hxxps://google[.]com

Analysis

max time kernel
264s
max time network
266s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 21:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://google.com
Sample240802-zzphyazgmn

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	NW_store.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	NW_store.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	NW_store.exe

Executes dropped EXE 16 IoCs

pid	Process
1184	Setup.exe
1044	nst3D3B.tmp
2920	PcAppStore.exe
4116	Watchdog.exe
860	NW_store.exe
3176	NW_store.exe
2328	NW_store.exe
428	NW_store.exe
4776	NW_store.exe
2844	NW_store.exe
1876	NW_store.exe
1748	NW_store.exe
5672	NW_store.exe
6100	PcAppStore.exe
5336	NW_store.exe
5696	NW_store.exe

Loads dropped DLL 53 IoCs

pid	Process
1184	Setup.exe
1184	Setup.exe
1184	Setup.exe
1184	Setup.exe
1184	Setup.exe
1184	Setup.exe
1184	Setup.exe
1184	Setup.exe
1184	Setup.exe
1184	Setup.exe
1044	nst3D3B.tmp
1044	nst3D3B.tmp
1044	nst3D3B.tmp
1044	nst3D3B.tmp
1044	nst3D3B.tmp
1044	nst3D3B.tmp
1044	nst3D3B.tmp
1044	nst3D3B.tmp
1044	nst3D3B.tmp
860	NW_store.exe
860	NW_store.exe
860	NW_store.exe
3176	NW_store.exe
2328	NW_store.exe
428	NW_store.exe
4776	NW_store.exe
428	NW_store.exe
428	NW_store.exe
4776	NW_store.exe
4776	NW_store.exe
428	NW_store.exe
428	NW_store.exe
428	NW_store.exe
2844	NW_store.exe
428	NW_store.exe
2844	NW_store.exe
2844	NW_store.exe
1876	NW_store.exe
1876	NW_store.exe
1876	NW_store.exe
1876	NW_store.exe
1748	NW_store.exe
1748	NW_store.exe
1748	NW_store.exe
5672	NW_store.exe
5672	NW_store.exe
5672	NW_store.exe
5336	NW_store.exe
5696	NW_store.exe
5336	NW_store.exe
5696	NW_store.exe
5336	NW_store.exe
5696	NW_store.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PCAppStore = "\"C:\\Users\\Admin\\PCAppStore\\PCAppStore.exe\" /init default"	nst3D3B.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PcAppStoreUpdater = "\"C:\\Users\\Admin\\PCAppStore\\AutoUpdater.exe\" /i"	nst3D3B.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Watchdog = "\"C:\\Users\\Admin\\PCAppStore\\Watchdog.exe\" /guid=6F95B8B4-C02B-43C9-8CD4-016780936B63X /rid=20240802211304.555240816000 /ver=fa.1091q"	nst3D3B.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	PcAppStore.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	NW_store.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	NW_store.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nst3D3B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	NW_store.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	NW_store.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	NW_store.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	NW_store.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-656926755-4116854191-210765258-1000\{86E91BCC-E848-46D8-BE39-14F0A249BB75}	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 696210.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\PCAppStore\assets\images\css2?family=Inter:wght@400;500;600;700&family=Open+Sans:wght@400;600;700&family=Roboto:wght@400;500;700&display=swap	NW_store.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
4264	msedge.exe
4264	msedge.exe
2256	msedge.exe
2256	msedge.exe
5060	identity_helper.exe
5060	identity_helper.exe
3720	msedge.exe
3720	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
2028	msedge.exe
2028	msedge.exe
1184	Setup.exe
1184	Setup.exe
1184	Setup.exe
1184	Setup.exe
1184	Setup.exe
1184	Setup.exe
1184	Setup.exe
1184	Setup.exe
1044	nst3D3B.tmp
1044	nst3D3B.tmp
1044	nst3D3B.tmp
1044	nst3D3B.tmp
1044	nst3D3B.tmp
1044	nst3D3B.tmp
4116	Watchdog.exe
4116	Watchdog.exe
4116	Watchdog.exe
4116	Watchdog.exe
2920	PcAppStore.exe
2920	PcAppStore.exe
2920	PcAppStore.exe
2920	PcAppStore.exe
2920	PcAppStore.exe
2920	PcAppStore.exe
3176	NW_store.exe
3176	NW_store.exe
3176	NW_store.exe
3176	NW_store.exe
860	NW_store.exe
860	NW_store.exe
2920	PcAppStore.exe
2920	PcAppStore.exe
6100	PcAppStore.exe
6100	PcAppStore.exe
6100	PcAppStore.exe
6100	PcAppStore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2920	PcAppStore.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	860	NW_store.exe
Token: SeCreatePagefilePrivilege	860	NW_store.exe
Token: SeShutdownPrivilege	860	NW_store.exe
Token: SeCreatePagefilePrivilege	860	NW_store.exe
Token: SeShutdownPrivilege	860	NW_store.exe
Token: SeCreatePagefilePrivilege	860	NW_store.exe
Token: SeShutdownPrivilege	860	NW_store.exe
Token: SeCreatePagefilePrivilege	860	NW_store.exe
Token: SeSecurityPrivilege	5332	msiexec.exe
Token: SeShutdownPrivilege	860	NW_store.exe
Token: SeCreatePagefilePrivilege	860	NW_store.exe
Token: SeShutdownPrivilege	860	NW_store.exe
Token: SeCreatePagefilePrivilege	860	NW_store.exe
Token: SeShutdownPrivilege	860	NW_store.exe
Token: SeCreatePagefilePrivilege	860	NW_store.exe
Token: SeShutdownPrivilege	860	NW_store.exe
Token: SeCreatePagefilePrivilege	860	NW_store.exe
Token: SeShutdownPrivilege	860	NW_store.exe
Token: SeCreatePagefilePrivilege	860	NW_store.exe
Token: SeShutdownPrivilege	860	NW_store.exe
Token: SeCreatePagefilePrivilege	860	NW_store.exe
Token: SeShutdownPrivilege	860	NW_store.exe
Token: SeCreatePagefilePrivilege	860	NW_store.exe
Token: SeShutdownPrivilege	860	NW_store.exe
Token: SeCreatePagefilePrivilege	860	NW_store.exe
Token: SeShutdownPrivilege	860	NW_store.exe
Token: SeCreatePagefilePrivilege	860	NW_store.exe
Token: SeShutdownPrivilege	860	NW_store.exe
Token: SeCreatePagefilePrivilege	860	NW_store.exe
Token: SeShutdownPrivilege	860	NW_store.exe
Token: SeCreatePagefilePrivilege	860	NW_store.exe
Token: SeShutdownPrivilege	860	NW_store.exe
Token: SeCreatePagefilePrivilege	860	NW_store.exe
Token: SeShutdownPrivilege	860	NW_store.exe
Token: SeCreatePagefilePrivilege	860	NW_store.exe
Token: SeShutdownPrivilege	860	NW_store.exe
Token: SeCreatePagefilePrivilege	860	NW_store.exe
Token: SeShutdownPrivilege	860	NW_store.exe
Token: SeCreatePagefilePrivilege	860	NW_store.exe
Token: SeShutdownPrivilege	860	NW_store.exe
Token: SeCreatePagefilePrivilege	860	NW_store.exe
Token: SeShutdownPrivilege	860	NW_store.exe
Token: SeCreatePagefilePrivilege	860	NW_store.exe
Token: SeShutdownPrivilege	860	NW_store.exe
Token: SeCreatePagefilePrivilege	860	NW_store.exe
Token: SeShutdownPrivilege	860	NW_store.exe
Token: SeCreatePagefilePrivilege	860	NW_store.exe
Token: SeShutdownPrivilege	860	NW_store.exe
Token: SeCreatePagefilePrivilege	860	NW_store.exe
Token: SeShutdownPrivilege	860	NW_store.exe
Token: SeCreatePagefilePrivilege	860	NW_store.exe
Token: SeShutdownPrivilege	860	NW_store.exe
Token: SeCreatePagefilePrivilege	860	NW_store.exe
Token: SeShutdownPrivilege	860	NW_store.exe
Token: SeCreatePagefilePrivilege	860	NW_store.exe
Token: SeShutdownPrivilege	860	NW_store.exe
Token: SeCreatePagefilePrivilege	860	NW_store.exe
Token: SeShutdownPrivilege	860	NW_store.exe
Token: SeCreatePagefilePrivilege	860	NW_store.exe
Token: SeShutdownPrivilege	860	NW_store.exe
Token: SeCreatePagefilePrivilege	860	NW_store.exe
Token: SeShutdownPrivilege	860	NW_store.exe
Token: SeCreatePagefilePrivilege	860	NW_store.exe
Token: SeShutdownPrivilege	860	NW_store.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe

Suspicious use of SendNotifyMessage 60 IoCs

pid	Process
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2920	PcAppStore.exe
2920	PcAppStore.exe
2920	PcAppStore.exe
2920	PcAppStore.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2920	PcAppStore.exe
2920	PcAppStore.exe
2920	PcAppStore.exe
2920	PcAppStore.exe
2920	PcAppStore.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 1520	2256	msedge.exe	81
PID 2256 wrote to memory of 1520	2256	msedge.exe	81
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4828	2256	msedge.exe	83
PID 2256 wrote to memory of 4264	2256	msedge.exe	84
PID 2256 wrote to memory of 4264	2256	msedge.exe	84
PID 2256 wrote to memory of 4292	2256	msedge.exe	85
PID 2256 wrote to memory of 4292	2256	msedge.exe	85
PID 2256 wrote to memory of 4292	2256	msedge.exe	85
PID 2256 wrote to memory of 4292	2256	msedge.exe	85
PID 2256 wrote to memory of 4292	2256	msedge.exe	85
PID 2256 wrote to memory of 4292	2256	msedge.exe	85
PID 2256 wrote to memory of 4292	2256	msedge.exe	85
PID 2256 wrote to memory of 4292	2256	msedge.exe	85
PID 2256 wrote to memory of 4292	2256	msedge.exe	85
PID 2256 wrote to memory of 4292	2256	msedge.exe	85
PID 2256 wrote to memory of 4292	2256	msedge.exe	85
PID 2256 wrote to memory of 4292	2256	msedge.exe	85
PID 2256 wrote to memory of 4292	2256	msedge.exe	85
PID 2256 wrote to memory of 4292	2256	msedge.exe	85
PID 2256 wrote to memory of 4292	2256	msedge.exe	85
PID 2256 wrote to memory of 4292	2256	msedge.exe	85
PID 2256 wrote to memory of 4292	2256	msedge.exe	85
PID 2256 wrote to memory of 4292	2256	msedge.exe	85
PID 2256 wrote to memory of 4292	2256	msedge.exe	85
PID 2256 wrote to memory of 4292	2256	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa198346f8,0x7ffa19834708,0x7ffa19834718
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1748 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1924 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1748 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5900 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6716 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7076 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7192 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2028
- C:\Users\Admin\Downloads\Setup.exe
  "C:\Users\Admin\Downloads\Setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://pcapp.store/installing.php?guid=6F95B8B4-C02B-43C9-8CD4-016780936B63X&winver=19041&version=fa.1091q&nocache=20240802211243.108&_fcid=1722633130433636
    3⤵
    PID:3612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa198346f8,0x7ffa19834708,0x7ffa19834718
      4⤵
      PID:2544
- - C:\Users\Admin\AppData\Local\Temp\nst3D3B.tmp
    "C:\Users\Admin\AppData\Local\Temp\nst3D3B.tmp" /internal 1722633130433636 /force
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1044
  - - C:\Users\Admin\PCAppStore\PcAppStore.exe
      "C:\Users\Admin\PCAppStore\PcAppStore.exe" /init default
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:2920
    - - C:\Users\Admin\PCAppStore\nwjs\NW_store.exe
        
        .\nwjs\NW_store.exe .\ui\.
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:860
      - C:\Users\Admin\PCAppStore\nwjs\NW_store.exe
        
        C:\Users\Admin\PCAppStore\nwjs\NW_store.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\pc_app_store\User Data" /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\pc_app_store\User Data" --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\pc_app_store\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\pc_app_store\User Data" --annotation=plat=Win64 --annotation=prod=pc_app_store --annotation=ver=0.1.0 --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0x7ffa07f1a960,0x7ffa07f1a970,0x7ffa07f1a980
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:3176
        
        C:\Users\Admin\PCAppStore\nwjs\NW_store.exe
        
        C:\Users\Admin\PCAppStore\nwjs\NW_store.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\pc_app_store\User Data" /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\pc_app_store\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=pc_app_store --annotation=ver=0.1.0 --initial-client-data=0x1d4,0x1d8,0x1dc,0x154,0x1e0,0x7ff665e08a60,0x7ff665e08a70,0x7ff665e08a80
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2328
      - C:\Users\Admin\PCAppStore\nwjs\NW_store.exe
        
        "C:\Users\Admin\PCAppStore\nwjs\NW_store.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1944 --field-trial-handle=1948,i,3993267821621901083,9525198152838419238,262144 --variations-seed-version /prefetch:2
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:428
      - C:\Users\Admin\PCAppStore\nwjs\NW_store.exe
        
        "C:\Users\Admin\PCAppStore\nwjs\NW_store.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --start-stack-profiler --mojo-platform-channel-handle=2056 --field-trial-handle=1948,i,3993267821621901083,9525198152838419238,262144 --variations-seed-version /prefetch:3
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4776
      - C:\Users\Admin\PCAppStore\nwjs\NW_store.exe
        
        "C:\Users\Admin\PCAppStore\nwjs\NW_store.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --mojo-platform-channel-handle=2196 --field-trial-handle=1948,i,3993267821621901083,9525198152838419238,262144 --variations-seed-version /prefetch:8
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2844
      - C:\Users\Admin\PCAppStore\nwjs\NW_store.exe
        
        "C:\Users\Admin\PCAppStore\nwjs\NW_store.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --nwjs --extension-process --no-appcompat-clear --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\PCAppStore\nwjs\gen" --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2648 --field-trial-handle=1948,i,3993267821621901083,9525198152838419238,262144 --variations-seed-version /prefetch:2
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        NTFS ADS
        
        PID:1876
      - C:\Users\Admin\PCAppStore\nwjs\NW_store.exe
        
        "C:\Users\Admin\PCAppStore\nwjs\NW_store.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --mojo-platform-channel-handle=4460 --field-trial-handle=1948,i,3993267821621901083,9525198152838419238,262144 --variations-seed-version /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1748
      - C:\Users\Admin\PCAppStore\nwjs\NW_store.exe
        
        "C:\Users\Admin\PCAppStore\nwjs\NW_store.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --mojo-platform-channel-handle=4644 --field-trial-handle=1948,i,3993267821621901083,9525198152838419238,262144 --variations-seed-version /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5672
      - C:\Users\Admin\PCAppStore\nwjs\NW_store.exe
        
        "C:\Users\Admin\PCAppStore\nwjs\NW_store.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --mojo-platform-channel-handle=4472 --field-trial-handle=1948,i,3993267821621901083,9525198152838419238,262144 --variations-seed-version /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5336
      - C:\Users\Admin\PCAppStore\nwjs\NW_store.exe
        
        "C:\Users\Admin\PCAppStore\nwjs\NW_store.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --mojo-platform-channel-handle=3308 --field-trial-handle=1948,i,3993267821621901083,9525198152838419238,262144 --variations-seed-version /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5696
  - - C:\Users\Admin\PCAppStore\Watchdog.exe
      "C:\Users\Admin\PCAppStore\Watchdog.exe" /guid=6F95B8B4-C02B-43C9-8CD4-016780936B63X /rid=20240802211304.555240816000 /ver=fa.1091q
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7372 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7536 /prefetch:8
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6752 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7680 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7684 /prefetch:1
  2⤵
  PID:348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,1849720064910013586,3696265359297088810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:6100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2108

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5332

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x33c 0x30c
1⤵
PID:6000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5820

C:\Users\Admin\PCAppStore\PcAppStore.exe
"C:\Users\Admin\PCAppStore\PcAppStore.exe" /init default showM
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:6100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

773CFF2C7835D48C4E76FE153DBA9F81_15174A80589B8DAF9768E9131F4845C0

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\773CFF2C7835D48C4E76FE153DBA9F81_15174A80589B8DAF9768E9131F4845C0
Size 471B
SHA256 f95e9ba7427edcf1664a08c2033fc140affc3082420d42a475ac3d20d54847ac
MD5 b3dd49600626b53c8194b28e82a16c9e
SHA1 069cd47a6fbb6d51749c72fc03254c281c8f9bf5
SHA512 1ca76e0a4f6f658c59fc52e5be8d05b0f6f54864c5aed36da6c5d8f0c99a236e7e50d88363a63c4e8e10e22af4b67643afbb9df5e6e0ce7a4efd59167383c046
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE
Size 471B
SHA256 b99f285c4c8351855416160e6270035372d7b8477dbcb00ecfeab8029760b6d7
MD5 1310eb82273cbb01093a342c0ce70cf4
SHA1 aa5a6aafadf100238cde5262dcf68bc53920eb81
SHA512 261c60ba6fd91caa8123203232db97fb8d8196153eedb94cc58d8dc67fe7d3efbbfeeefc092a6636400b054c4e5f5431478312ffb7c1fb81f64128ac9109484e
MD5 SHA1 SHA512

Submit Download

773CFF2C7835D48C4E76FE153DBA9F81_15174A80589B8DAF9768E9131F4845C0

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\773CFF2C7835D48C4E76FE153DBA9F81_15174A80589B8DAF9768E9131F4845C0
Size 404B
SHA256 c4da6bcb6be58d50635b1cea7eddbe152e2c1a1193ecd2c3914cba01cce037f5
MD5 b9a861aefa29721fae0c3236ebfc8f43
SHA1 9c26db6179f856ab3701f6e8a5bd4d49d2be2568
SHA512 0b6a9b6359850d5ff6a5f6b0753568642378ed06b9d060e29b950ac8950ddac7eed8afdc754d1a3aa1e6a2a602a2115979f67b71a64acd823ac94aa96d4805bb
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE
Size 412B
SHA256 a33af6cc22af82bfa885c930bbe072d5b9c28e0223aee6e49beb2390c81e0381
MD5 a1ecc8d58c36ab0b72d4a1c94aeb3b9a
SHA1 64439e685a917bef49a3ef858813286e4f4c0524
SHA512 896d0943abf2c9e951a59fce0a60a1e700db65b8946911597723f3ea24571a0ab5b588d90241fd7104e7c79924a7cac0174497afb3e19acd01b0337e95fd0ddd
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4
MD5 9e3fc58a8fb86c93d19e1500b873ef6f
SHA1 c6aae5f4e26f5570db5e14bba8d5061867a33b56
SHA512 e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de
MD5 27304926d60324abe74d7a4b571c35ea
SHA1 78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1
SHA512 f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001
Size 209KB
SHA256 27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6
MD5 3e552d017d45f8fd93b94cfc86f842f2
SHA1 dbeebe83854328e2575ff67259e3fb6704b17a47
SHA512 e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9
SSDEEP 6144:ewpSHs6ljYg6trFqiSAprekukr20IgIgR:OHvhlo8XGus2oR
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000031

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031
Size 18KB
SHA256 89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571
MD5 8eff0b8045fd1959e117f85654ae7770
SHA1 227fee13ceb7c410b5c0bb8000258b6643cb6255
SHA512 2e4fb65caab06f02e341e9ba4fb217d682338881daba3518a0df8df724e0496e1af613db8e2f65b42b9e82703ba58916b5f5abb68c807c78a88577030a6c2058
SSDEEP 384:IhocXmE6eM871P7td/mcOKA454H2orQEONKrOqxw:f6WeL1P//9D54WCCKc
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 33c8de4c3f9a33731a35365d993f3cc20a77b8b05279a77cdaae9644d129bc18
MD5 05c7b6b107e64dd8b53b1214cde77a5c
SHA1 0ff6e7f8450648e532a20b6f5c80c1bcacc6e94c
SHA512 4e077316c676873f4545e653eb1c61c48e86a7b537b19a9ce8735dcaecbadb966302d16c21068f73d94c775989ba9b12b02bd2e8ec7514ff1ebe6bf30f77df1d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6d0d509a52a8db65ed721d58d582429da015e00093607b3ac721d0c83ce2b4fa
MD5 8833d82bb6530ebd4687638bff835ca2
SHA1 d9cf86ba11d5e717f762dd7d44d4bcd360132028
SHA512 379cd818e5cdd77e994fecc419f946c33edce46ed542f728e7920b8b60953fdf058ae6d38f3a3472e44c9043c47abd2a4e09682fc559782ee9f6b34e61bb2253
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 9c3ad1db528f3723df18dfd69eab183fcee32d72deb2f9b90e41ed4fc3e79416
MD5 1346eccb9d34a1a414d0fd86c6b2c436
SHA1 1f86b56757774e823c6a1069137cafa9b9076a3e
SHA512 b854319647218682cece0c911bedb5baf6e60edd37ccc3604a165074cd7ffe02b330929dc4650b0204a73b6c6cc191aa1aad81f11e7785f5786aaa82c3fc94a1
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 7ae7b51be39d94db2773dba7c93ad324bdafc48e072225cf190a8561a6fd9795
MD5 33861b80577de96b8849162d51ad582d
SHA1 9235f99e5b62a439ffec625f968e958942363fdf
SHA512 4cf19b41c869df22852378216a618eb4f9c29d843aa48e7e0420845d506c379513fc1fd9bb48e974aa9d88b0a84fd00ad98b14494cf8bb19f98369b0bfa459f9
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 86e8f98b13fddffba977c3379559de7ee8e627ed52917b70c24fd36bba709d0b
MD5 d5934ab6388e916d8cca225949611dc7
SHA1 50d87061e0e9bd08f2f235a02a5c3b0a4c1e6a41
SHA512 60a4d9bc8eb5ef5f60807db9fd5e22c630d64d6be3d3705cb4de855db832b7b669b98d35883ce509adbc0356372449ef8f16b7b15ac8d50d7a06865c3678a80c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 4KB
SHA256 8ba9341befec7cd36ae73d70241efdeee270f800e1c10d2e5d2c1ede7093de5d
MD5 64c5e8b1da50150f1160a166076691f3
SHA1 68a0ce49ebc8aebd60dd915a6487b80ed7ef8184
SHA512 7a3800d2430b098d3b24b1e4417b2d0f1894ec7ae86113bbdb257518eac433efc01e2b045728c94b4b9db3f5b8bed512233205e8464e79dbcd2cc16f142b8381
SSDEEP 96:J6FmG5PS4TqrqCD6V0eCoG7pGnGdEGZHTGhG7bMGaZGHG2QM8TzGQSMNGwELGTxS:J6FmwPS4Tqr9D6V0eCoApiqEwTy8MdZy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 927427ec8112d57da923dffdc42c1c77f0fdb03cb93f5b4aa3b029a63f8b2e40
MD5 5da111c1505e03e69b2877250ed6fbe8
SHA1 d984720467f151fa22d2cda03f2505e1b6ce6e70
SHA512 2e597f043ba0271519dd1d237e40ddb8d9dcebbea60b45e3d7b4e90e7abf0e3526a6ab4906db43c4c0b994df70eb2785eae5ef659e1f1d4cb118e1046f9ed6dc
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 c55d66e65afa0db7b564d6debdef88fac01e7ad4ab08b31559703bce88a08918
MD5 c065bb4eb509c7191eabc64d7a855c5a
SHA1 d90b967b3cbe5dcf23c5b3fca298631986d67295
SHA512 0d6efe63898519da9bfe8093fafa28940761582cf6ff08a12bf7e43d80f1de6755a7c2f4b767767480f37e55f1bcad53c624e73eb20f368a05abe88f6bccf42e
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 11a8699956d0c3558b7253b66b01ad83ce639304ca51df44958752b2704b861d
MD5 a2af86fe4a0685db33a0b68447096008
SHA1 beb1cb5df1609d48649d083a31df4375d9e5abb2
SHA512 1c7eef5b2dd8908bafecd0023472f818831214d321f7937083bebc4beefb055cfe3667a67c7b42d480227c76926fa09d027735488103f746d3b008fccc91efee
SSDEEP 96:ngkzUW1vVwpvWMoiVmdeH4piNcuUWQyV+VDCziEwb:ngkzfpVGWMX4k+uro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 e8ffc1d4b5b80a3fc2b1df958a1e2d8b4da8cecb8dcd87820c1082d799fbaea4
MD5 0368bfd9d7a2f30e30a40f6d7d282ecd
SHA1 a043fdb0acbd5224bcfeac066febd4351daf85bf
SHA512 23398c0160bd8ee4d830d32593aad52de3741566ac93ab471f892768a8116c3107d19ef2d732b0fc50b3d2c6ddac51df123937bb82578f6f25e3c2956507d22e
SSDEEP 192:ngkz95LD5WMwObaAFgJu4INq55NSkPurg:ng25hW/AEx0kPf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c5052f836a835a41b13b9895894bbba2533ee4248eb3880699356ded33896a5f
MD5 5473e77ff33c801671565736225d7d39
SHA1 202cfe91391ac50a164962e68a5e8fd29e795188
SHA512 5cba136700f4ef9c502f717a6fc036493653831de3f36ec16f221dc1f6b50e41e083996c5543e94e99c06b02fa6e762fddf3433f1310d61c96bf15471efaa626
SSDEEP 192:ngks15ID5WMHm0c5Ucr6baAFgJu477g93MkavjldRh4VqBVb7UKq55NSkYurg:ngx5IWR/rAE5wVZ0kYf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 fd4bc0629ec79ff809f5bc21dd2454050df0f87d236f75fef003797e96156dea
MD5 58b1501b0152abb52ceaa341d8579afa
SHA1 7c3db2d7d33586af914fc32e39537822253c4ebb
SHA512 92a2f79b585ad911a28473621a6eb040e3b4e734d1696910669ec479113a38854bd6ef9229e399f56f1311c60d83278150a0ca2d83ca09cb423d631db169b887
SSDEEP 192:ngks15fD5WMHm0c5kucUcr6baAFgJu477g9axh7vjldzE4VqBVWZpPKq55NSkSNU:ngx5NWR2/rAEdfV5N0kSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f9c56f53042c24f6ef2f26610e817bbe5b60b183bcbe41e034f3dd281e0cb70b
MD5 14abbd0675fe6f2f53d02a5ee27a0dee
SHA1 da5fbc9be9988a8f2b7a6e430b4b2769497e57e9
SHA512 ab06468472f8c37e7260e8ee8a8a42c8fca6534597604a082f216d47749bd6d3bc1ad01ded83d0b6e1ba68f6c685dbc00a6464ccf5fb971b4c8b4073277e97a6
SSDEEP 96:ngkzlW1vFwpvWMoiVmdekuXS1Mq4pi/cuUWQyV+VD7AiEwb:ngkzgpFGWMUuCOq4kEurg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 1b1a387ae9df0725ee488de5037b19fa54bd08077f12386477037ce2fc5c5f75
MD5 53737c2229f08efdfad9ff3e73526012
SHA1 2bf9cf9dd133afd29f2d1aa2a67855f311ccc439
SHA512 2a857f13bc307dcbf659dd701f992e87a3716fcf7ae1182b0e04cabbbd21ee57436f9643e945676d9bbeb2064434dc4404e1f8150f074ccfeebec0d5cd530865
SSDEEP 96:ngkzFW1DFwpKKWMoiwR5mdeluTS1ggJuJSMHdq55HpiDcuUWQyV+VD7AiEwb:ngkzA5FVKWMwruWmgJu4Aq55Hkourg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 6f43bced1c59b7088a9aa4f86b02c8878f6bfb897d7ac528de49abf1b3bda763
MD5 a37dfaa2de9615126f05c3d88aa4fbcb
SHA1 38043f63af37c2184370d3ba26b9e706c543eb52
SHA512 4db7c83c8b08ba6bb4e7f10f7398f6d95bf8398ef9f43f2cd712933003fe2128584661e6322d557d2166740ffd0e600f6a83bab022e6ef98e0f4eeb0eef708b2
SSDEEP 96:ngkzFW1DkwpNeWMoiwR5mde7KwMSjCgJuJSMHdq55HpimlcuUWQyV+VD7AiEwb:ngkzA5kaeWMwQwzugJu4Aq55Hk5urg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 d8460c25c26254f9e12e961cf90d9d6cb253f3ae9112828fdf8bffad178fad17
MD5 2e40255c7a8365cd3afc78b740c79cb5
SHA1 2b43fd80675c1a5623cf665682a6c92f98f10272
SHA512 b3dbd7fcbeb70338b31f65a2302a94b50d9097fcb5e20f49b98738c1156aa849a2e2690c7d83488c41d5afa5cac6a4779b8ec4cf1691d738c84e5b06a718ebe7
SSDEEP 192:ngksp5JD5WMw0c56baAFgJu4+g9MMlvjldhBViaNq55NSkIurg:ngt5vW1rAEuF0kIf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 cdab6860632cd041e1ecd881d89c2a90ce5972a549a4206490af63ef336cf6f9
MD5 7ff50233d5c11e030896be655be2b31c
SHA1 b5ed0485b5d2d688dd90441fe2c64411577f77e2
SHA512 8f25bf4c448854c0848246834b290971d23b758ad55c69078252fd055af1b327e2cea112f40fae157b021c09f4ae0a4d889665aaa2a9349dcc7489de40638446
SSDEEP 192:ngkz95yD5WMwZyj6baAFgJu4+v2Nq55NSkrurg:ng25qWorAEa0krf
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 538B
SHA256 3f60f7b5dbc77f20d24494c2271158f7190e1df50ddaa0b48b8e3c84e501a052
MD5 9498782d00e7bdf5a30d7ea2873d6b61
SHA1 6906f20c5ca9ba226c0a2d6da6e5401eda2ccb24
SHA512 9150c384aa8b10eff882d7c2408db8c30fb33398437b5736705ff1e867d3cd1c44776101767af3902d3ed58c493f789deeebb3e54f614858427113cfc8b3fef6
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 99909668eb6c213d5ba193e2484bf382851b2b6f224af560281e69767264a99d
MD5 0eb014833aaa6744e1099b747e9a4ef0
SHA1 ef4ae7efc1a1373fdc175d1f18fe20b4bed21bf6
SHA512 218114891abded7aa7f8dcf27c877ff01644d943f9f02e679719a1a3f29fa610bccd5d61b1dcfe15243a5d86656cb738ffbe9d8e6760f6cd12e091d5960e0ab5
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 ab6c54e059828f72392e9379b4e9f6e53e57e49447f8e9e0695085b98da9c0aa
MD5 db65d06ff3868033e8be536413ef2f09
SHA1 deeff5b934dfc65ba8c39a346021ee8c55c6a727
SHA512 6a2091dc355e68fbdd51062738c905daaf645bc0b785d832acab17f07fa76a84878960ced94c0a9cba527336b7f9b5ad59c455c98fe9b8eaf069ea4bc182d0e4
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 c83fcbae49706625b398359eed889f9136bc56093062b8836e2d150443194408
MD5 251ee933e395b4d8d537ef0008b97782
SHA1 9a07218819a9a278d57b0fb5ebf12fb2c21dd20b
SHA512 15b527518ff307c9c395ec3011f4f19eaed5e1f8e13d45f2716e2e7bed2477032e1deeb43fadc5ec4dc33fa468985ab22f7af4f90c8b1e8eaa3eb2facfd81294
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 d5078e2a7f53625c332f83c3a4fb0d8bea088095bf5993157a6e0e4720539931
MD5 33a2901a7b83179f083a452ca0db713d
SHA1 25fbc73a1ad0b92996901e562ffbbba7d367a79a
SHA512 0a3c07f0722206f62a636a05882068cbcc9cc499c9af8a4ade349412091c60164185435ec520864d11a952475dd3a3d79f9d7aa09c9bee7695f319dfe18797e6
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 89eb18411f2e5ce4b68f5b1825bf8e889f5700c3cce12e8fa9e204df289601bc
MD5 6e3ff9eb339b1a141c7e5fa477e7e4c8
SHA1 17576b7adf07acda74a2d8c46fc1878784c31648
SHA512 d836868548e395fa95861e0f609f7848ffc047fb70a9275d2aefdc15080088fb7d76cda52119977b5de58322a60856421d6feb8c7f3c3c8a1ca5d0cef21816ce
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 9b1db6a24b5f9dbb1f57cb314094fc2d8d83902fd7b8a04021f70702e29176e2
MD5 87485b47c215665261e02f1c3aaabf34
SHA1 8367c53160eb790da979384f9a3b3ff43a29d169
SHA512 0acfef622fea0b1c01aee849f46ecb5d7100b411cc26a5cd170d730ae340898032bce71501b48e7d62c1ae587a21cb45d06d69f001fd02d282eea2805ca03d79
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe587f3d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587f3d.TMP
Size 538B
SHA256 ada6e6011cd52d65656e4856c5afbf1c27e0bc35b6be9b16845002eca6fc6c02
MD5 487a97fa074b86320d6d875576d3b4b5
SHA1 c0ced01ec54a02981493b789c26628e18cad46e1
SHA512 3a57c48a097c22cdccf78d9e98c682382e9a7d24f0640a28ae40b1f9ed909372ac89316a2d3d686556f72edcf5a258c341320e3b9b34351beafa7562b60cee63
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 60391635956a16b5e5394e5a78a6be8690168f59d7f2167b8b2fe5a355276972
MD5 e7dd42f78e00cf48ada5e72a68af1845
SHA1 9a8e1a6eb7ec74f9477826fe19beb139536a9e48
SHA512 b9910774cffa206fec4c9e97d21165c8556bf3ea4eee51ba99708a880b4428a68493ea0aa0e68692039e6fcf14054e043962b719798fd01777607198a9360be3
SSDEEP 384:+9iIxuERzA83h09RZxY9w6uqaE9Ko3Q6w:tIxuERzA83h09RZx6gE9I6w
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 9ca288375fb78784ceee7f6f0499a56da5921b9d10641418743a797c0efc8a01
MD5 eb7d8e5a6bd0e6ab7148b57b32190318
SHA1 524bd2cb3ebaedde7d42fcd31005c096f60eaee7
SHA512 432d2ee7af4ad083f25f58165208c4129bc810b4207dbe09c42a11b87c04dc638059cd1b5b0c579b44458c6a46181836ff33e9a20a1db3743d6e8d6cc9f191b1
SSDEEP 384:U9iIxuERzA83h09RZxY9w6uiaEfKo3Q6w:/IxuERzA83h09RZx6wEfI6w
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 4d823da53625b98527d67a1de3e5ae344a0a6a9da607fc03ff5e259eb04f16c8
MD5 9b8461000fe652819c7b2ef8e00a283f
SHA1 d9dfc4095e0008280a795c9df8ca5363c554f6b3
SHA512 eed5f851da02d91ae1eece295d6058585744d88a1cdac0730c152cacbde0ce8e57f85efc4d6b01ddb274ae1298a336f61cb662c62ecd8b787b6215832301b923
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup9zze2RULnc88s0KVhY3Q6w:A9iIxuERzA83h09RZxY9zju9OKo3Q6w
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 9f6ef9ae3d71953c7c398097429a77e6fa07fb5beac059db0ae91e85fa5332dc
MD5 397e67aee84455d6c4f3816eefb91690
SHA1 4eda51d15c6a79e2715b7ea49ad7f4ded7b066f7
SHA512 153ac0e3511111745fbbd0a0d8ae8e5671670933e0c811944c743a41bbe7418c1e789972f0970ddca2b83e50324f3a78c42c0a89894637548a913f4176a854fb
SSDEEP 384:q9iIxuERzA83h09RZxY9w6uqaEVAKo3Q6w:pIxuERzA83h09RZx6gE+I6w
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu25F9.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5 SHA1 SHA512 SSDEEP

Submit Download

inetc.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu25F9.tmp\inetc.dll
Size 38KB
SHA256 a793929232afb78b1c5b2f45d82094098bcf01523159fad1032147d8d5f9c4df
MD5 a35cdc9cf1d17216c0ab8c5282488ead
SHA1 ed8e8091a924343ad8791d85e2733c14839f0d36
SHA512 0f15b00d0bf2aabd194302e599d69962147b4b3ef99e5a5f8d5797a7a56fd75dd9db0a667cfba9c758e6f0dab9ced126a9b43948935fe37fc31d96278a842bdf
SSDEEP 384:njt65uI9oYzcCaHjl9Cb4I1f0AGhrHXoREnRxtIpH/u0abJ2v2DW9O9tk8ZwkpwD:noHtNQoRSIwTJB6Q/kPyBp6
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu25F9.tmp\nsDialogs.dll
Size 9KB
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsJSON.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu25F9.tmp\nsJSON.dll
Size 23KB
SHA256 64b3efdf3de54e338d4db96b549a7bdb7237bb88a82a0a63aef570327a78a6fb
MD5 f4d89d9a2a3e2f164aea3e93864905c9
SHA1 4d4e05ee5e4e77a0631a3dd064c171ba2e227d4a
SHA512 dbda3fe7ca22c23d2d0f2a5d9d415a96112e2965081582c7a42c139a55c5d861a27f0bd919504de4f82c59cf7d1b97f95ed5a55e87d574635afdb7eb2d8cadf2
SSDEEP 384:n7U5CiIZ1ZC2RvhrTfldNuwQ5pk+BISivMyyOgqCoRUj+OvHxOuofnykhVQJrTU:YoZ1ZnhrTfldqk7Yyy94RxOcVQJrT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Math.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw5E40.tmp\Math.dll
Size 67KB
SHA256 8d9a23dd2004b68c0d2e64e6c6ad330d0c648bffe2b9f619a1e9760ef978207a
MD5 85428cf1f140e5023f4c9d179b704702
SHA1 1b51213ddbaedfffb7e7f098f172f1d4e5c9efba
SHA512 dfe7f9f3030485caf30ec631424120030c3985df778993342a371bf1724fa84aa885b4e466c6f6b356d99cc24e564b9c702c7bcdd33052172e0794c2fdecce59
SSDEEP 1536:GUZ9QC7V7IGMp2ZmtSX5p9IeJXlSM2tS:T97WSth5lwt
MD5 SHA1 SHA512 SSDEEP

Submit Download

metadata

Path C:\Users\Admin\AppData\Local\pc_app_store\User Data\Crashpad\metadata
Size 114B
SHA256 70e222421a1415cdf7841c98668129e487b6c86c9346b9b69131377b4d2839ce
MD5 b956968a9b1c68a4a1ac0ad9770c4d71
SHA1 81503f945ad29fedb8f53dd61b71d30a397956c5
SHA512 ab012b346699b0f2f42930b0221b1ae0185ca604a74d97d660cdcc80351d991effd230bb69e6780c94eeb5dace6de2630914c565f771fdb2f8ae141776bbff06
MD5 SHA1 SHA512

Submit Download

a287466b-6694-4ea7-9be1-539f4645cc94.dmp

Path C:\Users\Admin\AppData\Local\pc_app_store\User Data\Crashpad\reports\a287466b-6694-4ea7-9be1-539f4645cc94.dmp
Size 2.0MB
SHA256 0c558458f69ce427f81d634eca75b9513b8cef23134ed79b0fbdf261d0b6c3ed
MD5 23e17f23109de03e7726cf0d08373c86
SHA1 4f349126ff9c3d827469e8e5354c3da19e7ced84
SHA512 59a65f20991af6e81ac0b0e766012f62fe7c769ab7ff3b7093d24357534e9cf54c3f6b12d2228c23da7a1323671d8180d7f0e0c71492f7d3736c0e3fbc716f80
SSDEEP 12288:uwsYYYVEHwgpJoF1iZ8JgKyAFEsp0gXFW7c9/GC9rPvZposd58l:uMOjoPiASCEPgQg/GQLosd58l
MD5 SHA1 SHA512 SSDEEP

Submit Download

826031c5-8abe-44ef-9ae0-963cffefbc8c.tmp

Path C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\826031c5-8abe-44ef-9ae0-963cffefbc8c.tmp
Size 148KB
SHA256 d98e226bea7a9c56bfdfab3c484a8e6a0fb173519c43216d3a1115415b166d20
MD5 728fe78292f104659fea5fc90570cc75
SHA1 11b623f76f31ec773b79cdb74869acb08c4052cb
SHA512 91e81b91b29d613fdde24b010b1724be74f3bae1d2fb4faa2c015178248ed6a0405e2b222f4a557a6b895663c159f0bf0dc6d64d21259299e36f53d95d7067aa
SSDEEP 12:YcFpCkgfvMbb555555555555555555555555555555555555555555555555555O:YepCb8bBvK
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 3130b815a241a16dc654033271f8f1a5a9c01d02db3336646def30afc6231c0c
MD5 e2f5a98322aabd8d1668d0915fce8046
SHA1 cc444673a7c128b516978a8cdb05429599d26581
SHA512 78b3f6227b671d84fe637285bdb50b46c178a056d7f2c169dd27c82d29e322758873afc622ccfeaab306045d76a8ec56c96e7d25594b2765f61a63d8b794d03c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 916139e7c2b203e855f2097ca00690317b61998d8efd20ec780019873bb288c1
MD5 25bb3ee23c543b62c4cd6b27f251d119
SHA1 e60490a50c4a5f044ec6d8481ba6388127aa7474
SHA512 777f8eb28d00fb1e9d748e15c3af4a836482ad6927ad5056254e5804ba8ebfe399484e0c97bd3c6eebee2d71e5c2067dd041a47f2ddc56a0f177b9e3049fcec5
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 22a55a3eddba59b6ad6bd5548765cf68c7acaeb32d78d38fa8f523cd78f435ea
MD5 33f68a9c24d9ef9fd6459e3b88903d63
SHA1 23f2f27e003ca65390e12e3ced70725218c9056a
SHA512 f933c61c4bb73edf2ea40c06e3f35042c261911043cc0fdb4a9cd6ad0cd57c1f6f87a40d4db07032851c7cde861f6bd93f834354f466d9dca4d2936ec6a34438
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 7c15e18016e63bf936a47602bbb81b0d865b520c4265fe25537b8ef68d24c645
MD5 d6275db0c0f21e69cc6e43551581b8ae
SHA1 e2c01220c2476623dc0322048ba32eab783c26bd
SHA512 4798dba68d6964f37cdfef3ed32c1571e27574c5ae5a5da49849100c97d6692505451e76b00d6f4514bc7d95349fa1b48cabf15b73a6152c87cc710c165b5a23
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 4ef18971a424b6c7036d51386cc2ca47da37d02e7b223ed85f87a5a0c4ea6160
MD5 657ceb527a3b803cdb5239f7c73f58ad
SHA1 38e7496c29c8b8fce4d48bd4ed83ea61ab6848e6
SHA512 4ee2d2ec0c22f650fb26c00a96f200a31307cba3b20c80a790022662438e31fde28bb4178b40211e3aec484d12ea943ec595baee0c42c05cf8687c5faca3a782
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 ca7295f8df65c501ce9d8fd73904e04a0d1b69025114f4e79b6fec254e1e2ba7
MD5 683acbe135ef537caba479a1174086d1
SHA1 ed54ced1d59b2eb5584cbe166acc56af2ddf7278
SHA512 6c99fd65d04375c57dcc80dcd0d390b5ed31b1b0e8dba4f76f50a9f38c7063f8c29b929eccaec0cd94327bf3daa36440fca46308e35cd64ea6d02d2cfc15fae8
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5af5fa.TMP

Path C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Network\TransportSecurity~RFe5af5fa.TMP
Size 523B
SHA256 13f478d86cf3760676113cc2b3343c110ba8a533132d404a478e2a8ae965cfc8
MD5 7d8b4fde7e39869cf0eb36da884c40c6
SHA1 b279f92deb84a871306a87170e0f6d719a3878b7
SHA512 f9fa3a52a5b1ec76049bdb4bee3976c2a44d9c6d5df32ca6c518c8cf28d900926da7bda73797770afbae55497815a838ce306b46d81c49f2281ce0024f60293e
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Preferences
Size 4KB
SHA256 7de00faaee926915380b7e99b8001162903d57e872897789335d5ba693d6a03f
MD5 963a08cfd5c64c1a5eea7d450c05c4f5
SHA1 5b38795ececb4b980c586a61eddf2892e225aa93
SHA512 c5029d4b0f13e406c019bf66ec9a4b1f2a945674eca808b80abe0ac87979d1c1dfe0352f41acb946c28b79258cda0a14a495c03ddb1029443e613f9eefd22308
SSDEEP 96:rMIPtYvCDs7lskeY16Z2X7/x+6MhmueqV7A42Mpbp:rRVm7HeOXV+FpJA4Pp1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Preferences
Size 5KB
SHA256 066607c3b32ecf866b2aa71dde13db0090aaf485df3fb006649e91d12abe2678
MD5 ffc18d46d47718e5dc421f14fd30529c
SHA1 8576bbfca18e1da3d239aeeeba799891ff589985
SHA512 83fe144075770b3a3137cf3e8b0cdb85bb278238bd2b75909f34098ebee227b7f2f72eb9d81ad44eb4cc669f0bcb3bba1f5b58fd992c7fda2f275f12c8b7d1bc
SSDEEP 96:rMIPtYvC6s7lskeY16Z2X7/x+6MhmueqV79Q2Mpbp:rRV77HeOXV+FpJuPp1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Preferences
Size 4KB
SHA256 f86af6e4826816d2e44db5e496343148296d727365058a3ef142e5d515c3f786
MD5 d7a30a33955de6bc257f84f386db75ca
SHA1 08b902d31bef2a80d4ef9cf26828afe63c9b18c9
SHA512 d8998b0da9b6e1a0963ec47348a76be2bde27e87adec7bc79761a6b3abd7556e54384559b383ee34971340b9cef9694327d5c395f9fc7286ef6522195e2a4925
SSDEEP 96:rMIPtYvCss7lskeY16Z2X7/x+6MhmueqV7T2Mpbp:rRV17HeOXV+FpJTPp1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Preferences
Size 5KB
SHA256 20200c75c38b1c42425686e60a186893dfe495f6cadd6800872683b7e405ed33
MD5 65fb51e38c5d0d9686023b5b65a4fec0
SHA1 40d56640ce41b4a7dea5c554df6a87fcaa37077a
SHA512 8527ddafe8fba941ce2a7f310f7c4859a8939e5ce2b8cc4ef6f8c6fb4c47a2fe769c1a2e4634e6a2f598cc22875a7c64bdc19ff0ec8244b088d0cd5744f97ec4
SSDEEP 96:rMIPtYvC4s7lskeY16Z2X7/x+6MhmueqV79Q2Mpbp:rRVZ7HeOXV+FpJuPp1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Preferences
Size 5KB
SHA256 f1207316c500c01cc472e610f5e5192b1c3dbb1d0bf50a5d3e9fac748131bb1e
MD5 3bf162ec3a4b949998c5c3c840907638
SHA1 3fcd27bd882d84dfdcfee6b4b4588d9d7723cdfb
SHA512 b89d8b979a86cc668efca870f60a7b64990cd6b33a52672a1934f483d854543f790d6d906b00335a16cb09287c08443dcd2455ef6b0f47296a1185445d63ff6d
SSDEEP 96:rMIPtYvCFs7lskeY16Z2X7/x+6MhmueqV7yQ2Mpbp:rRVE7HeOXV+FpJdPp1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe5ae4b4.TMP

Path C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Preferences~RFe5ae4b4.TMP
Size 4KB
SHA256 875e7b6ab114ce2f9f4fdd709fe2f731f7f01450853c4092449b43940c92910d
MD5 3aeded616a5d8c14da84772e6505ed92
SHA1 7fe45a233c2ee1dd651a0f28b3826db7853d06c9
SHA512 e12ca665e4bfbc0276b54b91bcde2cbfb51a27625ddaa9b48dba7b9e2273e57d8c9b0be2df0c529d612fd3f5660ed52a5cff11e67ef2b56644f9a7f7785d7e17
SSDEEP 96:rMlDPtYvCZs7l8deY16Z2X7/x+6MhmueqV7A42Mpbp:rAV870eOXV+FpJA4Pp1
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

pc_app_store.ico.md5

Path C:\Users\Admin\AppData\Local\pc_app_store\User Data\Default\Web Applications\_nwjs_pcapp.store\pc_app_store.ico.md5
Size 16B
SHA256 b1a6a6fb45ad1e13054c40dc7c09e3098ee830bcf1ebaec27f640ae4c64b8416
MD5 03e9f614a008075733c76883156b568b
SHA1 5f9cb1b06928487c4b836e9dedc688e8a9650b0b
SHA512 7e6969c8908a6bf57bd2cb4457a7c78360468383acee589278e49829617e2f3b872dd8213e57a2ed8f512d444c67a2e619deabdc1394d1c39c7759ed3c744f94
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\pc_app_store\User Data\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\pc_app_store\User Data\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\pc_app_store\User Data\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\pc_app_store\User Data\Local State
Size 2KB
SHA256 8c988cf77e936be0e6331d95170fc0afc96ac2df470b80b4298f1b4132d35f0f
MD5 c3596769a55b5371e43436713f96faa4
SHA1 aa11fc743e9c8bb1a9e6937be93b227540f5aa9f
SHA512 6809a0f62652de302fb796594e42019bd9ebda433e99e377ad87a0fc962a824ff99dc08fc0d71100521f7ec24f1847142c4b728f24b450ec8728c06a49dcf365
MD5 SHA1 SHA512

Submit Download

Local State~RFe5abb43.TMP

Path C:\Users\Admin\AppData\Local\pc_app_store\User Data\Local State~RFe5abb43.TMP
Size 922B
SHA256 551d549bbb003371f6e63ba3ec11263bb522d91a1724b59542d03c055daa3a40
MD5 3e103d09e234b28a36af96963774f8ca
SHA1 5053325d3e811b62f402284a78f4e8f053252d6b
SHA512 7120261d6b5cf2f813e3915b2605f05670bf952ff22cc6aea207603dbe9020ce16f9b9824a310a821211bedb8eb8056904375d21cc057d1a363fff070208811f
MD5 SHA1 SHA512

Submit Download

Setup.exe

Path C:\Users\Admin\Downloads\Setup.exe
Size 117KB
SHA256 2ae9cb1edc9fe800d9d12bb14ce69a7e5c5895259c3e90e6f11caca01b09e8fb
MD5 103d8dd25e76930bb3202cfd485ae013
SHA1 c4fba375744c128fdfda9da2eb96ddf49643ae97
SHA512 b5a9e8b4ef2a042c78cf6d340460976c9a308c9e6e605de42ed327e4e29e5315cadf1274cd3469ef6aafd5707c2417ab4d5807c8d8f76998f93172c2c1039840
SSDEEP 3072:KbG7N2kDTHUpouDNDheVPzy5n+/mGCKHUv:KbE/HULNcVry5nmwv
MD5 SHA1 SHA512 SSDEEP

Submit Download

PcAppStore.exe

Path C:\Users\Admin\PCAppStore\PcAppStore.exe
Size 2.0MB
SHA256 71226b69696e60a14e516c80e0852e636e9c2ac1f4498eeb8d38d4a93dc57391
MD5 92cc70d7d67db4a1dfc22857920c9364
SHA1 ea5ee53da20a09cacdc054b2fd462f10c901cb2d
SHA512 390f252a618539e0412177f9b43ba7e46e68909620e9abe3cbb57db2ef5e8a207b28c79e6d98bde7f6ddb520c8d57b62f5d34b7a06af3d6e1ae75d30ba7c29e7
SSDEEP 49152:RDzJpHmQKjDCvmNe/lfWADk2SXpgZu3EHqXeF9iH0OmgQXVtnjCJl0a9C5JYGJSG:DtmQKfCvmNe/dDDh73oeXQ0JlsC5JY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Watchdog.exe

Path C:\Users\Admin\PCAppStore\Watchdog.exe
Size 269KB
SHA256 828ad0151134c8a6e80b3d1716bf8a35cd902b3eecf7e3009987693ffd696ae4
MD5 7b432b3da82d7e40916d1d2eb6f9f48d
SHA1 e399e64d069169e9c61068d111b7cf5f57bae513
SHA512 eae6b619014979f7b529bfbc923d1f1047efdf8c15bbb306fb4e02a9aae05dbd99036602f7606b53812af7da369e55ad84d08b25da8a083f3bf3121016762716
SSDEEP 3072:y+BPcnjPR/usTaxqT266DZZG4c72LUnAR9i0oraOpAASo6mHYR4wyT3Ho6y7U:HEi02VD7G4cKoARs74gT31
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg.pak.info

Path C:\Users\Admin\PCAppStore\nwjs\locales\bg.pak.info
Size 1.0MB
SHA256 e84331e84cd61d8bdacc574d5186fb259c00467513aa3f2090406330f68a45db
MD5 82d7ab0ff6c34db264fd6778818f42b1
SHA1 eb508bd01721ba67f7daad55ba8e7acdb0a096eb
SHA512 176458b03cc2b2d3711965cd277531e002ae55d284b6c9178d2353e268f882430235468e5a1e9e45c8427864d109cf30a024a993b4763a75fa2744f6e0a6ae2a
SSDEEP 12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
MD5 SHA1 SHA512 SSDEEP

Submit Download