a7e03719c8ce67524ea5cc7cc208b9517e1bdbae9db2f6e9330c198b84ed495a

Analysis

user interaction
yes
max time kernel
34s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 22:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Marco_1.1.4_x64-setup.exe
Size 5.2MB
Sample261027-2f4vmaxsgw
SHA256 a7e03719c8ce67524ea5cc7cc208b9517e1bdbae9db2f6e9330c198b84ed495a
MD5 a8aa7ccde7b1eee1591236955f7fc4b7
SHA1 2c28c50f732cc9ce653b47d5f509a8156a29fae3
SHA512 05532f7261a2fe5f8ff6b597ef5a854e13c58e7f2c77c1527b43a680a48857fe32bec2f3aa71559301b78928d27ad63bec15b676345f34ab26d03ddfa3228c17
SSDEEP 98304:dhNo0ixQolrIrqkPVP/QQxA+Rf3XhA3SkGBNkih5sAJtYn0xlHWT1A2Mbh6OOSp:ddixQoWrqkPV3j5ksP7tWn+dIY
TLSH
T12F46334E5B70A05FC21DE4F32C33867E42E3457FE818668FCF522AD6B84DBDA94161A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2504	marco.exe

Loads dropped DLL 7 IoCs

pid	Process
980	Marco_1.1.4_x64-setup.exe
980	Marco_1.1.4_x64-setup.exe
980	Marco_1.1.4_x64-setup.exe
980	Marco_1.1.4_x64-setup.exe
980	Marco_1.1.4_x64-setup.exe
980	Marco_1.1.4_x64-setup.exe
980	Marco_1.1.4_x64-setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	marco.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	marco.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	marco.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	marco.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	marco.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Marco_1.1.4_x64-setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	marco.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	marco.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	marco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	marco.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
980	Marco_1.1.4_x64-setup.exe
980	Marco_1.1.4_x64-setup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1948	msedgewebview2.exe
1948	msedgewebview2.exe
1948	msedgewebview2.exe
1948	msedgewebview2.exe
1948	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeImpersonatePrivilege	980	Marco_1.1.4_x64-setup.exe
Token: SeImpersonatePrivilege	980	Marco_1.1.4_x64-setup.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2504	marco.exe
2504	marco.exe
2504	marco.exe
2504	marco.exe
2504	marco.exe
2504	marco.exe
2504	marco.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2504	marco.exe
2504	marco.exe
2504	marco.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 1948	2504	marco.exe	94
PID 1948 wrote to memory of 1644	1948	msedgewebview2.exe	95
PID 1948 wrote to memory of 1632	1948	msedgewebview2.exe	97
PID 1948 wrote to memory of 1632	1948	msedgewebview2.exe	97
PID 1948 wrote to memory of 1632	1948	msedgewebview2.exe	97
PID 1948 wrote to memory of 1244	1948	msedgewebview2.exe	98
PID 1948 wrote to memory of 2864	1948	msedgewebview2.exe	99
PID 1948 wrote to memory of 2864	1948	msedgewebview2.exe	99
PID 1948 wrote to memory of 372	1948	msedgewebview2.exe	100
PID 1948 wrote to memory of 372	1948	msedgewebview2.exe	100
PID 1948 wrote to memory of 372	1948	msedgewebview2.exe	100
PID 1948 wrote to memory of 3424	1948	msedgewebview2.exe	102
PID 1948 wrote to memory of 3424	1948	msedgewebview2.exe	102
PID 1948 wrote to memory of 3424	1948	msedgewebview2.exe	102
PID 1948 wrote to memory of 4596	1948	msedgewebview2.exe	104
PID 1948 wrote to memory of 4596	1948	msedgewebview2.exe	104
PID 1948 wrote to memory of 4596	1948	msedgewebview2.exe	104
PID 1948 wrote to memory of 4664	1948	msedgewebview2.exe	105
PID 1948 wrote to memory of 4664	1948	msedgewebview2.exe	105
PID 1948 wrote to memory of 4664	1948	msedgewebview2.exe	105
PID 1948 wrote to memory of 1052	1948	msedgewebview2.exe	106
PID 1948 wrote to memory of 1052	1948	msedgewebview2.exe	106
PID 1948 wrote to memory of 1052	1948	msedgewebview2.exe	106

C:\Users\Admin\AppData\Local\Temp\Marco_1.1.4_x64-setup.exe
"C:\Users\Admin\AppData\Local\Temp\Marco_1.1.4_x64-setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:980
- C:\Users\Admin\AppData\Local\Marco\marco.exe
  "C:\Users\Admin\AppData\Local\Marco\marco.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies trusted root certificate store through registry
  - Reads the TCP/IP host and domain name from the registry
  - Modifies system certificate store
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=marco.exe --webview-exe-version=1.1.4 --user-data-dir="C:\Users\Admin\AppData\Local\com.marco.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=2504.2072.16402023456705306362
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:1948
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.marco.app\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffc4b06b078,0x7ffc4b06b084,0x7ffc4b06b090
      4⤵
      PID:1644
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.marco.app\EBWebView" --webview-exe-name=marco.exe --webview-exe-version=1.1.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1724,i,12448672528196139447,8685565978076967780,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1680 /prefetch:2
      4⤵
      PID:1632
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.marco.app\EBWebView" --webview-exe-name=marco.exe --webview-exe-version=1.1.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2036,i,12448672528196139447,8685565978076967780,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3
      4⤵
      PID:1244
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.marco.app\EBWebView" --webview-exe-name=marco.exe --webview-exe-version=1.1.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2372,i,12448672528196139447,8685565978076967780,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:8
      4⤵
      PID:2864
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.marco.app\EBWebView" --webview-exe-name=marco.exe --webview-exe-version=1.1.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3612,i,12448672528196139447,8685565978076967780,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:372
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.marco.app\EBWebView" --webview-exe-name=marco.exe --webview-exe-version=1.1.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4168,i,12448672528196139447,8685565978076967780,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
      4⤵
      PID:3424
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.marco.app\EBWebView" --webview-exe-name=marco.exe --webview-exe-version=1.1.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3664,i,12448672528196139447,8685565978076967780,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:1
      4⤵
      PID:4596
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.marco.app\EBWebView" --webview-exe-name=marco.exe --webview-exe-version=1.1.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=5096,i,12448672528196139447,8685565978076967780,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:1
      4⤵
      PID:4664
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.marco.app\EBWebView" --webview-exe-name=marco.exe --webview-exe-version=1.1.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=5276,i,12448672528196139447,8685565978076967780,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:1
      4⤵
      PID:1052
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.marco.app\EBWebView" --webview-exe-name=marco.exe --webview-exe-version=1.1.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5512,i,12448672528196139447,8685565978076967780,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
      4⤵
      PID:1868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

marco.exe

Path C:\Users\Admin\AppData\Local\Marco\marco.exe
Size 21.0MB
SHA256 668913d5331e65c59bce02fe1d1001f4b298b40210a0eb93370967bd915540d2
MD5 e0ee0a973c465fd23752ab8c187fafbc
SHA1 4076417897d41ee6ba1921e690e773a7a35a9f84
SHA512 82d9c68a5324b62537aac846d82f869121b2f58a3cc7748415aa67d0d6a0c6163171b9ab1466e3cdaf7d7f2d5d1fed6f65a686465d782b6877284b0300bc0bcb
SSDEEP 98304:LO+9oxR3uJcnFfiKsieOwjkA007U7SADa4LuLI4+DIL2gw/f6AybRxu1fPL+7z+g:LbodsiZAKq4g+Ew/yAyALWz8oMA
TLSH
T15C271825BA5A98ACD09BC47483468A634A7130DF0B35B9FF45C492382F6DBF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsgEB96.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsgEB96.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsgEB96.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsgEB96.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

44313c63-6b41-4506-b792-482c24fac7ea.tmp

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\44313c63-6b41-4506-b792-482c24fac7ea.tmp
Size 1KB
SHA256 c15a4435dbb877e87994920426181390f640c6f04d8165e4d779d6797e17d78e
MD5 ba518a6d4d2c212c971f71e06b2ee9ce
SHA1 2b1c6f242bff89c8896888ae5c8851a7baca4afe
SHA512 f30601ab8cdb5cf1e8e5c79c5113a863f07da9e4bfa1ee5a41332815604acce777d2dbdcb4b77c873e994a1cd81c123c7464ebda26d45a6857b2524c37df5b08
TLSH
T1263160B3D8903F325D91D547725B7E4B6E2060BAE3604E4466EE4B2811F75DCA63EC22
MD5 SHA1 SHA512 TLSH

Submit Download

55f9dad6-f1e0-47ae-934e-f709d7c35afb.tmp

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\55f9dad6-f1e0-47ae-934e-f709d7c35afb.tmp
Size 16KB
SHA256 7acefe7f907a6a1a0449558215c15445f12e60fc637d4e4204c62e77c821faaf
MD5 ac0d56431fa346782d08616330e071aa
SHA1 bfd832fef375e4c032c667816a386eb082d9d9de
SHA512 b4e4efb79673c961a4a9d7e9457a6842e623d3ebf4ae308197c50f1c7c1207f5476b1a6b5eb348d909ea7da8166b90e5a4132dfc607c57fa7b722d4974473293
SSDEEP 384:zv+OBqImmJvGBLx3NaFMJF4Nb7e26fpStg6r5:qcvGtlNWGpwV
TLSH
T1FB72AEA61C746E272CE6C40ABA8E6B47DB716297C1D07FE8DDED5F0E113B0842362D01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

624f7a9b-4719-4c1d-952c-7876ed0516cc.tmp

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\624f7a9b-4719-4c1d-952c-7876ed0516cc.tmp
Size 3KB
SHA256 b2445195019b25614cb355ad4eb09d8c7e80a0557e62d457f68509212cba4819
MD5 c8587fe19efc095c765d12d4d6eb9f72
SHA1 4a32fc2267fb72ec776059ed12ec7b5aca62c061
SHA512 358408dc155c7dc3cec7e74ad9e2aa2d2f254af6b72456825d5606873d33b9556b01bcba9cab4aa6386c4b0adb6dcae95731f7155577f38b3f4e72ebcd37522d
TLSH
T1DC71B772A864B9374DE2D906B98A3F07BAA55177E5903FA4DAED0F1C01E73982352C13
MD5 SHA1 SHA512 TLSH

Submit Download

8c718e5c-c355-4c85-b040-106bab688ba2.tmp

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\8c718e5c-c355-4c85-b040-106bab688ba2.tmp
Size 2KB
SHA256 c78981e027748a9f4be460bd0153f3ca494f67c2514a0a92ee285a6fb0618469
MD5 1c126ed6b4fccb48a1d05e41caf6eef8
SHA1 91cc0d694d0231b32c1ede89ecea7b02ec191f21
SHA512 39b6f2c5137f31a9245f7cdbbb5e7a9510bf9328d732f63fe1d05b87383af7e9fc3d2bf7fd221379fb7c310febbf6145035387c12789795aba685a1b0eea4a5d
TLSH
T1FC51D7B3AC04BB374DE2C5067A5A3F13EE3561A5E7611FA0AADE0B1800E719C3306C22
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8c360c9ef65e299f22a6f73c16a17c14af2a956b61bbd2fe3ed6d404bd8ab88f
MD5 6a46979b409b3f3572a58d29fc27898a
SHA1 923ec6ffa7e4af48f8a36a76d42e3466827899c1
SHA512 9c643d661ab7f53c72e16fb226f9b8d27183dd1d045699876be280617cc0493aba81348357bc540898b62b97ca111558c32def0ff88199ff0879ca0690b27adf
TLSH
T174D0121736210134C81028330042720D0505D30B400781019829861D2ED84680902541
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 088240fa66ddd80bbf3c45325a44895d0a78ce3faeaac8929cc84b00a5d08a99
MD5 7684273a240b59bbb9fd8281775720ff
SHA1 65eed113b916596fa0694bb56c929afcad20c1bd
SHA512 7b88298f6a6a73ee64cccc8bd3e9139da03a67535ea43b0c2f95d4ec1a8e78ab4a71606abbd7064108f1ef740ea3e3e4302839ed311946e2430665e8d6a97ba5
TLSH
T1E1D02B1233100A74C9201C330282E20E1A85F30B8003C118E819C52C2D984E80E014C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 746692208e423801d5d08d405364a6979ad248fc02dfadc59ab4f84b590ea69f
MD5 c6642ed5604a6b1ff645d2bf66234f33
SHA1 d3ac5352d3f1fb8ad5a3893525d6ef367313f6b1
SHA512 8c038e00087dc27a3f6d34a638492946bad6afea8b694058ac4a8c28eb9b2a5cf5f665322a295a7704ca03fbf563d744d920d7f0a710e65a3302da383ec0bfad
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Default\Cache\Cache_Data\f_000002
Size 16KB
SHA256 61580c28d11ad443b88bc8100b9d07f8fa4d54fcaba6184e54f66dcfea9e1dac
MD5 390d9989e83e47370d0a554f8c62b2df
SHA1 2aea72e76a6445f12577ecf3fd084f8273046212
SHA512 f477832cec9352916c8715b131b98a37daf3041a3d57a57494911a6c297b9eb115742d670a6292c01c0e447b66757f7cb426df3c228fbce2fb519515d92a31fe
SSDEEP 384:SSiytb19LUOCEser5u5y/wLpfizSgaIZiDh:d+WFq1PDh
TLSH
T16972D785728174E343B39455506F448BF1AA1B5ABC1EDAD0F70AE6D0AC3E81DA0F6F8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Default\Cache\Cache_Data\f_000003
Size 229KB
SHA256 db598c91ed72db57e315671f067d20bcf117dbb032c88c9477209bab8b40ac70
MD5 b12e7b9810b5b215e01c8ed4189de0d5
SHA1 a5e68d07ef40d20635bf78c336bece3d1857c1a8
SHA512 7ed82d5a183be834fd0edc0f19acddd6af7a9acfc3b867ac4f189c442bed07c96f4b25b64c5eaa971cf0cc845411c4a95a799385a18f4b04cca1eac574094dbf
SSDEEP 3072:+4cqEFl4Dbh+sjHYYeu1uK7zHP4fBJHMLkTiQLCjkRfvrSzA6aMxiIORJ:4qEFlcNjHjgK7j4fBJ0F2DSc6aMjOv
TLSH
T151343BEA73D2B13247EB02A6903A0105F3795D94144E052CF678EDEE79A5489A3F3F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Default\Cache\Cache_Data\f_000004
Size 16KB
SHA256 2ddc5bb4762e51ab0cf174cd817f3569bf4d2725452f3ec673a3e092fbb80fa7
MD5 2531c04b6927977e970dbbfbf7397ed2
SHA1 f3e720b8842899c95a3024a6dac618096ccc3ecc
SHA512 bf528f418f10329afa2fd1c1d6d49bbdd23dc3d74caeea3bdb674f96b97dd0091219e209d4ab60e174dcd0e0fca42d7df160b72490e06d56018c33fb80b5d471
SSDEEP 192:LXRuADXBCCdn1h0PgUvhS1pbP5E5dqBNlWo6uwDPrKicpI:Lhu+RCqn1ePgUo1DnWpfDPmnS
TLSH
T12A72C884F68160E342F76868505F44CBA1AE0B57F40DCD82F60BE59458BFD19B276EEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Default\Cache\Cache_Data\f_000005
Size 662KB
SHA256 cd8af7c5f2eccf34112d612eb65601c558fdbad2078a377a0ff796f90e66a29d
MD5 1eb3d5a02c408bb5b2eda67ddaaae59f
SHA1 94268eef69008d25f006a5c5374e5380b140dbcd
SHA512 a86f08600ed3c7d776668bf70ebd753faafb0de02820af7e004da5caa723bef508f619d025ee1f60e7a89ec17f221ac559e71067c7eb6bceec0fcdceae54b0d4
SSDEEP 6144:nONePMPQfA/392K0PTLvNJ7QFPQMHZ/N57wDNcEyrUAcMLcKQEBTvXxpCt5kaCDE:o3uLn8720rCA7ELs1E
TLSH
T1CCE46EE93341F0729BF742A780AF0502B339295A280D4428B669ECDF757489D62B7F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Default\Cache\Cache_Data\f_000007
Size 46KB
SHA256 b29e85f137845f8dd042aeeb8b1db9d989cd0819115f5c42f3993253d050431c
MD5 acf023f9330b50f4c0a470d0bb8dfeff
SHA1 7df1227d4b30ac331d9aa7e6398dc7bb35e860e0
SHA512 47acc3e75815971303fde02a932b4c6d7a907744e280bbe8eafe22ea16ed46845bf9799913fc8428a69a89f54d26429fc94d6229f1879f5b13edeb1a4c1c5482
SSDEEP 768:Rk8K0uP/BGiSo29tMKtjp7lHLq1v+Jcs/GdqOMaE9c:y0uQiror1lHO2JcUOMaH
TLSH
T1C3231A5EB2C5FA7C07DAA6D4D62A8C05BA570979E94C90709ED5D1C1287888FC02BF3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Default\Cache\Cache_Data\f_00000d
Size 233KB
SHA256 083e5183b26a40146976765b8c15b4f5449f89ab186fd9c35aa8f63468f88b78
MD5 45dafe434fa19076a348858fb417c3ab
SHA1 aabbf5d2d5da008520988db1553983be4d31c659
SHA512 2aa97abd574e53489b76014d2f617bda7de5e255fdb6b5d9a54444b3d48c3c69d1aff3dd688a13345614d4707d98d94fe74477c9d3469ca843be75eef05d226a
SSDEEP 6144:xr+1ed0wcDsXOW1YZ70CAxrl4j1KZ7Zh3zIYa+E:01pwclW1+70JrWwlZ2+E
TLSH
T10A342224A72836DE62C7F339223DE85BEF5A5F6481DF07081ADB1562384FA87CAC5714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Default\Cache\Cache_Data\f_00000e
Size 16KB
SHA256 7cd0b1df38c25225e1cf7742b3a4c67494e70ebcbbbe68d6d2c32a0c6b3c83f4
MD5 2cd5a639fc3d902c6c5b50c128562929
SHA1 85e0b3905968178758cb94175a486266f6fb3149
SHA512 740843e4d5f24006a6157b6b836f4cd6e384f291eb4f98548eb77be5d3311dbc0af44c308339ad1a9c8d8f43591d0e0d3c8b03c57bcf8dafca4b1c10db5d2c8f
SSDEEP 384:rA/5uv69UCM3IX4TDraHB9hyPx3HNqtrFQC2fYkfT:zhCM3BcvyPx34Fl0Y8
TLSH
T17872E1EB883A479B49F37917496D119519BF44EFCCA047E53603FA192B6C091DE28182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Default\Cache\Cache_Data\f_00000f
Size 54KB
SHA256 75bf727b301d3e24dab36de789044abea432669ee7effefbe6c1d23994d63453
MD5 26460a39af216347c2779dbaee1e2705
SHA1 a28fa54669b3a84d4e740c3e7e04006e2985f128
SHA512 9cc4ef9829a40b4e3a3c56cc340c7a974231fbfad6a1fce9159d5add8b0b31798f4f15cf05d9ac1df66161bdfd84cfd7dcd9f027c6e72ed585b90f8fcc50c4d5
SSDEEP 1536:ucS/nQoMvUHwtbHIvKD0M8+7BZmAQg6z9VAtoy7:ucS/1QtooP9QHz9e7
TLSH
T16C43024A99EA5653BF236632E60D43F0AD6FE5E45D0B0AD17C66708B47CFD4A313A020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Default\Cache\Cache_Data\f_000010
Size 36KB
SHA256 4fbb9423ec6bf832a53225cfa3369f480aeb083373b9bbcc715fc306959100db
MD5 b0563c4f87a4bd436fd2d0a000c08265
SHA1 6b61ca8b964fbc70b39f58b5b2ac05abe65a50df
SHA512 5f380836105cb2bbce125aea753867fd3faf0d0ea2984613b4d74dc518ea5dfa7205b021a44c09fb76ece4464217fafcfcb74e1f7a189abed7d9056c6ab2b2ed
SSDEEP 768:lfy2j9prTExldeo5ZRd9b/C3iba+Ek5H2:lffj9prTKpSea+R5H2
TLSH
T1A3F2F1A0F622C4BEC960E5BB06062DE6A195FF982D60E1213F14C9C38CE59CC179D76D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Default\Cache\Cache_Data\f_000011
Size 76KB
SHA256 d72d5d3c3821335912885a1cb11e3bf1983509e619d17f77d99e167ecffb164b
MD5 ac31f6911e7494fed8abe3ceea8d5125
SHA1 949e6ec0d0321dbe4324a31c82a8c18d5acf9d97
SHA512 038aad8aba29d4f2438af5014fdb29f16916196f753aeb0ed5ef371ea09e49087a41cb05aa89bcc66502970ddc3ba3917436da9f2795eb95e543ce98b5566a40
SSDEEP 1536:OMtBew3yZBYBlQt20xci1V6vNpMEgpJ9TcX5rTDzsdY3Ob+:OMtkjZBmlQtTxci1V3jXWBT/sdt+
TLSH
T16573120B0D6BEA85BB159595FCE87CA2C9ED68569575160F8EF0C6CB53EBC032E80039
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Default\Cache\Cache_Data\f_000012
Size 27KB
SHA256 59e9f2ebac5c39bf73a7f1b0b11dffa98cd5b58722cbf5e8fb3f2d059d5d7fe3
MD5 7e54e5492a538eb7dbb00880f732c668
SHA1 c3120eb75a819edd6f4ce0414e80a12bc82ea958
SHA512 4576e5eb8826fcb7c93ea0bd1a0f68e89e380e4556404896355a48ce01ccb245c23fef374241118d74449647688b496ea65960b3f2e4b9c3d00e62085eb15cc6
SSDEEP 768:Mx/K0XpP82TeWI6HtpaG8sVmHoi1XBFMq:gFXJevUXa7sVsXXMq
TLSH
T1FCC2E1C3CF4712962DE087BBB08CB496946529C54B57E43D76E548A817F3ED7C12883D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Default\Cache\Cache_Data\f_000013
Size 17KB
SHA256 14ffbd21698de949e55492e053e95b474b455293467b1da34171681b7bdf192f
MD5 db9bee6eac30aba3565791df308edd63
SHA1 a5105f3848d12f9713274d63834294905e1c59cb
SHA512 68a8b19410f55e18e1c914205a1a626becaadef075166eae8e65a68a911410d3c351797cae975ddbe105fd293af61572246d8a9cd859ea8eccb25a9640b50aae
SSDEEP 384:4HPLRrp9jc65ufPGfp/bpkxtpRPqWorcfMXpUaQrXOjuib:4Hjhp9o3XGVpetHREZPKXa
TLSH
T1E982C04A1B272292EFFF1A194D3649ECDDE169DEFCB7753567F6D0E68940202228D10C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000014

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Default\Cache\Cache_Data\f_000014
Size 22KB
SHA256 ed835fc66701823e9243c8008d0d9031e4624fba81931b08527a20d5b36acc2f
MD5 9c03adb796aa7d79df7ffa00226c6352
SHA1 55998701b7c2ffcb48b0bcd5b026b508731417a9
SHA512 a8c37b85ca9f7b14b6455e5d48aecf63325ef01f5cc88c173a8f49b01bd69d3b635095d13cfadd4ded265d7e499c515edff7c459ec749f5a2910d5784186a13b
SSDEEP 384:e68/LNldm9x8N8c8FdgPqM5JNJrD1g4ng/kOfr5ulYdcc0pzQEVwbHa18YEcPgNQ:uxlQ597Mro/xfNbdccsxq618Pc3
TLSH
T18DA2E1A19408BF6F0DE09BB31435E93F0CA192067C9A3821D5A306E754EF6335630DF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Default\Cache\Cache_Data\f_000015
Size 20KB
SHA256 70d19bfffbe16def5782f137df84cd14dbd57cfebfee2c045d75c5641190479a
MD5 9b0af0d90c51230a494908f8e30ef20f
SHA1 da483f7550aff0af55f874f652a25c28fd5c1472
SHA512 f702f7bdd3e779ab3cc19056ab6607dc91afce2d6cd3302881be2ce5a7d1027770b2899e5e5a08dece0d6e3c74240eb70dab94c6728394620721f1a47a71213f
SSDEEP 384:bi1pQSV/pcCHY0EJ30aYDa/TEbIS7iGSYChXLTqtNKujS/b9NKq36ajzfR:bcQSV/pW9pTyIWBWbUWn36a3R
TLSH
T10AA2E11BAD6F39D6A15C9C77C08A1CB34F5BD5CB494ECD66D109C1DACDB181F222A806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Default\Cache\Cache_Data\f_000016
Size 21KB
SHA256 afb986422397b2f4c44e1a4b6a3c4e64019146b46980d9e2fc8eaa3edbd6d3d7
MD5 4a1021f0eb87400f02d973205cfa3392
SHA1 d538db5381985f71db93007667277a115b81dcf5
SHA512 389b1dc00d2179e64986ff4706c1def0311daa99cb8a37c6ee0a4aac0bcf090286d0efda5c81d369d467fb980b9e072fb8246fce929f12544da8892061fc4754
SSDEEP 384:7LbxbrKT0s4khjJysobyqQvHotAfsA2wZS1kJHRzx8LjVHSZWdJ1G7YsJMrN:VnK09khjJXGyjvHz03lGJBxkkoJ1G7WN
TLSH
T108A2E1F8BDD90AE8656D83500C5B4D762CFF819B1879F78127AAC9FD27A933842E4045
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Default\Cache\Cache_Data\f_000017
Size 17KB
SHA256 f17c4f9aacb1e8a8cf5438cd43cfcebd8bbe59fcf87c0e6446620cb056b5de51
MD5 a6a5616323de4dbd7050fb8c3073e245
SHA1 ba68a2d02307d444a682d69d4b72b0302b75578a
SHA512 7a9f7fffaefc4b7a25990ccc972ffe91608d25b4bcf3cce363ec4fdc86af5a49f47219e5a89044cfdfa64dbc4e6a657673baf7f935f40886d5aea68f720d0b5a
SSDEEP 384:AdGp7NM/0yhHyzQAfwR2BN7TnCEiPHC1/WIArMRaZv0mm2eljwTWr7FHP27dYGs:5u0CHyzQA4R4iP+JRaZkjVFHPCds
TLSH
T11682E128C94F7A8F76879EC55E5BAF44824C242D1282565BCE1D2EE190B720EC48F7F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Default\Cache\Cache_Data\f_000018
Size 24KB
SHA256 fc82ed0cd13416c57b363d93d7ab27f70c3b241e9304b64b11f9ecbf2a092422
MD5 d583d1353ef92bed706f08fcdd713db2
SHA1 3d11e7838711975acf47e5175a68812c05e7cd50
SHA512 99c9b16e88930135cb62a4315de8c979c0fdfcc54153b53e32456248dba200a5f653df4c5ba4c6c6df246316b7349040c2294fb38b9490c7435feaa77c33c4c0
SSDEEP 768:SJ1IW4vORbwskS2mqArZA+Qydv79PldZOUqqh:SavVskSMArZAnMvprZOU/
TLSH
T15AB2F2832AC259E7E1DF54A3C2BCC0F76023269E526ADE835AF148E41FA791921C554F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Default\Cache\Cache_Data\f_000019
Size 17KB
SHA256 cb0e38e836ce882fe688bab6322419ba1ee63857501f721ff7e85f12130b9ddb
MD5 0fe449aabf8b7aafa4aa0a85a6dbd681
SHA1 fae65019a6a81fcba39ddbe0e55fc33484011d84
SHA512 2e31f78da811fcf0bd14c7841283853d9db87e53c4ee47e272f2243343bfc573700de2bbd75120a6ec2d11a1e4cf50783a6a19532c835dc543b92afe5447a6db
SSDEEP 384:OlwGXz1Su6WL2NaQ2+eXlTT1lmJHvD1nmhL7NmhPohmzrM5HzAUHJ:ywk8WLZDl3qPBngLhmhCqM5Hh
TLSH
T15A82DF75C5548B37CCB789C0DF12ABCA9B596D240D889D0C44B4091BC93BEB294BEEE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001a

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Default\Cache\Cache_Data\f_00001a
Size 36KB
SHA256 006fa310ea7940530ada711c745765d69a16c2a800cc5bfcb46c64ec2877b9a6
MD5 4ac5e8ec44422a421d5542850f721dc4
SHA1 507a2643da0d674651bdf3a93ba84cc507766326
SHA512 bac12c0af305c3a5249fd103886066f307929bfc9808b96341a49e4bb3e0670542f52d267f5ade46064af8fb6c88ac4985a57710b6ebb9f8221f6c4150d6fee8
SSDEEP 768:rISChx+i72DHZ/8d+K5EqRsVv5/44148aOLvLdwo:rILb7Qk7Rwh14Keo
TLSH
T191F2F1046F1745B0B9B7D8E7AC962A72E60F0514954F301234E7488B6F0CA9F8F667BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001c

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Default\Cache\Cache_Data\f_00001c
Size 18KB
SHA256 c81626723e49946e442af3b2cc6c8eb31d0a051e18dfc0ff1046fd25f9683f4d
MD5 2e6fce72fdf6e879ece22d3c05550eee
SHA1 4654646b8cc6085d11b511d07563d98a39143330
SHA512 71a9473cb624062def3eb5c673379395cb66ae9609bb849a460001c9450ceb683c2a2a51acae0818e54ded9b014d33b6dfcfcd026d1ecd59c26a4521e8baeaee
SSDEEP 384:7YtpetR2Fp/lqMs+1ABdc8nbAOmKWwJ3Vcr2uLlO4G3J+Kg61V4:Me/2//lDs+n8ntm1wVcrloFg6M
TLSH
T1AB82D1F9EAE7B3A6A5EC047302D9D0D37DB59031C2B6608143CD5F15B2E728ACD69970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Default\Code Cache\wasm\index-dir\temp-index
Size 48B
SHA256 dead2d22191226bb7704f591a04585748c8d25a97f73a25b476e32f6d750515d
MD5 c944d7cb349e1604f6cede4abd8a13ec
SHA1 caa2fa59c251d4094e5b50acbd799c07b4053f4d
SHA512 23a3d8656a5c51441d3c7bbe49b2db4f9d04f0776b7f0a9d95239b5fc4d3c2a7a32e3a4054e262d8c2816c620855419c32ed75ad389504e2b96f7949e147656c
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Default\DawnWebGPUCache\index
Size 256KB
SHA256 73a788b9e3ac569d16f7d2df7b775fe07d3c2deae6cd6c1694e0c7ec371efa42
MD5 e28ce91c5f316459c442024c31337542
SHA1 cf2c666f2e307c0016eb6e4d938036eaaa544a04
SHA512 f28274fab475f022e521247199f8eda28cdf25bfa995b8ff46fa87d07b7447111b2dd7ee2820a163b8eb32f56d6728bff90bc87c3d8cd7cab076611ea25661e1
SSDEEP 3:LstlNllkll/l6Ml:LsX3lEt6Ml
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Default\IndexedDB\https_app.destinyitemmanager.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Default\Service Worker\ScriptCache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.marco.app\EBWebView\Local State
Size 1KB
SHA256 028278d409aa7964c8961a59461ff7ccf9506ca9b37f7c0e418cd069640633c0
MD5 2f4f4eec038cd18790d2a449982555ca
SHA1 9e3d46f97c5a6db33269fd9a3ba09a4bde7d9b41
SHA512 12b4d9e6c5726aba74e280458fb496b3e0b68cca038304abd1a47194e54bd206af71945df30f71ea2c664e4d48c54fbcca9465f0c91c027507817dc4a0b7f89e
TLSH
T1512192B3C4943F326D91C447B3677F4B2E6050BAA3200E18A2DE0B2411E70EDA73AC72
MD5 SHA1 SHA512 TLSH

Submit Download

1JYGZ47QZGM7WNUR0SVL.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1JYGZ47QZGM7WNUR0SVL.temp
Size 4KB
SHA256 d4abcfcde41d708c448aa5cb8c7c00549a6aabfc3f295a8622663d6204eaf27e
MD5 7af3d6daad57410a1c63cb793a67e751
SHA1 28d6ab11d0256bd4ebcd77af505d56b50282546a
SHA512 8c8f82ed396d139ed0ef1061da7bed47dfd68f3b32c4d78256050843cc2c05958e38e28510b602182c6abe3a5516f18d3ce0b61c895efc658005663158abedda
SSDEEP 48:zVvdrdO3cW8zPJ9z3Y3dDzXXulkz2PdJpEY8vdrdO3cW8zPJ9zDYDpdDzXXulkzE:RW8zBJ3OzHumzK2tW8zBJDczHumzP8
TLSH
T167A1E00416E61A17F2F79E7759B27E02C977B589DA050FCE00C04B200DBBA84A9E9F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a2e0412b8ad04a2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2a2e0412b8ad04a2.customDestinations-ms
Size 4KB
SHA256 62d2ad353ac448b9945e78456718da324d0cffd33acfa72284f6114d6adcff5d
MD5 04dbb41b631a25ac507560149e6a98cc
SHA1 21e04beecea8e6a986483641a244bf1ceee5982f
SHA512 55b291c7c0c3f7e25d25c82186d2775998725f0a9c7e4ed41098e5f076d01acc3ab15cae19be7fb1605fdb03b6b513b28c98322647e55f75c1fbc797b3e38d3c
SSDEEP 48:HvdrdOpcpuzPJ9z3Y3dDzXXulkz2PdJpE/vdrdO3cW8zPJ9zDYDpdDzXXulkz2PV:JpuzBJ3OzHumzK2vW8zBJDczHumzP8
TLSH
T119A1D00416E61A17F2F79E7759B27E02D977B489DA450FCE00C04B200DBBA80A9E9F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

53NWMO1BRQ3SVN7ZBHZI.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\53NWMO1BRQ3SVN7ZBHZI.temp
Size 4KB
SHA256 71e1cac700cadefdbdabf9e18b0e9893b1273a617e64e659e3ce1c2570744f0d
MD5 b42591cea83ec0143750ce205ab234dd
SHA1 de8afc5e8717ffe1efb03a93792e1227bea2b38d
SHA512 21272c0e6f3adfe8bc09eb968a98742e0e577b0a3fcd0f147b4734fdf1e4bbc4f391fffc133cfbc91d1ac44c4d78c45dac6463ad56cb9226c82afd81d04034e0
SSDEEP 48:mvdrdO3cW8zPJ9z3Y3dDzXXulkz2PdJpESvdrdO3cW8zPJ9zDYDpdDzXXulkz2PV:sW8zBJ3OzHumzK24W8zBJDczHumzP8
TLSH
T14CA1F10416E61A17F2F79E7759B27E029977B589DA050FCE00C04B200DBBA84ADE9F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SUPRFGJYA7AFST5CV05T.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SUPRFGJYA7AFST5CV05T.temp
Size 4KB
SHA256 78d9715902c3c9d813fdb01a29e09248193c628140f23c687c08f17db139951e
MD5 2216f79fd862800447c4ebb7b58b99a3
SHA1 b0a6086e793fb9fc416f1b157f2bedb8a046f5a5
SHA512 c1938a5cbc19919f210278a9a4916e5316d4ba5e1a5982ab095a0aaa6e88359f77d33ff80117e7018b6c7f3c7862fdd19801ceb5d0e9444994eb2e0f9e83849e
SSDEEP 48:MvdrdO3cW8zPJ9z3Y3dDzXXulkz2PdJpEEvdrdO3cW8zPJ9zDYDpdDzXXulkz2PV:iW8zBJ3OzHumzK2qW8zBJDczHumzP8
TLSH
T178A1E20416E61617F2F79E7759B27E029977B585DA050FCE00C14B200DBBA80ADE9F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Y83NSV92N95CFBORFVF0.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Y83NSV92N95CFBORFVF0.temp
Size 4KB
SHA256 ca143c4ac988af0906c08b17c1dcf1d4e59c76660726cc4ff9ca76d72affcfb0
MD5 cbdfc39fff2a9dafaf2329225ee443a3
SHA1 15261f85a1e10a265aa2ae95a1890561db957378
SHA512 7eef2c1e8869391b4dd091569e19504f4d6516b069a2a8bcb766ecf778e7d6925202808b06604cac295e7511b9669d99451b05258eb2ccabd206cb09ba6d6997
SSDEEP 48:uvdrdO3cW8zPJ9z3Y3dDzXXulkz2PdJpECvdrdO3cW8zPJ9zDYDpdDzXXulkz2PV:kW8zBJ3OzHumzK2oW8zBJDczHumzP8
TLSH
T108A1F10416E61A17F2F79E7759B27E028977B589DA050FCE00C047200DBBA84ADE9F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/372-213-0x00007FFC67530000-0x00007FFC67531000-memory.dmp

Download

memory/1632-75-0x00007FFC67530000-0x00007FFC67531000-memory.dmp

Download

memory/2864-131-0x00007FFC679C0000-0x00007FFC679C1000-memory.dmp

Download

memory/2864-132-0x00007FFC68420000-0x00007FFC68421000-memory.dmp

Download