120879497cadcc19040c9e48684536c8d7323383ce379633ca35f3cef0337583

Resubmissions

09/07/2026, 22:26

260709-2c1zkabv7y

09/07/2026, 22:06

260709-11ekssbs9x7

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 22:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 4.5MB
Sample260709-11ekssbs9x
SHA256 120879497cadcc19040c9e48684536c8d7323383ce379633ca35f3cef0337583
MD5 440caac8eccdd78d5b8556901ba851a0
SHA1 6dd89bee3b8b03e165fec9356f362e0edbd574a6
SHA512 300901c4e1475a220c8bc1963d2ca37d207b650ae96a8eaac881c29cd3f7b3a54d040e5a6427963580c9174f0b2e90954e599e2b3784672cc8d3cfe93a3d0d2c
SSDEEP 98304:uVzCTWj5bvoX1bE0LIhyotUVXeg79NziJeK6BKbda63PF8ps:uoTIvsNE0LcUNH2eKtbEo
TLSH
T17E261209DAD702F8DDA7C6BD8A965403D772B8860374CAEF02D197160FAB5E09E3B711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
3052	PcAppStoreSRV.exe
1760	PcAppStore.exe
2076	AutoUpdater.exe
1264	Watchdog.exe
2756	PCAppStore.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	PcAppStore.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Site Characteristics Database\CURRENT	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\DawnGraphiteCache\data_3	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\d1ba37db-85e4-4ea9-b9cb-1b605069f7b6.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Site Characteristics Database\MANIFEST-000001	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\GraphiteDawnCache	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\GPUCache	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\Network Persistent State~RFe59d1dd.TMP	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\GrShaderCache\data_3	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Local Storage\leveldb\LOG	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\728c4137-8136-4d81-b173-a27f411d1041.tmp	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\data_1	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\a78af591-d846-4af5-8f9f-b19f1e05a0bf.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\77ecb1223b9c0439_1	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000028	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Favicons-journal	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\shared_proto_db\metadata\000001.dbtmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\SCT Auditing Pending Reports~RFe58bf82.TMP	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\DIPS-journal	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\3051db8d05dea5c0_0	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000018	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\index-dir\temp-index	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\GPUCache\index	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000016	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\eabab38efe6a494e_s	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\e7e48a44-9d1f-4e2c-8aa2-6f1dedf1da1a.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\ShaderCache\data_0	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\BrowserMetrics-spare.pma.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000027	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State~RFe58bc75.TMP	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\shared_proto_db\metadata\000003.log	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\AutofillStrikeDatabase\LOCK	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\VideoDecodeStats\LOCK	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000024	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Extension Scripts\MANIFEST-000001	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\GPUCache\data_3	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Feature Engagement Tracker\AvailabilityDB\LOCK	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000025	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\AutoUpdater.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\shared_proto_db\metadata\CURRENT	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00000e	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\cache\3087274722.html	PcAppStore.exe
File created	C:\Program Files (x86)\PCAppStore\Watchdog.exe	Setup.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00002a	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\shared_proto_db\metadata\LOCK	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000001	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000014	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Extension Rules\MANIFEST-000001	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\Trust Tokens	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\ExtensionActivityEdge-journal	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\ShaderCache\data_2	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\DawnGraphiteCache\index	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00000b	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\cache\785347551.html	PcAppStore.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000019	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000028	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00001a	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\e0eb2d2a-0792-41a1-a0c8-ef7d315263d6.tmp	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\heavy_ad_intervention_opt_out.db	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\EdgeEDrop\EdgeEDropSQLite.db	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\GraphiteDawnCache\data_1	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\DawnGraphiteCache\data_2	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UINumberDescFormat	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0025	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UINumber	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Security	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ContainerID	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Security	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ContainerID	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Driver	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UINumber	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UINumberDescFormat	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Mfg	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LocationInformation	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0025	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LocationInformation	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	PcAppStore.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134281084312498454"	msedgewebview2.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\ = "URL:PC App Store"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\DefaultIcon\ = "C:\\Program Files (x86)\\PCAppStore\\PCAppStore.exe,1"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\shell\open\command	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\shell\open	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\shell\open\command\ = "\"C:\\Program Files (x86)\\PCAppStore\\PCAppStore.exe\" /src=custom_protocol /query=\"%1\""	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\URL Protocol = "PcAppStore"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\DefaultIcon	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\shell	Setup.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1680	Setup.exe
1680	Setup.exe
1680	Setup.exe
1680	Setup.exe
1680	Setup.exe
1680	Setup.exe
1680	Setup.exe
1680	Setup.exe
1680	Setup.exe
1680	Setup.exe
1760	PcAppStore.exe
1760	PcAppStore.exe
1264	Watchdog.exe
1264	Watchdog.exe
2756	PCAppStore.exe
2756	PCAppStore.exe
1444	msedgewebview2.exe
1444	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4172	msedgewebview2.exe
4172	msedgewebview2.exe
4172	msedgewebview2.exe
4172	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
1760	PcAppStore.exe
1760	PcAppStore.exe
1760	PcAppStore.exe
1760	PcAppStore.exe
1760	PcAppStore.exe
1760	PcAppStore.exe
1760	PcAppStore.exe
1760	PcAppStore.exe
1760	PcAppStore.exe
1760	PcAppStore.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
1760	PcAppStore.exe
1760	PcAppStore.exe
1760	PcAppStore.exe
1760	PcAppStore.exe
1760	PcAppStore.exe
1760	PcAppStore.exe
1760	PcAppStore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1680	Setup.exe
1680	Setup.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2076	3052	PcAppStoreSRV.exe	98
PID 3052 wrote to memory of 1760	3052	PcAppStoreSRV.exe	99
PID 3052 wrote to memory of 1264	3052	PcAppStoreSRV.exe	100
PID 1760 wrote to memory of 4172	1760	PcAppStore.exe	102
PID 4172 wrote to memory of 1868	4172	msedgewebview2.exe	103
PID 4172 wrote to memory of 1556	4172	msedgewebview2.exe	105
PID 4172 wrote to memory of 1556	4172	msedgewebview2.exe	105
PID 4172 wrote to memory of 1556	4172	msedgewebview2.exe	105
PID 4172 wrote to memory of 3268	4172	msedgewebview2.exe	106
PID 4172 wrote to memory of 836	4172	msedgewebview2.exe	107
PID 4172 wrote to memory of 836	4172	msedgewebview2.exe	107
PID 4172 wrote to memory of 4524	4172	msedgewebview2.exe	108
PID 4172 wrote to memory of 4524	4172	msedgewebview2.exe	108
PID 4172 wrote to memory of 4524	4172	msedgewebview2.exe	108
PID 4172 wrote to memory of 936	4172	msedgewebview2.exe	111
PID 4172 wrote to memory of 936	4172	msedgewebview2.exe	111
PID 4172 wrote to memory of 936	4172	msedgewebview2.exe	111
PID 4172 wrote to memory of 6008	4172	msedgewebview2.exe	125
PID 4172 wrote to memory of 6008	4172	msedgewebview2.exe	125
PID 4172 wrote to memory of 6008	4172	msedgewebview2.exe	125
PID 4172 wrote to memory of 2280	4172	msedgewebview2.exe	130
PID 4172 wrote to memory of 2280	4172	msedgewebview2.exe	130
PID 4172 wrote to memory of 4984	4172	msedgewebview2.exe	138
PID 4172 wrote to memory of 4984	4172	msedgewebview2.exe	138
PID 4172 wrote to memory of 4984	4172	msedgewebview2.exe	138
PID 4172 wrote to memory of 5172	4172	msedgewebview2.exe	139
PID 4172 wrote to memory of 5172	4172	msedgewebview2.exe	139
PID 4172 wrote to memory of 1444	4172	msedgewebview2.exe	140

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1680

C:\Program Files (x86)\PCAppStore\PcAppStoreSRV.exe
"C:\Program Files (x86)\PCAppStore\PcAppStoreSRV.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files (x86)\PCAppStore\AutoUpdater.exe
  "C:\Program Files (x86)\PCAppStore\AutoUpdater.exe" /i /step=init
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Program Files (x86)\PCAppStore\PcAppStore.exe
  "C:\Program Files (x86)\PCAppStore\PcAppStore.exe" /src=installer
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=1760.1248.12148845503096450881
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4172
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x170,0x7ffd3760b078,0x7ffd3760b084,0x7ffd3760b090
      4⤵
      PID:1868
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1680,i,1600778824843781782,11400675117439237984,262144 --variations-seed-version --mojo-platform-channel-handle=1656 /prefetch:2
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2000,i,1600778824843781782,11400675117439237984,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:3
      4⤵
      Drops file in Program Files directory
      PID:3268
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2324,i,1600778824843781782,11400675117439237984,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:8
      4⤵
      PID:836
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3576,i,1600778824843781782,11400675117439237984,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:4524
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3548,i,1600778824843781782,11400675117439237984,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:1
      4⤵
      PID:936
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4732,i,1600778824843781782,11400675117439237984,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:1
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4936,i,1600778824843781782,11400675117439237984,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:8
      4⤵
      PID:2280
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4252,i,1600778824843781782,11400675117439237984,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:1
      4⤵
      PID:4984
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5108,i,1600778824843781782,11400675117439237984,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:8
      4⤵
      PID:5172
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4932,i,1600778824843781782,11400675117439237984,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1444
- C:\Program Files (x86)\PCAppStore\Watchdog.exe
  "C:\Program Files (x86)\PCAppStore\Watchdog.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1264

C:\Program Files (x86)\PCAppStore\PCAppStore.exe
"C:\Program Files (x86)\PCAppStore\PCAppStore.exe" /src=shortcut
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AutoUpdater.exe

Path C:\Program Files (x86)\PCAppStore\AutoUpdater.exe
Size 1.2MB
SHA256 e09ae200a5203902fad658a9b2134b02a98d2ec487e38070a55a231aa784d9d1
MD5 d1e3b35dafcc895e6cfad42d137d04cb
SHA1 abdb19a60e7254a438e449efdba3af769e9899f1
SHA512 49e1c8f91ff41718afa10e5e82262000a7a3aee4021e5a7da7b4fc733be425fc70797b77130f9b41e621d9f5c255b9693a21cb05432e486b32f32a9ff7798ef3
SSDEEP 24576:Jc5Atj2SpMZavtMS6dQ/5OfPMdSSoC2UXPNxUsRKZkh0lhSMXlMJRv:JcWdNRKZJG
TLSH
T1E6557D1A96A442FCD0FAD17CC656691AFA713C46837027CB1284B9661F377E4AF3E702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PCAppStore.exe

Path C:\Program Files (x86)\PCAppStore\PCAppStore.exe
Size 5.7MB
SHA256 e70e3ec59ad817e18deab81ae8c85ea8264193b0d211f80f86cb4741d243e915
MD5 d95a8ff1f7ffc85af4d55309c1123a19
SHA1 b5da666ee16d2955e0f1d32a7d6f1d3c2f71dd18
SHA512 a9981d49ad83d5032eb498c9ad965b75b535068272f87960c8be4564bb2120e9b14df11b37b22e58823ab5335af1559d27aabbe838f1aa760a2e8a73e0073ef3
SSDEEP 49152:vTjwCCgIJeiEb2tiP5mbtvbFClRGvMsidtLkoY2KLc2Mt1E3TQptq:vICCPEWxvmRGYAQtGCU
TLSH
T14656E85AD6B642E1D4F9D178C626722BFC713C5EC134A70BA781AB175B32760EA3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PCAppStoreSRV.exe

Path C:\Program Files (x86)\PCAppStore\PCAppStoreSRV.exe
Size 841KB
SHA256 9662a6c12e1f489e600c3aa2bba34a95f074d4220d5b90dd8f862c0fdb281f22
MD5 fd35f476234cae3d45f750765dffb285
SHA1 86281c46353ba943621b76bcae641d9778218893
SHA512 0c43f0e2f701c0a32c6d299dd71eb7d1f3ec1ea0e0899b7bdc63b4baa77836868b9dcbbf0be9422bd30e3d7ed7ca180a94ba7d9eddb106abc6ab2fc1ffb72b78
SSDEEP 12288:Cpv3/MMt0zEQBdtkCHyBvDSBIDph0lhSMXl+pPIbwBxcBXj:Cv3k40zE2dtjHyBbkI1h0lhSMXlyPOvT
TLSH
T182058D2AEBA942F8D07BC178C992650AFAB27C5A436167CB039175672F336E05D3F701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReadMe.txt

Path C:\Program Files (x86)\PCAppStore\ReadMe.txt
Size 146B
SHA256 5d2f34957843469949690c30182f3549c5af8211c46283217cbcfcf9b25c1583
MD5 2c23d1996a76f9a6310cf32c3d0fe585
SHA1 6e8788fda04cbe47671ac87825c22380ef04bccb
SHA512 42b4e971b52b671c6ce5bcac1ce2283913d3bbd1bde4714539a197845c511814d32ba296d9ce6c573cd95ffaff7f3964862cb9c6e4813019b9705c07152515ba
TLSH
T167C02BE3B00F04378212824924CBCD00EF1DC07699C14709183240BD9513208C323C6D
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstaller.exe

Path C:\Program Files (x86)\PCAppStore\Uninstaller.exe
Size 401KB
SHA256 3fd0be01793c19bfe0782d6d95b0997eca350c1735c9ebf1caf8bf289993eaca
MD5 2cb08ec5e087ae21294d7f8a51658144
SHA1 848962498fe35c2f1b077fb71f0b151a1a9eccc9
SHA512 f3cf8c5abc22b9bfa5b60d2179ff78232e4b6298c66b5935d03dd0f48d0688a7fecf17ae1e5f2a5459a3ad88c00d132e4487710ee359ef059f96be9faa1be6a2
SSDEEP 6144:xep1lcLWNBPTYmGm1mMd1YSxIJpTWHc/njixAS9rdDgA:01Ym1R17x+eajix9rx
TLSH
T146949D09E7D508FDD867D2B88D934446E7A2BCDE07685ADF23E486560F236E04E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a12f7f8c75f94969b9da8c821c97007adf9fe747a16cea462bc90f2d0514915b
MD5 7b8be748a1d75205a9ad33155e638b2c
SHA1 fbb7383a90ab3ab536651a6c22eec7df308407cf
SHA512 18af44c0a96164b1eff2794c84b5c8431a92de9b5e0b6e7e072274c5e1ed31fae538e9ee1e9b520944764ad6d36211415db7b260188736b6bdd0e8670540f27a
TLSH
T1B6D0121232120134C12021330042A50D1448C50BC0455105743CCE7D6ACC0501907441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ef46aaefe8ee6dc2f392f35c8a7ece54b7921e480737541d83479ab8052bf3ac
MD5 bfa9c234cad343ea95e849967541f010
SHA1 29967f564d13ca2751a1a92857d1e48eb7e4c8cc
SHA512 45a0b00f8603b73dc9671a1ea5d5576eb903e02bf75218b643e8ca797fd4c1c4619e8191024211c2265a28fcd204c60de355cf42a9efaf6fbf3cfe61781c4ce0
TLSH
T145D02B13F221023EC12030730181E52D2A09B20F9042501AB43CCF7CA9CC0D70B828A1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 84898ceb69edc8af565c76d7a02e2486f2af9f95e5f4afd930eb97fffeade1d2
MD5 a04b190d09270bcd27c68865e7eb3b02
SHA1 91f7c4bd3efcbe38a15aacf4dc0dfd6f6cded412
SHA512 7745b6631540ea973932a02301274a8df630a85489ce2f2c5994d781f1bd8a315e03e6f2459af4bed2954a3f9062cfdac70910bdb7c431f6275007b1fe434e15
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

f_000007

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000007
Size 47KB
SHA256 3100e775e8616cd2611beecfa23a4263d7037586789b43f035236a2e6fbd4c62
MD5 260c81a4759baf163c025001c4f27872
SHA1 f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298
SHA512 9acec3e7a411a1eb6d072c3773bb14e5aa74d85d334674ec0fb018b7937174d5b612b756b2ce7aa3993d31dfe172516e7aaec79c7dd209eac5fd15d9aea077e9
SSDEEP 768:Gp4Wb3wv+eCLRZRtq9uGHpHveBOX5qw/14X+5edVWK4afHSTle4MRhVUNMT/TQDt:Gp483wdmXRtqhJPeByj/f4WK4mHIj8xw
TLSH
T1BE2302DF9E4D72D29271267045338383798E2D8A50AAE7A1061C0FE6DE05B69D31FB9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000016

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000016
Size 36KB
SHA256 65a6c5423c1ac08c7bb2c27777194d24069d9e32bc2dbbe27025f5a507df424f
MD5 2bf267e483e3a3826ff400338eaf2b8a
SHA1 c316cefbc76e89020765b29a2a92f7996b40b887
SHA512 97a0090ce19016538007bab4ca26efc6100f8d57654e126bc65abc465c5b3754afc8a300440991764894764eb995330c856d19139892dfce62afdbb035a49400
SSDEEP 768:A7kKqdDEDmJElRJomS2j7f44cKBngw3YYYYonrE+fny:f0WE6mS2j7fJBnYYirE+fy
TLSH
T1A8F2F1713E632CFBBA50DD36024E78188966B8F59F251DD7BAC921800C225D27B92ED7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 fca8e53f3a887d9ca14ec64379c8b4574aaaedbcbfb24ab91b529af7c11a5da6
MD5 c8652050117627a63e30b30bbbda4752
SHA1 7497de7da9ea11445c34c977d6967fb673d75f3a
SHA512 84fe053aafc8641d8ade73103c31b70516041bca84e47501a3ecd38f0548f456d8354b6d8167d3d1551a3393345a98ebf8668615198a85a1d5286ac35395f85c
TLSH
T1BAD01219458411D1DFE5C27766D06EA97C12D692C5D21E62142481EF65B32C0525470A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 e367981358b07597daed67f5b4897e3be920c4f42bf99f8338a8990b991892fd
MD5 9d7b8b937a8bb6b0eef23f463b014038
SHA1 d53b916515b5bd251259bf726d70c9471cb66fed
SHA512 3f81846ff4c6b012feb0adbabaeaa1dcfe842a59de07efec81a3624987ef60232a1164be60dd854e5a9470657eef9e5ccd20eb5384eec25c439581fd8bfc3fdd
TLSH
T114D0A71E5D4946C7FBF506702AD21D45796AD541CEC22F751B5540EB54D3290228868E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 a861bee9c0c1a2363b4c8072dea0b015b618c0d7c4132fe84bc47af2692219ef
MD5 addb6701cad3bc566f7e88f048f8b103
SHA1 3405ee758a27977e188daf15ada886fa6fa854cb
SHA512 747129c26147cff9dfa3b5b73e067232acf1e716f98b9cf7b5cf565335f0973ab1ef9f22a61759768bf1b5d822d1960b0e550b499a046a91ecf472e4d8f9f45c
TLSH
T11EC09B19558015C5DFC5437557F45D957C62D5EAC9D31F22116D05DF51E33C05280B0A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592c56.TMP

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe592c56.TMP
Size 48B
SHA256 b70c44254454650209fbab55668d5157a5d00a8ef19dba225cbb93e790693fd4
MD5 fb1de502859f0b27437fe2cdd9a4ec55
SHA1 7be65f2a915423aab418966a7e30f86b403383f8
SHA512 440d02af3ecdf0aea2727828f343eb64e2ff70003543ae2b4fe3bce59eff76695d4aee5ba017910f7bd2ff5a99ba600456fe5bd8ef50ca79194069d25e81f346
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 26243ec6c719f5d996a154cdc26eb4ffa9baacf8eb992943604d2b5774c65274
MD5 2afb8cdea3d158d365f98b73d3766bc7
SHA1 a7f20ede842c830b6238e9bd733070fd2a8be6c6
SHA512 bbe0ce7738109690523ef0a43d32850f19e0fa134c6e8611fd8c5e7d91714190f08a2ddf775cc93bdf1a4474a0dc54ea1cb0d730afe484d35f95950e047829d0
TLSH
T1EA318BAA8BE4C97DFE8112F82E612C1BCD5D0921031C6B3AC8E07F7A97E1460E30560F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe58e625.TMP

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\Network Persistent State~RFe58e625.TMP
Size 84B
SHA256 712196693e3527ac1131831f1a2108b6c0e5c68967b26d51a452611cdfb86e0c
MD5 32b9dc9cc81d0682e78627c873fdd651
SHA1 46c486386d3e153c3e9b11d54cb52cf0064b71cf
SHA512 f18bc37f8b72411548da247aa1394cc5ac03c3bbd98e82eb8ba290ef239ef5b8625cf4835bd41ce7c52766d0bc3bfe9150dd22dbf62f0f05992ddde5fbfdc811
TLSH
T154A0121490405CFB0308835504146463C3F50002421848A91634318D019209D0004403
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\TransportSecurity
Size 690B
SHA256 375d580f89decb32cc4dc7085e615857f1eeb938675300f056651c341ec626f4
MD5 14fcddf4bc69849069a7e83519e2206b
SHA1 ab22480a7f65c355c3d3771245105b84b9481974
SHA512 6090ab87ecc17036be8664dce52e3b3976d42aac3483a6b3dbde73c33e807c34e02f474921bcb6b4db5ccdcf3c58f0a6564d14de2c64ca96ddc844d8ceaccf8f
TLSH
T1F1012BD7917FA5371079586F1D847C192B79F535514394E8DA92C73CB0819FF1B06822
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\TransportSecurity
Size 690B
SHA256 3134315abfd1659a00d0d1de2846437201b247deadb1351c7f6be3bee2069689
MD5 5233f4e90f5328afdfdc49a8fafefe36
SHA1 2b365358e3e56fb0b075a89c4b73f3951ab4a2bd
SHA512 edea3b11c3b9bf8cf10b55408220aa4675636d900f1809b6955779c04f2b8183212d9fba63881e0b38841dda360757893afb5c71722aec4f72293cec842793f5
TLSH
T13B017BD7907FE4671069986F1D907C191B79F535414394E8DA92C73CB0819FF1B02822
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\TransportSecurity
Size 690B
SHA256 f46e2c81825828976600f6e45935d67b5fd645f2ab94302f266da55037825976
MD5 703e8d9ef613daac5ee90b001a08e783
SHA1 6d775fb1a9940e0eb97c893cd08b4d0f1713ddfb
SHA512 4f8a652f26134b4c0cdbcab086268bacd0b9ea540aae5c4fb9f1e00dc06cdda1e05bb48faf6bb66d4d022ef1791ffe2d65ae232cb816a68b3b590424fab6b097
TLSH
T193012697917FE46720795DAF1D407C061F79F53A818398E8EE93872DB0816FF1B06822
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe595d97.TMP

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\TransportSecurity~RFe595d97.TMP
Size 690B
SHA256 bfc592534b52d14a07dacd024ce3fc41b5f1151df32e9db56f8b3017a87f239d
MD5 99d9709c5ec3ad05b418eeaa7b36f3e2
SHA1 b9543c16ea5307e097c913efdb31bfd9e4462782
SHA512 8a46604599132fd09e6f3bb29f5fbd6345a6c68c7e5344c2e392364229425fa35cd55d2cedddb6901214bb56df248b7068e36b9758ff56755938e7fb30f92152
TLSH
T1A00176D780BFA937103A58AF1C417C0A2B7DB93680A294F4EAA7462CB0805FF1602822
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Preferences
Size 7KB
SHA256 276a2520911b268b333c2d19de4a6401c91aba98eacc0cc8756eb46056fd8fd4
MD5 151dd92a7ba1fc3b1cdb8ca7641a7702
SHA1 1cfd7c22e063b82fb55546d4c26cf1a5a9319886
SHA512 25f3d0d88294f739c5f360cea1646a291986d404b3321e8dd403618d08e133dea1c5268028d930e57ef30ad7793f736c2a44e9cecb056f2a82aebccc73a93c08
SSDEEP 192:stI0Tumf4Z8p9TG/S+WikncsljaYhqwvhfM3:stRT3/U/VvCaoHG3
TLSH
T180F1B8435E686D7B4CC7E21D7D35BB52E2F6102227D41E48AFFD8A0C04E66DD220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Preferences
Size 7KB
SHA256 466972552a8350dedb3b7c1e8fa840753e2d9cd599140db9b349e8101267e6c5
MD5 835189c69798a993da93ffa8033bae95
SHA1 f05acfa1df14375be1ee396b74bb36732dc4090e
SHA512 6c5ec588f09968924cea1cbdee44921a9c8a8c58aeb22806fab6cf705eebdb5f84b0a5b46bf4eeb02b4b1f467c90a8cd5823e07e428f02212e6cad66d0547ded
SSDEEP 192:stI0Tumf4Z8p9TZn/S+WikcppSljaYh9wb4rM3:stRT3/H/VvQaVv3
TLSH
T1E0E1B7435E6869774CC7F21D7E35BB52E2F5102267D41E98ABFC8A4C05D66CC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Preferences
Size 7KB
SHA256 def29496248e69e5fa4b4ade96d02e150b5b7f273b1b930bd4bd25c99873d3af
MD5 08cd0d0732c845d58187dc342ed98954
SHA1 46a7cf02547a84f4579b9ad425ff80f58db9baa5
SHA512 5f7264b150f691809d4c9f0db44ace9659b7708b5ebe0c23ee81614e28b3116d9328c0e3c4ad09eecdd7859d2f9790b57fb61059b8bd448560f3b05e52e7ce96
SSDEEP 192:stI0Tumf4Z8p9TR/S+WikGdKljaYhqwahfM3:stRT3/H/VvoaoiG3
TLSH
T1E8F1B7435EA8697B4CC7E21D7D25BB52E2F6102217D41E48AFFD8A0C05E66DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

a065364b-5f20-4124-ac95-f887af12a86f.tmp

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\a065364b-5f20-4124-ac95-f887af12a86f.tmp
Size 6KB
SHA256 e25b27713779d80d7b988cef0441e724e1529569795487daf10cf27ae28849a9
MD5 61c343b37d9961c3556dea4f19b8e6ec
SHA1 3f1aa0a17013076919a1ac214641d31b8cb77529
SHA512 bb6fe0c0ae5270c89c32d3a2bec97c8911d71dd462617498627f7e0c800ed97e478320d5369974287ed89acb7348e81859b4f1d6ec999370b5d1a9c61df6143c
SSDEEP 96:stI05XLKjb93AffgZ8i0v2tEykX8m/7qx+WVHMSm+uec4GUfIYRQjx+gFbrMEYL:stI0JuAf4Z8p9Tl/S+WiCGUAYRwPbrMF
TLSH
T164D1A7035E68697B4CC7E31D7E25BB52E1F6102267D41E58EFFC8A1C48E66DC620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State
Size 1KB
SHA256 1cef4fbc59f6be88f8c1869e473cc5dde2cf17583d27c509a0b4e905a1983470
MD5 8f6b923fcd39059039823427dc60b545
SHA1 00ae0bb8e2ee80a445645ea8c16b78618b6b9b1d
SHA512 18776377741a2b5e453952e42e6e7919a716280b7f1104f9fdb48ce90789ccb6ec6eb25e2152c5f47efe529e21b6e1698e7cfd1a89b3180e13a01556e2f67994
TLSH
T14C3165B3A4D47F3368919B557743BF9B7D28602AC1848E44B6DD4F0C02F71AC962AC36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State
Size 17KB
SHA256 3f437b9d3f2020fbb38a6ee19fd360684d8e5125dc1879e726c7dc1fdcb25040
MD5 2dbfdaddfac9b9de7cbbffa279c53b65
SHA1 cfc44e89d13f5cbce4bd675152577bbf791bb07d
SHA512 02d6837667dea01b7baa1028c1822e51a498ae1929c3a7e8769b322acca52e081697dd50e8f1cd8325b723bd016ea368c6d32d354d69fc300ea8dadead35fa76
SSDEEP 384:zssrv+89zHqlDNP9oidFNgfcCHz2JPOP4IxhCwY:brv+4UNbdUHSOP4ILg
TLSH
T1EF827C32E568E7336CF3D689B5477A0BBB78614681C50AD0DDC82F8D429B5DE230AD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State
Size 2KB
SHA256 bdc959ce274d1bdafa37696074a5bd18a0e35da4e0fda67d105333e36cf00a65
MD5 a3715429e7ebeae9133879478228a6ab
SHA1 133338d4cfaff510cb50232b828e4cc3383039ce
SHA512 7393bbd91e4420ae29d718ccbf9fe144a1ad589a3d16aa94fc8213c684fa57b49826148e95a45402d827cbf6a39f6d6223f9724746ee3cce29cb38b1eaf46a86
TLSH
T15B51A77368D4BB3389E38B547E463F53A93C612686951F50AADC0F0C01E75AC1302C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State
Size 3KB
SHA256 23c767b855de9b9d7fd8ebba4316fdb06b25bc80d378c5fbc08fb0c18ef72522
MD5 42b37c0c51bd285d40ba95846ed3d581
SHA1 e860e52338205e5de104e564bc14b8dcd8cd1537
SHA512 a5a34b52d76b7e547b7dd19423cb3c97ea7fcbf7fbfee4c283927c3cecd3b8c2ff6cae9079a9bf3b0378a0cb6b8bce731a41cc17e38ca0bc6bc31a337ae57872
TLSH
T1B371847369E4BA374DF39A14BD863B16B6696127D5C53F94EAEC0F0C01D72A81312C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State
Size 15KB
SHA256 9ba07435d442e9195221dbafddf06c62c1bf3ab2c9b0d6f2ff42744b43a5b6f9
MD5 7ef9d22a619fd903b455f7b4f12048ba
SHA1 bd06078c0c1b0425d3453ea07b1f1b216aa1f50f
SHA512 5a7563b83f5f15e23c98d94832d7c34d4cb502a5618e726c4a474d772551f2474a8d7d7586ea0ee697126560b080c4a8dfe13af413d95c5779b4e77ea2ac026f
SSDEEP 384:zDsrv+89zHqlDNP9oid6NboL5Nzl4IxhCwY:0rv+4UNbdPNJ4ILg
TLSH
T122728E33E57CA7335DF3D509B58A6A0B7F3C505681C21B94E9C85F8E42AE0D92316E13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State
Size 17KB
SHA256 88e8ab6196e54869d332d04d92ef29ceee9cba75a0e6b2a806ce7ce5148ea4f8
MD5 ed2f2105b29ba00f1db5865fc2fa9ed7
SHA1 e2ba6e74aa0e35233acdd6cd436271ed170e7f44
SHA512 6a84b0f7abb46dd165c97f1ef51ab933e03659bd8cdaaf9b26eed6308dc8b87b542ddd8ef9bdbbd6be1a01b07bdac39f8dbee4c13d44ec6e777b124cce7758a3
SSDEEP 384:zSsrv+89zHqlDNP9oidFNgfh8Hz2JPTP4IxhCwY:Rrv+4UNbdFHSTP4ILg
TLSH
T1C9827C32E568E7336CF3D689B5477A0BBA78618681C50AD4DDC81F8D429F5EE230AD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State
Size 16KB
SHA256 fc9b035a73c30c12fa8335498dc4b9252d84c52a815a9b799a85914a3d8aff4e
MD5 f6e809259db97bbb57a3bc61253a5a96
SHA1 24c91585cae3d533a7e8fa740042f27e89eefad6
SHA512 c327cb80173df75682f8519ffd0ad893b92ab62640c077f3bf9c36d8873a33486ff032847941aae25abdaac320ba0374e385917c85058174de3f75ab4e1079e4
SSDEEP 384:zIsrv+89zHqlDNP9oidwNbf7dHzl4IxhCwY:/rv+4UNbdgHJ4ILg
TLSH
T1EF728E33E578A63359F3D509B8866B0B7F3C605681C21B94E9D85F8E42AE1D92316E13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58bac0.TMP

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State~RFe58bac0.TMP
Size 1KB
SHA256 17c9bb965916abb59a3ab0c7821977912032fcd852e340c02480ab27dd8e15e9
MD5 056e949d88fae2ccabf138de008489ac
SHA1 c16178028c54072b76b0861a278177345a9aabe1
SHA512 c3542e660b29a30220eb444882cb2f217757e1b3f0af17460e3e1ab0d285f6ba25e158f6b5d17baafeff703c63f011aadc035a7f1bd0658483ac04c3cb5015ae
TLSH
T1132135B3D4D87B3368919A65B643BBDB3D18613681848F48B6CD4B0C02E74BC8627C37
MD5 SHA1 SHA512 TLSH

Submit Download

Watchdog.exe

Path C:\Program Files (x86)\PCAppStore\Watchdog.exe
Size 856KB
SHA256 674298fc655f67debf448653d774aa67d2736a675b91479fb84a476d0ba1b6e9
MD5 6c305f66e4e00c1ed5021a2e95ac2aac
SHA1 3c64448bd4c3077b87c8acfb48fe84ca086fda2d
SHA512 ab8d32d693f1e7a6724737e996ea92ab39b1efd6ab7433b4e15c5ad50f801cd0e295a8cc280c07de7944893ae7d956590885444118211ef1c89a12b6f20b08cf
SSDEEP 24576:n6dHLN0DHu2CRz+7rbpa0/vTVh0lhSMXlhwB:n6dHLN0DHu/Rgvplom
TLSH
T1C5159D1AEB9801F8D4BAC27989A22546F7B27C4647615ACF139135A73F336E05E3F702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1259544006.html

Path C:\Program Files (x86)\PCAppStore\cache\1259544006.html
Size 18KB
SHA256 53f278fda227f87187fe82969b3974486bfcc84616fed80146ee0d99a2686a02
MD5 f39062f0fc648722db0131ffb89bc66d
SHA1 e112442b5199b770e22ef7649730790507c334a4
SHA512 94fc5be113af4fa1ad35fff168c78f23dd29d486a1aff903704f7b01b85ccb6dac004141ce6cb4865a6d49fe1134e91486f4f8dda856145987b027fdecb5dc59
SSDEEP 384:sOguS1uiRRyBT0EsiPwa7F6iHiPg4z47+tRx4ysG6VQlAq:sOWRyBT0E34ahCLpRx4ysG64Aq
TLSH
T1EC82510C3AF600618177317D4E6F96083535A0332688CE517D9CD668EF6893E67FAB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1946753793.html

Path C:\Program Files (x86)\PCAppStore\cache\1946753793.html
Size 19KB
SHA256 3d1ba809a5bcffda8232a57572557c725b3c61bb9ac17d2c868fb4c54d987196
MD5 fed916f8124df43cbf694e2f42e9e3b2
SHA1 ef8822ab95b14e8250ccfda9fbd2a8bbc0cd0e74
SHA512 6d703b91976034b757d25ab7d1690f2cb3e65d5cfd75b6e632222abfe8ffdb4a19408a15b33a966a41fad9e62853a33bedffdb6bb668ce20058f653d0049c97f
SSDEEP 384:MOguS1uiRRyBT0EsiPwa7F6iHiPg4z47+aRx4ysG6VQlAC90:MOWRyBT0E34ahCL2Rx4ysG64ACy
TLSH
T10C92510C79F600618177317D4E6F96083535A0332688CE51BD9CD668EF6893EA7FAB8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2384453744.html

Path C:\Program Files (x86)\PCAppStore\cache\2384453744.html
Size 18KB
SHA256 3ec37ecd40512d087e06257a61a2663dfe3a18ebe0052de5df8d71bfaa9cc1c8
MD5 1db2592c59d5242cff099b82516a0ba1
SHA1 2685c4664cb65012357de064463ea59ee109b798
SHA512 0722c9427681e501563295ddfa7a19b7fbc2567643664cb836c66fc643a6ecaf02867d9b0bad433a31e6c6a37ffacf532c6edf2a881784f9514fcb90834eeec4
SSDEEP 384:3P8OguS1uiRRyBT0EsiPwa7F6iHiPg4z47+tRx4ysG6VQlAiPN:3P8OWRyBT0E34ahCLpRx4ysG64AiPN
TLSH
T12E82410C3AF600618177317D4E6F96083535A0332688CE517D9CD668EF6893E67FAB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cache_setup.json

Path C:\Program Files (x86)\PCAppStore\cache\cache_setup.json
Size 7KB
SHA256 e305af8bfeffd4f690be27b11644e6e9a2d83f4d49b61a251908a69a6315caa9
MD5 fe7c713b7db9523586823d0b11048e8e
SHA1 2191c4150322af0852e827f295ae1b9d1ea495ac
SHA512 03a0798530b8812311c7eb6cab59685ca42309cc2fabc08b99e48bc329218b3640361f682c32c5c6608c2f975f58c508249d86b87ad6fc3a9a080c0ee432f182
SSDEEP 96:0zrUdIYCEG6kUuHdZvjPVLHqztJvWIKqfx4bv1k+vfreQISgGeQI3CXBeQIiVE:0sdIR6kUYdRJ7qD/uLCQDRH0
TLSH
T1E4E1A8FB89210F4FB452A6CCDC9B3C08D76994353F1176D4E7D61466A06223AF8C927E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cache_setup.json

Path C:\Program Files (x86)\PCAppStore\cache\cache_setup.json
Size 10KB
SHA256 77506f06c1f605912620a78331e924d92ac554127e1e47b5ca57252feb9ef9c5
MD5 c99329f70c3c9d509788006390fa0478
SHA1 0f9e45d2cc0e2083b9e46448545f544b1ad6cd55
SHA512 1080d8373ffdf5ddc938863f448feb1511dbe5c068cc1c3c234768fe2a1ee4becd4299df5d58ce4747fb3efdb2a84a452cede65864ecd403aee5a6fedbf0bdf7
SSDEEP 192:0sdIR6Z+qFxDbpIuykvwwWZWRHAmCcVbguSO:LkY+S1tgmzM7O
TLSH
T10522A4BB48111F5FF011B6DDDEA77846C7A5A0303F267691C78A1C62A43133EE8CA56E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pcappstore.ico

Path C:\Program Files (x86)\PCAppStore\pcappstore.ico
Size 16KB
SHA256 c753fe727a127586181e04060af8689e4bf9a86c1b0c0e7ac850c030481c5d70
MD5 80950421cd3f8ae4e8606f28ad636a34
SHA1 cdc6faf6415876d939a77218e78e7447d7134239
SHA512 f67e05108bde39ec0643ec16b308447522ff71d788d1aebc98cf19d8c327abe6279ebfbf3bd3ae6172dcf905f0580c584d9cecd4fc79c88eab112c60d8a778ef
SSDEEP 192:fkP+f6Tf1L6bYw0Yl//Ryfc6negmvC4ytCGPJyUDYFU/gJo9FmGI+xOw8SSOshY+:E+f6Tf1LMXeiUDkU/gJo7mGOU+
TLSH
T19472BEEB9258CF8ECD0BB9F9141950FA0A8BCDFDEA4A30D5E2E9719BB4C64350572503
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4172_1591793685\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
TLSH
T169A022F3F000F02030022F8A80203C00C8A23BA80C8020808000BEE0200322A3A0C820
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4172_1591793685\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4172_98117689\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

773CFF2C7835D48C4E76FE153DBA9F81_D9070B80E002B56309375EAD5B6A198F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\773CFF2C7835D48C4E76FE153DBA9F81_D9070B80E002B56309375EAD5B6A198F
Size 471B
SHA256 a7f2588e381eade8b36215a9fb4027bf7113f4ee19e50643a06a2a6eaf714094
MD5 776bd01ff603c493497b30f84ec65eb0
SHA1 59d69a28d21918871b34c88615273427429f20ba
SHA512 7fd5724cc71dffc63962e9530bfc9cd0c4532077f8c07aa7c926444a30105a5ec869b98fd9caae74a2566206e305949104635df63c4a64acd4db8cfc9a9b2dea
TLSH
T10EF05CA300C1D0F1B028184C7A3DE900383AA6B0D0AB007658282AA4AC60DBEBC03280
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE
Size 471B
SHA256 ef990b4647de418611c64888ecd7c13ff3edbb21d7fd6bc3bc738ca4b10c5b89
MD5 4f3b93bbc0c697c360f22112e41adbd1
SHA1 148ab799244f1d7387eb1667f1b92844b0893962
SHA512 b45be889c755157b65c3833fb754d983300050b60bd7eeb28c3c98d76e942b30aa9e6d23b71104ee2903efab43417e01a959e6bc1a21f01a3055a447dc5ab87d
TLSH
T19DF0D4D5007CF42237874C6D295D57BDF421503134C445D4F17C0AA156709E7E42DA35
MD5 SHA1 SHA512 TLSH

Submit Download

773CFF2C7835D48C4E76FE153DBA9F81_D9070B80E002B56309375EAD5B6A198F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\773CFF2C7835D48C4E76FE153DBA9F81_D9070B80E002B56309375EAD5B6A198F
Size 416B
SHA256 fec6589eea9944c1867e08ef8915f90df0f6bf9539ba30b2663013a88beb7d39
MD5 399b9a014c35e27282a6cd58b1196919
SHA1 381caedcc6eddbd8e7204c81aaa52e8835dc9425
SHA512 9ee47e596f4d4448f1b737aa040776d87efdb9735107f938976c82b5d387c611c57212d91d18cab77a778d5bb30e0c317287dd2fe6b0f47101030b75c53f532c
TLSH
T1EDE0C0192AFA029EF675EA3542D901658E0BF0231C149BA22A44430BA62B744FC31964
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE
Size 412B
SHA256 52b7aee61d5072c86aad5a5631b253f623693df08c11723a8d07ff9e6f2ccfd1
MD5 7757e2dd172063a32c3435f40bb59c0a
SHA1 50e1413f9a2a9236fc0c287403cc5bd402aa5ffb
SHA512 a3bfd3708d2acdd2cc9a94abc17e0a2dc7be601f8dbe32d34dea52da607c50b1bad33b7be21d9522462a5deec2bd4aa2b149d1544d0c353cf1961fe3671e0ac0
TLSH
T15BE0683422FE411CF6A5E5756FC5B43185ADF1250411A27029C52700B62AA00DC12A25
MD5 SHA1 SHA512 TLSH

Submit Download

pixel[2].gif

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ODLR95UN\pixel[2].gif
Size 42B
SHA256 ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
MD5 d89746888da2d9510b64a9f031eaecd5
SHA1 d5fceb6532643d0d84ffe09c40c481ecdf59e15a
SHA512 d5da26b5d496edb0221df1a4057a8b0285d15592a8f8dc7016a294df37ed335f3fde6a2252962e0df38b62847f8b771463a0124ef3f84299f262ed9d9d3cee4c
MD5 SHA1 SHA512

Submit Download

AutoUpdater.exe

Path C:\Users\Admin\AppData\Local\Temp\fb.KJBQqOfspkgp7U6jLRrhW3GUpEmBES.tmp\AutoUpdater.exe
Size 1.2MB
SHA256 90cca9477be0b7c6a608876651dc0ad1d8a8ba1d3effa25f24c94283b4598af1
MD5 3243d2b0ccc52b14cb9100c9176a80fc
SHA1 0a0115d30f9aaf66f66194bc255fa3eef82a578a
SHA512 92f268fa5dac38edd9a2e8ba6e5f97c9ec56d4608fd5752e2670e49c6d1f13089f253d17248fa2e705fd2efd3a21dcf25f768b17d6227ebf0bb2ebe93fcbd3b2
SSDEEP 24576:Jc5Atj2SpMZavtMS6dQ/5OfPMdSSoC2UXPNxUsRKZkh0lhSMXlMJR:JcWdNRKZJ
TLSH
T1D6557D1A96A442FCD0FAD17CC656691AFA713C46837027CB1284B9661F377E4AF3E702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/836-155-0x00007FFD544A0000-0x00007FFD544A1000-memory.dmp

Download

memory/836-156-0x00007FFD538D0000-0x00007FFD538D1000-memory.dmp

Download

memory/1444-828-0x0000020B1CAA0000-0x0000020B1CAA1000-memory.dmp

Download

memory/1444-817-0x0000020B1CAA0000-0x0000020B1CAA1000-memory.dmp

Download

memory/1444-818-0x0000020B1CAA0000-0x0000020B1CAA1000-memory.dmp

Download

memory/1444-816-0x0000020B1CAA0000-0x0000020B1CAA1000-memory.dmp

Download

memory/1444-827-0x0000020B1CAA0000-0x0000020B1CAA1000-memory.dmp

Download

memory/1444-826-0x0000020B1CAA0000-0x0000020B1CAA1000-memory.dmp

Download

memory/1444-825-0x0000020B1CAA0000-0x0000020B1CAA1000-memory.dmp

Download

memory/1444-824-0x0000020B1CAA0000-0x0000020B1CAA1000-memory.dmp

Download

memory/1444-823-0x0000020B1CAA0000-0x0000020B1CAA1000-memory.dmp

Download

memory/1444-822-0x0000020B1CAA0000-0x0000020B1CAA1000-memory.dmp

Download

memory/1556-105-0x00007FFD53B60000-0x00007FFD53B61000-memory.dmp

Download

memory/1556-442-0x000001FB83B40000-0x000001FB83B70000-memory.dmp

Download

memory/4524-207-0x00007FFD53B60000-0x00007FFD53B61000-memory.dmp

Download