073A6867F99D9EC0F0C01C76D91342C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView\Local State
Size 2KB
SHA256 bf171dd38f12e72b9c5e434aeee366394241357e9d16482047bfa72294e76eb1
MD5 b4cffc4e3db4e1682263ef2312acb792
SHA1 75d0b4767de67f6f92c1076d233dbd1a6d20ca94
SHA512 907e41c48447a87cc91bc4ac1eccb11a41112fd72543d8433257b6a315d87958cbc3ac48a2537beb0cc9e887409a9a379ba275fb6aad0c24b3b17a032ac5526a
TLSH
T1AC51B5336D6096738AA3A205798A7F639F3590B5BB422F54AADD0B0C01C799C3303C73
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView\Local State
Size 3KB
SHA256 fd5540ecdc77efa96e3a340cd8bd0a161b98b6bf8963c873ea35e98195d54c3b
MD5 daaa510bec353f47a99b3ea270d03411
SHA1 b082b50b3efe15e02a65c253af237a3a1bffd06c
SHA512 188e85dd98edc8b81109bf1c50c67e994ac5926a416b603b3c0d79fc521c965d07ca63c9b55d978bc455d427ee666ae9f5fc53e8ba5b00667498190185ab5577
TLSH
T14E71963B5D7099774EA3D605788A3B16A7A59076EB853F98D6EC0F0C01C76D82353C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5a0030.TMP

Path C:\Users\Admin\AppData\Local\Temp\RealLottie-{A45D32AC-0D38-4EB2-9A29-0BD90E85D751}\wv2\EBWebView\Local State~RFe5a0030.TMP
Size 1KB
SHA256 cd49d5a98b253efdd9a22abbe2541059d9ba43e13b2acd989e78d5ea92cd946d
MD5 54b2002a49fc2cc2c94a671afe250f3b
SHA1 4d9050bd8b8a49c908d50f85b0fc9a2be87c04c3
SHA512 0e5e093d1ce114a5fb0b38ba4a73d0fb26cb7af78c9600aefb77c57b989fb472f068dc63afe890e58443fa14b31c9e22a7d627edeafee7d97a71cf47f15aa192
TLSH
T1AB315477DEB046739996B1063149BA976E2150BAA3525F44B6DDCB0C02D748CB62BC33
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1328_986997630\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5884_980494563\CRX_INSTALL\_locales\en_GB\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

file.txt

Path C:\Users\Admin\AppData\Local\file.txt
Size 58B
SHA256 73d6c4a097530e256c1d1dd022f60733d2d70bae864e8d7ed6d9e664cc833a99
MD5 8582537ad625df9036d5a82d0c914801
SHA1 0c8c155e76c9ea1fc2b3e72f5ff81f3bd6975714
SHA512 240b54d26f2ba4e2d669175c7fcca6b844499c9da4cf48079c6328855df210c28eaba8ac4fb4ef79e63e78093335b8355c7b2e3621a02de108c91c5c011b93ce
TLSH
T190A0022494C5149D984A9E4836D1585161A000C386AFD359DC305A02001774228E25C5
MD5 SHA1 SHA512 TLSH

Submit Download

RealSetup.exe

Path C:\Users\Admin\Downloads\RealSetup.exe
Size 13.2MB
SHA256 55145e11d01ba8117b065ea99c54362fcf24ba867db0e30664e09719a5286182
MD5 531f52149baa3b3ad63ff7d108c86559
SHA1 4685d48d8adad9fb7e5c81ee72376ccea75fdf31
SHA512 db803489f660a99842ac6d1a000e4985b12a2ebb4754c173c86977aabc2e8c799f5ca8717f24aafff4d53ce8af4e212992122afa9bb94cf04ae02098727eaf4f
SSDEEP 196608:eO9V917WlnSNOL8UTldFrrLKZ8XoDoJ7SRz1f+7:Bbf7WlnSNOIUTlHuZ8XoDoJ7Oz1fi
TLSH
T114E69EA9B6BC00E9D476C1B8C2869223E772B45517B057CF1A649AFA0F63BD01E7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3308-368-0x00007FFA9AF00000-0x00007FFA9AF01000-memory.dmp

Download

memory/3812-320-0x00007FFA9AF00000-0x00007FFA9AF01000-memory.dmp

Download