Analysis

  • user interaction
    yes
  • max time kernel
    266s
  • max time network
    259s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-en
  • resource tags

    arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    29/09/2026, 14:50

General

  • Target
    https://cdn.discordapp.com/attachments/1549967333865554031/1554256902756765817/Mark58-windows_1.zip?ex=6abce2ca&is=6abb914a&hm=cbc41bab1978d6c2d92e6b1f5b4291c0f02136da2483aca5cfbf0f068d4632c0&
  • Sample260929-r7wcfstybt

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 56 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Detects Pyinstaller 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 5 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1549967333865554031/1554256902756765817/Mark58-windows_1.zip?ex=6abce2ca&is=6abb914a&hm=cbc41bab1978d6c2d92e6b1f5b4291c0f02136da2483aca5cfbf0f068d4632c0&
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1732
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1a86c728,0x7fff1a86c734,0x7fff1a86c740
      2⤵
        PID:3012
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,10113444526255493341,2582081622551394087,262144 --field-trial-handle=2008,i,3135317973912784070,14782310144571519357,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2000 /prefetch:2
        2⤵
          PID:1616
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2152,i,11318818532788214207,16054875419921507031,524288 --field-trial-handle=2008,i,3135317973912784070,14782310144571519357,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2160 /prefetch:11
          2⤵
          • System Time Discovery
          PID:4300
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,12692459605275723854,10329753291508071577,524288 --field-trial-handle=2008,i,3135317973912784070,14782310144571519357,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2384 /prefetch:13
          2⤵
            PID:4852
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3044,i,3770355100551156304,11577881551217163260,2097152 --field-trial-handle=2008,i,3135317973912784070,14782310144571519357,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3084 /prefetch:1
            2⤵
              PID:3964
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3048,i,16973447878523515154,16663909351644313499,2097152 --field-trial-handle=2008,i,3135317973912784070,14782310144571519357,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3104 /prefetch:1
              2⤵
                PID:4016
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,5170423663654524536,7205245298174839545,524288 --field-trial-handle=2008,i,3135317973912784070,14782310144571519357,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5360 /prefetch:14
                2⤵
                  PID:2084
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5704,i,11404596389318608057,16641223778290945114,524288 --field-trial-handle=2008,i,3135317973912784070,14782310144571519357,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=748 /prefetch:14
                  2⤵
                    PID:4104
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,9824475804251176687,6018166989166927672,524288 --field-trial-handle=2008,i,3135317973912784070,14782310144571519357,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5664 /prefetch:14
                    2⤵
                      PID:3244
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,16110381558222739525,14754367364896045751,524288 --field-trial-handle=2008,i,3135317973912784070,14782310144571519357,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5672 /prefetch:14
                      2⤵
                        PID:3020
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,18400269860846593560,4502501243013482895,524288 --field-trial-handle=2008,i,3135317973912784070,14782310144571519357,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4616 /prefetch:14
                        2⤵
                        • NTFS ADS
                        PID:5424
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5544,i,1159148080688174166,15119740036914739821,262144 --field-trial-handle=2008,i,3135317973912784070,14782310144571519357,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5484 /prefetch:10
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:420
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,16122522811793692682,17226824996736737730,524288 --field-trial-handle=2008,i,3135317973912784070,14782310144571519357,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5672 /prefetch:14
                        2⤵
                          PID:5160
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5896,i,10874726055861799427,11699156607290301272,2097152 --field-trial-handle=2008,i,3135317973912784070,14782310144571519357,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5648 /prefetch:1
                          2⤵
                            PID:3716
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5884,i,3543404939052456760,5243519763844319022,2097152 --field-trial-handle=2008,i,3135317973912784070,14782310144571519357,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6016 /prefetch:1
                            2⤵
                              PID:5228
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6320,i,3656496142233197981,3749608820168500427,2097152 --field-trial-handle=2008,i,3135317973912784070,14782310144571519357,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6344 /prefetch:9
                              2⤵
                                PID:5836
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6380,i,3258617762715771387,16598636763358712342,2097152 --field-trial-handle=2008,i,3135317973912784070,14782310144571519357,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6160 /prefetch:9
                                2⤵
                                  PID:3200
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6484,i,10374594377011679185,9164615169681820908,2097152 --field-trial-handle=2008,i,3135317973912784070,14782310144571519357,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6492 /prefetch:9
                                  2⤵
                                    PID:5936
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6740,i,17580710377698307012,16670573814277280265,2097152 --field-trial-handle=2008,i,3135317973912784070,14782310144571519357,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6708 /prefetch:1
                                    2⤵
                                      PID:2016
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6828,i,15754174286047275213,7144948591115697686,2097152 --field-trial-handle=2008,i,3135317973912784070,14782310144571519357,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6836 /prefetch:1
                                      2⤵
                                        PID:5852
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6616,i,16764437586571001912,15388349739843127261,2097152 --field-trial-handle=2008,i,3135317973912784070,14782310144571519357,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6984 /prefetch:1
                                        2⤵
                                          PID:4900
                                      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                        1⤵
                                          PID:3916
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                          1⤵
                                            PID:4396
                                          • C:\Windows\System32\rundll32.exe
                                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                            1⤵
                                              PID:3984
                                            • C:\Program Files\7-Zip\7zG.exe
                                              "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Mark58-windows (1)\" -spe -an -ai#7zMap24205:98:7zEvent8026
                                              1⤵
                                              • Suspicious use of FindShellTrayWindow
                                              PID:5024
                                            • C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\Mark58.exe
                                              "C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\Mark58.exe"
                                              1⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Reads the TCP/IP host and domain name from the registry
                                              • Suspicious behavior: AddClipboardFormatListener
                                              • Suspicious behavior: GetForegroundWindowSpam
                                              PID:2840
                                            • C:\Windows\system32\AUDIODG.EXE
                                              C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x0000000000000494
                                              1⤵
                                                PID:6116

                                              Network

                                                    MITRE ATT&CK Enterprise v16

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    BookmarkMergedSurfaceOrdering

                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                    • Size 6B
                                                    • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                    • MD5 SHA1 SHA512

                                                    BrowsingTopicsState

                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                    • Size 649B
                                                    • SHA256 f8f259c223be5ce9263978dab703ac9bc55d9d5945a48883c8fc575ba6ee9c74
                                                    • MD5 SHA1 SHA512 TLSH

                                                    Network Persistent State

                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                    • Size 3KB
                                                    • SHA256 ee004c57f6eaf4913680326b1cf95a6d4f3f9d395ee8f3bf716d34ef3f8f98e4
                                                    • MD5 SHA1 SHA512 TLSH

                                                    Network Persistent State

                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                    • Size 2KB
                                                    • SHA256 b9d5dd24c583d9a0fca42ab7d2e080100867ea8c969a0cccf80fb053ab13de2f
                                                    • MD5 SHA1 SHA512 TLSH

                                                    Network Persistent State

                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                    • Size 3KB
                                                    • SHA256 f05d82e6783c66d2d1e720a23326d7ee16f41d23b3c853d306ccbdb35a188768
                                                    • MD5 SHA1 SHA512 TLSH

                                                    SCT Auditing Pending Reports

                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                    • Size 2B
                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                    • MD5 SHA1 SHA512

                                                    Preferences

                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                    • Size 11KB
                                                    • SHA256 a4efc5771d498f40e1a7c4502cd6dba489be042cd7e35004dca793f29d45da44
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    Preferences

                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                    • Size 11KB
                                                    • SHA256 999cc8ada3ea04e1d8f402c21dd20b26c2249a05bdf1969ecdb9f06c9f0a010f
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    Preferences

                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                    • Size 11KB
                                                    • SHA256 dfb99b99817e1e55e1e9c5ce0c8a44984fa58698a72453b3d08c68a58bafeab8
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    Preferences

                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                    • Size 12KB
                                                    • SHA256 3bac1b82fb5081c5447b144cdc8d77dac155ae434a2b7ef350fce86ec37d966e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    Preferences

                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                    • Size 12KB
                                                    • SHA256 d953d81fcef781000f3a61ed1ee6ff54d36eb54d9a76698ff99f42ee90a11bad
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    Preferences

                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                    • Size 12KB
                                                    • SHA256 4bfc1a1082f40ee5e2980981f4745a92710e5094b50ee936ef59c2a470d053d8
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    Secure Preferences

                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                    • Size 13KB
                                                    • SHA256 183080ab87b58b695e03979ec4d826a874606e28a558a00578c46ede242e7bf3
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    Local State

                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                    • Size 131KB
                                                    • SHA256 2cd8784c37c98cd63485dbe774cf97f505fd36d05387e5c8c1577e2bf9aca114
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    Local State

                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                    • Size 131KB
                                                    • SHA256 f2a381741e9adbe35bcb6549c7e1a0294663a0cb35968a4c7f0b6d987e46018c
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    Local State

                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                    • Size 131KB
                                                    • SHA256 ea084e878749ce9a43fd29485f3a6607df9b9531a65b660877f960d2317876e6
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    Local State

                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                    • Size 131KB
                                                    • SHA256 836c0146b917ab6fe8c0102648f2e789737ce2bd4f488b1fe447c88151d2d54d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    Local State

                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                    • Size 131KB
                                                    • SHA256 760cc5e8635493f0098c925d681d9101cafe6235984110f04944abda84acfe90
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    Local State

                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                    • Size 130KB
                                                    • SHA256 fd71688ca95b346809d25775495cf577b39f5ed639bf4717d0666fa554314fe1
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    Local State

                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                    • Size 131KB
                                                    • SHA256 6f2d39cf87d164037cccb0f86212f877efc8d29648eb9442b4d4b6b716695025
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    profile.json

                                                    • Path C:\Users\Admin\AppData\Local\Mark58\profiles\default\profile.json
                                                    • Size 45B
                                                    • SHA256 0bf756c3bef65b9944b311fb962e5045abe220bf6a7bef198f05a1cb0eca1d7e
                                                    • MD5 SHA1 SHA512

                                                    Mark58-windows (1).zip:Zone.Identifier

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1).zip:Zone.Identifier
                                                    • Size 228B
                                                    • SHA256 7e49019ad1c2ba726f5959fd6e302c6f4cef4c3132865ba5bc8ec5c8ebe4a44b
                                                    • MD5 SHA1 SHA512 TLSH

                                                    Mark58.exe

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\Mark58.exe
                                                    • Size 15.4MB
                                                    • SHA256 37858ee06019da081f8fd9518b6bb252a8177e52e8b77311c21b2fbf154800db
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    qt_en.qm

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\PyQt6\Qt6\translations\qt_en.qm
                                                    • Size 33B
                                                    • SHA256 494ac9a2b2cb2fdeced353f4a9f898ed8dcf616e9bc667438c62681e3f7f79cf
                                                    • MD5 SHA1 SHA512

                                                    VCRUNTIME140.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\VCRUNTIME140.dll
                                                    • Size 117KB
                                                    • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    _bz2.pyd

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\_bz2.pyd
                                                    • Size 84KB
                                                    • SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    _ctypes.pyd

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\_ctypes.pyd
                                                    • Size 124KB
                                                    • SHA256 0e56107a891100535f2da79d85a5ae65ff1227b4765bd108f8593ac1a1110d81
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    _lzma.pyd

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\_lzma.pyd
                                                    • Size 157KB
                                                    • SHA256 e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-core-console-l1-1-0.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-core-console-l1-1-0.dll
                                                    • Size 21KB
                                                    • SHA256 88ace577a9c51061cb7d1a36babbbefa48212fadc838ffde98fdfff60de18386
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-core-datetime-l1-1-0.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-core-datetime-l1-1-0.dll
                                                    • Size 21KB
                                                    • SHA256 1bd81dfd19204b44662510d9054852fb77c9f25c1088d647881c9b976cc16818
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-core-debug-l1-1-0.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-core-debug-l1-1-0.dll
                                                    • Size 21KB
                                                    • SHA256 591358eb4d1531e9563ee0813e4301c552ce364c912ce684d16576eabf195dc3
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-core-errorhandling-l1-1-0.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-core-errorhandling-l1-1-0.dll
                                                    • Size 21KB
                                                    • SHA256 d56ce7b1cd76108ad6c137326ec694a14c99d48c3d7b0ace8c3ff4d9bcee3ce8
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-core-fibers-l1-1-0.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-core-fibers-l1-1-0.dll
                                                    • Size 21KB
                                                    • SHA256 91d249d7bc0e38ef6bcb17158b1fdc6dd8888dc086615c9b8b750b87e52a5fb3
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-core-fibers-l1-1-1.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-core-fibers-l1-1-1.dll
                                                    • Size 21KB
                                                    • SHA256 fc9d86cec621383eab636ebc87ddd3f5c19a3cb2a33d97be112c051d0b275429
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-core-file-l1-1-0.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-core-file-l1-1-0.dll
                                                    • Size 25KB
                                                    • SHA256 1ca895aba4e7435563a6b43e85eba67a0f8c74aa6a6a94d0fc48fa35535e2585
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-core-file-l1-2-0.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-core-file-l1-2-0.dll
                                                    • Size 21KB
                                                    • SHA256 4cadbc0c39da7c6722206fdcebd670abe5b8d261e7b041dd94f9397a89d1990d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-core-file-l2-1-0.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-core-file-l2-1-0.dll
                                                    • Size 21KB
                                                    • SHA256 93c624b366ba16c643fc8933070a26f03b073ad0cf7f80173266d67536c61989
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-core-handle-l1-1-0.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-core-handle-l1-1-0.dll
                                                    • Size 21KB
                                                    • SHA256 39095f59c41d76ec81bb2723d646fde4c148e7cc3402f4980d2ade95cb9c84f9
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-core-heap-l1-1-0.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-core-heap-l1-1-0.dll
                                                    • Size 21KB
                                                    • SHA256 8f105771b236dbcb859de271f0a6822ce1cb79c36988dd42c9e3f6f55c5f7eb9
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-core-interlocked-l1-1-0.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-core-interlocked-l1-1-0.dll
                                                    • Size 21KB
                                                    • SHA256 53b25e753ca785bf8b695d89dde5818a318890211dc992a89146f16658f0b606
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-core-kernel32-legacy-l1-1-1.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-core-kernel32-legacy-l1-1-1.dll
                                                    • Size 21KB
                                                    • SHA256 a9b13a1cd1b8c19b0c6b4afcd5bb0dd29c0e2288231ac9e6db8510094ce68ba6
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-core-libraryloader-l1-1-0.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-core-libraryloader-l1-1-0.dll
                                                    • Size 21KB
                                                    • SHA256 7f39ba298b41e4963047341288cab36b6a241835ee11ba4ad70f44dacd40906c
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-core-localization-l1-2-0.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-core-localization-l1-2-0.dll
                                                    • Size 21KB
                                                    • SHA256 6ee44dd0d8510dc024c9f7c79b1b9fa88c987b26b6beb6653ddd11751c34e5dc
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-core-memory-l1-1-0.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-core-memory-l1-1-0.dll
                                                    • Size 21KB
                                                    • SHA256 0512a35316ec9180437f86696a84c5c06a7e4e82e050055a656e5bf9fca206f9
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-core-namedpipe-l1-1-0.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-core-namedpipe-l1-1-0.dll
                                                    • Size 21KB
                                                    • SHA256 c05f1fffe3b5a2738ea54ce9485cca026fb9635f982626fba1e1dcc531897273
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-core-processenvironment-l1-1-0.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-core-processenvironment-l1-1-0.dll
                                                    • Size 21KB
                                                    • SHA256 c4eca98c3c67b6395d5b005b00ac1eb0318b86b23aa71035a44c2b1602befba9
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-core-processthreads-l1-1-0.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-core-processthreads-l1-1-0.dll
                                                    • Size 21KB
                                                    • SHA256 5ccb89e93d67bc3288d4e84649c5346e66e15e3d7cd65d989daf3f4cb584be9a
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-core-processthreads-l1-1-1.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-core-processthreads-l1-1-1.dll
                                                    • Size 21KB
                                                    • SHA256 4ad565a8ba3ef0ea8ab87221ad11f83ee0bc844ce236607958406663b407333e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-core-profile-l1-1-0.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-core-profile-l1-1-0.dll
                                                    • Size 21KB
                                                    • SHA256 7809160932f44e59b021699f5bc68799eb7293ee1fa926d6fcca3c3445302e61
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-core-rtlsupport-l1-1-0.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-core-rtlsupport-l1-1-0.dll
                                                    • Size 21KB
                                                    • SHA256 9dc1e91e71c7c054854bd1487cb4e6946d82c9f463430f1c4e8d1471005172b1
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-core-string-l1-1-0.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-core-string-l1-1-0.dll
                                                    • Size 21KB
                                                    • SHA256 60fc31d2a0c634412f529dba76af3b9bf991352877c6dae528186d3935704cfd
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-core-synch-l1-1-0.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-core-synch-l1-1-0.dll
                                                    • Size 21KB
                                                    • SHA256 3a72b4f29f39a265d32ad12f0ce15dbf60129c840e10d84d427829ede45e78ad
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-core-synch-l1-2-0.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-core-synch-l1-2-0.dll
                                                    • Size 21KB
                                                    • SHA256 efc1e4460984a73cf47a3def033af1c8f3b1dbc1a56cd27781d3aacf3e3330cb
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-core-sysinfo-l1-1-0.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-core-sysinfo-l1-1-0.dll
                                                    • Size 21KB
                                                    • SHA256 b203d862ddef1dd62bf623fc866c7f7a9c317c1c2ae30d1f52cb41f955b5698e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-core-sysinfo-l1-2-0.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-core-sysinfo-l1-2-0.dll
                                                    • Size 21KB
                                                    • SHA256 2703635d835396afd0f138d7c73751afe7e33a24f4225d08c1690b0a371932c0
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-core-timezone-l1-1-0.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-core-timezone-l1-1-0.dll
                                                    • Size 21KB
                                                    • SHA256 33f4fddc181066fce06b2227bded813f95e94ed1f3d785e982c6b6b56c510c57
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-core-util-l1-1-0.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-core-util-l1-1-0.dll
                                                    • Size 21KB
                                                    • SHA256 6eda016742a6171205a387a14b3c0b331841567740376f56768f8c151724207d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-crt-conio-l1-1-0.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-crt-conio-l1-1-0.dll
                                                    • Size 21KB
                                                    • SHA256 b762061b688aae679afe788904d2c9970f74a7dac98f3b42463d08f25e483d3f
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-crt-convert-l1-1-0.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-crt-convert-l1-1-0.dll
                                                    • Size 25KB
                                                    • SHA256 ebb2ae5535a64f65daeab8235585114fc9dd2cf1a49f5852d446250b998b6ae4
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    api-ms-win-crt-environment-l1-1-0.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\api-ms-win-crt-environment-l1-1-0.dll
                                                    • Size 21KB
                                                    • SHA256 17d63275d00bdd8670422b95bd264c532998e0a1b041079e54fce4b6b7a55819
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    base_library.zip

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\base_library.zip
                                                    • Size 1.3MB
                                                    • SHA256 6fe41198df2da27f1b853f043142d4c659a68713783e02289e5eef08fc7d57bf
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    libffi-8.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\libffi-8.dll
                                                    • Size 38KB
                                                    • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    INSTALLER

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\numpy-2.5.3.dist-info\INSTALLER
                                                    • Size 4B
                                                    • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
                                                    • MD5 SHA1 SHA512

                                                    codeMirrorModule.-QdMvsKi.css

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\playwright\driver\package\lib\vite\traceViewer\codeMirrorModule.-QdMvsKi.css
                                                    • Size 6KB
                                                    • SHA256 20be824a82832b62cc04642d31da3c609fd280b23f1cdcb1e622c4f40aac5ab8
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    codicon.DCmgc-ay.ttf

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\playwright\driver\package\lib\vite\traceViewer\codicon.DCmgc-ay.ttf
                                                    • Size 78KB
                                                    • SHA256 0f1d5219934e96e83b8db162d60b4d8c09b5de1e7d38031cbafe4a3c0f2889c9
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    python3.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\python3.dll
                                                    • Size 68KB
                                                    • SHA256 fb975a606e7fbf74f64260e3f60c3490b4f74a183c0926fd6ed1ac4c52ac7b1c
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    python312.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\python312.dll
                                                    • Size 6.6MB
                                                    • SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    ucrtbase.dll

                                                    • Path C:\Users\Admin\Downloads\Mark58-windows (1)\Mark58-windows\Mark58\_internal\ucrtbase.dll
                                                    • Size 1.3MB
                                                    • SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH

                                                    memory/2840-3533-0x00007FFF19380000-0x00007FFF1960F000-memory.dmp