c6b3efcf1e2991bf2798fcda7d24586f1bbdf695816c8d8a2612c67bfae24b8f

Analysis

user interaction
yes
max time kernel
899s
max time network
512s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 22:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xo.exe
Size 8.9MB
Sample260929-2w85aahb49
SHA256 c6b3efcf1e2991bf2798fcda7d24586f1bbdf695816c8d8a2612c67bfae24b8f
MD5 d5bb8e496e7ee91cfb8c4bcd9077f8fe
SHA1 c3c9fb6f657c4534192fb9de76a5e95815ce7ea3
SHA512 e42187c0747ed52461141d6388fe643619e1313aac3aac5125d77befa09382e2d11f9be5baa42b697b651da008e4196c44629b34c3e3788c425e7cf8a10f0e18
SSDEEP 196608:/ENiXUtv5sO4QVtZ1Xwm3/MAhg6BC+hppdbv8Pvtuq:/K5l4QVt3vrhg64+h3+N
TLSH
T16C961252A287923BE0491B3A0562F27458FB6F507026DD1287F46CEFFF354611E2E6CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery installer spyware

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1320	xo.tmp
4640	Marhab.exe
6632	Marhab.exe

Loads dropped DLL 46 IoCs

pid	Process
4640	Marhab.exe
4640	Marhab.exe
4640	Marhab.exe
4640	Marhab.exe
4640	Marhab.exe
4640	Marhab.exe
4640	Marhab.exe
4640	Marhab.exe
4640	Marhab.exe
4640	Marhab.exe
4640	Marhab.exe
4640	Marhab.exe
4640	Marhab.exe
4640	Marhab.exe
4640	Marhab.exe
4640	Marhab.exe
4640	Marhab.exe
4640	Marhab.exe
4640	Marhab.exe
4640	Marhab.exe
4640	Marhab.exe
4640	Marhab.exe
4640	Marhab.exe
6632	Marhab.exe
6632	Marhab.exe
6632	Marhab.exe
6632	Marhab.exe
6632	Marhab.exe
6632	Marhab.exe
6632	Marhab.exe
6632	Marhab.exe
6632	Marhab.exe
6632	Marhab.exe
6632	Marhab.exe
6632	Marhab.exe
6632	Marhab.exe
6632	Marhab.exe
6632	Marhab.exe
6632	Marhab.exe
6632	Marhab.exe
6632	Marhab.exe
6632	Marhab.exe
6632	Marhab.exe
6632	Marhab.exe
6632	Marhab.exe
6632	Marhab.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.playservices.Base\is-HQ6E0.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.oyunstudyosu.DiscordRPC\is-AP95I.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.oyunstudyosu.DiscordRPC\META-INF\ANE\is-R8UJ7.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\is-10J3B.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\Adobe AIR\Versions\1.0\Resources\is-TP4LE.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\androidx.cardview\is-M00UT.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.facebook.Login\META-INF\ANE\is-9NL2L.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.GoogleIdentity\is-PEAPD.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.playservices.Identity\is-B3FL9.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.oyunstudyosu.DiscordRPC\is-IU5FS.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\androidx.appcompat\META-INF\ANE\default\is-L0LD8.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.Core\is-LP56A.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.square.okhttp\META-INF\ANE\is-LBQLQ.tmp	xo.tmp
File opened for modification	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.Core\META-INF\ANE\Windows-x86\QueryString.NETCore.dll	xo.tmp
File opened for modification	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.oyunstudyosu.DiscordRPC\META-INF\ANE\Windows-x86\DiscordRPCANE.dll	xo.tmp
File created	C:\Program Files (x86)\Marhab\unins000.dat	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\androidx.core\is-UNBSG.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.facebook.Core\META-INF\ANE\is-6L8LI.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.oyunstudyosu.DiscordRPC\META-INF\ANE\Windows-x86\is-490TN.tmp	xo.tmp
File opened for modification	C:\Program Files (x86)\Marhab\FreSharpCore.dll	xo.tmp
File created	C:\Program Files (x86)\Marhab\is-RECB6.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.android.installreferrer\META-INF\ANE\default\is-5QISU.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.playservices.Auth\is-QK91O.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\is-2DDLO.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.oyunstudyosu.DiscordRPC\META-INF\ANE\Windows-x86\is-3G8HJ.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.Core\META-INF\ANE\is-SN36F.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.GoogleIdentity\META-INF\ANE\default\is-L7FAP.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\androidx.core\META-INF\ANE\default\is-AE9G0.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.android.installreferrer\META-INF\ANE\is-84GNQ.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.playservices.Base\is-IDD77.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.playservices.Drive\is-L6D0E.tmp	xo.tmp
File opened for modification	C:\Program Files (x86)\Marhab\DiscordRPCANELib.dll	xo.tmp
File created	C:\Program Files (x86)\Marhab\Adobe AIR\Versions\1.0\Resources\Licenses\pixman\is-8DU5R.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\is-E5A6A.tmp	xo.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1528_1818371195\manifest.json	msedge.exe
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\is-V57D0.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.facebook.Core\META-INF\ANE\default\is-V1Q5E.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.playservices.Identity\is-PFSKH.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.freshplanet.KeyboardSize\is-TICA8.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\is-LMSJG.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\Adobe AIR\Versions\1.0\Resources\is-GHJ5Q.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.Core\is-N0HLV.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.GoogleIdentity\is-6EPA5.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.playservices.Base\META-INF\ANE\default\is-4K5DM.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.freshplanet.KeyboardSize\META-INF\ANE\is-KAMSN.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\androidx.browser\is-SO69G.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\androidx.core\is-4ITD7.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.square.okhttp\is-ITKD6.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.android.installreferrer\is-Q8E7F.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.Core\META-INF\ANE\Windows-x86\is-8J3O3.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.facebook.Login\is-EUH9L.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.playservices.Games\is-59JES.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\Adobe AIR\Versions\1.0\is-7C33N.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\androidx.appcompat\is-H5558.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.Core\META-INF\ANE\Windows-x86\is-2HMBU.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.square.okhttp\META-INF\ANE\default\is-ASF9M.tmp	xo.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1528_1818371195\nav_config.json	msedge.exe
File opened for modification	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.Core\META-INF\ANE\Windows-x86\Core.dll	xo.tmp
File opened for modification	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.Core\META-INF\ANE\Windows-x86\Newtonsoft.Json.dll	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.Core\META-INF\ANE\Windows-x86\is-GA247.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.facebook.Core\is-VEAT7.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.facebook.Login\is-LG943.tmp	xo.tmp
File created	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.playservices.Auth\META-INF\ANE\default\is-UKCEK.tmp	xo.tmp
File opened for modification	C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.Core\META-INF\ANE\Windows-x86\CoreLibrary.dll	xo.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Marhab.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Marhab.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Marhab.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Marhab.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xo.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Marhab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Marhab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xo.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5092	chrome.exe
5304	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/4532-0-0x0000000000BA0000-0x0000000000CB1000-memory.dmp	innosetup
behavioral1/memory/4532-443-0x0000000000BA0000-0x0000000000CB1000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Marhab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Marhab.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Marhab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Marhab.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 16 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_IMG	Marhab.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_IMG\Marhab.exe = "1"	Marhab.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\Marhab.exe = "1"	Marhab.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Marhab.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT	Marhab.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT\Marhab.exe = "1"	Marhab.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_IMG	Marhab.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	Marhab.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Marhab.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT	Marhab.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT\Marhab.exe = "1"	Marhab.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT	Marhab.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	Marhab.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_IMG\Marhab.exe = "1"	Marhab.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT	Marhab.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\Marhab.exe = "1"	Marhab.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\discord-1344120828987576340\shell	Marhab.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\discord-1344120828987576340\shell\open	Marhab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\discord-1344120828987576340\shell\open\command\ = "C:\\Program Files (x86)\\Marhab\\Marhab.exe "	Marhab.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\discord-1344120828987576340\DefaultIcon	Marhab.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{3F0F7C79-C815-41BB-9A7B-275DFAFAE1BF}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\discord-1344120828987576340\ = "URL:Run game 1344120828987576340 protocol"	Marhab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\discord-1344120828987576340\URL Protocol	Marhab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\discord-1344120828987576340\DefaultIcon\ = "C:\\Program Files (x86)\\Marhab\\Marhab.exe"	Marhab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\discord-1344120828987576340\shell\open\command\ = "C:\\Program Files (x86)\\Marhab\\Marhab.exe "	Marhab.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\discord-1344120828987576340	Marhab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\discord-1344120828987576340\ = "URL:Run game 1344120828987576340 protocol"	Marhab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\discord-1344120828987576340\URL Protocol	Marhab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\discord-1344120828987576340\DefaultIcon\ = "C:\\Program Files (x86)\\Marhab\\Marhab.exe"	Marhab.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\discord-1344120828987576340\shell\open\command	Marhab.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1320	xo.tmp
1320	xo.tmp
408	chrome.exe
408	chrome.exe
212	msedge.exe
212	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeDebugPrivilege	4640	Marhab.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeShutdownPrivilege	408	chrome.exe
Token: SeCreatePagefilePrivilege	408	chrome.exe
Token: SeDebugPrivilege	6632	Marhab.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
1320	xo.tmp
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
4640	Marhab.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe
408	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4640	Marhab.exe
4640	Marhab.exe
4640	Marhab.exe
6632	Marhab.exe
6632	Marhab.exe
6632	Marhab.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 1320	4532	xo.exe	86
PID 1320 wrote to memory of 4640	1320	xo.tmp	97
PID 408 wrote to memory of 2648	408	chrome.exe	103
PID 408 wrote to memory of 5092	408	chrome.exe	105
PID 408 wrote to memory of 4136	408	chrome.exe	106
PID 408 wrote to memory of 4136	408	chrome.exe	106
PID 408 wrote to memory of 4664	408	chrome.exe	107
PID 408 wrote to memory of 4664	408	chrome.exe	107
PID 408 wrote to memory of 4312	408	chrome.exe	108
PID 408 wrote to memory of 860	408	chrome.exe	109
PID 408 wrote to memory of 4312	408	chrome.exe	108
PID 408 wrote to memory of 860	408	chrome.exe	109
PID 408 wrote to memory of 1952	408	chrome.exe	110
PID 408 wrote to memory of 1952	408	chrome.exe	110
PID 408 wrote to memory of 4012	408	chrome.exe	111
PID 408 wrote to memory of 4012	408	chrome.exe	111
PID 408 wrote to memory of 5036	408	chrome.exe	112
PID 408 wrote to memory of 4728	408	chrome.exe	113
PID 408 wrote to memory of 4728	408	chrome.exe	113
PID 408 wrote to memory of 212	408	chrome.exe	116
PID 408 wrote to memory of 212	408	chrome.exe	116
PID 408 wrote to memory of 4848	408	chrome.exe	117
PID 408 wrote to memory of 4848	408	chrome.exe	117
PID 408 wrote to memory of 2096	408	chrome.exe	118
PID 408 wrote to memory of 2096	408	chrome.exe	118
PID 408 wrote to memory of 5416	408	chrome.exe	119
PID 408 wrote to memory of 5416	408	chrome.exe	119
PID 408 wrote to memory of 5808	408	chrome.exe	120
PID 408 wrote to memory of 5816	408	chrome.exe	121
PID 408 wrote to memory of 5808	408	chrome.exe	120
PID 408 wrote to memory of 5816	408	chrome.exe	121
PID 408 wrote to memory of 1952	408	chrome.exe	123
PID 408 wrote to memory of 1952	408	chrome.exe	123
PID 4640 wrote to memory of 1528	4640	Marhab.exe	131
PID 1528 wrote to memory of 2732	1528	msedge.exe	132
PID 1528 wrote to memory of 5304	1528	msedge.exe	133
PID 1528 wrote to memory of 5692	1528	msedge.exe	134
PID 1528 wrote to memory of 5692	1528	msedge.exe	134
PID 1528 wrote to memory of 5692	1528	msedge.exe	134
PID 1528 wrote to memory of 5920	1528	msedge.exe	136
PID 1528 wrote to memory of 5920	1528	msedge.exe	136
PID 1528 wrote to memory of 3784	1528	msedge.exe	137
PID 1528 wrote to memory of 5276	1528	msedge.exe	138
PID 1528 wrote to memory of 3784	1528	msedge.exe	137
PID 1528 wrote to memory of 3784	1528	msedge.exe	137
PID 1528 wrote to memory of 5276	1528	msedge.exe	138
PID 1528 wrote to memory of 5276	1528	msedge.exe	138
PID 1528 wrote to memory of 5876	1528	msedge.exe	139
PID 1528 wrote to memory of 6028	1528	msedge.exe	140
PID 1528 wrote to memory of 5876	1528	msedge.exe	139
PID 1528 wrote to memory of 5876	1528	msedge.exe	139
PID 1528 wrote to memory of 6028	1528	msedge.exe	140
PID 1528 wrote to memory of 6028	1528	msedge.exe	140
PID 1528 wrote to memory of 5968	1528	msedge.exe	151
PID 1528 wrote to memory of 5968	1528	msedge.exe	151
PID 1528 wrote to memory of 1884	1528	msedge.exe	143
PID 1528 wrote to memory of 1884	1528	msedge.exe	143
PID 1528 wrote to memory of 5580	1528	msedge.exe	145
PID 1528 wrote to memory of 1308	1528	msedge.exe	146
PID 1528 wrote to memory of 5580	1528	msedge.exe	145
PID 1528 wrote to memory of 1308	1528	msedge.exe	146
PID 1528 wrote to memory of 3776	1528	msedge.exe	148
PID 1528 wrote to memory of 3816	1528	msedge.exe	154
PID 1528 wrote to memory of 3816	1528	msedge.exe	154

C:\Users\Admin\AppData\Local\Temp\xo.exe
"C:\Users\Admin\AppData\Local\Temp\xo.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Users\Admin\AppData\Local\Temp\is-NLQJF.tmp\xo.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-NLQJF.tmp\xo.tmp" /SL5="$A01D4,8281462,1060352,C:\Users\Admin\AppData\Local\Temp\xo.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Program Files (x86)\Marhab\Marhab.exe
    "C:\Program Files (x86)\Marhab\Marhab.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://newmarhab.com/app/login/3026731f301b6725eddfa4fc1f66f26c
      4⤵
      Drops file in Program Files directory
      Checks processor information in registry
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1528
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7fffb8f5c188,0x7fffb8f5c194,0x7fffb8f5c1a0
        5⤵
        
        PID:2732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2008,i,11143732187806300031,15427935236195493063,524288 --field-trial-handle=2328,i,1967706873723309855,11171300673602170841,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:5304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1876,i,15363199220743163610,5964961901640737914,262144 --field-trial-handle=2328,i,1967706873723309855,11171300673602170841,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
        5⤵
        
        PID:5692
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,7148673829225690846,10472055151224431256,524288 --field-trial-handle=2328,i,1967706873723309855,11171300673602170841,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
        5⤵
        
        PID:5920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,15777002200357781854,5021986873754449744,2097152 --field-trial-handle=2328,i,1967706873723309855,11171300673602170841,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
        5⤵
        
        PID:3784
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,4793936384911352256,6211998404924521202,2097152 --field-trial-handle=2328,i,1967706873723309855,11171300673602170841,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
        5⤵
        
        PID:5276
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,8772177480544718483,8617135883067148502,2097152 --field-trial-handle=2328,i,1967706873723309855,11171300673602170841,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:1
        5⤵
        
        PID:5876
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,15305801263255185785,12059339315911514436,2097152 --field-trial-handle=2328,i,1967706873723309855,11171300673602170841,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:2
        5⤵
        
        PID:6028
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,2388699746769459593,14016776457258729912,524288 --field-trial-handle=2328,i,1967706873723309855,11171300673602170841,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
        5⤵
        
        PID:5968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,6597308592373770611,13334457526736211822,524288 --field-trial-handle=2328,i,1967706873723309855,11171300673602170841,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
        5⤵
        
        PID:1884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,1383924696195674742,6831361000430928881,524288 --field-trial-handle=2328,i,1967706873723309855,11171300673602170841,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:8
        5⤵
        
        PID:5580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,16259947827732029659,14200819139803602673,524288 --field-trial-handle=2328,i,1967706873723309855,11171300673602170841,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
        5⤵
        
        PID:1308
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,3709286155559939403,17051929666552568430,524288 --field-trial-handle=2328,i,1967706873723309855,11171300673602170841,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
        5⤵
        
        PID:1152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,3709286155559939403,17051929666552568430,524288 --field-trial-handle=2328,i,1967706873723309855,11171300673602170841,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
        5⤵
        
        PID:3776
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,13096429106913611517,9075866576883726456,524288 --field-trial-handle=2328,i,1967706873723309855,11171300673602170841,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
        5⤵
        
        PID:3816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,11237520678981158037,13187906156995329195,524288 --field-trial-handle=2328,i,1967706873723309855,11171300673602170841,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
        5⤵
        
        PID:5556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,3720502207090495601,11105849880310305937,524288 --field-trial-handle=2328,i,1967706873723309855,11171300673602170841,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
        5⤵
        
        PID:5968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,624671905486611435,993215473174810488,524288 --field-trial-handle=2328,i,1967706873723309855,11171300673602170841,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
        5⤵
        
        PID:1964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,1152251070118093197,1824957423839183708,524288 --field-trial-handle=2328,i,1967706873723309855,11171300673602170841,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
        5⤵
        
        PID:5428
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,15962107164577306462,14520021174635061588,524288 --field-trial-handle=2328,i,1967706873723309855,11171300673602170841,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:8
        5⤵
        
        PID:6068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,15897747209453440562,7925097198398970746,524288 --field-trial-handle=2328,i,1967706873723309855,11171300673602170841,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
        5⤵
        
        PID:5780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,9553008339437884693,15225903724951217719,524288 --field-trial-handle=2328,i,1967706873723309855,11171300673602170841,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:8
        5⤵
        
        PID:3844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,8491176525065866426,9915701881258079372,524288 --field-trial-handle=2328,i,1967706873723309855,11171300673602170841,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
        5⤵
        
        PID:2380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,5500109895874409002,8488823916866963481,524288 --field-trial-handle=2328,i,1967706873723309855,11171300673602170841,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:8
        5⤵
        
        PID:4692
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,7757271746053960775,11447540710928641960,524288 --field-trial-handle=2328,i,1967706873723309855,11171300673602170841,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
        5⤵
        
        PID:628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6660,i,15574759881580586372,17159405617439174109,262144 --field-trial-handle=2328,i,1967706873723309855,11171300673602170841,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,6979690531789503205,15706094818305675146,524288 --field-trial-handle=2328,i,1967706873723309855,11171300673602170841,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
        5⤵
        
        PID:4684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fffb85dc728,0x7fffb85dc734,0x7fffb85dc740
  2⤵
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1944,i,9778220403719133303,2928488601779230956,524288 --field-trial-handle=2064,i,1107135608469713264,14884978338710667733,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,17987506069173817621,5290877975715155538,262144 --field-trial-handle=2064,i,1107135608469713264,14884978338710667733,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,958834116909559252,11479720834635775344,524288 --field-trial-handle=2064,i,1107135608469713264,14884978338710667733,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2512 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,7161056505206489540,12038344861820638105,2097152 --field-trial-handle=2064,i,1107135608469713264,14884978338710667733,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,14424414044554755967,17512135906030524734,2097152 --field-trial-handle=2064,i,1107135608469713264,14884978338710667733,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3220,i,213891314583366109,11273474355026288522,2097152 --field-trial-handle=2064,i,1107135608469713264,14884978338710667733,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4736,i,1453482241844693207,1726870612440903753,524288 --field-trial-handle=2064,i,1107135608469713264,14884978338710667733,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4712 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,5666660507245636368,6888579183880738656,524288 --field-trial-handle=2064,i,1107135608469713264,14884978338710667733,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,1308381798726501143,12775125457110916783,524288 --field-trial-handle=2064,i,1107135608469713264,14884978338710667733,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5780,i,8551286826889916336,7224375328397046568,2097152 --field-trial-handle=2064,i,1107135608469713264,14884978338710667733,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4508,i,17302952261397896385,15029263893454621365,2097152 --field-trial-handle=2064,i,1107135608469713264,14884978338710667733,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3100,i,13755034216088584903,2880626200572684475,524288 --field-trial-handle=2064,i,1107135608469713264,14884978338710667733,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1700 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4512,i,16747013839326240840,17677337229951605466,524288 --field-trial-handle=2064,i,1107135608469713264,14884978338710667733,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3244 /prefetch:8
  2⤵
  PID:5416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4772,i,15599242399019688019,14947379626075629155,2097152 --field-trial-handle=2064,i,1107135608469713264,14884978338710667733,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3496 /prefetch:2
  2⤵
  PID:5808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4588,i,10611627549458849026,10719112493213629744,2097152 --field-trial-handle=2064,i,1107135608469713264,14884978338710667733,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5960,i,18388309725587049950,16627606295015388990,2097152 --field-trial-handle=2064,i,1107135608469713264,14884978338710667733,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1952

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3564

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:3816

C:\Program Files (x86)\Marhab\Marhab.exe
"C:\Program Files (x86)\Marhab\Marhab.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6632

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x520 0x52c
1⤵
PID:900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Adobe AIR.dll

Path C:\Program Files (x86)\Marhab\Adobe AIR\Versions\1.0\Adobe AIR.dll
Size 14.5MB
SHA256 6b4ed2e44bdf9b21d56dc008a02d88386ac858fa307a1d4925deb48da772b47a
MD5 fa9cf339a5de165a91417bb426bf5bf5
SHA1 110f73b481fd62f20124a071ec4fb4cb920ac64d
SHA512 b23a068adb8155648e44fdd0c44d7c99f36c7e4973d087d3da98535c88d971f011e906d3cd0338c302874bff743f36aa9652531e56f0784b51ac935c1b0e3237
SSDEEP 196608:1D8gBb0hGWeqHxrpYEML18pObxUUlddfF5a2iqLUbLmxDs:1D8MCGWd9mf186lddfF5a2iq4m
TLSH
T1E2E6DF62BB41C6B1E89F4976547B6B2F84BED241C73140C7B398649E0B313E29A363D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

application.xml

Path C:\Program Files (x86)\Marhab\META-INF\AIR\application.xml
Size 4KB
SHA256 de643c0a7d3da34a590610202392cfa4e1b752e3e06d5137cda4546664d32d15
MD5 ef2a04da244603afaff9c97094d4f3fe
SHA1 b5c05cab388c14df316d933a2cf124ee62b2ac99
SHA512 5657ed2ad8bcb00dbc4f7631c78b7a28bb9980ad8c1e46994a9523b8c80e09895e918849e133c7999658250b9a0d19fafa07210e6ac59332f6fb2e395c3e3ac3
SSDEEP 48:csXhEFF8BK5GtCJpXD+8cQrXDEjcTpqWXZ+fCf34Cj+nTqCl+NLcL6ZcxY6RMjCv:XXhEn8WGQJxdpqKZajos9YKoEDVt7Ld
TLSH
T153A1690A54CD2FDF02DCC06FFD1F2024C53B7A5E65D2A6C9E6F35450A86DA1946F2E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

library.swf

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\androidx.appcompat\META-INF\ANE\default\library.swf
Size 1KB
SHA256 1242f966c309e051d5fb2335f616c0934e346455cd837eda5bc403b9f9488ead
MD5 b090de30e22d3d0fd8b310c4f1f6b291
SHA1 55ac7604ef66d151cbe6b650306ecd1e09dcba91
SHA512 fef9b334080706902ea38cbd94f98bea631b8209261236f967055140a14720659978ed12c3ca53f5ca55127fc324a2bceff80a3f98dee355fa9ff987303c2e68
TLSH
T14B21A7C6F971B53028A2BE2E4921ED774BA6450845F02FE394D4D6EC6CCE125D34C1B6
MD5 SHA1 SHA512 TLSH

Submit Download

extension.xml

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\androidx.appcompat\META-INF\ANE\extension.xml
Size 1KB
SHA256 a9cffed10968f95aa218abb91d3512a7a76a4d8101dfa13ed0dae8f3e7e4e179
MD5 cb10258bf9c9fa5acda3d821af080e7e
SHA1 d0b8a1a9e6fc23a8dd26e5719d97f1e620b1c044
SHA512 99e13a135d509fbff91cc91921ef4b5b00de10c4eb0dcf895d31df81b305556e74293dd72e83a07efe3cbe8b5e3a17635f08266b778c962f7f67b31c1ef9a1a0
TLSH
T1393104988F9C0C2A12FD802BFF7E618467A70FEC7411B84840DB197399EAA5610E1FB1
MD5 SHA1 SHA512 TLSH

Submit Download

library.swf

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\androidx.browser\META-INF\ANE\default\library.swf
Size 1KB
SHA256 0ae64ea7ddf329ba9669e3b73a81314721ba0fa4ac97fe0474a00e5c5a64aa9f
MD5 7a79db5d61c72e07e0a43851912f4b6e
SHA1 60765b55a5820505436e97ac5cc302e965f628e4
SHA512 c9d2b8e38b06bbe77142ad95cd96217b1c69258ddee75f2309c759c89276e9c9346da54a87e6284ff0afbdb57a09b95896aa01809620b6ae3613d5d0060fd142
TLSH
T19121F9F1EA42AE2C81D9D83605A5CA332F1C6542CC1803AA93940317AA73A3C36C5773
MD5 SHA1 SHA512 TLSH

Submit Download

extension.xml

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\androidx.browser\META-INF\ANE\extension.xml
Size 1KB
SHA256 e284f0dc6e08c6c3194d173d32617c48e551afea4badfdb6bba6dc9232d7b0dd
MD5 190d69a1b38d368e8db38b3acce52817
SHA1 76443fb4674d1e17ea756a6c2c09c6906da4a990
SHA512 f195fc99a23a152a17d28863ba00cef817ab0a8886cb8c01a496f3e161476ec9bc2bbce13d20a6d665f4cf1a3dc6a4feb0b46df60dcad415c8e69ad6cd917e85
TLSH
T1DC3146C04B4E5C260AFE8035EEBE40C4B7376E7878D1B85C41D335926ABF25610E6EB6
MD5 SHA1 SHA512 TLSH

Submit Download

library.swf

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\androidx.cardview\META-INF\ANE\default\library.swf
Size 1KB
SHA256 63385f309e5f6cc19cec66e3c3683d41a32d742d01e6fa799388f24a1a5b16b2
MD5 a9a263b273aaa41351be44f004ea517e
SHA1 c3aefd59c7f0f275bc5910f4f93354bb58704591
SHA512 5cc2f324cd8d0272d6e7719d7e8fa558c8f2d07dd2d171387b4c8ace92c25c25cf26a17fe97c639e019d09a0db429534a52e17eadb2797d1f74c979b8ebc1125
TLSH
T1092196A94353ACD216C0F2484838A5AC0B3D501117D9A80374BA6276DDDADEBBB4A2CD
MD5 SHA1 SHA512 TLSH

Submit Download

extension.xml

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\androidx.cardview\META-INF\ANE\extension.xml
Size 1KB
SHA256 cf7ef301e5bf804b859fff9e4a5b43fe76bad2f86698dc204cb50c61f5f6e5ee
MD5 a856342d12743c11cc91d60258bd0fd5
SHA1 da008f25480f96b1e026c7767938626fe2dafa9d
SHA512 ce67aa3429b1f2eceb676322fd01cfff1937ad2f77f8eaeb790f6163e3d075f2f2c2abe9d487bb5320a5cb01d0838dc7925b599a0b2a122b057da6b1d29c6da6
TLSH
T1553103848B4C4C7602FD8025EA7EF084A7272DB87851B96851D3A1525BBF2B720E2FB5
MD5 SHA1 SHA512 TLSH

Submit Download

library.swf

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\androidx.core\META-INF\ANE\default\library.swf
Size 1KB
SHA256 b2c4108498c3f4f5fa1ed77cb9c636c2f9df23cb5a0ceba3f1dda8721cab7923
MD5 078e502c71e139b950a6b4fa99a7c258
SHA1 7361091eb2165a29c310d7567cae1909af3270b7
SHA512 aa935d8127489c2038dd50484ed7b3c4bdc9b65ae8f31573c998efc6210bdf223009b8fd2343d8f4574f75dcac968047a5ac484e8263802b78bd35f90fa5edff
TLSH
T12A21B683E6E39901ED0FFE8782E55A6889757946022849EC28014D2CD6BB3BE0B1B970
MD5 SHA1 SHA512 TLSH

Submit Download

extension.xml

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\androidx.core\META-INF\ANE\extension.xml
Size 1KB
SHA256 52ad36e8957a793243e6812928fc50e8cc2de4649eea458ac4190d880322851e
MD5 c4be4dc545c5b0f40455fbc444624cec
SHA1 46f64cb89bec3a53b621e23472129c16777f233e
SHA512 bfea74051a514cf12a6702225c427d95b372f5f7928e00b48ed3a02ad3e74fe807ab2aa66d5fd59b4724942394e953e90680939b32ab4bbc2b0452dc7ba44cb8
TLSH
T1283106840F4C4D660BFDA025EA7E50C4673B3D787851B88969E3615269BF25610E2EF1
MD5 SHA1 SHA512 TLSH

Submit Download

library.swf

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\androidx.vectordrawable\META-INF\ANE\default\library.swf
Size 1KB
SHA256 41b6cd8e50d431963642cc7f06b6ad804f64b84da6284b1d96852cbf44735e41
MD5 56c6f2bb309c54c69980b8ad93f906e5
SHA1 84cc1a6d84700357d9681140451f80cddede9a5c
SHA512 d896e7c06108cd08bbc0e5d2e05f535d5d211147100a64cd65a39aad98cb90708e80f7ffe24ca2fd4ebd934c6f93ca6016ee200f6b9cb52c475de3a0cd6e0f35
TLSH
T1B121B9E6A1B775546C3338FD40F0A84F0AA721C78569030F5AB76D16905583DE904398
MD5 SHA1 SHA512 TLSH

Submit Download

extension.xml

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\androidx.vectordrawable\META-INF\ANE\extension.xml
Size 1KB
SHA256 6d4cf7fec317a67cb75fdf7a7984be828745e0f04d932cb3a869833a73c26ced
MD5 8d7edbe9b307ae29054cc1ea2bedd5d0
SHA1 de147b3aebbdda523cc8c1204da02fd557297748
SHA512 ec763f502ec86fe60e75932ca8de646256eaef4947a39c2afdd4ebe369a42ecda8392d58d945d71a4b2c258cd8392158e3f3f608fed516c082264048b1a56d87
TLSH
T1023128C05B4C5C150EFFC025FBB94080D72B1DE9B801789852D396895DEE9955BE1EB3
MD5 SHA1 SHA512 TLSH

Submit Download

library.swf

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.android.installreferrer\META-INF\ANE\default\library.swf
Size 1KB
SHA256 a252c209742b3e80974a45799f566e4fe59b9907f57c8cfaa2c10138938b7e0d
MD5 59cdced9264c0e55291e05812f0bb159
SHA1 693b7f652ef18f3b88e85ecb4ea6788077497cb3
SHA512 6715ae9138a4b571ff1c7505732543b04cf4cabd16d1f495fd8b03a048804264145cc83fa3862241fc6799108285735e340a3554da0260c4e5e62819e60abe92
TLSH
T10031299B1E59B581763F614C2601320ACA2BF24CC93835AF2573D69FC91D031F195836
MD5 SHA1 SHA512 TLSH

Submit Download

extension.xml

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.android.installreferrer\META-INF\ANE\extension.xml
Size 1KB
SHA256 a389e6f0f24d54fdba385ff09e169c17f16a281086077eba03adb5a024713fb1
MD5 74c51bbb178471bbfa7d2b4b553e1367
SHA1 11f0dd95a9d9edcf5997d97c76c4320d2a98ebf5
SHA512 9921380b894ead72aa61d47c5b028c40c270f4f5333b665b782257ce0112a511901b3f932790c5d24dfc309b46c866fe8d6eb7237aab1f5e66f072eb07c06c22
TLSH
T1C231C3CC0B5C0C351AEC4235EBBB4188772A5DA87831BC8D81D751825D6B7592093FE2
MD5 SHA1 SHA512 TLSH

Submit Download

library.swf

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.Bolts\META-INF\ANE\default\library.swf
Size 1KB
SHA256 f07548f63b85aba5e4a63b1848253272d5853231c0198bc90458ac911d422a18
MD5 13582c1bb11d282232b057b825b2c337
SHA1 0c6bafb42e864efc777be23b4bfdfb1a9312cc3b
SHA512 f30f9a559d5591d0f6f2449d6061aba52d252297fb730a01061cde6461281e9d26d7d3dd9669fd52252feef48b059e778ee8ef61384ed104c25970aa275285b9
TLSH
T14821D8F556272359095F0AF337830DED176E1D31E06FA792802B5923888A56D082DD9B
MD5 SHA1 SHA512 TLSH

Submit Download

extension.xml

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.Bolts\META-INF\ANE\extension.xml
Size 1KB
SHA256 b3e573e240dfd7621bc1eea6f97a9efc74a45146202a84e4fc64d2381909b3cf
MD5 9c42c4bbf97b58f503d30abd3df35f04
SHA1 cb70a48adb7c4e2b7df6254de1df36bad181556a
SHA512 d9d68f48e162ea91354daadfe47ec9d26a1e87351d8cbc6c6eca68579c16b304125435c57f022c8b6b19b5bca440afdd705771e00c26e55be3cb2df904cd4c16
TLSH
T12741E3C8079C4D6906ED95B6CFB750D4673B1CAC7CC2B85D81DB52218A7B3A721A2FB0
MD5 SHA1 SHA512 TLSH

Submit Download

Core.dll

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.Core\META-INF\ANE\Windows-x86\Core.dll
Size 102KB
SHA256 e8b15c8846571e52c334c301d68da7a10d5567b4c071a5a9e07df44d979632af
MD5 cca6c51d081653cc0fd5f394170fce58
SHA1 7326a5ac925b325d6eaa97620be919d23ceb54a7
SHA512 b65d9a52b11fa4daab4d40bc654bbde2929f34e2974356d198c6df1f0c85cba64d27a8a29be5d2a336d14422b376c5b2c28b96dcc98a6c3cf3aff3a813662bb1
SSDEEP 1536:D4P6PWOARZax8jLiJpnOPArQdsgwR0hdPPBK089r8w/fzD1:NWOAIEiLnKArmsgwR0hdXBm9oE5
TLSH
T1C4A32B4627A14872C4EED77D7C72D1683232D445AB92E7B3A342C6644FA938F8721BD3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreLibrary.dll

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.Core\META-INF\ANE\Windows-x86\CoreLibrary.dll
Size 19KB
SHA256 c14618c1d06b162c783f096f644e88a300ca7e2660dc5e0c39e40c50c1adb662
MD5 e7f27722d28ef1e1a44e6263c429f28e
SHA1 a6b3259ebc0efdd692da8afa99b2a74c1491b195
SHA512 f7fc40269cd6b2d93a8d6881f7c26c9a6b07ad66e2a060d13c717f990112fecece3766c5f50e194b14441525ac05f3fed423f89b6d9403770025d4a7fe1d0eb5
SSDEEP 384:WqjMSbXujI3KKV8LnuA8Dwm/T/IMSm7Rp7QlsQ4d1eI:bwSjuMKKV80D/9jeI
TLSH
T103923B60E7F98756EDFF0AB9F873464912B1EA559C03EB1D1A9C208B1C97B4443607D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FREInterface.dll

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.Core\META-INF\ANE\Windows-x86\FREInterface.dll
Size 118KB
SHA256 12c7ee86021839616a4653c50dd7e8f3f357431a063d91a4df539df91c629729
MD5 e6b96c0a0f6a9459e98405a3a746a35c
SHA1 d67b6b2e41a6a00fafc2200a3f38ba9fa3b7f642
SHA512 ceb6de0617daaa4af0298d2f694ea19e131da7f66e5feff24a255f2bd234131a32c8f6262f36815693fd372c733f5d62ff4133c33c6105e615e0b662a04fbdf9
SSDEEP 1536:KMcwAtR+pIzI3Er5cXtOV8xZE7BARKChsBWTbHVoWUf9pjDSpXc6L9/B6sVF+N:25IIAErWXPZENARphsBe8e9ws3+N
TLSH
T1C1C31B1E66F10822E8C913B2B422C23D11E5D88567E33B87978393E56C8977EE915FD3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

library.swf

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.Core\META-INF\ANE\Windows-x86\library.swf
Size 1KB
SHA256 1922ae616606c78eea7bab79c48a820e4361f269e77bade5bdf4385b4fae1bb7
MD5 d35d4e12e2df74e0169d7e615319996d
SHA1 76fd1b12bc81adf2cb1b56cc088704fc01a13cf0
SHA512 fcb725a0546accab67cdb4d64304e6acc2bea8adc0bd8b3f038aeec24ac35648e4f222ad4ad4f6b367c87585810b00f0b3fcb7589011d3ac2443cf1fd231511d
TLSH
T14E311D6BFAEB11D7649FDF7308FCC722E970A69EC14D63499074516DCD8096DA8D1010
MD5 SHA1 SHA512 TLSH

Submit Download

extension.xml

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.Core\META-INF\ANE\extension.xml
Size 2KB
SHA256 3716a9fe9018f555eee29259054489554e0553e3219b008571bc49ff4610074a
MD5 21706ac03b52098ad9147573ced0055f
SHA1 1e762d574f6199c4947702dc9a8b95815819219e
SHA512 a0a3f147e1c72565f470453823071b1590f8043046f875affa38e71adc3c2de4c4248b700ef9eca23cdbd49ab91f7daf8670e3a65de57e2dc5908ae3d8384c7a
TLSH
T1FE5115C4079D4D661FEC91369EB760C8732F2C2C7D81B98DD2E30126C76B2E52182EB1
MD5 SHA1 SHA512 TLSH

Submit Download

library.swf

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.GameServices\META-INF\ANE\default\library.swf
Size 18KB
SHA256 643ff85b649aafec6a94800e2d063ea5d02d1355451c0f683b85b45981e178ad
MD5 b7146fc80f507127f01c3e6ed6d91c30
SHA1 3572f0fc88d3ccfddaf74777c9e7117270c04efd
SHA512 91a225d33004ffda39b50aa5cf28d604f5a1b0d3475aaa90a92bcff0035cc1b5093f40e83fbb3bc8a834bba7cd74d6793afbfe58f007e845b0d7e5a885950809
SSDEEP 384:WOvJOEuggWtuvikAMh3dV24cKAF1bsxgBKdzKSH+cj:WON3Rk7h3dV2zfFNUPpu0
TLSH
T10782D091123EA24D67D1F30EE44DB98375852D929E9C7EC6C96FC00FF2A41AA01DE42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extension.xml

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.GameServices\META-INF\ANE\extension.xml
Size 2KB
SHA256 229c1dbc885b0eb3647a72d1843d484ae915f492e3faeb96ae253c2bf0f9fe29
MD5 81da4dd4ff3612c4b3e5019043d25f12
SHA1 8e11d9d49c8d5c6fa1dfe33bf896c8b46da57a3c
SHA512 d55d2189eff4117270c62d64ce278b8a74667440fb9bcfe864daea48d2c08ee812966bb95e273adc66095513f03713ebf55dc004ba9c9ed64e0c98e31eb3611d
TLSH
T1CC5128DC07DF0EB646ED6136AE7310C4622B0DA87C81B85DD6E3422246EBDAA3051FB0
MD5 SHA1 SHA512 TLSH

Submit Download

library.swf

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.GoogleIdentity\META-INF\ANE\default\library.swf
Size 3KB
SHA256 4b7c90339bc6b2cc66d3726805b1c85ee26550c31ce0ba58f82bb3d9640711f2
MD5 b4dc232abb66ef73d7da89c2f5412fe6
SHA1 b5926b56f87dbe9bd8c7bfadc3a4e43c00fad340
SHA512 780acead544be4b78109e74147ee231adff6b9c213fb9362f9008a0295bec89983194c0ad1cdc4f6a0ec2027a69123e2bd0c907db38aa79e673999c4ba61f186
TLSH
T11B615D40636858EACE0BAED1C5BAB4B06CC63154F16EECB3CF9414A6C757594029BA1B
MD5 SHA1 SHA512 TLSH

Submit Download

extension.xml

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.GoogleIdentity\META-INF\ANE\extension.xml
Size 2KB
SHA256 a6933cc172e599ba07e23a6ea79ed5c82d780bcddb9ee4240b263c5184e25b25
MD5 5a1a4f14470512ce554ac65c7f806a57
SHA1 6210ead0f7fe917988e7f749adb464ec5b8b230b
SHA512 40aaf74593280eb112d02f705a2e02f94bbbb0a554c4ab3c67f5336084282537faa4445fa8b963208ff28cdac83bbe580f59d80cadb0bb17202da9939acd5489
TLSH
T14441F7C72BCD5D1707EED179FA7650C4B62F0D28BC81B88992DB4126467B2A611D1AF0
MD5 SHA1 SHA512 TLSH

Submit Download

library.swf

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.facebook.Core\META-INF\ANE\default\library.swf
Size 7KB
SHA256 9536e063b27963399b01f4d6108b80e6805090cea13c9def8e4e9ca7ba1c72aa
MD5 04bf97b9cb8f8158e85ba1ebe04ecc8d
SHA1 9c23fdf9e49a8d97c5bb1efb962c577d53509b7a
SHA512 8f9f21b81713d004152360f73c362594b74b968c5c0f52f6b38f1466491db9695bb171a262fc43ac044f76b37771cccdc6b7d9f619f5c19413199ab1e744102b
SSDEEP 192:hqPcTcyjJOb57xs8Ou7KldMwWhmM0JchS1J7bDP9UGE:I3kQ7x7ZeldMwe30QS/H9rE
TLSH
T129F1A00C1C949B1E2D638A7E29F0960E24D346CC045EDC77F4436FD96E6A31CA67708B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extension.xml

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.facebook.Core\META-INF\ANE\extension.xml
Size 2KB
SHA256 8df4ed85492b5ee5073b6b24fd05e870896c3360ed2a69c7cd21f8e826e09a2d
MD5 320367cba5dcc33c557a3f158a16efd2
SHA1 124ca7219f3db6a8d4e2d8e0087bd9fd95e58b78
SHA512 2bf94c99493228d12c64492c10f7f2de07d4375c8cc184f77a12f024e00063579dc471abc2205c4ac21303ad81ad73c9351845489fb7552cf5751a150c20d2bc
TLSH
T11E5147CD079C4D674FFC9436CE7620C4A73F6C2C7942B99DC1D31229A66B2A52682AF0
MD5 SHA1 SHA512 TLSH

Submit Download

library.swf

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.facebook.Login\META-INF\ANE\default\library.swf
Size 4KB
SHA256 03be4283797048822a9fb2536237da89847ddfb1f0a8908b97eddd71ee8b306b
MD5 464eafb38cb294cf863cf040ff2e2063
SHA1 8f87e827a0419b0e93bb5e72d9d38e67e08a88f6
SHA512 fe27e2d60c8b82f591ddb5af481aae0405ad074ca34d456e43024975624fa56167b3dd7f3e09297b3cdc95e4c40637205523b916489343573335a7f675d73473
SSDEEP 96:S8z4NG66I40Z0V2ZFtUcCA84q3Srl0iPtrSPWEHzduKBarXv+FaNLa/bLUB6KjDA:Vzo6H0ZxVjjlghzLar/gwLaDLUQ8M
TLSH
T184A17E70227548B6406CBAA72CBD56AED4714DBC8B2A087A58F7E81EF2BC540ED909D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extension.xml

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.facebook.Login\META-INF\ANE\extension.xml
Size 2KB
SHA256 3e0bdff2674b74535acc7c0beb22680f3d89307f995d655eca734c4ad6c2af3a
MD5 c177d80285d6d29add89c361cdbc3ac7
SHA1 f3bb9dd3b4d14bbfeede3739b89ebccbcf953138
SHA512 0f7af1d7f92bbb0c65bd38a7db2a180b1f674748a4b909dfc4e850c62e07dfe944d9f9d162ce97bec2be17e7657ff6768fc5df64aaa86e31d3e079fee24b6789
TLSH
T18E515BDD479D4D1746FC9436CEB310C4523F5C6C7942FE0DC2E35125EAAB2AA2292EB1
MD5 SHA1 SHA512 TLSH

Submit Download

library.swf

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.playservices.Auth\META-INF\ANE\default\library.swf
Size 1KB
SHA256 0d8e8a200164b8915ff82d34e0908f6dfd1753c94116fc6f86fee63946cdcaf8
MD5 88d2d775e61ed3daccb817a2251bf81f
SHA1 9c69416cc147014b2f2e3b831e4ecadfb1288699
SHA512 cd742fc7bfab2e77d7359aedea0f5ea8bb4ea152934ecbe95db39bb42fbe5d76d2fa468b1f84700a2ae2647acac27be7ee142be64be00aaed05d80428c1a33bb
TLSH
T15621CA8D68A682B92F538656D9C7F4A021E7A194544227F6910E396D1040E40EEE7DB6
MD5 SHA1 SHA512 TLSH

Submit Download

extension.xml

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.playservices.Auth\META-INF\ANE\extension.xml
Size 1KB
SHA256 6ccdb84cf9809fef7df0322ae3d7a09085827286d4205755bbb095e953f89e76
MD5 634aaf6d17c52bb8f55bc51218c24a77
SHA1 a1f539e663f3d489ccf5c658046bfaa3caf3afa5
SHA512 2b9edf4606d5c26374bc3b831df1a26e2993476d1825641c8523b98faa5ec6c62fc8cf05ea7f3148eb8913da92246e544f8be57e970515b813eae07637fa2870
TLSH
T1303114D406CD4C2D03FC446ACE7B80C8673F0D687985F65CE2E76160A6BF65A16D2AF4
MD5 SHA1 SHA512 TLSH

Submit Download

library.swf

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.playservices.Base\META-INF\ANE\default\library.swf
Size 2KB
SHA256 f75c6149365c3c5b3388a74051d2d5152cb280680c772497a4e1e8943777de1f
MD5 aab28329ecd7fd27ccd242d77c9dcd54
SHA1 71f21fb60b736b8174822f6aa7b5254784af3251
SHA512 d32abcc0dda1d78ac4be55324c3e0345779960c4e515da4d835b7f55fab9bef0c5800a412dec30d22752a7bb8635d0eb762df39515ab1c9efd1613d3cf360371
TLSH
T11B410BDADEDEC320A885BF32E3E326BD7E48C589C4697855310A30199D0C766030ACC2
MD5 SHA1 SHA512 TLSH

Submit Download

extension.xml

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.playservices.Base\META-INF\ANE\extension.xml
Size 1KB
SHA256 9636dd0bb48f4bdc22176f2422a292a8817cc03c26bfba07d5ba4ec3203eaf4c
MD5 b73fb99f4763ed9724ec71d2f575dc77
SHA1 30dd2c50dcbb452ed9f2c97f450cc6df01d2601e
SHA512 4f820a77cad49ad0a2f456777b2a84b3d1ab3485db6031a8b75bc1f42150e213c8fe1f7bccfcf03a04114ddc2a4930c3aa97e12b3cf3aa665b671cf7e8a2f1de
TLSH
T18A3114884BCD4D2903EC5429CE7B50C4673F1D687881B75EA2E3512275BF65A2A93EF0
MD5 SHA1 SHA512 TLSH

Submit Download

library.swf

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.playservices.Drive\META-INF\ANE\default\library.swf
Size 1KB
SHA256 bb0544f0c06356fe022f4a96231659dd1e35a0ee7f35eef9cdf9078f95e405d3
MD5 aec38c23829f552e5341c338845d4cef
SHA1 4c74d759c7bceedf89aa02d08071fabde446acee
SHA512 6353c0782a79547913be70a7b1e8bdf9e6a21f44e21b16f283bde8b7f32b9067b92563ae72023551292ba422fa18e19ea27ead95e4483d25686b4d66b732b37d
TLSH
T1252106A045978E88308FA1B44B0A03992C03D21BB691CB99DF1A350FECDA66A73520E8
MD5 SHA1 SHA512 TLSH

Submit Download

extension.xml

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.playservices.Drive\META-INF\ANE\extension.xml
Size 1KB
SHA256 989db5b0ff5e170d70f1d6163def11e0ba0ae49838f5a5d18bd3ad99013861d8
MD5 cafb6a143944839f73e09b2b136a8563
SHA1 a11665f70d1ddf4ecf5c558d193c7b3187658102
SHA512 04e85e8ad16e503ed456c034c79a5348d3d0753467b27637ab965c15ce70926a35a2ecbd5bac5c889f631354ba8c08958f9e3d9c403e1eaa0ff3baee7aff6cb2
TLSH
T15631F5800ACD4C2903FD442BCEBB8084673F1D6C7482F69CA2E3512275FF66E1D91AB1
MD5 SHA1 SHA512 TLSH

Submit Download

library.swf

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.playservices.Games\META-INF\ANE\default\library.swf
Size 1KB
SHA256 ac595c9a29ec9a69456d998b3c7340bcf98c4749d2824fc46ed2adf3aad538df
MD5 8db95fee1e3dcb9af09b60df62086771
SHA1 6bb5192562942fdf4669e9dd180c107d64e85002
SHA512 64613275e97779e1e66587cdccba5f56df62a002ed8f70ac2344192bece4059c8186b82410709b84b112ca5d999f9c561effd7be95741bc0473a2c2ef58c42c9
TLSH
T17821CA1782A38A184570CD57D9939880501B7B9D29AD1B4DE11C4352B37FC50C3B5DE1
MD5 SHA1 SHA512 TLSH

Submit Download

extension.xml

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.playservices.Games\META-INF\ANE\extension.xml
Size 1KB
SHA256 caf56210810e52dda9003b5467745ff49f278d694568b486238cdfcce6a28128
MD5 7cbd365417eca61bb5a8bfbfa6b5aa2f
SHA1 b46a4c108a4148bba60158d4cfa82fe33f278dcc
SHA512 2f30ff29e1a6af634ddf73a7ca44168deadd60c224a33fd1326abea848ea129488d24e24c0e466f6a8f27bb5b7caf62c122532a43eeb9e2181eb9ef7b3caf9a4
TLSH
T10131E68807CD4C2507FD482ACE7B90C46B3F0D6C3C81BA5DF2E7922165BB65A15A1FB0
MD5 SHA1 SHA512 TLSH

Submit Download

library.swf

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.playservices.Identity\META-INF\ANE\default\library.swf
Size 1KB
SHA256 506f3fc49199ef7ccb522644e9ff96ae8ef84810f4bb30355488a1954a003979
MD5 c9d84414e170f1ebc879a8f67aaadd09
SHA1 fb6f130b9066f3c0f09c724e844accea1dbcf83b
SHA512 a51c34ec765f1b2f5a82ce9edd966602feac0491e9682b2e0b5b3bbe5862b5046452d936dcf8a5cf687404f26ff44584eb58da85a8b886770f47c732df6a5129
TLSH
T1E12193B372EB1F43242A099CCB0495C860A9904B8217EB8A0089524E5FACE7C83A0903
MD5 SHA1 SHA512 TLSH

Submit Download

extension.xml

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.playservices.Identity\META-INF\ANE\extension.xml
Size 1KB
SHA256 f38b93af8c28ccd46c27f49b46df40b930ee8bb1f1ecd1e571eded88709434b0
MD5 ed87ac6007db774e7d752639904dc310
SHA1 9704ee1604414cf2e8be9d58248a6962bbfbfbee
SHA512 0c335ee07c016a648b6e71cd96ae7df7d07b0f9a2c93509ad04a647ca0c8b2ae4fb7901e39dee9393435a6a42bd499c387d211933b905b856de55b9aa201202a
TLSH
T10A312C8106CD0C2503EE6469EE7B40D8EF3F0E683C81B69DA2EB511265AF56915D1AF0
MD5 SHA1 SHA512 TLSH

Submit Download

library.swf

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.square.okhttp\META-INF\ANE\default\library.swf
Size 1KB
SHA256 08c621a224a242294b6ce6331b8a27438400b62c3c9f747cc53b0ed30ad6d9ed
MD5 6287acc967d8a5439bc43fd9a6f2562e
SHA1 f09dee4683c0cd7a273eb4e5e34bda68b407b1f9
SHA512 827ff75faacb64af1ef35bd499cc975015fbba6efa7907d42ca756e3ef584dccb40815bd353586fb12bf880a7cdf8ecfe68e3665a2995f31e09a9d63c46bbd6e
TLSH
T16311B6C5E2870A36C3C9831B87A1AE1882D324AE7038AC40DAF585324B04C1302791DE
MD5 SHA1 SHA512 TLSH

Submit Download

extension.xml

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.distriqt.square.okhttp\META-INF\ANE\extension.xml
Size 1KB
SHA256 dd67dda14a57b63d2194b29d06e00a8c29439fec779f74a41e1666317df570d7
MD5 d5d0779dcacf0dd875d20e6d22a52ab1
SHA1 569df8456a00db2c825a7650bcc1342110e2ac66
SHA512 a874961b2fe65aa3e13a6ec4b448c23b49706c2c4c318c3d7270b7c917aaad7bea7865444824988e16f07974711a3cd38cf8814ffa0eb0feb0967dd06fa8033e
TLSH
T1FA31E6CC164E4D6902FCD0BACB769084E3378F787881B44C91D7D11AA7BFA961092EB0
MD5 SHA1 SHA512 TLSH

Submit Download

library.swf

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.freshplanet.KeyboardSize\META-INF\ANE\default\library.swf
Size 2KB
SHA256 6b3010690a2a7d862b475a864271e730b4a0c47321bb04fc52a0ae1bdb8ba810
MD5 2b770f31bd4147ec809ae31a13568d7c
SHA1 aeaf9911ce7458ba89ae31d9673b0003a763fdb1
SHA512 e3cbc9f6b280709be433ad8eacc75b7640549328246ca8896c85e0e318247bab0af2f06e20472027cea52ec0c3043bdb491aed0f635e38b643dcc4a72da31136
TLSH
T160412A2C7CC7844114E2761CA639D3BFD08F9366E738450A1568B76FCD5A284369B0F4
MD5 SHA1 SHA512 TLSH

Submit Download

extension.xml

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.freshplanet.KeyboardSize\META-INF\ANE\extension.xml
Size 1KB
SHA256 969516277a225e0a4d66d73ed94bcb8ea5fd07c407298d228a55abb8c10e931a
MD5 9a9035ced1daa6bd83ae1aafe1efee58
SHA1 06381b4fbc812de51f1f1f46fb61ac01f54f066a
SHA512 bf24a67a3f19b50f99a85f38dd661c58a45703f03aaaa3b94b0e657c27f270fe1879431f47caa0a0c18a26ccfa0f00ecf48f8209db5731a584a51f9968c3470c
TLSH
T1D63137D043DC4EDA9AD8A5394EB352D427371C7DBC81F88CF2EE14618F6A1A2224767C
MD5 SHA1 SHA512 TLSH

Submit Download

library.swf

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.jetbrains.kotlin\META-INF\ANE\default\library.swf
Size 1KB
SHA256 d69140a1d8c4b1e0c94130a055f07cfb3ed93e1cb1feeb1cb8d22cdfa97779a5
MD5 bc78f1bc02b55f60fc6ed43d9ccc4a20
SHA1 8ec2b72c4c9f3b49d8d00f40244f19d315bb1d9a
SHA512 bfb5c2014ac01444b8ac9fbca3983b6253e1038e0060642037dc91df66fcbdccfbed8e725582382d0e7401aab588d8e1a948081f40638451a967697c9f3a0a53
TLSH
T11921C6C7AAEBE03BDC594B0EE45FA4258A28D407E848898B270D6CE5D2681498F1C30E
MD5 SHA1 SHA512 TLSH

Submit Download

extension.xml

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.jetbrains.kotlin\META-INF\ANE\extension.xml
Size 1KB
SHA256 f169c12c5970cccf704192de1124de82d7186d688c1a0623a2626de99ab2e4a0
MD5 5e679c059b31fd362ac7461319622d6d
SHA1 79c20807cb5b20225631f270290a01000c769892
SHA512 4cde0777aee50e67b180c40b6be6dfdb22f8563b73598e6fc43b93698636a3eb3e5c57cba4938adf2369af6e18ea4a556f0fe75f89c0503dc52f1e73527969cd
TLSH
T10831EFC4064D4D2503FCA0B6CEB660E4A33B0EEA7842B948C5D393117E6F36760A3EB4
MD5 SHA1 SHA512 TLSH

Submit Download

library.swf

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.oyunstudyosu.DiscordRPC\META-INF\ANE\Windows-x86\library.swf
Size 6KB
SHA256 ad228f098f6831104c3e867ebfa23a8754f5af6d3ceabfea01c8081ba4444a0b
MD5 19a3b186ba7b64c011daae2a64f33bad
SHA1 477bf0ec612e95b8335927cd67caaac65f465166
SHA512 d789d6d53462ab07f21022910396a88093871050ab8644bf2e126a88544977a42e637735359cb9f53664039d9ddbc221f422a15ea1ca6e97c3d241077b3d1a46
SSDEEP 192:GBHGDW53Gl9X93nSMdWASwnSj2mgkoqGg6MNdx7Pu:G1GmWXtS0SitcGgjx7Pu
TLSH
T1F9D18E5841BE4FA71C7007F7A27B561881C95AA23702CDCBE8748A379352829B626939
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extension.xml

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.oyunstudyosu.DiscordRPC\META-INF\ANE\extension.xml
Size 903B
SHA256 b686a64538665984e39768741e661208a01ca56aa5cc315a345ad6f88d35a768
MD5 044db4e592ff894f55afb9476eb7f99c
SHA1 aac2138ad1d945a61bd49d4401fcd887fdeaf7a4
SHA512 eb3bd1b2b6c160b18b553e74278c072af88eadf3c9290e7e1ea05f68c520b1b1c942209c3c40ba70859c59ea73c514244d1f45ef444c55be944a6cbe9ac9f71b
TLSH
T18911D6F652F9489212D0A9358FB694D8AF65083B7887E90CB1DC0A199F1A4B25207A66
MD5 SHA1 SHA512 TLSH

Submit Download

library.swf

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.oyunstudyosu.restart\META-INF\ANE\default\library.swf
Size 1006B
SHA256 79856764dffed88d2cc52afce126192b166644432ab8635b60173c3c23ff972d
MD5 7dd7dffae4d6d3a32c3e3ed962442405
SHA1 56bf014bae7a6401bc30129b0cca62136c02805a
SHA512 dc14ab90e6c9bba37d0bf1b95f8200d28e39c9c23473afe5733916cbbfe3d230abb4438a06dfbc6de57a306e04f13db955a02d7d628578fa408d316f9a63c12d
TLSH
T12D11D5E8641135BDE4AD20CEA9EEE85192E6D2CDF00A317B18C1E0FEAA88004E231184
MD5 SHA1 SHA512 TLSH

Submit Download

extension.xml

Path C:\Program Files (x86)\Marhab\META-INF\AIR\extensions\com.oyunstudyosu.restart\META-INF\ANE\extension.xml
Size 1KB
SHA256 29c17ba7a48cf2f1415ac0405ac663eca69c25a4c10f83432bc8577b6573ba53
MD5 4d64911c40238384f17ed66c9954f5b3
SHA1 194c48ec0b868877ce9e85d9ee5073ae137d3fd5
SHA512 5178b2f56d8fc4f9d7dc7023f8126e0e76fcc3fc4c1638e5b0ae5794bd8a416bb3b30eb265b0aeb94fb7cb61031db5becf5378e37c0ead768aaa2823173b3c84
TLSH
T18421DEA532C84C8A0BF2943AAEBA85C4FF220C7F7981B42CF1CD15174F349A55583F21
MD5 SHA1 SHA512 TLSH

Submit Download

license.txt

Path C:\Program Files (x86)\Marhab\META-INF\AIR\license.txt
Size 128B
SHA256 19317e818b58a8541535c9afa5dfa24896ebcfde9cf12b8952ce97d6851a7046
MD5 b9f33de23aeb627ad1923bbbe1eb7a86
SHA1 a028dc4518c912e1aec995674d21b0ee0662bc38
SHA512 cdaa1e8cf7dbb1322da5d863579c27c9daf93473f2db98dd58408e5d6d06945ffea1693f83a390478cf797634c470e7029d24a3e0e0ff76788ec8c83a9dc3775
TLSH
T1EFB09B55599965D756CCC645F477F539110550714C0552441AF49645461116086D8CA7
MD5 SHA1 SHA512 TLSH

Submit Download

Marhab.exe

Path C:\Program Files (x86)\Marhab\Marhab.exe
Size 345KB
SHA256 2d6020db3ed471baf3d8a43a5c142459b1965f7496e95892da528e3d21d9c019
MD5 83cb54c8534df3fcd9e3e875fed6d305
SHA1 06cbf3fbad4768b8eb3ff8a4132c967fcbeab1d8
SHA512 9ca2ee5fac68567d07b99af9bbf218466bd5ca84490c7c47611e1ceaa2b6037591ebb0a98a62dc33a204c42311569af5c1a21c21102bf785e33c8027d4f74292
SSDEEP 6144:coOEbFzmW4vcF57fSL7X/lpOaCqAhWes4yGzEU:9OgTaLwq+Vs4yhU
TLSH
T1CD74C5C18206471BC6922B3C0018F3744EE5BFA0B16ACA5687F57CD7B639AE31E569CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Marhab.swf

Path C:\Program Files (x86)\Marhab\Marhab.swf
Size 1.7MB
SHA256 7ea4c167f699fc4518e2ed2adb819354d40c10815f9300bfe24a95007c36efc0
MD5 6bc9c34843ec12e2a86ee15115a605c5
SHA1 40dbd3c25048a73c122c55e5a24e640a3da08d07
SHA512 363b8572949f4f557e7b19e24f14b3717644cde13ae8622dea5ef2cd6e517fbd184af99381809245428bea36c5bd1718c6a491ea60cfe5a95d363953989932a8
SSDEEP 49152:Njhf6hGZw4fZ0T6ndSXQTfvF7LHWtgbGGQwrvnBi:Jhf6hswJWSAR7Wt5mvnQ
TLSH
T1E88533BD006779DA596B5DF80B885DBB4D847C1FEA11ADFC40B54AD86CEED308D028A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1528_1089656666\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1528_1818371195\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1528_369342049\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 2e8b8febeee3f2d21bc7b2b716248d57ae7f114a11325e8249096901871eba0d
MD5 6837c2e94c2a73822066224797cfcb8c
SHA1 e680e55b1790d1e39f46bc5d4da966f091f1657f
SHA512 b12c2b770d6d751ade0941209c34c1fc2b6ff0ff42982fc88015c1d6d8bc2e75866da0a6c45b4052273ab5fc9a131e2e5bd2b1e1af1ca11a0e59e0043f5929bd
TLSH
T113F0F4B5CD21EC3B28FD5B1820A44746EB90135B2690895F3B3C820D8FB567B868695C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 346KB
SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
MD5 fc31feb6dbd996017ba0751ebf1a2be0
SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
TLSH
T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 ec4af45aa904a7276fb1f8f67539658f0f33021be1b1549ad2661af0f7b7054c
MD5 213514fabdcf8079413b0987fe7bb581
SHA1 67626b950914e40fbdc4a8e9a5b791997e3291a0
SHA512 b74173e6a9fcaa871c0c3c800bf9e5900edeb1335b971dff781fda6e2acfa61714f1b5fc5562ad6bf4e2cc98cf65eb76e7f4077736a82b8cd8c3e33dd9ef6583
TLSH
T181C02B24BE74C400F7BC1831CD22540C2000065C14847383405C40FCFCD3044C980501
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 4d4f2b51c490298b524d1ee70e0feb9a4d785e89df42f13caa66f286c5b50333
MD5 a5a52f0370b2be16abad99abafbaf336
SHA1 f4c837329d050425a8770341e2937215d56af1b6
SHA512 68fb29d3461b5c3c3fbed9a3bed3c26881ebda20a7966caa4214b929e8180cef9e743a50ca64ce71faf4510c7d9804a07895d733e0e8ab78da66a4ecd7bab285
SSDEEP 48:YALlhbhSkqHq2qthUNswXLs5foKslQRsMfsPSos3KsyHC6sUC6zsYqzsLcsTtsYE:DJZKFwWc5z7nQH/vr3zE
TLSH
T193915DF7C3D4867DC81156F49B15AF2BCE2E0918522C3C26C8D8AE5B53E2872D25175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 691B
SHA256 4003766a3e937086150806ee40ce58c84085efa4a53a6e8fe4d94132674c01ce
MD5 15461e4982eb5a9745cba51a98db66db
SHA1 dec3900fe409f41301ef9e642f0c36b8becd530c
SHA512 7bdfb4e4e4b6b8016ecfd925b7fdaf71e62d891356c791225a69c719a506073b20f2db4c384e405f8b4090acbd8511fb9c1bc51c62ff6de93bfcbda04e193096
TLSH
T104017BA7E27DBA3750BD85BB1D047C492ABAA43411816CF4DE5BC22EB0828FB0F12447
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 546a6be1bc7645bf218d2bbafb3fe9631a4f5d97b6891f5c9451bc260b5cdf90
MD5 95b430f90c255f701f943d4ca9888d06
SHA1 f0a2200afb33885ff5dc57d197e4d23328f29a03
SHA512 4bc89aa7e73d44a4f1f43fee8466cd7faef76fedc7e9b6ae60f59f00584bd847abfc1e569a9392afd5c9ebdbefde86e42f798fd65dd5f495031b02dc57cc21e6
SSDEEP 192:yRZcDbg2v71vAPRp2Kf9IHsb+WNn+VabY2Uj27eIhF7VyIsnAUge:yRZcQC56XJ2wEV2S2Rje
TLSH
T17332A329EE20757B5CDBC32AFA61B757D7F5002261942E84EAFC883C14DB9CC221B457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 56beeb241d770b4eb80ce45bd4719b6534f55f8ffc3b2ac6793a1c87e17b155d
MD5 14194c999b4b229098fe26ca178015a4
SHA1 c13fb1f06c45c1de0c4c9f43165eff61f9d0baed
SHA512 93080b8db0757ca5214a979471c72167360f97f738816328cfd6460c965ee520602e1f60d25ab48e35559e4e18911dcf03bf4a401c9c7444b206829d03afd754
SSDEEP 384:c6jY/7KxkXqKf/pUZNCgVLH2HfgslcLXODYj+ErU3UeHGoVt7Sh4r:cqY/7KxkXqKf/pUZNCgVLH2HfgsqTOEq
TLSH
T13E52F927A84C9A3F0FD8C64DDC16AF4FADF501576668092457FB9C18039A7CB214A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 a9d16b1cdb6ac28f419efcda59683b7e65df0b0bf77c92cb6905b9c652c59195
MD5 7c463a6083417bb6ff61a71c889867c4
SHA1 dd2aa96a06d28588bc5495f90d41c13a8dbf472d
SHA512 56d2418baf0481f2d5e477b2c633695ca1980b8fc4059ddb5d99b384ed00d90a337ff1798a879fe24b41d9e92a801c349f75afc35427282a97cdc835c2d57db5
TLSH
T1A3A0021459D09450DD1051B868321A531A4168546C90830384AD1844EC6B1C0C2B2210
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596807.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe596807.TMP
Size 48B
SHA256 f8df020329780816263e575681f28680621546e8e5b9b99dc394255a0e8023d8
MD5 5f7b797db1b3c9dad46b6dec8530179a
SHA1 fe7324d4ed238c4c4ae0f202f40a084fc407c16c
SHA512 d8c7cece14d2be2f1b13f40f9d0f8559abb4641f8dfb7ba3b9cac923da38e7d6ecdba92cf132713a67fe825edebb505a6b3963e8543da523051b421d4eeebc52
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 e767aeeb8846b6e341bfdaa271432fc744fbdad63476530296024348262f9264
MD5 ba30a22237f2caa87cf8420d88dda925
SHA1 81fd7abedf5c341b9d53283880e585a807c5aaea
SHA512 42877b6e2f7f09938dad5c157164501f0187032333890721481c59af0169ac37bdff6d523086a7f304f631b2286640a101eaaf4d55caeb0f8e42ab4ae9d09df0
SSDEEP 3072:dkX+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:dkX+hFD+7t56OD9ZfSApprr
TLSH
T1BFD31232AA91D8BBC9FC6541B157A304DE666CED41DE3A09444A5F8EE09FC4C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 264KB
SHA256 67907353af68ac38333741d6e371f36c700e514fce62c87ce552fa518eea60e8
MD5 037f6e03e4705615e14679fc8ad3f0e6
SHA1 9bd8f29d1905f25f0f7cdfd3255c887731330f82
SHA512 60064b824a9c1beacacdebdaa63247fdd4566254eee725a5c5c88fd789136570d6a270db6267d54efdea4a5ba39f481ff5d7b3665b4ec483bc15d97e44ce13f3
SSDEEP 6144:QLtrfxmSttCd/V6vsRLyjowIe+hFD+7t56OD9ZfSAppri:QLt78StI8UlgowIeyFSXD9ZfS4E
TLSH
T140442333F748CC73987DA240B157E713A9D24CE9029BAE1581C356DAA25B8CC1AF2F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 264KB
SHA256 51dfdc8d467e29ccb734c56e083759ccce71a65ed5d16d92004b830acd159383
MD5 b07de2e5f1fbd040c9ef8b3394c1c3f3
SHA1 26c59b38df079ca4d302b438629d865f0007a1e4
SHA512 17211e56eb4b0a0d98de2bc3b8965f83fd9c4bcb9d9a3eee470090b2fcb139f81717c49bd5135530e0f7d241f31f1876322a689cd899d8c226c3ac4c09e0ac97
SSDEEP 6144:Q1trfxmSttCd/V6vsRLyjowIe+hFD+7t56OD9ZfSAppri:Q1t78StI8UlgowIeyFSXD9ZfS4E
TLSH
T136442333F748CC77987DA240B157E713AAD24CE9029BAE1581C356DAA25B8CC1AF2F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7331d61b72578f10058ae20f1a7351dc99070a754006884c0b775bb57bffd9cc
MD5 df1098b0a62fea8609e624a81ae2865a
SHA1 eb148addd613d8dae155058eacdf967eae295b15
SHA512 0ec5916b4d090394f668a1ee0ca76c2125146f8b8507c9e7dd1bb90a8aed21e61551b85c2a32b975aea241df7bda238c513a58ebe378cd3af3d77e71803ef6d8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18eb5a70b8dc14ee5a30ef2a54b3e14abbda2b2d751a8e8abad286d8e92d8872
MD5 a2b3071ef6468d20d3499dac11b0df41
SHA1 e96a1ba764d6003a0c508557df66dec18df2a1e7
SHA512 144677b38dc2433c6ce2cd569ea8dac3d5f5013e173fcf4e0e6d6d88ad42c12001c58ec8fdf8229ee7476fa921cb946792037c4914570deac4969d9365895b19
TLSH
T113D02BF89BD88520F433383400388283308C660420065221A873114C0C451C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e411e40b2b1e7f1576e6c2cf3027d590d4c5916b7a5e41c1a711f9117d0f1e1
MD5 f86a69ac894860b8a7e2ac52b3c2987b
SHA1 835d87e07bf2af2a2410d66f27145dd25efdaad6
SHA512 6de1915f0367b482a80195c1b703b1007a524ab2a6815670db955de8dd4235e1faa888dde7fcefe1ccbf4dae73b9d41563a6a2f7e5d8d75bf2ff9783b485b777
TLSH
T1ABD02BF8DBD88120F033383400398283308C660420061120A873114C0C441C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e73b391410b47c494ee7953905a0c60fd04c6bc35617583539b46b92968689a8
MD5 c67fbef7f62bf0056c3e3f786716b78a
SHA1 45f832458a5b84f29df5280a7973ebf46d014c4b
SHA512 623599849df6e275e849b53aa15de4c0c6df018ceb72805f4afbfea2a8577410fc6f21085b8473298805a9eec11bfc75b61276472cfcad39c54461995984dd1a
TLSH
T180D0C0F0CEF896F0F031343C01344142308C274122021211B432001C0C900C34265DE8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 583caf103f78744b5bf8caf7fc1b02a4141e13fb951c79c57601d0d40c90507e
MD5 c72eb6c3eb56e430e34984acf07262f0
SHA1 70ec16a5eeceb55464484fc9502f913df8b09d96
SHA512 5ffa1388863156aeae17785cacedbd7fdb1a5cc2372ca5d40b742c9ded70f40b06d2fda1eb9e5a9a447d5895f8263333e92b9c3a68f74b24734d3a1860b748e9
TLSH
T105512DE1D5D44AA3FF989A3382F607B7363655A2A6CF5F5E61ACF4B9480F724500318C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59dda4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59dda4.TMP
Size 3KB
SHA256 5414b48fb887a0c55772323bc491dc03149097ca3a6ec6ddf11d4f866f52ce3c
MD5 ece4e97b423669386b96d241eb64a200
SHA1 abc1bb386265f92e9947c79abd7851f52affa655
SHA512 db8609a7719d25b877ee727fdcb5851923d64f663ceacd52fa83dacf861b2912267fcb80ee5c0e089c8ca0ec78697ceb1c27ffd62fabadb363b4f90921d73297
TLSH
T10B512DE1D5C45AA3FB985A3382F607B7363695A2A6CF5F5E20ACF4B9480F724500319C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f5c2fb58874de00ca645843bac2484999a753bac5efa5e2dbaa3b527ac37db9c
MD5 272046526c561a94427e123761d4ccdf
SHA1 7f1aa41a6a3e46508553ac3e388a768a0dbcfa13
SHA512 6537a7393a086be62a342197a3facecb0668cd8666d3dfd2135fb52c7bac3a307564968610ea5ba4604f5aa93c7413edeff0670fb29abc57e7117836a0db6859
TLSH
T10C81AEF7C3E9866D8D0156F09A19AE1BCE1E0519432D3D2A88E4EF4BD3E3871E11264F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 142ade9ceb972145ef761fad5b226da4b83d1e41caaea318b401c196c5c59554
MD5 e457b45dcff07454c864e52aa7fd3f24
SHA1 3337e2e52cfa3944d648b05cfa70c31f50b3b3e2
SHA512 f559f0556c09c71f24df884ce49de30166f589bd6fe6abc7ca6eba9a611fb66c725969eaccf4516ff434fec8cc097a4b618e8bfef65eb8e0457acb31b8472700
TLSH
T1A981AEF7C3E9866D8D0156F09A19AE1BCE1E0519432D3D2A88E4EF4BD3E3871E11264F
MD5 SHA1 SHA512 TLSH

Submit Download

ce9de34a-6b70-45ad-80d8-cd52bdeef9f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ce9de34a-6b70-45ad-80d8-cd52bdeef9f2.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6795a311ba0e0304db867444f3ee4d58a359a46130026e4e3714ef108228791e
MD5 ad0ca03348f27f4ec342513ad73a8eaf
SHA1 3fdadbb6781f31beffbfc381c3576338595f3579
SHA512 92029b7569275aea9e6fa8805c315638c5ee635cf8b345b4aace9c8076ff49c935c8e8a49a89772ebce152535bb265b418133d2dfe5d1c49ce06c80a7befd0f3
SSDEEP 192:sxZxRysz/fAsEMp1mSEdKIdpNYHW6+WNiVa/YapJP95IgU7LJ:sxZxFz/fAsEQct6HbN/n7UB
TLSH
T1E122C856AE34A97B8CC7E21DBE19BF13D6F5103291D11E4CABFC861C04E66DD220785B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 00a5d9f3bc3014a79208aea760b975846c15e2ecae85a159ac6774538e61f4eb
MD5 292eee5011634d3daa1f4e138375bfde
SHA1 f0ede0c769189768ceb4d6b812c83521988b18c4
SHA512 43c2dd43ac9c2529af15ca85cd6b14ddf2a35b60670b331dc5a2c833390f9173e1d6de39b8863f0443b9f161ad3b731578f4d7f72cbe8696b5f9e524514b381e
SSDEEP 192:sxZ6R6Zz/fAs0NWpVJp1mSlIKIdpXSHW6+WNGeK+ZYepy3e+jIgb87LJ:sxZ6kz/fAs0NWvDc/iHbzZiYB
TLSH
T16042E956BE34A9BB8CD6D21DBB15BF13D2F9103291911E4CA6FC862C04E77DD220785B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 97aee514b509d3004a3cba40152f9b7b2b0f3ef8d41fed7a42b6cd17abfc7315
MD5 ee429aaef5e7f1ce8717947676319ec3
SHA1 b46b59c0628247b21725d672b419afc696b21b5e
SHA512 dcfc2ac46cc0047f0f5fa4d5916924c6feef236f672f9108b882c33f6b8bb527dda2482d74eb49c0953f2ec2872565c7b02929719618fd01b6d2104c270c8a45
SSDEEP 192:sxZ6RhZz/fAs0Ip1mS2fdKIdpNSHW6+WNiK+ZYap395Ig587LJ:sxZ6Rz/fAs0Mc/EHbmZxKB
TLSH
T1D132E852BE38A97B4CC6D21DBA55BF13E6F9103291911E4CAAFCC62C04E77DD220785B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9e0860b7535413f02fb82e4cf34d5c41b43767200e9fd5ac12043154be31ac51
MD5 0817a0d3729576471b934c8985b69221
SHA1 9a6980def0967ba84a826183b9ae16665f0b056b
SHA512 65e1daaac3bbf785f7893b63aeef09cf7aca7ca64bc3e587f2b115afaff146df684ed633ffe7ab58cd5cb7a4cee5c3d189cf9428efb33139fd72bb05d9c434d9
SSDEEP 192:sxZxRhsz/fAs0Ip1mSEdKIdpNYHW6+WNiK+ZYape95Ig587LJ:sxZxUz/fAs0Mct6HbmZqKB
TLSH
T18332E856AE24A97B8CC7E21DBA15BF13E6F9103291911E4CA7FCC62C04E77DD220785B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 04c41c90ed04917fc33d387b2c326edc544c9a689366300bbbd0acfa859a2afb
MD5 fa3f59d822ec0ea0e68679bf8dd3571b
SHA1 e0698655d871fc614149a9e2479f15fcd081d29b
SHA512 f912ab6bc362d8dd7c86c8fd0df12da32d1d48ca7f5b6e8a99ff5a912931a7d48e6357a18a0c728f0cb5f12e087ce45ba11767a827318f8be38d79c509e9f742
SSDEEP 192:sxZxRhsz/fAs0Mp1mSEdKIdpNYHW6+WNippXYapV95Ig5y7LJ:sxZxUz/fAs0Qct6HbyX/cB
TLSH
T1E432E756AE34A97B8CC7D21DBB19BF13D6F9103294911E4CAAFC862C04E77DD220785B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 18975d1f9065d858ee7893f1594a141538629b949f47dc7036dbf3e1f5d840fd
MD5 c66f8909193adba6b6d44e122985faa5
SHA1 94e142920e0e3d9aabb4a44627bd384af3b55721
SHA512 759704bc6691e907fb8592f9022eab1704cb4464e56f19f3a0f82c4b6f7168f16d155521ca5f91fa7a37609197c6fc2e9fca39ee21140526786d1669ac1ced75
SSDEEP 768:71WPctj7pLuLMWKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtMHlLlACy7Jro2:71WPctVEMWKWvKeEeu1jasMHlLiF7i45
TLSH
T1DFE2EB7B680CCB7E4FC01A9DDD1A7F9B6EA8028B9698CD4047FE945C02C67EE51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2f84ab6f9d78ad3c84148d83f9770240cc9c519476efd8c43a07a88b150ce078
MD5 ccd06e5eadfce8cb83b6cfd9b242a8e0
SHA1 f311898e52ed4aebeebdc1b85356afbfd853695e
SHA512 893ad852a2cc31abdf5f44c98cc83bcb8fda05190e697c2100b609df28e005b77e53691908cb821e73aa396a2687157a91629fc5f5f85c08d25bbf06640f9980
SSDEEP 96:KI9KK+wKODKKgIgaN+6AI42CI79462KQT4k20SaTUan4:4pdVx4
TLSH
T17391421570BB171138BD754C82A497AE464231E33658E66BBBFC04728F6BE290DFE4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0820fd76-1148-4c0c-82fb-b415ea55eeb7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0820fd76-1148-4c0c-82fb-b415ea55eeb7.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 de91576366a541bc8d95aa74c11cc1682da6d8d3193d65f5d37b4aae03b6c1d6
MD5 b3fa674bec433c24d4f1f3a72a585adb
SHA1 a02f946ebb35df0c35e6f65fe5dac3ae1390aaff
SHA512 f7b0e8a47f88570b2dd189ee57bac1d1407983fd7944179405eb620b3621d9c8ef2f3bab39d1e1dddbbb8e3540ed219a0dd2d2c4fc6b0a784fc47d73794faaf0
SSDEEP 384:ngiFPZcI2rsN+8TUNTUlIltu5tK1o3QhffpfIGmAl89IX7iGIortN6dsl93PtgOS:7FHaRwgfocf7Co7iArVl93PXstjr
TLSH
T19AF260F188D39DB6D8AE87C3572DAD0259BCC133B1885588B7E4692CEC9B1BFC306855
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ea5ec19671b9cdc5708ff5cef2b371abf5e118a16bbf8333df65fb77c1e24f72
MD5 83ff5c76155d9ac5b06e130967872ea6
SHA1 ae042a459f0af6bf7fdde48aa1dec7278f83032d
SHA512 eafd9ddc5374bc81968b4e490a64d8825f0e6846174b504abf555cc19ecae90f8706f10782b56772dc4b6a9b55670d37ffd36a9cfbfd82cb9f93cca77f1ef2bd
SSDEEP 384:n0ZcIhsNXJu5tK1EmQzIGmAl89IXYi2tgOIwZOyKLvog:yhAzC7CoYi2Xstjr
TLSH
T1DE828D32DD78AC7B5DEBA648F48637135EB85037E6C49F54D6E89B0D00DA398130B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 fcd53d1c0b00cf0070eb28922dff18a63f0ef08c15e20777667d964ebbb4e3bc
MD5 95f8f630ba2cbd6e488636f04863c366
SHA1 e56fdc00581cf128eb8de783a2514827bd07f2f2
SHA512 7b104d9060e41fe5a5dcd8e685d0b5057c8482a255f73d32b74463717b3ef95e9c15c6397bb2cb2bdb72e5cad955679c4bbe627b5e3eabb1c4b00804a2d13369
SSDEEP 384:ngiFhZcI2FsNK8TUNTUlIltu5tK13AQhffpfIGmAl89IXci2tgOIwZOyKLvog:7FpUhwgficf7Coci2Xstjr
TLSH
T198D2A4F198E79976E8AE4787A77D6D429DBCC053B5848A84B7C45D0CCC861BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 ae341990b17f69a5957ec1f9a59e98440da2d1c0e3a88d6c666ef8ef7cf46027
MD5 4e36e92d9b5f50bce043979fac1e4793
SHA1 7403a8301fb70746a1bed5cb97ed1a9f13db19b6
SHA512 0e9cbec35e5d185a2123f382a6128a6ec573cf4081e92211c6799a30e75c051890b4d8179da31035b13f849a1775515e9ec83c68794dd8b3c30e207a729cc685
SSDEEP 384:ngiFPZcI2AsNK8TUNTUlIltu5tK13AQhUfpfIGmAl89IXci2tgOIwZOyKLvog:7FH1hwgfiXf7Coci2Xstjr
TLSH
T1E5D2A4F1D8E79976E8AE4787A77D6E429DBCC053B5848A84B7C45D0CCC861BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 38c0d08dfb35a0806eb4226f18442452504de813a46e8c3969cc5c3f1d53e605
MD5 6ce052c2d74e586e6ffa7d40fce1558f
SHA1 a8606535776366c0e4bbdcd234c8022526dff556
SHA512 cda8f476f3651cd519309e542b766f966048d027b6e770c99d8ae35b4d0f2ff3e75bb2e7cbcf55964adba5e5023286003a03e9de47a0501cb5ddb89053918585
SSDEEP 192:aONq6IE4QmiUyIGTQuIGmApjzor2Ro0eIXXG27HuprqmPU6:aONq6DYEQuIGmAl89IX/H2U6
TLSH
T141121A31ADB8FC6B5EE3B908F48736639DA51037DA859F54E6D85B1C00DB35C270A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ba8dd85d8e6b6acea3e077dd68b1e3425a0c53c6c4199f9a0a2d89c4e38cab58
MD5 36bd3e40346611aa2960cf59e6298288
SHA1 af663bc751c3c1648ed740efc779b2ccd42d6bff
SHA512 2b8916079aa62bff4a070993595b7e340c06e721522aefac607caab9981d3db369d40552eb75cfebbf2765c726af31c739b05997e91520ce6eedda31d2546c3b
SSDEEP 384:nfZcIhsNXJu5tK1EmQzIGmAl89IXYi2tgOIwZOyKLvog:3hAzC7CoYi2Xstjr
TLSH
T120828D32DD78AC7B5DEBA608F58637135EB85037E6C49F14D6E89B0D00CA398130B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 3e1baa671b0308d874f6994f8c0f58cb40f92e4cab65256dd2b9d7855fad16e6
MD5 17004c334fc03d7dc2d6ebca01dce7e4
SHA1 d6ba0a27ecd1dec2797bfa356fc822c8ed93860a
SHA512 f85a8d87110d5226438e8a008e40230353c184db36aa839116d0e535caa816c36fd12c532085eecb8e771c9227e808205b339ead8ed57f10e14c2a41a944b158
SSDEEP 384:ngiFyZcI2AsNp8TUNTUlIltu5tK1EAQhDfYfIGmAl89IXSoi2tgOIwZOyKLvog:7FA1YwgfBff7CoSoi2Xstjr
TLSH
T1D1D2A5F1D8E79936E9AE4787A77D6E429DBCC053B5848A84B7C45D0CCC861BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 db29cf1eb957ae2363f20e1dbb3fa1a474cf3c9e60c2326dbbf41b1d7e61069c
MD5 24cddac986a306cb36261c78368c5aca
SHA1 c50ddec2d999189bc5f651a9718c04fa0ed0e0b0
SHA512 a9cdcf33ae585b26d745a69009c786c1079e65421db31f3ed3d7f81525695ba31b4582420dd072019c615f3e1b01559a5a7a2be52da7913d53fc8f16bd9420c3
SSDEEP 384:n1ZcIesNXtu5tK1EmQzIGmAl89IXYi2tgOIwZOyKLvog:NekzC7CoYi2Xstjr
TLSH
T18D827C32DD78AC7B5DEBA548F48637139EB85037E6C49F54D6E89B0D00CA398130B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5e9c1a8d5e61b00bb341d95a41c0b55620cfee78b4c6aa413177a8d2344a33f1
MD5 e4e8ed62447fce2e1886861c74b3d3a2
SHA1 fb0c307308354c7c6c091bf79edef1f1c5a8fc44
SHA512 6823129e79cbc77f13449c8338d1f6ee6d924a02bc1992220354ec452dd2cbf129e0a48fbec47e305a23c1e5833462ee719dbf1a776b902c9398d8e6d25bc99a
SSDEEP 192:aONQ6IE7QmiUyjGTPuIGmApjzor2Ro0nC7suCqU6:aONQ6DtJPuIGmAl8HsQU6
TLSH
T13D02EA35EC78BC6B9FF3AE48B4872A239EA5113BD6951F44DAE85F1C00DB24C1306927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

f399bd8f-c7be-4fac-a7ce-210df649c452.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f399bd8f-c7be-4fac-a7ce-210df649c452.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d48ec99df0b37de82998d137948885d23d3a4f242b990c87991dfb2670c223b9
MD5 3467e4c822b83389da4ace40961c2cb0
SHA1 51c428c3f79f5ec19f2c400c8d6163bcaeef0165
SHA512 c37335049f0aa0acdf276601a814725fd6ef2e1506b67b77df4c7db8d30353eaf6345225cb379b7682ad81d1a6cfea2185a14234fcdee7e77a5ee96a1ba5e480
TLSH
T14F410359BAEA0108B3B77E4A9BF6686D887FB8772F07D45D10010D4E0A23B40C872B37
MD5 SHA1 SHA512 TLSH

Submit Download

0faa32f7-f2c3-4fb4-9fa6-e0c42d2fc431.tmp

Path C:\Users\Admin\AppData\Local\Temp\0faa32f7-f2c3-4fb4-9fa6-e0c42d2fc431.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1f267cff-0783-40bb-9dd2-791b8890b7a3.tmp

Path C:\Users\Admin\AppData\Local\Temp\1f267cff-0783-40bb-9dd2-791b8890b7a3.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f9e477b0-a549-47f3-9daf-8ff357dffd19.tmp

Path C:\Users\Admin\AppData\Local\Temp\f9e477b0-a549-47f3-9daf-8ff357dffd19.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

xo.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-NLQJF.tmp\xo.tmp
Size 3.4MB
SHA256 6c2c4ad70588f36141a8ce64ed2dd1461a19c4131d5bd2d0fc9d373db159d0cc
MD5 ac176b1c2d4089cd5629f1db334bac08
SHA1 86982c343288a7adbaef313406fb3353f5b33786
SHA512 2c25d14ed0d2043854f8e14f80a0ae20738b495ac02c1d79b545a1ea08757c7d995861b3fd5171ae46c227d2581343bef48517de3cadc0bd1232e7e67d0e10cd
SSDEEP 49152:YdJYVM+9JtzZWnoS2VC23aun8+f5KuG2OY9IG9ivyv2cLx1RQ3333pB46W:KJYVM+LtVt3P/KuG2ONG9iqLRQ3333no
TLSH
T191F57D17F345613FD05A1A392527D261483BBE70762A8C569BFC3D8C9F361842E2B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1528_1540248371\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

49ab29e1-b4e6-4ff3-b3b2-f082c01a3b72.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir408_1253495110\49ab29e1-b4e6-4ff3-b3b2-f082c01a3b72.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir408_1253495110\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

PrivateEncryptedData

Path C:\Users\Admin\AppData\Roaming\marhab\ELS\PrivateEncryptedData
Size 10KB
SHA256 6befdd720462f0ea2045718fe0e29cd2c89a1ab4ced3e8f74e2416f5cff1d5f7
MD5 8638b66e6faa26fdcd7d2af380e9e5b9
SHA1 dd739c9114f3eea57f1791e1a36e65f38cdd81bd
SHA512 ef2753e97df441e5b722703d737300f9785ba9db487848d1ba62fd2914afca8ebe7164e6edd570d924d925a3640eb91ca45c27cf6c351de5704b2711caa365fb
SSDEEP 48:3rysiDEbkfQKZhH6aRSkumm6vx2EVpOTyO6dlA+2gC2NncW:GrtfQKZhaASklx/Cj6dlApKNnc
TLSH
T1B0225C765AABA946D0D44978C07C1C0D28EB5235E1CADA0657F831C9C0C1AD4EA9BAB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PrivateEncryptedData

Path C:\Users\Admin\AppData\Roaming\marhab\ELS\PrivateEncryptedData
Size 10KB
SHA256 10b0873e89208bf46fb2ce8677b047dbddf945a1d5f18463f0c2892d9140866c
MD5 c646c56ae78fe122979770583e80f5e3
SHA1 8905060bbddb1f286813552adcb2c9a274f26fbe
SHA512 778e7b72f8a0fcd12e140d51a80766f44cf756430f3ec7ef4548d4b45deebc87e01fd3ea7b174b101f0dd634bc6aed83f04173720e870dbbdd6bbae45635b6f0
SSDEEP 48:3rysiDEbkfQKZhH6aRSkumm6vx2EL09PW7LEyNep:GrtfQKZhaASklxL09+P8
TLSH
T1C822F8AD2EA65855E31809F4D13D6D3228EB047C99CC9B055FC931CC448A8D4B6685A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PrivateEncryptedDatai

Path C:\Users\Admin\AppData\Roaming\marhab\ELS\PrivateEncryptedDatai
Size 23KB
SHA256 bbb973f22f4f5befe72f978a41419e5edab53951b75d7c8578a08c9c60ff9e2a
MD5 227a1757f901fb1d9151e7163d34aeb7
SHA1 636ca84402ce2c17f0a57ec760ef81b759fdf0d8
SHA512 5de2618863b1a2e8613b1d58cabe17f45a318f1a5e268b94351881afb6fddd39539e8129bc15d284512ab665ebfafcd03672db580d7d8c7e5c67ea67c644af81
SSDEEP 24:7nZ7dxszsE8lEPg/mIa9qHsgDXJ8u9xQ6mWt8KWGFwdpKurr2EZD5szG:78X8EguIa3gDZZ971WlbKWVZD58G
TLSH
T1EDB2085F39996A4DD729A83D29F05454811450798180092A4EA33D7C024F18F2E82E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PrivateEncryptedDatai

Path C:\Users\Admin\AppData\Roaming\marhab\ELS\PrivateEncryptedDatai
Size 23KB
SHA256 7e15bab4128e5aacfa55e42bd82457b60cdcc31d2ab60126b54ab11a77516b79
MD5 420bef806d813feaa53f759819cfe934
SHA1 045c88a6a966a7f72c1dc82014e0ef353c81dbaa
SHA512 0354b9a0cace7b08db83d2373f387654705fa6e0a3335ef55d10164728df722a86b8b8624487d782d6e98fbc70741a8e8f701e594ac427ec6e4333695470e964
SSDEEP 24:v65d3x9NkDOvRb8Rsyl+jlP4k2RcrM0aC+4a5gpMuohBcg8x2vOmNxr/:v6DxRZb8MR46rLj+Vuovcg8ovOmNx
TLSH
T11DB2D8F108E8EDF6EDD9C071B58D325826A04648392E86778F215C8B75CCB56F61C8C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PrivateEncryptedDatai

Path C:\Users\Admin\AppData\Roaming\marhab\ELS\PrivateEncryptedDatai
Size 23KB
SHA256 27283e7ab86d372a2324fd318fc61ff02f5e8e5a939f24f42b88107ed2bfde0c
MD5 119de6c9d7465508a907174f94ecbebb
SHA1 c33e8060f785813b153ea09e76e30ab4df2148d0
SHA512 01ca145d6b5910009d9b342dbdd684931df542bb0d2d0188106246d4cf72608dcc6e65d2617d6f08a7429ace475fbbbdf344251b0b7d6d2a9e0ed2c88450be12
SSDEEP 24:HiLTVgt84u/9mMAQfsDHTEDSWcFRcfZv4PYL8rzXYr0:HiLyt84Q9mMpfMzEDLckfZwg8rzXYr
TLSH
T18CB22BE2A2E63020D58948358E77E144347DCC0FAC394E1C72AC0660E3CB289744BB2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PrivateEncryptedDatak

Path C:\Users\Admin\AppData\Roaming\marhab\ELS\PrivateEncryptedDatak
Size 264B
SHA256 8f698f65aae70a3f428d794ea83eec3593a2742eaabce0228ebb912975ccf9ba
MD5 4cf292689f239dce853a3afad8f06a75
SHA1 d80f7f3944a36437d71b546eaef5b7fcea39ca59
SHA512 1174b57af44d3f4b3a667aa96a9b0aee6bb401a93bf30d5609b2243378583567821d6b9557a2cde927b8299c8221007fbe9f0bb6518b32c14ec57ff253b776cd
TLSH
T124D095447B606016FD574EF3D9D754581E88740B64974343754C40C72461840DC30DF3
MD5 SHA1 SHA512 TLSH

Submit Download

PrivateEncryptedDatav

Path C:\Users\Admin\AppData\Roaming\marhab\ELS\PrivateEncryptedDatav
Size 12B
SHA256 977392eb042db621b3515b45cf90698f033a9a892264625a04c5d142e64e2013
MD5 e697f855890f0540b589e20fe3ef7a43
SHA1 55ec8b21f76f132ac1a69fe6d0e09aedb7909ed9
SHA512 6b303f97fe5f5702117dd2d1fb9818ea9d5c4bfc95605ae48c5567202741f5b41807609a84a8fb69e5c4d617dce0e617908732b7a0937afddfac24313b15b74a
MD5 SHA1 SHA512

Submit Download

memory/1320-361-0x0000000000AB0000-0x0000000000E20000-memory.dmp

Download

memory/1320-5-0x0000000003440000-0x0000000003441000-memory.dmp

Download

memory/4532-443-0x0000000000BA0000-0x0000000000CB1000-memory.dmp

Download

memory/4532-0-0x0000000000BA0000-0x0000000000CB1000-memory.dmp

Download

memory/4640-1323-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1355-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1674-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1675-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1673-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1672-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1671-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1669-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1670-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1334-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1342-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1345-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1348-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1343-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1344-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1346-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1347-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1349-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1351-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1353-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1352-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1350-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-2682-0x000000000DE50000-0x000000000DE68000-memory.dmp

Download

memory/4640-2685-0x000000000E200000-0x000000000E226000-memory.dmp

Download

memory/4640-2680-0x000000000DDC0000-0x000000000DDCE000-memory.dmp

Download

memory/4640-2679-0x000000000D110000-0x000000000D11A000-memory.dmp

Download

memory/4640-2678-0x000000006DDD0000-0x000000006DDE0000-memory.dmp

Download

memory/4640-2677-0x000000000A9E0000-0x000000000A9F0000-memory.dmp

Download

memory/4640-2676-0x000000000A9F0000-0x000000000AA00000-memory.dmp

Download

memory/4640-1335-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1333-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1254-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1289-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1291-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1296-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1265-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1316-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1266-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1319-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1271-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1287-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1288-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1290-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1292-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1293-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1295-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1297-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1298-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1300-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1301-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1302-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1303-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1314-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1315-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1317-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1318-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1320-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1321-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1322-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1325-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1329-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1326-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1328-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1327-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1324-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1304-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1299-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-1255-0x0000000003E00000-0x0000000004000000-memory.dmp

Download

memory/4640-802-0x000000000ACF0000-0x000000000AD11000-memory.dmp

Download

memory/4640-798-0x000000000AB30000-0x000000000AB3C000-memory.dmp

Download

memory/4640-793-0x000000000A6C0000-0x000000000A6DD000-memory.dmp

Download

memory/4640-794-0x0000000073E80000-0x0000000073E9D000-memory.dmp

Download

memory/6632-6441-0x0000000071160000-0x000000007117D000-memory.dmp

Download

memory/6632-6442-0x000000000C540000-0x000000000C561000-memory.dmp

Download

memory/6632-6440-0x0000000009ED0000-0x0000000009EED000-memory.dmp

Download

memory/6632-7434-0x000000006DDB0000-0x000000006DDC0000-memory.dmp

Download

memory/6632-7439-0x0000000011920000-0x0000000011946000-memory.dmp

Download

memory/6632-7433-0x000000000D3E0000-0x000000000D3F0000-memory.dmp

Download

memory/6632-7432-0x000000000D3F0000-0x000000000D400000-memory.dmp

Download