31db3179bb5ed391aa800783001721a0880151a835fc7b27ba1e490274974d4f

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MarkViewPro.exe
Size 19.5MB
Sample260814-emmtcsvala
SHA256 31db3179bb5ed391aa800783001721a0880151a835fc7b27ba1e490274974d4f
MD5 1c5fb327925d73b785b841b15ee02b67
SHA1 af4a58a1cff0addb712bb4a44237f7596b6c55ca
SHA512 b26bbf015edb74d1af1b1baf9c828daf663d9347cfbfde438264138e895e4679503f3e73801fd3d4d656a9b1af856b3b0daf5a4109340106f311eacbf260790b
SSDEEP 98304:p2Xo3UbQAQOm/XMKJ3SdD4Jo5vWoJoWcAKpfAEBWEr6vx2z4nmmJhpVWjVcFR3Jr:pPvAQOm/7oFW/AqeHpVWacMfJOKO
TLSH
T1A0277B4BF8E12895C5AA8674C1664043BF31B8468B2017CB7B6CF7A57F72BD0127B7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MarkViewPro.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 20 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_637631097\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_295144953\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_295144953\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_637631097\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_295144953\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_295144953\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_295144953\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_1049310780\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_1049310780\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_1049310780\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_637631097\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_295144953\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_295144953\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_295144953\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_295144953\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_1049310780\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_637631097\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_637631097\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_295144953\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_295144953\ranked_dicts	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1512	msedgewebview2.exe
1512	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2704	msedgewebview2.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 2704	4760	MarkViewPro.exe	89
PID 2704 wrote to memory of 6076	2704	msedgewebview2.exe	90
PID 2704 wrote to memory of 3040	2704	msedgewebview2.exe	91
PID 2704 wrote to memory of 3040	2704	msedgewebview2.exe	91
PID 2704 wrote to memory of 3040	2704	msedgewebview2.exe	91
PID 2704 wrote to memory of 3040	2704	msedgewebview2.exe	91
PID 2704 wrote to memory of 1240	2704	msedgewebview2.exe	92
PID 2704 wrote to memory of 1812	2704	msedgewebview2.exe	93
PID 2704 wrote to memory of 1812	2704	msedgewebview2.exe	93
PID 2704 wrote to memory of 1812	2704	msedgewebview2.exe	93
PID 2704 wrote to memory of 5160	2704	msedgewebview2.exe	94
PID 2704 wrote to memory of 5160	2704	msedgewebview2.exe	94
PID 2704 wrote to memory of 5160	2704	msedgewebview2.exe	94
PID 2704 wrote to memory of 5160	2704	msedgewebview2.exe	94
PID 2704 wrote to memory of 5160	2704	msedgewebview2.exe	94
PID 2704 wrote to memory of 5800	2704	msedgewebview2.exe	98
PID 2704 wrote to memory of 5800	2704	msedgewebview2.exe	98
PID 2704 wrote to memory of 5800	2704	msedgewebview2.exe	98
PID 2704 wrote to memory of 236	2704	msedgewebview2.exe	99
PID 2704 wrote to memory of 236	2704	msedgewebview2.exe	99
PID 2704 wrote to memory of 236	2704	msedgewebview2.exe	99
PID 2704 wrote to memory of 1512	2704	msedgewebview2.exe	100
PID 2704 wrote to memory of 3732	2704	msedgewebview2.exe	101
PID 2704 wrote to memory of 3732	2704	msedgewebview2.exe	101
PID 2704 wrote to memory of 3732	2704	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\MarkViewPro.exe
"C:\Users\Admin\AppData\Local\Temp\MarkViewPro.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=MarkViewPro.exe --webview-exe-version=1.3.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\MarkViewPro.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4760.4608.2130313500394824421 /pfhostedapp:f75addf09c4e8163d87cebaf308ba3a707a9baf2
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\MarkViewPro.exe\EBWebView /prefetch:4 /pfhostedapp:f75addf09c4e8163d87cebaf308ba3a707a9baf2 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\MarkViewPro.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffacbe25fd8,0x7ffacbe25fe4,0x7ffacbe25ff0
    3⤵
    PID:6076
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\MarkViewPro.exe\EBWebView" --webview-exe-name=MarkViewPro.exe --webview-exe-version=1.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1844 --field-trial-handle=1848,i,1760182345498517626,10644423295423554866,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:f75addf09c4e8163d87cebaf308ba3a707a9baf2
    3⤵
    PID:3040
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\MarkViewPro.exe\EBWebView" --webview-exe-name=MarkViewPro.exe --webview-exe-version=1.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2112 --field-trial-handle=1848,i,1760182345498517626,10644423295423554866,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:f75addf09c4e8163d87cebaf308ba3a707a9baf2
    3⤵
    PID:1240
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\MarkViewPro.exe\EBWebView" --webview-exe-name=MarkViewPro.exe --webview-exe-version=1.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2216 --field-trial-handle=1848,i,1760182345498517626,10644423295423554866,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:f75addf09c4e8163d87cebaf308ba3a707a9baf2
    3⤵
    PID:1812
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\MarkViewPro.exe\EBWebView" --webview-exe-name=MarkViewPro.exe --webview-exe-version=1.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3552 --field-trial-handle=1848,i,1760182345498517626,10644423295423554866,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:f75addf09c4e8163d87cebaf308ba3a707a9baf2 /prefetch:1
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\MarkViewPro.exe\EBWebView" --webview-exe-name=MarkViewPro.exe --webview-exe-version=1.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4516 --field-trial-handle=1848,i,1760182345498517626,10644423295423554866,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:f75addf09c4e8163d87cebaf308ba3a707a9baf2
    3⤵
    PID:5800
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\MarkViewPro.exe\EBWebView" --webview-exe-name=MarkViewPro.exe --webview-exe-version=1.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4520 --field-trial-handle=1848,i,1760182345498517626,10644423295423554866,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:f75addf09c4e8163d87cebaf308ba3a707a9baf2
    3⤵
    PID:236
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\MarkViewPro.exe\EBWebView" --webview-exe-name=MarkViewPro.exe --webview-exe-version=1.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4628 --field-trial-handle=1848,i,1760182345498517626,10644423295423554866,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:f75addf09c4e8163d87cebaf308ba3a707a9baf2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1512
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\MarkViewPro.exe\EBWebView" --webview-exe-name=MarkViewPro.exe --webview-exe-version=1.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=828 --field-trial-handle=1848,i,1760182345498517626,10644423295423554866,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:f75addf09c4e8163d87cebaf308ba3a707a9baf2
    3⤵
    PID:3732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Roaming\MarkViewPro.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 bb92d3ff914f4489d3abbe24fdb4e09ae8ca59b77d2bf067791c0e80cb9240dd
MD5 0193bb2e5503f5f74f339411398ce4ed
SHA1 33bbef6665755ed22be0d0c792b3e2433fc4078f
SHA512 3dcc429e1fc22df8aa4aa51bd041526a1924328dc5bff0271a6279cbc5f8a7efd33a23f519ad0dcc5f028789321fc3d7330d735e27c950e8ad020cb13e2071f2
TLSH
T169D0245377110534C13031331043750C0C00C30FC447C000543DCF7D3F140541D17441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\MarkViewPro.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 24727fa327305dda71ca117f3744775bbc1df904d4e38d5bbbce97a17f9091a1
MD5 a28e8935725b80d5eb424ed0afa6d159
SHA1 7cd782050964eb3b5a5f29f47a202535a9aa9bae
SHA512 1c6cecad7983ee99f973df6e6a13e2168ab3a9d4e01a2dea26c9089e4948d5b150e53e06d9621d1b90790fa0ab59af2a377d78562ba1aac13e639ad94103fe47
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\MarkViewPro.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

7e4eba4f-863b-4551-acca-3464b96a1d83.tmp

Path C:\Users\Admin\AppData\Roaming\MarkViewPro.exe\EBWebView\Default\7e4eba4f-863b-4551-acca-3464b96a1d83.tmp
Size 6KB
SHA256 63b17543c4cea0e9aa288ac8975d121da830eb078c07d559d8d69edd4f531e22
MD5 42b4b290ecd803d78f1a8308fad9fb2f
SHA1 3c7136f24389801319ea4e43bd756d658e2c0670
SHA512 7b9a3d3b46d8afb0feb6ca589501e7bd23e350af607992b0e397c122f3ac3bdfcfa5bd14eecb092315a7b8cc29a9b423a872f1b5cc4b3764e1baae22a8deab9c
SSDEEP 96:stU/db2dzb9Hkmo5h16Z5Ns7/x+6MhmuecS2W1ejeHK+g1o28XM1C7K:stYBAFoKNsV+F22WQjZ3oG6K
TLSH
T1D2D184015E24B97B8CCBF509BE35BA16E3FA607264D51E58EBF8462C14D66DC2307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\MarkViewPro.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 37ff84e1d8a70d19dc8580cead732352cf29b33ff8a2670fd38b038640b5c089
MD5 99d45b26519dcf8371bf17632fb61f50
SHA1 ff681500ad380ef63964606facf9278ebeadb92b
SHA512 e796b7c950d1a7d91c192ceb9852b10f4ed08bfed21897ee64e1dba35c30731ecf81b93dee5c3041800e3f1fbbd58304fb72f289aef7fffa8fd11532753e2209
TLSH
T15EC09202AB92C014CB16027578D341F2B83089A9825B4D074E91CEB66629388830F358
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59935d.TMP

Path C:\Users\Admin\AppData\Roaming\MarkViewPro.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59935d.TMP
Size 48B
SHA256 e44a03e654277773685e8767ec13daf6885095f5d1e34a66c96072feb935edee
MD5 ead909496887c60466132f21322ef74f
SHA1 f4c9c35ea08a9d35cce4610ce8ab69ae4971eb25
SHA512 c68098305a33e99ea191e6d1df92b19fd7c05725d687f7a3444f03626e9a4a002e9752d1ee4bd8e8cafc457d40cf3955e479a24f1038f5f817ac04bf365f4e0f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\MarkViewPro.exe\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 81b22168ff6ed7c43a24edc308982026bf574b8e363baf72753b59a31cd1d53b
MD5 d7d8cec72931838a8000d4273eabeb4e
SHA1 2ce5820b71adeb570788558f10454d2d87de5874
SHA512 be36b3d2f5ce3f9a73cdd185df09a77f5426374b75ad5078dbf1500ee90437ff86ea19f06557bb136f488aa484aaa8b6cb93a2a1b272943041ab5decbc98c62f
TLSH
T187016FB2C2D4C57D884112E467343913CD2E041952242D67CDE9FBEA5BE2471D71090F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a548a.TMP

Path C:\Users\Admin\AppData\Roaming\MarkViewPro.exe\EBWebView\Default\Network\Network Persistent State~RFe5a548a.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\MarkViewPro.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\MarkViewPro.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 3ff34ada32e00add09aa70cac6f7b7eb9644c6dbb33914df94d65f096a60f8ef
MD5 09a91da3d9b8259bd70efe284b466cdb
SHA1 89def42c520b5f40053bdcefc9b033bef5bb7f06
SHA512 a3d248842f86a1d418bbe9193d10892d34345f20aaf760b7a9e299adc364ccf250194c759dc91a65f8e56e8c399220c8adc96b8adf503dcbb66518c7b5976a2c
SSDEEP 96:stU/db2UGzb9Hkmo5h16Z5Ns7/x+6MhmuecS2W1ejeHK+g1428XM1C7K:stYB6FoKNsV+F22WQjZ34G6K
TLSH
T1CDD183015E24797B8CCBE519BE29BA17E3F9607265D11E58EBF8462C08DB6DC2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\MarkViewPro.exe\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\MarkViewPro.exe\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\MarkViewPro.exe\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\MarkViewPro.exe\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\MarkViewPro.exe\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\MarkViewPro.exe\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\MarkViewPro.exe\EBWebView\Local State
Size 15KB
SHA256 6c60bae3e1c97afcbee6ff3ae80f80797745b7b65c2109f5a25b3a728dc4c319
MD5 31aca888ce9d25984e29feb3625b9403
SHA1 1b0a0987c350960cac766fcca8fa61a8980e2201
SHA512 29e61c8c5a54c9bb477fdcf491c9849af88ec300d0ad2fa4e9561e7d70def49ade957ab4b634a8da0752c8152771f89a8148f623b08fd3a89e3abe9798c703bc
SSDEEP 384:T+aQikB+z/xvxjg/qhEwNBSaNq5ibAVdp6k9zU:y/UxvxjgC+Y3bULFU
TLSH
T11B72AE2765297E23A9F7BA04795D1B8BCBB984B350C16DB84EAD5F0E02C72D81342C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\MarkViewPro.exe\EBWebView\Local State
Size 2KB
SHA256 7b11e16fc0be539eaf042b67b9f001de65d4867f2b9b3dcfc69eafb55607203f
MD5 f7d8ba556354686e7f26c9f640efa959
SHA1 3bcad33b91bbe4de8fa128fd1755c4ada5f96bf3
SHA512 42c193585dcfb6e0a0e4c757cdb617911e41f22b1f8fee877263f381f22ce836a021c1defd5654d5c3bb8c619f11e10c04888cda99269a8e0ed07d41fea9baf0
TLSH
T1E3516373B910AA73C9E65605B99A3F229B369193AA511F60D9DC0B2D01D655C2342C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\MarkViewPro.exe\EBWebView\Local State
Size 3KB
SHA256 19a0a51809d2c1f36cca40563734efcb50b3ab390dcdf3142fd310a7105c4f2e
MD5 62682afe4a2ae34bd79e8c63ea3885ed
SHA1 bcee830b1148c85aaa8dc2dc8087598b15611892
SHA512 218f956898e1fb757640e09518cf7b44d759c1b7b76fcd50bf8ea3d8afe4fb99a43ba1e3f68bff9d975a7294d5d55b06e1e9d1e98ed8ebc65aea6a38965496ec
TLSH
T15B619537A970A9378DE79A01BC863F16A7A69163E5913FA4C9EC0F1D01D72881342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe593dab.TMP

Path C:\Users\Admin\AppData\Roaming\MarkViewPro.exe\EBWebView\Local State~RFe593dab.TMP
Size 1KB
SHA256 6dc6497700aad86f8f2dcbc745f6dd7b473d8e06b2fe23333569e5ee23862cdf
MD5 b76281e4c79a3a3695b05c8aee00c656
SHA1 6c7aa91d014729252f95a12f8782ec5b283b5c04
SHA512 188e21cc452d6228d82c2cb7c96c8517340088ce3aac9c871e77041ab3fc6bf81eb3bb755d6876b8ec55941b51500425285cda89945dc01e48979f0d2bafcf06
TLSH
T1152162B3E9606F33CDD6221275577E676E3291A382108A0099DD8B2E12E619CAB17D37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1512-319-0x000001A249CF0000-0x000001A249CF1000-memory.dmp

Download

memory/1512-312-0x000001A249CF0000-0x000001A249CF1000-memory.dmp

Download

memory/1512-314-0x000001A249CF0000-0x000001A249CF1000-memory.dmp

Download

memory/1512-323-0x000001A249CF0000-0x000001A249CF1000-memory.dmp

Download

memory/1512-321-0x000001A249CF0000-0x000001A249CF1000-memory.dmp

Download

memory/1512-320-0x000001A249CF0000-0x000001A249CF1000-memory.dmp

Download

memory/1512-318-0x000001A249CF0000-0x000001A249CF1000-memory.dmp

Download

memory/1512-322-0x000001A249CF0000-0x000001A249CF1000-memory.dmp

Download

memory/3040-186-0x0000016B609F0000-0x0000016B60B89000-memory.dmp

Download

memory/3040-29-0x00007FFAED770000-0x00007FFAED771000-memory.dmp

Download

memory/5160-102-0x00007FFAED770000-0x00007FFAED771000-memory.dmp

Download

memory/5800-237-0x00007FFAEE3D0000-0x00007FFAEE3D1000-memory.dmp

Download

memory/5800-236-0x00007FFAECC90000-0x00007FFAECC91000-memory.dmp

Download