risepro | hxxps://www[.]winkeyfinder[.]com/

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 19:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.winkeyfinder.com/

Score

10^/10

risepro discovery persistence stealer

Malware Config

Signatures

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Downloads MZ/PE file

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	NW_store.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	NW_store.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	NW_store.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	PcAppStore.exe

Executes dropped EXE 14 IoCs

pid	Process
4404	Setup.exe
4428	nsuD062.tmp
2856	PcAppStore.exe
5984	PcAppStoreWatchdog.exe
2384	NW_store.exe
5572	NW_store.exe
5732	NW_store.exe
2364	NW_store.exe
2012	NW_store.exe
412	NW_store.exe
6476	NW_store.exe
2344	NW_store.exe
6568	NW_store.exe
6684	NW_store.exe

Loads dropped DLL 52 IoCs

pid	Process
4404	Setup.exe
4404	Setup.exe
4404	Setup.exe
4404	Setup.exe
4404	Setup.exe
4404	Setup.exe
4404	Setup.exe
4404	Setup.exe
4404	Setup.exe
4404	Setup.exe
4428	nsuD062.tmp
4428	nsuD062.tmp
4428	nsuD062.tmp
4428	nsuD062.tmp
4428	nsuD062.tmp
4428	nsuD062.tmp
4428	nsuD062.tmp
4428	nsuD062.tmp
4428	nsuD062.tmp
2384	NW_store.exe
2384	NW_store.exe
2384	NW_store.exe
5572	NW_store.exe
2364	NW_store.exe
5732	NW_store.exe
2364	NW_store.exe
2364	NW_store.exe
5732	NW_store.exe
5732	NW_store.exe
5732	NW_store.exe
5732	NW_store.exe
5732	NW_store.exe
5732	NW_store.exe
2012	NW_store.exe
2012	NW_store.exe
2012	NW_store.exe
412	NW_store.exe
412	NW_store.exe
412	NW_store.exe
412	NW_store.exe
6476	NW_store.exe
6476	NW_store.exe
6476	NW_store.exe
2344	NW_store.exe
2344	NW_store.exe
2344	NW_store.exe
6568	NW_store.exe
6684	NW_store.exe
6568	NW_store.exe
6568	NW_store.exe
6684	NW_store.exe
6684	NW_store.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PcAppStoreWatchdog = "\"C:\\Users\\Admin\\PCAppStore\\PcAppStoreWatchdog.exe\" /guid=50B25195-D6C8-43BB-B2CA-A8BD616967EFX /rid=20240619194412.185240660640 /ver=fa.1091o"	nsuD062.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PCAppStore = "\"C:\\Users\\Admin\\PCAppStore\\PCAppStore.exe\" /init default"	nsuD062.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PcAppStoreUpdater = "\"C:\\Users\\Admin\\PCAppStore\\AutoUpdater.exe\" /i"	nsuD062.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	PcAppStore.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	NW_store.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	NW_store.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	NW_store.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	NW_store.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	NW_store.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	NW_store.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133632998657438573"	NW_store.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2080292272-204036150-2159171770-1000\{E9D08055-4AC7-4077-89E5-F6C4A40E6E9E}	msedge.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 116888.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\PCAppStore\assets\images\css2?family=Inter:wght@400;500;600;700&family=Open+Sans:wght@400;600;700&family=Roboto:wght@400;500;700&display=swap	NW_store.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 486379.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe
2052	msedge.exe
2052	msedge.exe
5072	identity_helper.exe
5072	identity_helper.exe
1612	msedge.exe
1612	msedge.exe
5720	msedge.exe
5720	msedge.exe
4404	Setup.exe
4404	Setup.exe
4404	Setup.exe
4404	Setup.exe
4404	Setup.exe
4404	Setup.exe
4404	Setup.exe
4404	Setup.exe
4428	nsuD062.tmp
4428	nsuD062.tmp
4428	nsuD062.tmp
4428	nsuD062.tmp
4428	nsuD062.tmp
4428	nsuD062.tmp
2856	PcAppStore.exe
2856	PcAppStore.exe
2856	PcAppStore.exe
2856	PcAppStore.exe
5984	PcAppStoreWatchdog.exe
5984	PcAppStoreWatchdog.exe
5984	PcAppStoreWatchdog.exe
5984	PcAppStoreWatchdog.exe
2856	PcAppStore.exe
2856	PcAppStore.exe
5572	NW_store.exe
5572	NW_store.exe
5572	NW_store.exe
5572	NW_store.exe
2384	NW_store.exe
2384	NW_store.exe
2856	PcAppStore.exe
2856	PcAppStore.exe
2856	PcAppStore.exe
2856	PcAppStore.exe
6652	msedge.exe
6652	msedge.exe
6652	msedge.exe
6652	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2384	NW_store.exe
Token: SeCreatePagefilePrivilege	2384	NW_store.exe
Token: SeShutdownPrivilege	2384	NW_store.exe
Token: SeCreatePagefilePrivilege	2384	NW_store.exe
Token: SeShutdownPrivilege	2384	NW_store.exe
Token: SeCreatePagefilePrivilege	2384	NW_store.exe
Token: SeShutdownPrivilege	2384	NW_store.exe
Token: SeCreatePagefilePrivilege	2384	NW_store.exe
Token: SeSecurityPrivilege	6248	msiexec.exe
Token: SeShutdownPrivilege	2384	NW_store.exe
Token: SeCreatePagefilePrivilege	2384	NW_store.exe
Token: SeShutdownPrivilege	2384	NW_store.exe
Token: SeCreatePagefilePrivilege	2384	NW_store.exe
Token: SeShutdownPrivilege	2384	NW_store.exe
Token: SeCreatePagefilePrivilege	2384	NW_store.exe
Token: SeShutdownPrivilege	2384	NW_store.exe
Token: SeCreatePagefilePrivilege	2384	NW_store.exe
Token: SeShutdownPrivilege	2384	NW_store.exe
Token: SeCreatePagefilePrivilege	2384	NW_store.exe
Token: SeShutdownPrivilege	2384	NW_store.exe
Token: SeCreatePagefilePrivilege	2384	NW_store.exe
Token: SeShutdownPrivilege	2384	NW_store.exe
Token: SeCreatePagefilePrivilege	2384	NW_store.exe
Token: SeShutdownPrivilege	2384	NW_store.exe
Token: SeCreatePagefilePrivilege	2384	NW_store.exe
Token: SeShutdownPrivilege	2384	NW_store.exe
Token: SeCreatePagefilePrivilege	2384	NW_store.exe
Token: SeShutdownPrivilege	2384	NW_store.exe
Token: SeCreatePagefilePrivilege	2384	NW_store.exe
Token: SeShutdownPrivilege	2384	NW_store.exe
Token: SeCreatePagefilePrivilege	2384	NW_store.exe
Token: SeShutdownPrivilege	2384	NW_store.exe
Token: SeCreatePagefilePrivilege	2384	NW_store.exe
Token: SeShutdownPrivilege	2384	NW_store.exe
Token: SeCreatePagefilePrivilege	2384	NW_store.exe
Token: SeShutdownPrivilege	2384	NW_store.exe
Token: SeCreatePagefilePrivilege	2384	NW_store.exe
Token: SeShutdownPrivilege	2384	NW_store.exe
Token: SeCreatePagefilePrivilege	2384	NW_store.exe
Token: SeShutdownPrivilege	2384	NW_store.exe
Token: SeCreatePagefilePrivilege	2384	NW_store.exe
Token: SeShutdownPrivilege	2384	NW_store.exe
Token: SeCreatePagefilePrivilege	2384	NW_store.exe
Token: SeShutdownPrivilege	2384	NW_store.exe
Token: SeCreatePagefilePrivilege	2384	NW_store.exe
Token: SeShutdownPrivilege	2384	NW_store.exe
Token: SeCreatePagefilePrivilege	2384	NW_store.exe
Token: SeShutdownPrivilege	2384	NW_store.exe
Token: SeCreatePagefilePrivilege	2384	NW_store.exe
Token: SeShutdownPrivilege	2384	NW_store.exe
Token: SeCreatePagefilePrivilege	2384	NW_store.exe
Token: SeShutdownPrivilege	2384	NW_store.exe
Token: SeCreatePagefilePrivilege	2384	NW_store.exe
Token: SeShutdownPrivilege	2384	NW_store.exe
Token: SeCreatePagefilePrivilege	2384	NW_store.exe
Token: SeShutdownPrivilege	2384	NW_store.exe
Token: SeCreatePagefilePrivilege	2384	NW_store.exe
Token: SeShutdownPrivilege	2384	NW_store.exe
Token: SeCreatePagefilePrivilege	2384	NW_store.exe
Token: SeShutdownPrivilege	2384	NW_store.exe
Token: SeCreatePagefilePrivilege	2384	NW_store.exe
Token: SeShutdownPrivilege	2384	NW_store.exe
Token: SeCreatePagefilePrivilege	2384	NW_store.exe
Token: SeShutdownPrivilege	2384	NW_store.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2856	PcAppStore.exe
2856	PcAppStore.exe
2856	PcAppStore.exe
2384	NW_store.exe
2384	NW_store.exe
2384	NW_store.exe
2384	NW_store.exe
2384	NW_store.exe
2384	NW_store.exe
2384	NW_store.exe
2384	NW_store.exe
2384	NW_store.exe
2384	NW_store.exe
2384	NW_store.exe
2384	NW_store.exe
2384	NW_store.exe
2384	NW_store.exe
2384	NW_store.exe
2384	NW_store.exe
2856	PcAppStore.exe
2856	PcAppStore.exe
2384	NW_store.exe
2384	NW_store.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2856	PcAppStore.exe
2856	PcAppStore.exe
2856	PcAppStore.exe
2856	PcAppStore.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2856	PcAppStore.exe
2856	PcAppStore.exe
2856	PcAppStore.exe
2856	PcAppStore.exe
2856	PcAppStore.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2212	2052	msedge.exe	82
PID 2052 wrote to memory of 2212	2052	msedge.exe	82
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 3968	2052	msedge.exe	83
PID 2052 wrote to memory of 2972	2052	msedge.exe	84
PID 2052 wrote to memory of 2972	2052	msedge.exe	84
PID 2052 wrote to memory of 3988	2052	msedge.exe	85
PID 2052 wrote to memory of 3988	2052	msedge.exe	85
PID 2052 wrote to memory of 3988	2052	msedge.exe	85
PID 2052 wrote to memory of 3988	2052	msedge.exe	85
PID 2052 wrote to memory of 3988	2052	msedge.exe	85
PID 2052 wrote to memory of 3988	2052	msedge.exe	85
PID 2052 wrote to memory of 3988	2052	msedge.exe	85
PID 2052 wrote to memory of 3988	2052	msedge.exe	85
PID 2052 wrote to memory of 3988	2052	msedge.exe	85
PID 2052 wrote to memory of 3988	2052	msedge.exe	85
PID 2052 wrote to memory of 3988	2052	msedge.exe	85
PID 2052 wrote to memory of 3988	2052	msedge.exe	85
PID 2052 wrote to memory of 3988	2052	msedge.exe	85
PID 2052 wrote to memory of 3988	2052	msedge.exe	85
PID 2052 wrote to memory of 3988	2052	msedge.exe	85
PID 2052 wrote to memory of 3988	2052	msedge.exe	85
PID 2052 wrote to memory of 3988	2052	msedge.exe	85
PID 2052 wrote to memory of 3988	2052	msedge.exe	85
PID 2052 wrote to memory of 3988	2052	msedge.exe	85
PID 2052 wrote to memory of 3988	2052	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.winkeyfinder.com/
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa993e46f8,0x7ffa993e4708,0x7ffa993e4718
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,9415186720940031236,1087727237976922349,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,9415186720940031236,1087727237976922349,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,9415186720940031236,1087727237976922349,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9415186720940031236,1087727237976922349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9415186720940031236,1087727237976922349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9415186720940031236,1087727237976922349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,9415186720940031236,1087727237976922349,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,9415186720940031236,1087727237976922349,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9415186720940031236,1087727237976922349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9415186720940031236,1087727237976922349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9415186720940031236,1087727237976922349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9415186720940031236,1087727237976922349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9415186720940031236,1087727237976922349,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9415186720940031236,1087727237976922349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9415186720940031236,1087727237976922349,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9415186720940031236,1087727237976922349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2156,9415186720940031236,1087727237976922349,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6624 /prefetch:8
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2156,9415186720940031236,1087727237976922349,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6636 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2156,9415186720940031236,1087727237976922349,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6792 /prefetch:8
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9415186720940031236,1087727237976922349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2156,9415186720940031236,1087727237976922349,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7276 /prefetch:8
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2156,9415186720940031236,1087727237976922349,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5720
- C:\Users\Admin\Downloads\Setup.exe
  "C:\Users\Admin\Downloads\Setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://pcapp.store/installing.php?guid=50B25195-D6C8-43BB-B2CA-A8BD616967EFX&winver=19041&version=fa.1091o&nocache=20240619194347.281&_fcid=1718826205847774
    3⤵
    PID:5756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xfc,0x128,0x7ffa993e46f8,0x7ffa993e4708,0x7ffa993e4718
      4⤵
      PID:5772
- - C:\Users\Admin\AppData\Local\Temp\nsuD062.tmp
    "C:\Users\Admin\AppData\Local\Temp\nsuD062.tmp" /internal 1718826205847774 /force
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:4428
  - - C:\Users\Admin\PCAppStore\PcAppStore.exe
      "C:\Users\Admin\PCAppStore\PcAppStore.exe" /init default
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:2856
    - - C:\Users\Admin\PCAppStore\nwjs\NW_store.exe
        
        .\nwjs\NW_store.exe .\ui\.
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:2384
      - C:\Users\Admin\PCAppStore\nwjs\NW_store.exe
        
        C:\Users\Admin\PCAppStore\nwjs\NW_store.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\pc_app_store\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\pc_app_store\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\pc_app_store\User Data" --annotation=plat=Win64 --annotation=prod=pc_app_store --annotation=ver=0.1.0 --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0x7ffa8640a960,0x7ffa8640a970,0x7ffa8640a980
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:5572
      - C:\Users\Admin\PCAppStore\nwjs\NW_store.exe
        
        "C:\Users\Admin\PCAppStore\nwjs\NW_store.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2088 --field-trial-handle=2092,i,17013381689459128071,13790892004741253470,262144 --variations-seed-version /prefetch:2
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5732
      - C:\Users\Admin\PCAppStore\nwjs\NW_store.exe
        
        "C:\Users\Admin\PCAppStore\nwjs\NW_store.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --start-stack-profiler --mojo-platform-channel-handle=2112 --field-trial-handle=2092,i,17013381689459128071,13790892004741253470,262144 --variations-seed-version /prefetch:3
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2364
      - C:\Users\Admin\PCAppStore\nwjs\NW_store.exe
        
        "C:\Users\Admin\PCAppStore\nwjs\NW_store.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --mojo-platform-channel-handle=2312 --field-trial-handle=2092,i,17013381689459128071,13790892004741253470,262144 --variations-seed-version /prefetch:8
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2012
      - C:\Users\Admin\PCAppStore\nwjs\NW_store.exe
        
        "C:\Users\Admin\PCAppStore\nwjs\NW_store.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --nwjs --extension-process --no-appcompat-clear --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\PCAppStore\nwjs\gen" --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3116 --field-trial-handle=2092,i,17013381689459128071,13790892004741253470,262144 --variations-seed-version /prefetch:2
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        NTFS ADS
        
        PID:412
      - C:\Users\Admin\PCAppStore\nwjs\NW_store.exe
        
        "C:\Users\Admin\PCAppStore\nwjs\NW_store.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --mojo-platform-channel-handle=4420 --field-trial-handle=2092,i,17013381689459128071,13790892004741253470,262144 --variations-seed-version /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6476
      - C:\Users\Admin\PCAppStore\nwjs\NW_store.exe
        
        "C:\Users\Admin\PCAppStore\nwjs\NW_store.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --mojo-platform-channel-handle=4480 --field-trial-handle=2092,i,17013381689459128071,13790892004741253470,262144 --variations-seed-version /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2344
      - C:\Users\Admin\PCAppStore\nwjs\NW_store.exe
        
        "C:\Users\Admin\PCAppStore\nwjs\NW_store.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --mojo-platform-channel-handle=4764 --field-trial-handle=2092,i,17013381689459128071,13790892004741253470,262144 --variations-seed-version /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6568
      - C:\Users\Admin\PCAppStore\nwjs\NW_store.exe
        
        "C:\Users\Admin\PCAppStore\nwjs\NW_store.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --mojo-platform-channel-handle=4352 --field-trial-handle=2092,i,17013381689459128071,13790892004741253470,262144 --variations-seed-version /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.mobi-gamez.com/directory/best_solitaire_games?c=6283282216&p_key=FATNAT01
        5⤵
        
        PID:7116
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa993e46f8,0x7ffa993e4708,0x7ffa993e4718
        6⤵
        
        PID:7132
  - - C:\Users\Admin\PCAppStore\PcAppStoreWatchdog.exe
      "C:\Users\Admin\PCAppStore\PcAppStoreWatchdog.exe" /guid=50B25195-D6C8-43BB-B2CA-A8BD616967EFX /rid=20240619194412.185240660640 /ver=fa.1091o
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9415186720940031236,1087727237976922349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2736 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9415186720940031236,1087727237976922349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7316 /prefetch:1
  2⤵
  PID:6468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9415186720940031236,1087727237976922349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:7036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9415186720940031236,1087727237976922349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7156 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2156,9415186720940031236,1087727237976922349,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7676 /prefetch:8
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9415186720940031236,1087727237976922349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7356 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,9415186720940031236,1087727237976922349,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7708 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5528

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6248

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x538 0x53c
1⤵
PID:6872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\773CFF2C7835D48C4E76FE153DBA9F81_15174A80589B8DAF9768E9131F4845C0

Filesize
471B

MD5
87a78d925734119f045d411abddd43da

SHA1
11cc82dbf0dbf7623d3f4d0ffc1f55f73ab0943c

SHA256
b788a232ad969cdc84a1e85ffb7a2dd23cbe06e4bbd2a1666c980d917636964a

SHA512
ec3a34daa22fae035561512a764cc76fc300abd6fdca71144807c02aa6bf2127469e4279012a25d5a4734162526ba78f3167bfdd3666fa2fa2c05d6a2d3c4e83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE

Filesize
471B

MD5
e27bf0ea463d0e37173eb9a22a3a4d3a

SHA1
a09b6669bdecdac75736de079a0dee7bd2e76b99

SHA256
92dd942ecb488034116eaaacaf8b0dada613d767540186688352100e37d98165

SHA512
62f66905937234d6313a1be9ccada0008896f182a329bcfa427bac7946d5148dc06257e06aeca2109dbb9457bf21060f76907ed94020343b1b688d91fbcbd044

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\773CFF2C7835D48C4E76FE153DBA9F81_15174A80589B8DAF9768E9131F4845C0

Filesize
404B

MD5
a09271ff591f185fbcab5f9a81498999

SHA1
b3255ed37856bb7fed3ebf012eda0d0ba625d67f

SHA256
9d5f48f3ae2574409d5d13b37733b2ef7ba2e34f4204cd1e49d5b4429e368b30

SHA512
ac736abb00e79d9575b438576aa77e05f5c686b9fba65f545e5af1808f1e49aa732b2757432cbfbda1ed508d3f3d4cec4e5101fc700c909e4503dfce6e9c71c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE

Filesize
412B

MD5
c22f910bbeaad6bc2f14b8a4f262dab1

SHA1
7f6056e7ec9c75b38fb9b0abd5a2d2c7f86e5d50

SHA256
be454821aac5af5f9b90ff0af483e37c20525ceb6a1380c12fbf2a553b73010d

SHA512
a70ca259c20e06a5cfc2bb4e43b5931ac2e9d102073ae8e3f3a11f364ed3779a40ccfe0a4975dc52feead99463ec3fcce09adccb02232338852ca584dfd51436

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4ae29c4a-4278-4352-88fd-326741d9cc5d.tmp

Filesize
6KB

MD5
d4cc7895c507e7dfa2ea0e8d2e4df8d2

SHA1
3ce8febdf3d09201a15219ad4d8f50050da687b6

SHA256
cb407944eb8298cea64b84522decbf29a8c86692bd1a9c6cc4d4b649726a14b1

SHA512
9ead27fbb4115a0b82912c61e45a36136665c7281d00e24d90eade0ec1936cba18b2eb944a16082bb80fb10eb09a52955c3cf4335c84d47f5843d51889c2651e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
19KB

MD5
93069ed141b906f40645ff8d0cacedbe

SHA1
44f6f2ae47c447dbff22d4a105a48383dc24d8c1

SHA256
b6631d1b36e91ee87fd91575b16ebc9bf6bc264e85e8f0d37bbf7e08d69d5681

SHA512
90eb76355d2be14f89ec2c8a72f3f8534619c22b5b562cd062526351771d006206c7def2434ef5cc22f3637ccf275666c984a72213aae2998bf7623f930308f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
19KB

MD5
ce1093c800c0933d7c9674eda75790d8

SHA1
371c2dcde092f51b18852e2617bc6c0c176f5873

SHA256
57781a723db9a2483067bcbc89d1f30f7e2f22ae2d18aab1e45ad894d8cdab89

SHA512
fdbb31c607cc9a4bd75c42cbc552fb40d82e53804d156244ed2daa124c75e1680b908589f7a3ad8888b9b03ebfd1f4b3e83e19f84e3a746cf210d0b8a1678533

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
91KB

MD5
4d7cef078c8e161a5f51c75a189dc93f

SHA1
f063b37bb8f3329794f7d9673de51bf91f1196b9

SHA256
84fef7cf8887028b696afde1e12333c2b36b5bd60e5d72fa58ff938414d80284

SHA512
25554fdb9a4a0edbd5edbabda97024439504d8ce188fd16e987f7c412bc5056155d9adfe5ee70199e3f4cc1f32a0b7f34975cff1bcf11479bc5c35807d90a916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

Filesize
108KB

MD5
30b8986157c21f37b92db575cafe3809

SHA1
2849932b937f1465d80c2c8502f899510c038b30

SHA256
5e14944854bed6be3398ffb1dadad9e492345555c688111c323babb4ab0a489d

SHA512
154bf3a81aacfda7ec06b3449dbae391bdff0dbffa481c4f2c07b4397e00878e52a3db2f1d3c6f24fe943d7ebdde5d4f8eb9e513d70423e5e6d7f5e60ba2f6ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

Filesize
45KB

MD5
30a274cd01b6eeb0b082c918b0697f1e

SHA1
393311bde26b99a4ad935fa55bad1dce7994388b

SHA256
88df0b5a7bc397dbc13a26bb8b3742cc62cd1c9b0dded57da7832416d6f52f42

SHA512
c02c5894dfb5fbf47db7e9eda5e0843c02e667b32e6c6844262dd5ded92dd95cc72830a336450781167bd21fbfad35d8e74943c2817baac1e4ca34eaad317777

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
23f12d7a4d0fd4d3894c50e5bd6f6749

SHA1
fd6366db136c641ec54ecf0118746e68d2b0d57c

SHA256
33e5deecf49a8c8d548d17a3a0176671fb1cb875c8e163e98116f86f0a7ae875

SHA512
9e870f09e5f28aa0af5225796b5bff39c51fa69ead8eb10cc5eb57552deb4dcd9a6e4d0313f2877d80283d20f5884d5dcd1fbe2207b962cb402d7d1243da05d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
387205547f2f6c663d8263a243305f02

SHA1
2ab54435cddb36b5016dda9b6dc3237912f98653

SHA256
fbf4ad03b507bf3920e81dfdc1ba2b3f0d4e21bb370a0a67374305898581a23e

SHA512
7c380383a17992c5c83f3c12eda769d12f6c51347b4631df7550c40a186fd921a95853d9818712abf85e560570ea4e3b465c17be384c029ae3440fe8bdde19fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
bf9cc668aee64404ebfe11d3857b0b99

SHA1
851a3b62fcfdb72de65e1b510842cd7ec9151965

SHA256
9c4c8d7cd9245b05a1d5cd190dcffa2986ac1a51cec77be43a1afaf221fac8f6

SHA512
7799b370d9934cf57aea4549bff43364f9c4d3b096cbd1910d7c735bf3ae84f068cd5c6c8a4ecaec1752f13c3b2362034571caec6d58cc0d3b6cacf15ef46cce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
60b2dc31cf3d938fb4adbcb94334c78b

SHA1
3556fe1c6fdfc38bcbe992979e927c98b0ba39cf

SHA256
e83f70bd910169920d300597e0de28e95c561effa358eea83538e326b10905bb

SHA512
63fed3adf53c83d27a8d25e434679b730017fb95cc499a8c3921f72fcb59f4d491d3ae8e4a84ea46f1ba5790184cc882e982d366229c613cc9390969bdfc4ac5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
02235d850086e6b069bd4d09e74c7a35

SHA1
c7b74877ebd5be1dd7bedef953b205dfd97674f6

SHA256
bd7e20d62acc1c497f7abde2e04aec05ef8d9899953c53695898957c87247b14

SHA512
95e2f3beda5fc23ff92bd17255fa1d1c883d197eebcd711fe98b5e02140281fd13e5ca3cec71c749d13b9bce9eecc7df8f92561a1b26eaae374727709daf1f62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
badd4e8ff745eb96e36801a8c84a723b

SHA1
be95c2b8996a17b4d12e5f62114d484e10437571

SHA256
5ba71518476feb351fb68343383435bcaaed1cb68c075a034835ca20db19edce

SHA512
98190c9a5e97e3a89c279f6dd0599815f43757cb3438d2a300f0e58c69bd72a56dcf7b1678a4910e3ce66a72b3bd5a322f3a9abcf87b54c5b76ef4d8a54ab9b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
5af4b171112b28d2a530ae8ab53f2fbb

SHA1
bb6c2c3dd31e3f71912fe9fe02d44d0812806978

SHA256
e1562adae110b4fd306e442cb6ccb7a94b8d2fe5010feb05309091d8eb815f4f

SHA512
9bff31a18362041be9737ce502755aa814da6ffa4ce0c44c1cfab430d1bd8f51fd7db416f24dfac83ac22c98b9024974337bac6adec29129d5af70eb8f434ba0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
ed886e7bf4eae26562b3d599f65a5d32

SHA1
2ba25b3e765577528b22c820b801787830b26f78

SHA256
278bb14f5b44a8d2253bb1353edbc0d4a55fa1534915f4960f2ca6393741e275

SHA512
f75f272148532d660b8a3a54e44cbf0b12012b6b278af7f45819eff22b85effcc384cd1943255a649bab66353cbd0749ec054e0a8ee695ec0923f1b1a2446a76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
877dddc16589f3c35ec4751999ed69f9

SHA1
d63d77315f3ebb3bc98f32e0350d2fe52674bd15

SHA256
ac9f2a882ed6f24d76332b8907a5b53078839275c81afb03505222849158c82e

SHA512
6bdc4692e869a8d282196335d11ef8cee68b0c21133b0f6abb3d4b7c8cec16ab6881b9c44285459bf1f6989bd819ab6e6ad884f33bd519e5c858e4c16fd9f18e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
5c032ea6f2b3a073439df7abce66bb0d

SHA1
54088574dce61a595b7a074c1329a7a0a227c01e

SHA256
d5bb32a01cdaf4838c3300a6cdd5e5be317350fa60f85f6a3f4c568e2fdc4faa

SHA512
121cbdd45ab80d6879dad1d71be97cf85c07122b2211d2bf2182378e4a8adba7d2b705d6fab706d6fe2955fd7e197600c933e77a5220576765736ab90cd852db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
322ce35171186fbccc6473df2c5b8c06

SHA1
c01c2d4b569c33ae71d4db157e0a758231284b87

SHA256
16b457f01de6401216bf76cabf173243d2f7f252d4ce861cddce41178d63ce19

SHA512
b2a668d6aad5d703be14561833903fef83187e9cd772db9336c4f10fec8547d9456528d6c20e6bcf7ccea45399e3c65701c7f38946198d8ccdedfbc41f68e76f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
2324c3f476e571dc9ca5a78d03ea8f8e

SHA1
6018767a3a036f2e93b521e2e2e016f9deb78551

SHA256
eeea5452b957b861c445d026f00ec29df9885387c0c0f6ef1d6b56ce30d83c05

SHA512
0faf5556d4f915699294b61189cbf1708512b3b5be6ddbbc61416026b32ea2fff3de842e2fd9779476547d12fce617aeb73b973836dee63603d2251c393b4daa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c64c6097cadf4a6f7895590b88a460d1

SHA1
19cb466774ac91619517dc9906e43ca2f841d4c9

SHA256
dc071b00cb64363084ccdeee1c949dee9a82728631ded161f07c6cfe0579fab3

SHA512
26d22ca9733581802b472464c3f15b4919cb1a1fb10dfe26f1f837df8975d8c1b1fb1606827858af44f359fb3b757d12dc3574f55c5f52d98f58a245058618a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
28200b97c0ca891cc7ccf01f5531eac5

SHA1
a3ff28912c00f5bbc50ca28676f395122743af39

SHA256
ef44f7cddfa7cafff83198ff48ebc12360a43aed36e0448e46f20bf606833338

SHA512
d6bccb63b436b55ca22358ab72f5385f9a495895b88dd21b00c94b781b0622dedff17146eb0cfdf909101675749acd4fb4a59f035a4bea254a522f430d732ba2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
04c1aa4bf956e3f661498e5d2490762b

SHA1
c0c96190ee378e4df43c2a7e3090e02f79ce72d4

SHA256
2680df25b5b25dd9db742e4fe58cf07aff91909f5f1362006effcf417abcdcdc

SHA512
36b279c77d6273370956899b6b8f1c06b099acd0ea1fe1285b54b4183c08f2800885b6b449c6095d8e5904a2f47be8a953e0ccace6857dd824d236cf0b32ac38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e90c17d2481e43cbd0aa40d47f9c6028

SHA1
ef9f8cdbe06af6775ac5a2601c969be0bd846029

SHA256
831370f049c44646dfe081617ec48f760eac75501a4868b91eb1876b5a4b1306

SHA512
3414108be6ff6ead2950efd773c25d8fbbbb6ae92798d9d7b76717df06fbc22546c08b5eeea6c70f5cc1d649a88853274f2b0a26e0a6622ee3a92a5cc93269c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
54de64fed7c6dce3256b9955a3c3f0b5

SHA1
5ebd92e42ef24794fdeddb6aaa9d24de2c18005d

SHA256
68126f0268a2ee6f67f14e5ac5753e300e017cd97f3aaa75e1a7b446d9c680f7

SHA512
9ed6d2d4168ef623214df757516a0b0d66ae4f8a1d3230767e2fa2900a03728cec5a295b074636b7c65b832a1b5f1ce7518d5c3d3452902fa52a58dfba16f482

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
aec45e0788e7ccd1def376817cd87296

SHA1
e32e011372f47649428725fc71ff55ccea63ea6d

SHA256
1bade05ec7f548cf2b5d6e4cc54203d1fc55653beafb1bc221672cbd59fcf3fa

SHA512
1114166eed07067b6fe244c5f5b719919baf125192cae5c0febc51159b411155c63bc73002083485f6c118b0c1636604e9407d764c5a6ce955b89f390fb8d197

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a1ae.TMP

Filesize
871B

MD5
0a1966dbda82064a0d99727d70870851

SHA1
5cf09c3e718d3963f5711192b30c8da8841ed9fe

SHA256
98ebee81b2af421e782b32f30776f9c0b5cf3c285a4899f1eabcf462e62f5e61

SHA512
8687d8a34cdedc247b4d47b0fb457bc58a935fc64948881fe32f6e5a4947165db44d8ab8667583fe557d2a0b6cca7899cb779af6df1e05fb43fb3bc54b13916e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ce16e78fda433a79955e2c742f395712

SHA1
2f0147d3f588d9147420987b8599859121e66e81

SHA256
5dd6631cfe19272c78c663f1c753689399b5ce13d606611b1fafd1d853f0ecfe

SHA512
39ca63dfb09dc7baa2ac6f417aed2dc70ce5b6abb923ca0e68078f31ecc5b67dbb42a8524c64cef20d61ffa777d0c3c5e5250d0515ada932b16b7f3a7390baa3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0afe3c498c8bd8323448dbfec3c4f46c

SHA1
7415ec2f8539beb666b19e820f78fde03da9541c

SHA256
70c2308adae69cf2773944203592fcd2f00a285f196aa9b371187f1098a913cf

SHA512
5083a1aae8c78c9b4401eb3ddcf6b032c8c3ab2fd88952877b4cabf29675448b4ba1b79bb844ed5677108468b6482b38650312d06ac217fbd14710470da3875d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
010c89e729a50f5d86fb76d66f9c8a07

SHA1
3eba34475c34b54dc006502c52f4ad6e57434ed4

SHA256
a1a99853cdf6772ea8674fb1d4bc4d7459c822282517bef3a5ea8f4654bb4c38

SHA512
aa457c5b1061cc105a80efc5fbd26c9500222ce27cdbb40cdf867ceefe31c15997f3eccdc0ebbd89f61852a708bbe16162d3355102f3f8df7d6e9ee58fa08865

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp491.tmp\Math.dll

Filesize
67KB

MD5
85428cf1f140e5023f4c9d179b704702

SHA1
1b51213ddbaedfffb7e7f098f172f1d4e5c9efba

SHA256
8d9a23dd2004b68c0d2e64e6c6ad330d0c648bffe2b9f619a1e9760ef978207a

SHA512
dfe7f9f3030485caf30ec631424120030c3985df778993342a371bf1724fa84aa885b4e466c6f6b356d99cc24e564b9c702c7bcdd33052172e0794c2fdecce59

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszB7B8.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszB7B8.tmp\inetc.dll

Filesize
38KB

MD5
a35cdc9cf1d17216c0ab8c5282488ead

SHA1
ed8e8091a924343ad8791d85e2733c14839f0d36

SHA256
a793929232afb78b1c5b2f45d82094098bcf01523159fad1032147d8d5f9c4df

SHA512
0f15b00d0bf2aabd194302e599d69962147b4b3ef99e5a5f8d5797a7a56fd75dd9db0a667cfba9c758e6f0dab9ced126a9b43948935fe37fc31d96278a842bdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszB7B8.tmp\nsDialogs.dll

Filesize
9KB

MD5
6c3f8c94d0727894d706940a8a980543

SHA1
0d1bcad901be377f38d579aafc0c41c0ef8dcefd

SHA256
56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

SHA512
2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszB7B8.tmp\nsJSON.dll

Filesize
23KB

MD5
f4d89d9a2a3e2f164aea3e93864905c9

SHA1
4d4e05ee5e4e77a0631a3dd064c171ba2e227d4a

SHA256
64b3efdf3de54e338d4db96b549a7bdb7237bb88a82a0a63aef570327a78a6fb

SHA512
dbda3fe7ca22c23d2d0f2a5d9d415a96112e2965081582c7a42c139a55c5d861a27f0bd919504de4f82c59cf7d1b97f95ed5a55e87d574635afdb7eb2d8cadf2

Download Submit
C:\Users\Admin\AppData\Local\pc_app_store\User Data\Crashpad\metadata

Filesize
114B

MD5
40e8ac05451d31a97e6d3535a729a800

SHA1
c7af36193a853f667195f8a083ec826d91f0e15d

SHA256
e00c402641ad18156a6600d53183b8725fb37c1523b71835a747c0328cc56155

SHA512
41b97c4bef16e780cd37b79bfdc5bf9606bb0d5550e708a3bcd2d81d24db792f7abba4f7aeb0cae1b1f1e9734416586b517852a03048cbe9f6c40f2cfe0462ab

Download Submit
C:\Users\Admin\AppData\Local\pc_app_store\User Data\Crashpad\reports\d0eeb3af-c513-4d92-8efd-536d9684af8f.dmp

Filesize
1.9MB

MD5
f9be6c42fd489f480e92bc8ae7cced84

SHA1
c00a7b9cf3665a9fac5382d5f1fbf7b3edaee3dc

SHA256
8af3abf8cb0af34a2e0f38f94318874129cf387951f58108f3a4238d6af3be42

SHA512
f0d9cf3b5e8f0ebddc995d28ab1a98e0dcd846a47d4475d98f2962ee098e25e8d3c6594240cdb645888044042af0594a10a9cb59e55c2cf63998849d8fdf49bb

Download Submit
C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Cache\Cache_Data\f_00000b

Filesize
416KB

MD5
78b151f06a4e0f5c23ee128bf779c507

SHA1
9b4eee484605fa7cd4a3fcb41ddc140354615f48

SHA256
9760d9bde7fdfeae010de3e38ee6f2851f5b0b9f1974228cf69a296fd5f2be34

SHA512
0aaed169ecf34227aef3fce5ea608b2f9471bc991c3de555aba867a209e6c71f7cd45e5458d03f80ac521abdf045642cd94c0a95d3a030cb856490b2859a21a5

Download Submit
C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Cache\Cache_Data\f_000011

Filesize
516KB

MD5
cca340197220e96581d6aca8f94927e0

SHA1
f31cbc430ed7661698a5b0e2ef63c2e0716193ea

SHA256
26f2cce66aedc8daee96aa03a5f980ccffdbc216d2e7e5bad81d3a5b5d8e5c5f

SHA512
8091dd259e2fa23877d0341bedb3afb9a25f94669309e2c913bf2b9a4e769c35759bfdb6b0e4ac8591231f95e1187e86b15e60db6220f9e7d8a11a370325b0c0

Download Submit
C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
72B

MD5
562895591a1c7cf8daaa3aec2a5cd318

SHA1
ae7133fb17ab329129e5ae73c7418c6ed9dc308d

SHA256
d21cb834a991d0df3deb8721af49e5330e949db41ba533f150c873d061acc229

SHA512
233af5e28574ddbf3007e193282d668ac721850fecb77193f52063a98c9450725d0ec0f6c7d2d1211db54e85cfab39ae8bca8dce81b4d1401ce84d69b43dad7e

Download Submit
C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
06c9fec7008adcb0fc7f43a229f54adb

SHA1
d6939fae56e3e2a91f01da5f99fe8fe5a30e8a0d

SHA256
2af04ea8682f3161785ef879d47adc8a8072d2c8735b7ba1846bfb25b8f20df8

SHA512
4d7c4ed6f705b384cf7cadc64a5f13640ea2a8a7468bb2fad1122a4fe8f6dbf37c792b2092b031ebdfb5c4fb19766fc1aa2df32148f9d4f7101337f3809f3c8f

Download Submit
C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Google Profile.ico

Filesize
148KB

MD5
728fe78292f104659fea5fc90570cc75

SHA1
11b623f76f31ec773b79cdb74869acb08c4052cb

SHA256
d98e226bea7a9c56bfdfab3c484a8e6a0fb173519c43216d3a1115415b166d20

SHA512
91e81b91b29d613fdde24b010b1724be74f3bae1d2fb4faa2c015178248ed6a0405e2b222f4a557a6b895663c159f0bf0dc6d64d21259299e36f53d95d7067aa

Download Submit
C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
853fc549ac895993d1bf8855fdaa9638

SHA1
197ff0d480a829433e0843502a019173abf2b970

SHA256
f2fa013290236e951d5d2c7ae8b8b654c04f74eb162d511b58b9d1a3e10c9483

SHA512
aa4209353556405ddf994d0d819fc3133748d9eb98860e4ab9fe4a8ef27acd6ef785dab6d28ccd29d72b4570c0d1a5387a9aa7356a5e689323376ffc2a6a4ba4

Download Submit
C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Network\Network Persistent State~RFe594bb5.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Preferences

Filesize
5KB

MD5
ffdae4d526746498a64f087fc65341ec

SHA1
f5a7aa5226b9c4739a70a9712e70015dc8a382f8

SHA256
66aab0ea24682ba2d80cd6c8638744f27bd490ff1993b5eddb62aa69ee854182

SHA512
06eaed9be0d26db9a781c2cd46ca281e6dba0e011aeea213882f68145067d949711d9c4a129f31d09adecd68691b0a38b34bbfa751fef8f61e29e40191d8a441

Download Submit
C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Preferences

Filesize
4KB

MD5
0124db65c7de3e9e12abcacf33cdc4fd

SHA1
f1395510f59358b3afe060fd9f23ea45a7382cbe

SHA256
7884a9a08fdcf3d0969741b4f7b4e57de2fbc63cf067193def885d408e194c97

SHA512
1c8fab27c64d59f843f8e8dd33014210a286024bf045d2ebe9c828f02ab6643b677f7afe4d698a9a800fc452cfb6c21dc33f5e9e2bcc8388d5713c42fc95c284

Download Submit
C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Preferences

Filesize
4KB

MD5
c8577e8d4366701f1cd9c43139770617

SHA1
e81975aec85a66683432d2656e6a68f21f0ab3b1

SHA256
4925c7cf0df972a550514a85891c4a835db4cc034caaa42cdca9aa8ea3ba53a0

SHA512
cd9469e13ecc233093c8c07498fbd08ef9f07f699903b81e322a5bf8dee92d20ae13fd7c8d10926baa9be4b44d7138c2f212cef96b1161c196060ff5096dd028

Download Submit
C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Preferences

Filesize
5KB

MD5
480d19949395479871197bdadf491eeb

SHA1
8828780cb484e4f0678954e9920ca01adeece607

SHA256
da6f96fb212d9424552eee5989ad8a7defacc006033a412acc8ff4f4dc803fe5

SHA512
f383b61d6e8308072ac0479fc53940b28acfc957268ef2d539f9d166ce3e840238e056ec02309345635085b15c470b6c9652556ce6616c2f7a2d8e51ccad741d

Download Submit
C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Preferences

Filesize
4KB

MD5
56d49361a42bb3774c8d45cf83404f69

SHA1
385040705c29e952429a5ff06af4d48d1ecee942

SHA256
f6c2b176179861970c6af8e360db8609bdbd4c7aa443f797894160d229b94fa3

SHA512
2992dabea57e07b8334f4e91388c4f424c7926140a6a5a7926c8484a1a4a7181631e435a7cfb25972450f1af6b3de9d51319c297f5edbb2cdf2e937be45b87ed

Download Submit
C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Preferences

Filesize
5KB

MD5
2609d0f1f0c479f773dea944aeba164a

SHA1
67b857628178d06052d7e67b697503388bfa7e14

SHA256
aff6d69efe342d077cfb98e529258be6b866a9183f8073a3fff3626c6084397c

SHA512
43fcaa6b82b22feb955f257306228aec1fa310de26966b21e5660b837d593ab6af9fdb6ec9cd57f04d544cb7f9c96fcd9cf48f59b91e17a43f6e35904c61fb2a

Download Submit
C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Preferences

Filesize
5KB

MD5
0b9c5273de102c16c002640f007cf20d

SHA1
e8476e4bedbf252ecd6360c75051dc4ce5996ce1

SHA256
cf2f6db0200e22f9e9e5a8f6f5326cd3fb5b78176c80d908d49b0dfe33b8aa89

SHA512
13dc58d53b62a3a0270360e87c9ed22ca612df332b88f9d41b2b50390bc1b52598172efd656e8eb42763260d733344d42d70d3a5ee7052c8599dda66acf9af1f

Download Submit
C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Preferences~RFe58876b.TMP

Filesize
4KB

MD5
4d0d7f2e043a4bde5d01f7d04242a13e

SHA1
2d93d8e669846b6c515886de27571a4e1af81194

SHA256
b3b4f446f79f0d82bb49eff75cf6f4c5acb1ae3a25fdfb922d6fcc29aed9fbd0

SHA512
faeeae25d5d5d40b5a589946a5444b57fc4935092a0275f289de6161d5fafa3d3db30faeba2de0e7a5fe86487d4744daaefc176be9e2fd24b4abd2b25d340beb

Download Submit
C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Web Applications\_nwjs_pcapp.store\pc_app_store.ico.md5

Filesize
16B

MD5
03e9f614a008075733c76883156b568b

SHA1
5f9cb1b06928487c4b836e9dedc688e8a9650b0b

SHA256
b1a6a6fb45ad1e13054c40dc7c09e3098ee830bcf1ebaec27f640ae4c64b8416

SHA512
7e6969c8908a6bf57bd2cb4457a7c78360468383acee589278e49829617e2f3b872dd8213e57a2ed8f512d444c67a2e619deabdc1394d1c39c7759ed3c744f94

Download Submit
C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\pc_app_store\User Data\GraphiteDawnCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\pc_app_store\User Data\GraphiteDawnCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\pc_app_store\User Data\GraphiteDawnCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\pc_app_store\User Data\GraphiteDawnCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\pc_app_store\User Data\Local State

Filesize
2KB

MD5
15e06345a8e54222fd9f2ddf94e8bc60

SHA1
70cd3c448065495f0f922cd14d446877a5369a2c

SHA256
ef841a2e691d6f52a5c93e8305a65dfd7c586748c175249a31a5083bc5b67282

SHA512
d9a35cc43f76332c01bb8f4fc538cc25c294f6d4033933663a04be9543cce1d8e3edc8e197651142a3d311b889082a688c826988e3ffc8027c071ad76e4d0d5f

Download Submit
C:\Users\Admin\AppData\Local\pc_app_store\User Data\Local State~RFe585dfa.TMP

Filesize
921B

MD5
bf6ac7e69acd0e00cafc227bf270bc82

SHA1
1222c1e156c4057f7dc0f9057267e39737f6d5f7

SHA256
2bb81a35d369d26ac433c2c3c4e5ec7be0f64c8f4c3a0cc12fb533d60132a077

SHA512
868f2b2a8534eb961bea019d88484a19e62b5f20dcc1c3e0ce1f7be965adcb13c5dc49c9f76772974bcffc31cfc99f2d1895ba3763fbdb1818de444193884e3a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
3bedd97c7d22fe015f67267dc020824e

SHA1
6d1aaaf917a7c47fab128519cd489d466b07aa86

SHA256
b3a4edd9bd183c87602e10e8559580fc6b65763df21155b9c76448add5f453d4

SHA512
47c4c7cd61f6e843c3af6cd97b7ab5ed305df3e87105f88836ba3db41b90302181a291ba815be4a2e05e0b34b86a54fc80bddd481b84eef42e91ec9ff5931925

Download Submit
C:\Users\Admin\Downloads\Setup.exe

Filesize
117KB

MD5
42c0e84b457ec8de956096db40236043

SHA1
c18a67e3542c44d678db9cf87c5972e22e624859

SHA256
4febf0d7a4355391a4b1c989e0db09e9f669b03b3f3213f08e236b948e4fc711

SHA512
2e1686a02711a68300168d663835a60d7678e89cc95ba423b1e79bd72efd06e34a9a912b2e6cf4c5b75a56e87e11714026a2fdffc537314aecad4b8bb4bb5ca9

Download Submit
C:\Users\Admin\PCAppStore\PcAppStore.exe

Filesize
2.0MB

MD5
fcefc6099c1265e7f7b703c7a0154c5a

SHA1
84f13c7724e24a4416f3d65c143f013d9e9dfcfc

SHA256
4a223cf0623913c903cfc2c0a1a8450405244d8b86c1020e970cbdf8e7a30184

SHA512
d4d1a0d781ca851c9738c5981f13eb023092ce71e0cd04b3ed8dcc942a8ece54b9a031230e300bbdaa4486792f75af768fdbb882b430f5915bec85bcc66cf3f5

Download Submit
C:\Users\Admin\PCAppStore\PcAppStoreWatchdog.exe

Filesize
270KB

MD5
5e28dd3006a64174ff0f82469540712e

SHA1
803b328a407aa6799a86b3555c55b5b29c0b01f1

SHA256
d3ed2cd4c44b76cfef67934280f5952cca28a66e096f87f05b6ea1a64ee3f7ac

SHA512
fcc3b6a708fb0acf083da0ca853b3560d62ee2f23238b1d1d7bb9b93e4ee5dcdba29d41b9043af55c8168c3ac865b4a747b79c1fd5ea573169ec155e376a0aa9

Download Submit
C:\Users\Admin\PCAppStore\Temp\tempPOSTData

Filesize
3KB

MD5
6f349f2a8be679451c5f3408cff0fe0a

SHA1
182b0e14982ed0164882d08d6793f9b50b36025b

SHA256
e20addf71e50ba96067a262cf665ad06066a34a9bef73091145f33f16dd249a6

SHA512
7ceb7c2d9a69bfb9bbf88755dde8586cb0b6ddd1aa892bbae56bae7c1c481847969da60cc4c1788f96ca53aab7a18b89a76c174fce01ac41e463f2ef0b4c4cbd

Download Submit
C:\Users\Admin\PCAppStore\Temp\tempPOSTResponse

Filesize
73B

MD5
3024a54e0c352abe5eb5f753ca4828da

SHA1
df0206851654405c8e5c2d3bc96fb536b8c2dcbf

SHA256
3cd0a703506c7394d6115d9ff721516560894358aef07459f30d8930df6c3b61

SHA512
d9d44051df56b29aa596ee38463b781dbe27f917f7dae1b2420122616da108520429dda58c75c7e6b2d41093f83c5a4bae96024885af3956f23a3ce5bd3f9358

Download Submit
C:\Users\Admin\PCAppStore\nwjs\NW_store.exe

Filesize
2.2MB

MD5
e472e46bdfd736351d4b086b4c4ca134

SHA1
1aa886f0cb23b3d322a43be797d411fca84d82a7

SHA256
e825a252b5c5c9c2de8a6a6ade12a7f9cd0040f6a20e6ee44ba659034e6d5223

SHA512
173f5a7abdfea01c9c21ec716cba14eec4539da45e5734b3fd1e0688e1c22e4718bd701c25c8040d20cf48867e2a67ef2aba46380bab9ab1f7a42bd66fd33afb

Download Submit
C:\Users\Admin\PCAppStore\nwjs\ffmpeg.dll

Filesize
1.9MB

MD5
5fff6f0423a38bfaf174cb670650f4f9

SHA1
13ecd1c4784a5a178a998e9fc0dc08f556121712

SHA256
d4e6fc4e1bc6cb5b3ef7010e61d3a65e97804fb20346cee657688339075b2727

SHA512
e6ff0ea9f6196470f6e094d0ab655fb527c28fc2b2a5d126a10c1f4185c0dff5ed4f19e7ed717d67df324562b7aa56ed87aa0bd396a6ba722d3141b9f30fc41b

Download Submit
C:\Users\Admin\PCAppStore\nwjs\locales\bg.pak.info

Filesize
1.0MB

MD5
82d7ab0ff6c34db264fd6778818f42b1

SHA1
eb508bd01721ba67f7daad55ba8e7acdb0a096eb

SHA256
e84331e84cd61d8bdacc574d5186fb259c00467513aa3f2090406330f68a45db

SHA512
176458b03cc2b2d3711965cd277531e002ae55d284b6c9178d2353e268f882430235468e5a1e9e45c8427864d109cf30a024a993b4763a75fa2744f6e0a6ae2a

Download Submit
C:\Users\Admin\PCAppStore\nwjs\nw_elf.dll

Filesize
1.1MB

MD5
364f839ca8de4d942270d9097d48ef15

SHA1
82c8040dc2a733eb3ea3e051513c84f992bb17f1

SHA256
a4e521c12fe47816f2d9e2dfed9fd074e370ec587d0a0f3a03b5aebb76c06560

SHA512
baf1ed5e558dc0ae037fe0dff036792cfbd338915c8af99d10f0202b92ca820298657a86a0f3e8c1387326fda34de3ee08649c34af2417159a24aed9ced02df3

Download Submit