hxxps://cdn[.]pcappstore[.]com/lp/lpr[.]html?ap=adwp&as=g_d_all_jp_age_purv&gad_source=5&gad_campaignid=23755051632&gclid=CjwKCAjw6rfSBhAqEiwA_yocpkm-52d9kvTMcHxqNpswcf5VQ9y_IJq_sSEjLsSUQ5ZwbumvJUK1TxoCXKoQAvD_BwE

Resubmissions

09/07/2026, 04:47

260709-ferm1sdv6v7

09/07/2026, 04:37

260709-e9b1dadv5t7

Analysis

user interaction
yes
max time kernel
105s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20260513-ja
resource tags

arch:x64arch:x86image:win10v2004-20260513-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
09/07/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.pcappstore.com/lp/lpr.html?ap=adwp&as=g_d_all_jp_age_purv&gad_source=5&gad_campaignid=23755051632&gclid=CjwKCAjw6rfSBhAqEiwA_yocpkm-52d9kvTMcHxqNpswcf5VQ9y_IJq_sSEjLsSUQ5ZwbumvJUK1TxoCXKoQAvD_BwE
Sample260709-e9b1dadv5t

Score

7^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
5244	Setup.exe
5636	Setup.exe
5776	PcAppStoreSRV.exe
5824	AutoUpdater.exe
5512	PcAppStore.exe
5484	Watchdog.exe
2044	PCAppStore.exe
5796	PCAppStore.exe
4020	AutoUpdater.exe
4724	PcAppStore.exe
2680	AutoUpdater.exe
1872	PcAppStore.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	PcAppStore.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00003a	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Variations	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Web Data-journal	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Local Storage\leveldb\000003.log	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\SCT Auditing Pending Reports	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\Cookies	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00000a	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000012	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00001c	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\AutoUpdater.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\data_1	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\3f127b05-a29c-4b3e-b44e-cd480e606dfa.tmp	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\EdgeEDrop\EdgeEDropSQLite.db	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00002c	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00003b	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00003d	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\6909e13e-84a1-4370-9f1d-b138a9624148.tmp	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\parcel_tracking_db\LOCK	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\index	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000001	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000006	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00000e	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Feature Engagement Tracker\EventDB\LOG	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\3a931882b1d050ca_0	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00002c	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad\metadata	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\discounts_db\LOCK	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Extension Scripts\MANIFEST-000001	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\GrShaderCache	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\GPUCache\data_3	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Extension State\CURRENT	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000002	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\6f5357fcd51ef00d_0	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\PCAppStore.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\DawnGraphiteCache	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\1a41c72b8cb50f52_s	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000033	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000042	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Favicons-journal	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Extension State\LOG	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\b88cc28da7bd3787_0	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\optimization_guide_hint_cache_store\LOCK	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\cache\4255595730.html	PcAppStore.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00003a	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\ShaderCache\data_1	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Extension Scripts\000001.dbtmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\3f127b05-a29c-4b3e-b44e-cd480e606dfa.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\5ff5387787ebd765_0	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\ExtensionActivityEdge	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000025	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00002f	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000030	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\2ef9d2dd-d883-410e-8512-5283cc9b09dd.tmp	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Extension State\MANIFEST-000001	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Feature Engagement Tracker\AvailabilityDB\LOCK	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000040	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\ShaderCache\data_0	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00003f	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Preferences~RFe5a26b3.TMP	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\Watchdog.exe	Setup.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Extension Rules\MANIFEST-000001	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\GrShaderCache\data_3	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\GraphiteDawnCache\index	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\GraphiteDawnCache\data_2	msedgewebview2.exe

Drops file in Windows directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\swenum.PNF	PcAppStore.exe
File opened for modification	C:\Windows\INF\rdpbus.PNF	PcAppStore.exe
File opened for modification	C:\Windows\INF\input.PNF	PcAppStore.exe
File opened for modification	C:\Windows\INF\kdnic.PNF	PcAppStore.exe
File opened for modification	C:\Windows\INF\printqueue.PNF	PcAppStore.exe
File opened for modification	C:\Windows\INF\keyboard.PNF	PcAppStore.exe
File opened for modification	C:\Windows\INF\monitor.PNF	PcAppStore.exe
File opened for modification	C:\Windows\INF\cdrom.PNF	PcAppStore.exe
File opened for modification	C:\Windows\INF\acpi.PNF	PcAppStore.exe
File opened for modification	C:\Windows\INF\vhdmp.PNF	PcAppStore.exe
File opened for modification	C:\Windows\INF\cpu.PNF	PcAppStore.exe
File opened for modification	C:\Windows\INF\volmgr.PNF	PcAppStore.exe
File opened for modification	C:\Windows\INF\volume.PNF	PcAppStore.exe
File opened for modification	C:\Windows\INF\sensorsalsdriver.PNF	PcAppStore.exe
File opened for modification	C:\Windows\INF\usbport.PNF	PcAppStore.exe
File opened for modification	C:\Windows\INF\pci.PNF	PcAppStore.exe
File opened for modification	C:\Windows\INF\umbus.PNF	PcAppStore.exe
File opened for modification	C:\Windows\INF\netrtl64.PNF	PcAppStore.exe
File opened for modification	C:\Windows\INF\audioendpoint.PNF	PcAppStore.exe
File opened for modification	C:\Windows\INF\compositebus.PNF	PcAppStore.exe
File opened for modification	C:\Windows\INF\vdrvroot.PNF	PcAppStore.exe
File opened for modification	C:\Windows\INF\spaceport.PNF	PcAppStore.exe
File opened for modification	C:\Windows\INF\mshdc.PNF	PcAppStore.exe
File opened for modification	C:\Windows\INF\msmouse.PNF	PcAppStore.exe
File opened for modification	C:\Windows\INF\c_swdevice.PNF	PcAppStore.exe
File opened for modification	C:\Windows\INF\hdaudio.PNF	PcAppStore.exe
File opened for modification	C:\Windows\INF\hdaudbus.PNF	PcAppStore.exe
File opened for modification	C:\Windows\INF\mssmbios.PNF	PcAppStore.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2388	msedge.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Security	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Mfg	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UINumberDescFormat	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ContainerID	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Security	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Driver	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ContainerID	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UINumber	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0025	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0025	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UINumber	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LocationInformation	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UINumberDescFormat	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LocationInformation	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	PcAppStore.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280454962333229"	msedge.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\shell\open	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\shell\open\command\ = "\"C:\\Program Files (x86)\\PCAppStore\\PCAppStore.exe\" /src=custom_protocol /query=\"%1\""	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{FDB9DFE6-DE1F-42D9-9CCB-95907437D6A9}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\URL Protocol = "PcAppStore"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\shell\open\command	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\shell	Setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{35C3B682-5115-466F-A5DE-14534D23A5A8}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\ = "URL:PC App Store"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\DefaultIcon	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\DefaultIcon\ = "C:\\Program Files (x86)\\PCAppStore\\PCAppStore.exe,1"	Setup.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
5244	Setup.exe
5244	Setup.exe
5244	Setup.exe
5244	Setup.exe
5244	Setup.exe
5244	Setup.exe
5244	Setup.exe
5244	Setup.exe
5244	Setup.exe
5244	Setup.exe
5484	Watchdog.exe
5484	Watchdog.exe
5796	PCAppStore.exe
5796	PCAppStore.exe
2044	PCAppStore.exe
2044	PCAppStore.exe
1872	PcAppStore.exe
1872	PcAppStore.exe
5512	PcAppStore.exe
5512	PcAppStore.exe
4724	PcAppStore.exe
4724	PcAppStore.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
5984	msedgewebview2.exe
5984	msedgewebview2.exe
5984	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
1872	PcAppStore.exe
1872	PcAppStore.exe
1872	PcAppStore.exe
1872	PcAppStore.exe
1872	PcAppStore.exe
1872	PcAppStore.exe
1872	PcAppStore.exe
1872	PcAppStore.exe
1872	PcAppStore.exe
1872	PcAppStore.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
1872	PcAppStore.exe
1872	PcAppStore.exe
1872	PcAppStore.exe
1872	PcAppStore.exe
1872	PcAppStore.exe
1872	PcAppStore.exe
1872	PcAppStore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5244	Setup.exe
5244	Setup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 1732	3996	msedge.exe	85
PID 3996 wrote to memory of 2388	3996	msedge.exe	86
PID 3996 wrote to memory of 3076	3996	msedge.exe	87
PID 3996 wrote to memory of 2416	3996	msedge.exe	88
PID 3996 wrote to memory of 3076	3996	msedge.exe	87
PID 3996 wrote to memory of 3076	3996	msedge.exe	87
PID 3996 wrote to memory of 2416	3996	msedge.exe	88
PID 3996 wrote to memory of 1428	3996	msedge.exe	90
PID 3996 wrote to memory of 1428	3996	msedge.exe	90
PID 3996 wrote to memory of 1428	3996	msedge.exe	90
PID 3996 wrote to memory of 1472	3996	msedge.exe	91
PID 3996 wrote to memory of 1472	3996	msedge.exe	91
PID 3996 wrote to memory of 1472	3996	msedge.exe	91
PID 3996 wrote to memory of 960	3996	msedge.exe	92
PID 3996 wrote to memory of 960	3996	msedge.exe	92
PID 3996 wrote to memory of 960	3996	msedge.exe	92
PID 3996 wrote to memory of 3108	3996	msedge.exe	93
PID 3996 wrote to memory of 3108	3996	msedge.exe	93
PID 3996 wrote to memory of 3108	3996	msedge.exe	93
PID 3996 wrote to memory of 5056	3996	msedge.exe	96
PID 3996 wrote to memory of 3424	3996	msedge.exe	97
PID 3996 wrote to memory of 5056	3996	msedge.exe	96
PID 3996 wrote to memory of 3008	3996	msedge.exe	100
PID 3996 wrote to memory of 3708	3996	msedge.exe	101
PID 3996 wrote to memory of 3008	3996	msedge.exe	100
PID 3996 wrote to memory of 3708	3996	msedge.exe	101
PID 3996 wrote to memory of 1232	3996	msedge.exe	103
PID 3996 wrote to memory of 2376	3996	msedge.exe	107
PID 3996 wrote to memory of 1852	3996	msedge.exe	106
PID 3996 wrote to memory of 2376	3996	msedge.exe	107
PID 3996 wrote to memory of 2376	3996	msedge.exe	107
PID 3996 wrote to memory of 1852	3996	msedge.exe	106
PID 3996 wrote to memory of 1500	3996	msedge.exe	108
PID 3996 wrote to memory of 204	3996	msedge.exe	109
PID 3996 wrote to memory of 204	3996	msedge.exe	109
PID 3996 wrote to memory of 5244	3996	msedge.exe	112
PID 3996 wrote to memory of 5636	3996	msedge.exe	119
PID 3996 wrote to memory of 6136	3996	msedge.exe	126
PID 3996 wrote to memory of 3856	3996	msedge.exe	127
PID 3996 wrote to memory of 640	3996	msedge.exe	128
PID 5776 wrote to memory of 5824	5776	PcAppStoreSRV.exe	130
PID 5776 wrote to memory of 5512	5776	PcAppStoreSRV.exe	131
PID 5776 wrote to memory of 5484	5776	PcAppStoreSRV.exe	132
PID 3996 wrote to memory of 1968	3996	msedge.exe	137
PID 3996 wrote to memory of 1968	3996	msedge.exe	137
PID 5776 wrote to memory of 4020	5776	PcAppStoreSRV.exe	139
PID 5776 wrote to memory of 4724	5776	PcAppStoreSRV.exe	140
PID 5776 wrote to memory of 2680	5776	PcAppStoreSRV.exe	141
PID 5776 wrote to memory of 1872	5776	PcAppStoreSRV.exe	142
PID 1872 wrote to memory of 5984	1872	PcAppStore.exe	143
PID 5984 wrote to memory of 6052	5984	msedgewebview2.exe	144
PID 5984 wrote to memory of 1428	5984	msedgewebview2.exe	145
PID 5984 wrote to memory of 1428	5984	msedgewebview2.exe	145
PID 5984 wrote to memory of 1428	5984	msedgewebview2.exe	145
PID 5984 wrote to memory of 2192	5984	msedgewebview2.exe	146
PID 5984 wrote to memory of 5632	5984	msedgewebview2.exe	147
PID 5984 wrote to memory of 5632	5984	msedgewebview2.exe	147
PID 5984 wrote to memory of 5228	5984	msedgewebview2.exe	148
PID 5984 wrote to memory of 5228	5984	msedgewebview2.exe	148
PID 5984 wrote to memory of 5228	5984	msedgewebview2.exe	148
PID 5984 wrote to memory of 1240	5984	msedgewebview2.exe	149
PID 5984 wrote to memory of 1240	5984	msedgewebview2.exe	149
PID 5984 wrote to memory of 1240	5984	msedgewebview2.exe	149
PID 5984 wrote to memory of 5636	5984	msedgewebview2.exe	151

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.pcappstore.com/lp/lpr.html?ap=adwp&as=g_d_all_jp_age_purv&gad_source=5&gad_campaignid=23755051632&gclid=CjwKCAjw6rfSBhAqEiwA_yocpkm-52d9kvTMcHxqNpswcf5VQ9y_IJq_sSEjLsSUQ5ZwbumvJUK1TxoCXKoQAvD_BwE
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff9287ac188,0x7ff9287ac194,0x7ff9287ac1a0
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,13498562627360728373,11965064895585731228,524288 --field-trial-handle=2832,i,13905956329667162712,17213011195509574643,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1840,i,2762219785870750495,1706479023161723082,262144 --field-trial-handle=2832,i,13905956329667162712,17213011195509574643,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:2
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2216,i,13918376930453171105,3131040251047167844,524288 --field-trial-handle=2832,i,13905956329667162712,17213011195509574643,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,8896305837600978688,8681779369460977864,2097152 --field-trial-handle=2832,i,13905956329667162712,17213011195509574643,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,14213482391370314239,4779129673794540329,2097152 --field-trial-handle=2832,i,13905956329667162712,17213011195509574643,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,11649399945942293985,13357568429244612565,2097152 --field-trial-handle=2832,i,13905956329667162712,17213011195509574643,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,4862628649460876776,9422238847552405788,2097152 --field-trial-handle=2832,i,13905956329667162712,17213011195509574643,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=ja --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,10279658500613098826,14632749944281229199,524288 --field-trial-handle=2832,i,13905956329667162712,17213011195509574643,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=ja --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,3927457202622997326,6236801524730546557,524288 --field-trial-handle=2832,i,13905956329667162712,17213011195509574643,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=ja --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,1465727152497877763,12741743199180406141,524288 --field-trial-handle=2832,i,13905956329667162712,17213011195509574643,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=ja --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,14363652929438112954,3128594805057514492,524288 --field-trial-handle=2832,i,13905956329667162712,17213011195509574643,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=ja --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,8201347908029243359,8267023169656981049,524288 --field-trial-handle=2832,i,13905956329667162712,17213011195509574643,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=ja --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,8201347908029243359,8267023169656981049,524288 --field-trial-handle=2832,i,13905956329667162712,17213011195509574643,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=ja --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,525344566044286746,2259344632402023805,524288 --field-trial-handle=2832,i,13905956329667162712,17213011195509574643,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6532,i,16768579012251339727,1792930517907844990,2097152 --field-trial-handle=2832,i,13905956329667162712,17213011195509574643,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=ja --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,13812188635183911020,2626827007899263583,524288 --field-trial-handle=2832,i,13905956329667162712,17213011195509574643,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:8
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=ja --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7044,i,16104038630175885697,8205779863508227572,524288 --field-trial-handle=2832,i,13905956329667162712,17213011195509574643,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:8
  2⤵
  PID:204
- C:\Users\Admin\Downloads\Setup.exe
  "C:\Users\Admin\Downloads\Setup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5244
- C:\Users\Admin\Downloads\Setup.exe
  "C:\Users\Admin\Downloads\Setup.exe"
  2⤵
  - Executes dropped EXE
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,5874046213257411895,944694463425071200,524288 --field-trial-handle=2832,i,13905956329667162712,17213011195509574643,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,14381403031421587944,7593870810948549497,524288 --field-trial-handle=2832,i,13905956329667162712,17213011195509574643,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:8
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,14283037712461957733,8672011760806944573,524288 --field-trial-handle=2832,i,13905956329667162712,17213011195509574643,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=ja --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,5278263386899365929,1464502239786438020,524288 --field-trial-handle=2832,i,13905956329667162712,17213011195509574643,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:8
  2⤵
  PID:1968

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4780

C:\Program Files (x86)\PCAppStore\PcAppStoreSRV.exe
"C:\Program Files (x86)\PCAppStore\PcAppStoreSRV.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5776
- C:\Program Files (x86)\PCAppStore\AutoUpdater.exe
  "C:\Program Files (x86)\PCAppStore\AutoUpdater.exe" /i /step=init
  2⤵
  - Executes dropped EXE
  PID:5824
- C:\Program Files (x86)\PCAppStore\PcAppStore.exe
  "C:\Program Files (x86)\PCAppStore\PcAppStore.exe" /src=installer
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5512
- C:\Program Files (x86)\PCAppStore\Watchdog.exe
  "C:\Program Files (x86)\PCAppStore\Watchdog.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5484
- C:\Program Files (x86)\PCAppStore\AutoUpdater.exe
  "C:\Program Files (x86)\PCAppStore\AutoUpdater.exe" /i /step=init
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Program Files (x86)\PCAppStore\PcAppStore.exe
  "C:\Program Files (x86)\PCAppStore\PcAppStore.exe" /src=shortcut
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4724
- C:\Program Files (x86)\PCAppStore\AutoUpdater.exe
  "C:\Program Files (x86)\PCAppStore\AutoUpdater.exe" /i /step=init
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Program Files (x86)\PCAppStore\PcAppStore.exe
  "C:\Program Files (x86)\PCAppStore\PcAppStore.exe" /src=shortcut
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=1872.6080.11648522204729593560
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:5984
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x13c,0x16c,0x7ff92242b078,0x7ff92242b084,0x7ff92242b090
      4⤵
      Drops file in Program Files directory
      PID:6052
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1756,i,986159104384511712,12722832823523758082,262144 --variations-seed-version --mojo-platform-channel-handle=1720 /prefetch:2
      4⤵
      PID:1428
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2064,i,986159104384511712,12722832823523758082,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:3
      4⤵
      Drops file in Program Files directory
      PID:2192
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2408,i,986159104384511712,12722832823523758082,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:8
      4⤵
      PID:5632
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=ja_JP" --always-read-main-dll --field-trial-handle=3656,i,986159104384511712,12722832823523758082,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
      4⤵
      PID:5228
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=ja_JP" --always-read-main-dll --field-trial-handle=3940,i,986159104384511712,12722832823523758082,262144 --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:1
      4⤵
      PID:1240
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=ja_JP" --always-read-main-dll --field-trial-handle=4296,i,986159104384511712,12722832823523758082,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:1
      4⤵
      PID:5636

C:\Program Files (x86)\PCAppStore\PCAppStore.exe
"C:\Program Files (x86)\PCAppStore\PCAppStore.exe" /src=shortcut
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2044

C:\Program Files (x86)\PCAppStore\PCAppStore.exe
"C:\Program Files (x86)\PCAppStore\PCAppStore.exe" /src=shortcut
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AutoUpdater.exe

Path C:\Program Files (x86)\PCAppStore\AutoUpdater.exe
Size 1.2MB
SHA256 b73f90435563457a2a361290203bed99d54b2dbc5f96d6ac675506dd325d24cb
MD5 dcdba14043e07803e50cb35e17f2e698
SHA1 8ef39ed406c5b5bf3fc36330711c0c3824fe09b1
SHA512 8dd184b05801d86f09813593912117988721434aaf479b2c0423be1a8d7719c7bc9af80d98a59477e16f6b7ac107951e87d82d2161f186cea826b84c4707a962
SSDEEP 24576:Jc5Atj2SpMZavtMS6dQ/5OfPMdSSoC2UXPNxUsRKZkh0lhSMXlMJR5:JcWdNRKZJ4
TLSH
T1FF557D1A96A442FCD0FAD17CC656691AFA713C46837027CB1284B9661F377E4AF3E702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PCAppStore.exe

Path C:\Program Files (x86)\PCAppStore\PCAppStore.exe
Size 5.7MB
SHA256 b5e1ac6b2660ef161b6f9010de99a84eea523de3a04553001faf842bbe4c8cc3
MD5 215e8b608a68e31f3e637a995af978fb
SHA1 dd73d8062e5fede629c0e09c8cd189ae4b967e65
SHA512 3b4243251ce685b6e4a4816e974e112098803571d15f107c5ca91e590cb1f64d1ddae316b53c9763e50c1bb46a067e63aa1ba09c4f30fdb4f3fc95963d9bba63
SSDEEP 49152:vTjwCCgIJeiEb2tiP5mbtvbFClRGvMsidtLkoY2KLc2Mt1E3TQpts:vICCPEWxvmRGYAQtGCa
TLSH
T18F56E85AD6B642E1D4F9D178C626722BFC713C5EC134A70BA781AB175B32760EA3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PCAppStoreSRV.exe

Path C:\Program Files (x86)\PCAppStore\PCAppStoreSRV.exe
Size 841KB
SHA256 ab21147616dcf1b3058671547701dadf8083d829fb17efc537911eb965da3b7f
MD5 9610353af98398ef28e3158f08f169ef
SHA1 da72167b7128da68b18e4e04518c74cd68a22b92
SHA512 2444f85a5e251298736b47ec4c885cc5e04eb0bd296f1da5c60e35b8bc4c7243eb2d9862fbcb2e5f12c1609cb7d9b7ccafcc071fbfff2c13322a646bf0f7f8c0
SSDEEP 12288:Cpv3/MMt0zEQBdtkCHyBvDSBIDph0lhSMXl+pPIbwBxcBXx:Cv3k40zE2dtjHyBbkI1h0lhSMXlyPOvh
TLSH
T1D3058D2AEBA942F8D07BC178C992650AFAB27C5A436167CB039175672F336E05D3F701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReadMe.txt

Path C:\Program Files (x86)\PCAppStore\ReadMe.txt
Size 146B
SHA256 5d2f34957843469949690c30182f3549c5af8211c46283217cbcfcf9b25c1583
MD5 2c23d1996a76f9a6310cf32c3d0fe585
SHA1 6e8788fda04cbe47671ac87825c22380ef04bccb
SHA512 42b4e971b52b671c6ce5bcac1ce2283913d3bbd1bde4714539a197845c511814d32ba296d9ce6c573cd95ffaff7f3964862cb9c6e4813019b9705c07152515ba
TLSH
T167C02BE3B00F04378212824924CBCD00EF1DC07699C14709183240BD9513208C323C6D
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstaller.exe

Path C:\Program Files (x86)\PCAppStore\Uninstaller.exe
Size 401KB
SHA256 3fd0be01793c19bfe0782d6d95b0997eca350c1735c9ebf1caf8bf289993eaca
MD5 2cb08ec5e087ae21294d7f8a51658144
SHA1 848962498fe35c2f1b077fb71f0b151a1a9eccc9
SHA512 f3cf8c5abc22b9bfa5b60d2179ff78232e4b6298c66b5935d03dd0f48d0688a7fecf17ae1e5f2a5459a3ad88c00d132e4487710ee359ef059f96be9faa1be6a2
SSDEEP 6144:xep1lcLWNBPTYmGm1mMd1YSxIJpTWHc/njixAS9rdDgA:01Ym1R17x+eajix9rx
TLSH
T146949D09E7D508FDD867D2B88D934446E7A2BCDE07685ADF23E486560F236E04E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f87d1bc5765fb6409d93162172af092a144332ad15eb1a693b604e2c7da24a0c
MD5 6264f1a893d7dff644ea78dffd808c8b
SHA1 312c3231f49e8e884b480c87b33e3153ace10491
SHA512 ecf258fc29b80aaaaf80ef1bfeb6e488f395e4664fd6611332bb8bca156546ec67d2efc21ee6ce98fd855a5c03db9c88592636a54c764f8dcc479db890303c5d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b7fd720dd11e31f8bb05968979803b330194e08d4bbf1c9d55a5c412c4fb7aa6
MD5 9e6ba366b1a1beb1e7352557ba491c06
SHA1 7c18d8fcde5f27e343eb9480b53c0606f86d4c4c
SHA512 87b39f38bb562144b39f7307f3c40f348abc74b08a9499fe7a23d8869bd3496214bc232ca5a6fb5b54f5d2512a212ed1d07d4a00ad289be55e0e3b9deeb463a2
TLSH
T11FD0112A33020238CA2030330303AA082E02C20B808A8080A83ACA2E2A880E02A028C2
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

f_000005

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000005
Size 47KB
SHA256 3100e775e8616cd2611beecfa23a4263d7037586789b43f035236a2e6fbd4c62
MD5 260c81a4759baf163c025001c4f27872
SHA1 f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298
SHA512 9acec3e7a411a1eb6d072c3773bb14e5aa74d85d334674ec0fb018b7937174d5b612b756b2ce7aa3993d31dfe172516e7aaec79c7dd209eac5fd15d9aea077e9
SSDEEP 768:Gp4Wb3wv+eCLRZRtq9uGHpHveBOX5qw/14X+5edVWK4afHSTle4MRhVUNMT/TQDt:Gp483wdmXRtqhJPeByj/f4WK4mHIj8xw
TLSH
T1BE2302DF9E4D72D29271267045338383798E2D8A50AAE7A1061C0FE6DE05B69D31FB9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000016

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000016
Size 36KB
SHA256 f46f002800425a617c60affc3b2efabab6207596c4ec58d83f0e41a15549c805
MD5 a8d9eeaab331d1279e576ec997a12b18
SHA1 dd1089e702b25f6546f3b4e5e93e6fac93498971
SHA512 dc15c08f6baa400e74ecf2ace4da7a0af50b46a2b5fcda7faf8c2fb05f1764dc55dd4a2349068abd627b022b320107f97a4c8b8050023ad186e6ba4626703311
SSDEEP 768:www5YOEsTzcYpbwHv6qT4XGltDyH8rE3GtGwKxfWvxnFC6Zsum:wwcMsTzcYpsHNTnltmH8btGGJFC6ZXm
TLSH
T1DEF2F15A12F15A67DB539836EDEA46721B0091B09C2F0D6A9FBF50965B0F00A2BB70D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Preferences
Size 6KB
SHA256 de009b4485a225de70c31194e25fddd1d774a11ff2cc3196a40d079b429116e8
MD5 591714c47875db979e20ad8380dec8c8
SHA1 5a0462ba3d1efc96a2863f8d2eb52094c2fb6df4
SHA512 879469a09d09d3c58b6113a7a1439501806df6a71a4277f24c6d1a322db90d9cb20ed3d69fde04d3d45f74ea70d133c7141508f8539bdcc96ee5647a11d51699
SSDEEP 192:stV0T4BULfpu8p9FwY/S+Wik2rgebWYbf9gM2:stuT4aLl3/VFRWc2
TLSH
T166E1CA135F28997B4CC7E21D7A39FB92E2F6105166D41E88EBFC860C08D66DC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a26b3.TMP

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Preferences~RFe5a26b3.TMP
Size 6KB
SHA256 a9590b629741f40d0ab84043ce863b08e0322edd413f475f7e24cc6891816163
MD5 d0a92d70a9afd6f4dbe4e04b82ff3a77
SHA1 de9453404a2b358d35ed6ef93cf986a472830699
SHA512 96224b56158597df923583f87cf20620263abc6eaa8c47e8e1978ee75aedd8feb9e25df55b0f5eb5b68861938970af7dc30646945c6c5d5b2c51f9ef574ce01b
SSDEEP 192:stV0T4BULfFu8p9Fwn/S+WikpGyrbQYbf+cM2:stuT4aLhU/Vt2Qd2
TLSH
T196E1B9535F28597B4CC7E21D7A35BB91E2F6205166D41D99EBFC860C08D56CC630790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State
Size 1KB
SHA256 6701d88ab384b12f034a0719b0966228478a2cb43648c34190599b691810c836
MD5 518d98f340b070c8a952ca5cdba4c85a
SHA1 ac85e579bb5a548958fa2786fa1bc52652e4af0a
SHA512 c45893e2052ea98ebb3e6e78930ea2a836fe37361a6f066b1b43398c5dcf2ca520a87538cc05f16115d5328d8676d8d02379e46467f44be31571d06989de1341
TLSH
T18431B7B3989A3F37BCD16605B0217BE77E1120A6C2504F4462ED070C03E769D9666C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State
Size 2KB
SHA256 c06f31f72fd68c19c79018946fb0b1e725adc18fdc3677db7232c48b8a184883
MD5 fb6acc6517afbc9de20df3ea189bf339
SHA1 d7877aed0571a67c4c3d3e214db3e37e3e127792
SHA512 1379b5d227bf033bed9fb10ca1b395ef4171e92d0779ffaf28b7f2d08f6a6877c834aec6b028bc81a3f4463b7f5bc1c7dcc13102d1949eb620907114d0448871
TLSH
T16451B8737C5A6B7B9DE25604B8693FA3EA3250A197913F5096DD0B0C02DB69D2342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State
Size 3KB
SHA256 f8fb8db07a50e0298d2aff5c57e52c2d9e20c0ed2d1cb45b80321a94a5b8be6d
MD5 4fba5571d36d32d3431b937047528e5e
SHA1 aed775d4549173df555b31e779d85bffd7746b65
SHA512 746f0935c43c85bd784681d07440a68b65f17827e7cb639f3efa84c98223c672f51500e98719ab024993a7d84ccc3de709457c4eb2b00d393051626c0f1a56f4
TLSH
T1FA71A673686AAA3B5DF29A04B8953B57B6625173D6C03FA4D6EC0F0C02DB39C2341C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State
Size 16KB
SHA256 a50bbdb977fb2ad06aa9e275acbdd96d1ffc179336cb318a52c7badfb78e4514
MD5 affe7ca548668025d79f1c52093d68f0
SHA1 5e95d4941b8722bcf768160b870d004c18e6e0bf
SHA512 19a7cb02f93864c1c03a1641a838578a0e82c437f03ccfc0514f73c1e200a05eaffb18c79f5c4e091f0168589fb9d7142ddacad4199c3f73850f77a25ddc89d7
SSDEEP 384:z9srv+89zHqlDNP9oid6NbmSkaWz/QwyKNR:mrv+4UNbdLS7WDQwyKNR
TLSH
T121729E33A43DA7379DF29904F48A6B077B7860A692C11BF4D9D90B8D42DF0D92316E13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59d519.TMP

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State~RFe59d519.TMP
Size 1KB
SHA256 7fa3f377b3050aa8aca355139093fb6cf22b458e58cfa3308d08013453b42aae
MD5 e03c5529601d03f2a849d1ef41400eed
SHA1 25352ea91a0e34745580454ba2a2a8e9dcb050ea
SHA512 782c875f298316da51b0226c1392a103096be8c27c0c2d3c226606133f22db4702ffd9ac2fa402c5a8e1298388280aba2765bdea7b4aded8e0d17901512238ce
TLSH
T1A62165B3C89A3F7BBC915505F131BBDB3E1160A682505F18A2DD030803EB6DD96A6C33
MD5 SHA1 SHA512 TLSH

Submit Download

Watchdog.exe

Path C:\Program Files (x86)\PCAppStore\Watchdog.exe
Size 856KB
SHA256 adf3c855fdd4f92e32ff5d7b20a754f1a74e375f51d8f680514b97a23e5fd530
MD5 d1559541bc830385a6fabdf93120f9a6
SHA1 c321f4620c2fd45c216f45d808fc6d195130c02a
SHA512 69af0a29f7078e1e2f373f7d6f54cc6206b582de52823d6dd183adebaa22160b88b5d6312f70dfd34ecf7604a0e07c18d16362227748032e0ecb66b0821d5f7b
SSDEEP 24576:n6dHLN0DHu2CRz+7rbpa0/vTVh0lhSMXlhwI:n6dHLN0DHu/RgvploX
TLSH
T157159D1AEB9801F8D4BAC27989A22546F7B27C4647615ACF139135A73F336E05E3F702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1259544006.html

Path C:\Program Files (x86)\PCAppStore\cache\1259544006.html
Size 18KB
SHA256 53f278fda227f87187fe82969b3974486bfcc84616fed80146ee0d99a2686a02
MD5 f39062f0fc648722db0131ffb89bc66d
SHA1 e112442b5199b770e22ef7649730790507c334a4
SHA512 94fc5be113af4fa1ad35fff168c78f23dd29d486a1aff903704f7b01b85ccb6dac004141ce6cb4865a6d49fe1134e91486f4f8dda856145987b027fdecb5dc59
SSDEEP 384:sOguS1uiRRyBT0EsiPwa7F6iHiPg4z47+tRx4ysG6VQlAq:sOWRyBT0E34ahCLpRx4ysG64Aq
TLSH
T1EC82510C3AF600618177317D4E6F96083535A0332688CE517D9CD668EF6893E67FAB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cache_setup.json

Path C:\Program Files (x86)\PCAppStore\cache\cache_setup.json
Size 7KB
SHA256 8ff48e1873ab58e439f36bf1259adccdc6aec9ed73a52272c66fc662273a1d5f
MD5 6cc7b9152abf3b263ecfa483d1efee64
SHA1 d54e8578b2cd90aa4fcb53d0c303a3dea0cce3c5
SHA512 60dc9e378790694b1d6031034dfad93919d9df5f06bb9d354cc8ae97f0845a67d7a315d99b3f263f4006270a6e6386a48f657cc5e0890481fdab0d9cb7cc95dd
SSDEEP 96:eCIEqzrUdInUuHdZvj1VLHq0tJv7IKqfxhgndB4bvoHvTk+vBreQISL:e9EqsdInUYdRr7qi+M4LaQQ5bL
TLSH
T19BF134FFC9210B0FF466A1D8DC8A3808DB79943B3F5279E4E79B1526A061236E48537D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pcappstore.ico

Path C:\Program Files (x86)\PCAppStore\pcappstore.ico
Size 16KB
SHA256 c753fe727a127586181e04060af8689e4bf9a86c1b0c0e7ac850c030481c5d70
MD5 80950421cd3f8ae4e8606f28ad636a34
SHA1 cdc6faf6415876d939a77218e78e7447d7134239
SHA512 f67e05108bde39ec0643ec16b308447522ff71d788d1aebc98cf19d8c327abe6279ebfbf3bd3ae6172dcf905f0580c584d9cecd4fc79c88eab112c60d8a778ef
SSDEEP 192:fkP+f6Tf1L6bYw0Yl//Ryfc6negmvC4ytCGPJyUDYFU/gJo9FmGI+xOw8SSOshY+:E+f6Tf1LMXeiUDkU/gJo7mGOU+
TLSH
T19472BEEB9258CF8ECD0BB9F9141950FA0A8BCDFDEA4A30D5E2E9719BB4C64350572503
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

773CFF2C7835D48C4E76FE153DBA9F81_D9070B80E002B56309375EAD5B6A198F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\773CFF2C7835D48C4E76FE153DBA9F81_D9070B80E002B56309375EAD5B6A198F
Size 471B
SHA256 a7f2588e381eade8b36215a9fb4027bf7113f4ee19e50643a06a2a6eaf714094
MD5 776bd01ff603c493497b30f84ec65eb0
SHA1 59d69a28d21918871b34c88615273427429f20ba
SHA512 7fd5724cc71dffc63962e9530bfc9cd0c4532077f8c07aa7c926444a30105a5ec869b98fd9caae74a2566206e305949104635df63c4a64acd4db8cfc9a9b2dea
TLSH
T10EF05CA300C1D0F1B028184C7A3DE900383AA6B0D0AB007658282AA4AC60DBEBC03280
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE
Size 471B
SHA256 ad19162fc4397e4fe68698c93cbde16c886da85a92f2af088cf47c7611f4c35a
MD5 f63d430fe70afa4bbb92014562dacaf0
SHA1 52e6a5ad3e6755087c0accd685afea63c3cda440
SHA512 c491c8c8570e36d712912b32a8faf0e41dd51c0d97a0fb9d9ee3d6c006dfc6c8fa789f754dcfc24b3722a9ba7eaf04bf0682aac7e09476891093a90e643bebcb
TLSH
T1EBF0D48518BEF431B54158EC14B9877DB430513C85954462263DAC62C910BA7EA5B1B6
MD5 SHA1 SHA512 TLSH

Submit Download

773CFF2C7835D48C4E76FE153DBA9F81_D9070B80E002B56309375EAD5B6A198F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\773CFF2C7835D48C4E76FE153DBA9F81_D9070B80E002B56309375EAD5B6A198F
Size 416B
SHA256 9ae6a7c5d62992e127abc48906c42c9ae7daed2766aa303937c2876de37d87bf
MD5 96c5229c98f657ad1cee19cf5a6c4e21
SHA1 7fb3637ae271b8400323273222f4de86356a97f2
SHA512 e048b60a9ad9b3814776344498864e676ef39807a5930574baf1901b0eab2bbfd351ad26659f97ebb466c65c62ac63720ae0b5332038521eb4bb102764680efe
TLSH
T139E0C0093EFA019DF671EA3542D901654E0BF0230C248BA22A89430BA62B740FC315A4
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE
Size 412B
SHA256 8c690c7694406bba5922cf4f9aa17c4c22fd3e063111d5a7ad8cc667694c9802
MD5 2fe2c145dcf993d5f97be1aa2b3484da
SHA1 bb2d5c79b860d687126a22f1434f7c5df27845e5
SHA512 0c48173eb5d98a2beedf6609db915e8ec4c0160fdcaaec3a38556f8a96cf018b4eed808f81cc2e0235d73ae4df0a7c84707fcd52a5aec3d1ab3932d5942ab289
TLSH
T1B1E0C02413FE411DF1E5E4387FC5B8314A6DF1660815A2F82ED06704F706B40DC12D22
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1d6724b2d21e441d82d55381d5dbd50a74f07e0e66de8c008a66a41c0d8df6b4
MD5 4913301866d44f96da03a40d14c59828
SHA1 e99098b421ebbd5b847c541c9c32dc4df71687d8
SHA512 01e2c6dc3a90ced1cafd0acf36f71148638b3730e98bffa5fae530b827a08316f8e37daa731b32bf24d924ed8ce9119340c96d5cd0d16bb646d1b1aedc636ba8
TLSH
T108713C10D6620DAFF356323EA2C38DDC34F086510B5F6EDF9038A87E6A197A14B21477
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f383.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f383.TMP
Size 3KB
SHA256 36a9a12ca34368ce87aeaece98392a2f5e023bc6197a71c4071a91b53eb65c23
MD5 fa288b32fd04878cef3031338e0bb989
SHA1 b0086348217848d860fbdda6ee967aea7d8641a9
SHA512 9f1d4a9eb7b49586bbf3743376dc12fde27877aea50fd6dd611b32155ed76ddf6d25d491b0197475523da84fa79790c8d033661c3f158110facca154a5c48695
TLSH
T19A617120CA52086FF367323DB0D39DDC34F186660B5F5EDF6120687E6B197A186121BB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 1586536c89f0c94fc00ab35ccb49599ff4dc2188ec2dfea89852a9944e32fc2a
MD5 fd090a0522d0b7bbf310602596f9a41a
SHA1 6236af151ca9eba58d198be02bf78b604e796cc4
SHA512 f055bd821912e0a18c1cca9d8beeacc8c1a0c811928eb282f2a6014540c7bc48655caf9c18daac09ec7c87a40da1b6b84915ce97fe87452867f9ff41ef1a0957
SSDEEP 192:nadyjJyNSN0f+G83uy3Ct7XBBK4ywPH7DXspU3iV:nygqSN0/83uICtTBB/F7DXspU3iV
TLSH
T18514331F4F343721CDBD917629EB44A36D6DF03F8B5266CA68711470CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 3efb3b6b208e318f55bc3c3d810e3404baa0b3e2caa02a6730329acf3623f589
MD5 bd3e8a39b168eadf1819520439887a83
SHA1 573efc55c0311d5149251092630cf21064d5adea
SHA512 ceeb4f2dd389b7f338717c6c7653ea92ff7c5983e3dce66998df99abead57ca99e2f5d75949bfd0029919434d3fd6abe133724b733e28776d417ca98eb15884e
SSDEEP 1536:3fEEqxwWxMuGZqW3LIPDuV2rpBrMpv6Zsi7i23ERPq:crwxqEsDUk
TLSH
T15AB3642AD6A54C7B01F16264EC750382F315436F9286A82F3A7C9D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 62a12344a8c1d091a4731bcad5c11ae13bdeadf75fcb62fa6da66ec8e6f1c671
MD5 81f027ba1cca151d4cbb1f8aab05c248
SHA1 bc9ad354f86830b35a880db5df9fdd4a8baec3b2
SHA512 efa64f78f38291f3499c70dd1e9268d7c93382e4009ae55802c16bf39dea6974f7bdfc7ed3985c4f5dbacf3a5948cc93d2bfc3fc5c41340b5885e5eb62318c5c
SSDEEP 96:DeCPeCkeCyNeC/eeCZFEeeCReCreCPeCpeCKeCSeCtmeC0VUeCAeCuAwRGeCUJeH:DLw8DeYed3jVWGJm4VUU38GYJMawl
TLSH
T12C915DFB86D88A2ED81162F097287917CD590A24526C381BC8D4FF9B63D64B6F24098F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 504fa1e339b0076fe858720231a30b77518f8958897f6c41a04ee4b91b5f5442
MD5 6d817d126224d403dc840ad3bbb8aa82
SHA1 ebf6f9e09a53ef314b5fc39428e54b158e52413a
SHA512 e0d2ca7a55f8507d6da1351c69252fb3953b3d0243c50d7d3812529fedc0febc88416d9a133e8380dc346f4a8703c82f422de0801bcd99858553535380eda50f
SSDEEP 192:sxZUn/yfYKOMl8M9V/fksIwJ9Iqpl7HW6+WN5vY3/Y40GZNIgUoJ:sxZ8a1V/fksI6hlHb5Y/5UM
TLSH
T11142FA53AF3499778CDBD209FA55BBA3D6F50572A6900D44AAFCCA0C05E6BDC220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5f77397e5927cb85ad4bf2ea9afe59da63944800eb0e3abbd5234693b8206075
MD5 73961741db047c2f0469396320ddfac2
SHA1 c79c2418a5244a8c636be70d1027471898f56f00
SHA512 d26f0ba75dbbc5a5ed20d8195e28dc482a8c17a85154b25b9226cf813fbc8893568f73be26003e6a564c58fe36728832029bc8d0ba82a20dd28ecf2ddf801b1e
SSDEEP 192:sxZUn/yfYKOMl8MjV/fksDw19Iqpl7HW6+WN5vY3/Y4rThZNIg5+oJ:sxZ8abV/fksDuhlHb5Y/xpwM
TLSH
T12752E956AA3459778CDBD20DFA567B93D6F50472A6900E44ABFCCA0C05E7BDD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 35d56c4d5f76ef62bc0f87d17c8ee77a1e3fa57503df06a784e5a1eff7e0370d
MD5 d146083c4fbe79eddaee6eff12a5ae16
SHA1 f9b3cc5c9d2d5c6a89047452a71a7eea6a0b53cc
SHA512 3156c75e4d82c2836f82abb2e8f192e469752bb851f96cd097b619787bb54e1aae5f757b1cc6323b3d4b710095dc9ae9c510a46aae71c6fcd47bdbe1f89af1d4
SSDEEP 768:wj8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdvronkDUnc:wj8iJPNWvx76ru1jahALocd88Uc
TLSH
T192D2FA3B680CCB7E4F844E9CEC266F966DD801CB5B988D5447FA884C03C76EE512699B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6621320d33f4bf8cf85dbfe62d7a7ba9446ea5a1261754a4fd5b18d65b94a3e7
MD5 701e00b24dddb8f9c4f70a2872a43c9d
SHA1 e150905ce921730736bfef7e91f71218f1ebe6a7
SHA512 3e9ba71f4edafad19876dac14d748149d5fb6de0ff3bd8a435896ff9d0c0135f5a1bf3511a470e680d8428043052cbc6d0a44f926f33f7541d415c58b3ba25c9
SSDEEP 96:KgxSKak6+LiKAIgAxEwCui4WGbrg44K4dgq4c4YLqwVHr0xFzJZlz:ANdrAxEwCuivGb04cdgqX4YLqwVHr0x/
TLSH
T1E2918641717A22013C3D792C8195861F9E81F5633019BA7B77AD21B11FB6E929CFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 ca3573f877bb4aef5680546f2c45bbc734e3831cc2ee148aafc8bfe09c32599a
MD5 9e57500c8c6118762ce5732bb0a05521
SHA1 5062e65b25f7222d142630bcded42727675190d3
SHA512 438fef1055b6b271840b1e63575474a9b8e82debcf33dd239cee8598bda4d7cba11d4f930c440f0e90b9c7981037dad2bcf7539f7938ac5126bfb6cffb8548b9
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uF:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAI
TLSH
T1AAA2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5987f3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5987f3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 a1be9bf32a55bc23f589cd4c53c727a265f8d5e72e23a0fac571a7ecb1733e3c
MD5 1e1d6316285aa82fd34097c8c5b26e65
SHA1 ae91fa9937e415b5e405e4d78735c526e23df19e
SHA512 f4894d3cb7afc1d911b4da7446967fda3e78f39aa0208c032ac2558d3aec8fd53eea254da35ea3c3db2c7b8c67c7916806fbfd3e99a673317670bacb52ac3697
SSDEEP 384:qbFutNn/s3n9SbzsNr8TUNTUlIlsXjczOkklfBEab+3g:OFuj+94ewgzMfh+Q
TLSH
T10AB219F248D7493AD9AE8747B73E2E134EBCC057B5816A90B7C80A0CCD862BFD306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d79ed678b55ab3f5837ae5696095588283036184e8fe5f87e0d9f000cb4c1939
MD5 3b6185340cfd0fb992844fa0196ec3bb
SHA1 685bcf4f7852db0385070e9c967d4551a753e25f
SHA512 3510b3f02901c1deffa41a8e5653a99d79bd93ee1533fdf984a0727b6f5f552d4c88bd87a3e13fc00ce57b8d680c1b69a2d2ed6e82055bb297f1d26235830a1a
SSDEEP 192:u0TAsNJgQbAN2mqfQmiU1vAh4k03VbrNf9fEaVLICq+3AA:4sNJgXjqqOkklfBEaC+3l
TLSH
T1E442297698796C2B9AE39145F44B36135FB48167DB882FD4D6DC171C05CF3AC230B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a10ec7dd2652b8ec9512ad283027fbdfe25b1b93145a809019c3895240851838
MD5 e88ef651b769674b3584e307f1284d2b
SHA1 230d365d47f2fa3439cd67a73a0106d9842bf50a
SHA512 a27242dc39a2c7e909d22485fe6214590f72392f1998033774975e173fc18c7042732ce3e95f90d13e21e62cd377d9e4c499150d0bcde6c855bbcb191fd5d7fd
SSDEEP 192:u0LsNJgQbAN2mqkQmiU1vAh4k03VbrNf9fEaVLICq+3AA:XsNJgXjDqOkklfBEaC+3l
TLSH
T1FB422976A8796C2B9AE39145F44B36235FB48167DB882FD4CADC171C05CF3AC230B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d24ea2a1dd75447d2fdce83803b5bb3ca769b319db88453fdc93aefcc58965e4
MD5 7dfa1ff33d3991ca609834a7e729eb37
SHA1 09f2113657de871c26c356e8d113ab8825deeacc
SHA512 e35f0f62ae7120b45fae0a0503ec20edc607e60afd188939f306fc9f503b563b181ddc828f86ac46da8c10c3def5e27d4c9180eafdb6d7eaa1d25148cd038b70
SSDEEP 96:ZqONkqQsjpfmUTmDK5ih/cIPURHl8h4otop565D8BhPwivh50xy0SFYKGlHtvZbX:gONW6kDfQmiUyEQZ903VbrNfsQiAzU6
TLSH
T1DB02D8356C786CBBCEE3AD0AB58B67275FE5113BEA942FC4D9E81B0C40D725C1306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 76c0e1445e1d23afcca721b3bf03134007e053ec8e632de64e9eafe0ac3bd5aa
MD5 5ae6d9a5c3cac93e23c833f48a2e1612
SHA1 50b0cfbe6aa7c95923c8c44add49144ce0b91c17
SHA512 26fcf2e3dde889faf31911c202ad6c44abdc17fe0c202942e7f89eb70cd0313eb2a514f1654ee4a12cbf9993de08037b7441458ecdf11e74091c0fb7fad91f4f
SSDEEP 192:NONE6kmQmiUyiQq903VbrNf9fEaocRCq+U6:NONE63yq9klfBEah+U6
TLSH
T16D122B3268B8687B5EE3A851F48736275EA1422BEB893FD4D5DC1B1C05DF26C130B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 c2a5edd12612da1f55f7bd08ec7c2f7631fc027b1e44add819682bb803a772af
MD5 e4ea90599c683fbf0703602d19e4dfb6
SHA1 6075efa4d897eed0d288378fc7c0afff86848e98
SHA512 e5e3996db3e3ccc302ec1d53a39572c6144804a5aa04151301f0acbc080eac962cca91a61f685cf171de047c2b51abe0db0ef4ae215e61276e019219c9a67353
SSDEEP 192:uqQSNWMsnMcPPQLz3XX9VofsNJYcMQbAN2mqhQmiU1vAh4k03VbrNf9fEaVLICq3:OtNn/s3n9SfsNJsXjcqOkklfBEaC+3g
TLSH
T109725A36987A6D2B4DE38449F94B36579FB4816B9BC52FD4C9DC1B0C05CB3AC230B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58e49b43-1f23-47d0-8c4d-2ccd9c813ae8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\58e49b43-1f23-47d0-8c4d-2ccd9c813ae8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 31b7965338f350043b4418de5585da010074ccc361e938fd348c45f63f0adf1e
MD5 4b92df774953cc9e38ed181c337afabb
SHA1 b40b111ccec00d3ad8d15d58a1439817aaef3460
SHA512 f92a05442a8076c631360fc1a641f5076fdfc269bbb41cd7536b84e580c7ea4a3e09f864daa79e866e79ac98c2021cbbd1f59a505e677334563eca19271e84fb
TLSH
T17741F858A6E91158B3B76F5AAFF6A8AD447FB8772E06D45D10110E4F4B23B00C871737
MD5 SHA1 SHA512 TLSH

Submit Download

pixel[2].gif

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EBYGJJYO\pixel[2].gif
Size 42B
SHA256 ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
MD5 d89746888da2d9510b64a9f031eaecd5
SHA1 d5fceb6532643d0d84ffe09c40c481ecdf59e15a
SHA512 d5da26b5d496edb0221df1a4057a8b0285d15592a8f8dc7016a294df37ed335f3fde6a2252962e0df38b62847f8b771463a0124ef3f84299f262ed9d9d3cee4c
MD5 SHA1 SHA512

Submit Download

AutoUpdater.exe

Path C:\Users\Admin\AppData\Local\Temp\fb.J94HlaFAPoi742ceFRAa50ryN5pQ4S.tmp\AutoUpdater.exe
Size 1.2MB
SHA256 90cca9477be0b7c6a608876651dc0ad1d8a8ba1d3effa25f24c94283b4598af1
MD5 3243d2b0ccc52b14cb9100c9176a80fc
SHA1 0a0115d30f9aaf66f66194bc255fa3eef82a578a
SHA512 92f268fa5dac38edd9a2e8ba6e5f97c9ec56d4608fd5752e2670e49c6d1f13089f253d17248fa2e705fd2efd3a21dcf25f768b17d6227ebf0bb2ebe93fcbd3b2
SSDEEP 24576:Jc5Atj2SpMZavtMS6dQ/5OfPMdSSoC2UXPNxUsRKZkh0lhSMXlMJR:JcWdNRKZJ
TLSH
T1D6557D1A96A442FCD0FAD17CC656691AFA713C46837027CB1284B9661F377E4AF3E702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PC App Store.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk
Size 1KB
SHA256 fdd6b92186591d5d12cb0d8770cb708c1c1451bdee6f507af229f87e1a4e8914
MD5 f28567077b6a62ee0e362f3e28021e15
SHA1 c51b222cf7437e6257a94b89d26ca1d487894155
SHA512 fd3e6c34b7f09275f38aee58f7ee1360dba7514002bcc6ebcf604a71b73874aaa04833d246a436cd3eee01e5715a2083138334c84cd1fa88adef5c451eafa5a0
TLSH
T15621160497E61B29E3B5C6B256B316125637BC10EEB54F1F005542CC057A510AF6CF67
MD5 SHA1 SHA512 TLSH

Submit Download

PC App Store.lnk

Path C:\Users\Admin\Desktop\PC App Store.lnk
Size 1KB
SHA256 92b832a6610583634037fd9631889864a147f26e4cf0460cd92f8cb5bc379258
MD5 4856fa8af7ab60528336ccbb8af19977
SHA1 f90018e75b31e977aa73858a89ce0e53a2fd1990
SHA512 bb6c9e444e0b3d942af89b8da33637a5de184ffdfd65ff795c62d6efbad32d288322f1d97fbd2726f5bc469f905222ccc5bc71b29f87290a7983518fbf80df10
TLSH
T11D21D400E6EB0729D175C6B696F317025635BC21DE651E1F0095439C0976510ABECF57
MD5 SHA1 SHA512 TLSH

Submit Download

Setup.exe

Path C:\Users\Admin\Downloads\Setup.exe
Size 4.5MB
SHA256 ae71845c88130d89e883e2a1336159c15c5864245f411d0c67de146ced9ccd31
MD5 b9b7727e2a123156f179981bcec5456f
SHA1 ca68c5adf92957f5cdf18577c1a25f83733a15c8
SHA512 7f63bc8c03e2c7ba8faea4721d100b9fc87db33f63d813d68ba93017dae97d10fcc304a0e6e1ce35d587beb5d016780e82224c69b952a8ac9d34e343d6265b8d
SSDEEP 98304:uVzCTWj5bvoX1bE0LIhyotUVXeg79NziJeK6BKbda63PF8pL:uoTIvsNE0LcUNH2eKtbEf
TLSH
T13D261209DAD702F8DDA7C6BD8A965403D772B8860374CAEF02D197160FAB5E09E3B711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

printqueue.PNF

Path C:\Windows\INF\printqueue.PNF
Size 6KB
SHA256 f98c7e540d09ebcdefeafe9da36cfc74b5c3659a62a34ce9d141dbc6f2eeef13
MD5 f59baafa41a446ac2181b56f921d60a5
SHA1 3c8c51c0f3d487cffc09193f51acca932fbd476b
SHA512 b71a4fd7bf4304d135df0464161d05ee6a765516e000951963bb003cd7c140062d2d33263bc3c568e9431bb1d8ddead545ab076da3ab06784393e3ddaed21630
SSDEEP 96:DAVy2UzlRhw+oROtoR/hROo6NHJqhP/f9tpxE:+kC+ocUhROoYqxE
TLSH
T185E16715B3E98E14F2B69EB46CF450E98962BC915D01DB2F3154B31D1873E84DBB0B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

volume.PNF

Path C:\Windows\INF\volume.PNF
Size 5KB
SHA256 941836508fbd8332d8e58cf54ba61b1d9762e85241ed68e69cd60347ba0c9776
MD5 85ad57987d60a9386f443a9298d20457
SHA1 30c99b1e9420c4367d0898d2004c49e88d67602e
SHA512 eaf040836b49f55a93945180f605a9486c829e877286c3aa079703839d840b8dc89f1ed32d641f1ce30ec94cde5cf8e915afd2f859868585d6a5244b06a669e0
SSDEEP 96:ufSXR2lUISmpIH1AQqC63RV5h5TJZcAl83GqQNyLsapwwopBBcK:cumpIyZn3L53FZcAl83J+JBx
TLSH
T1E6C1454177E88F04F2B69A707DB05AE90936BD824C55CB8F3960730F58729D49BF062A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1428-474-0x00007FF944F00000-0x00007FF944F01000-memory.dmp

Download

memory/5228-590-0x00007FF944F00000-0x00007FF944F01000-memory.dmp

Download

memory/5632-545-0x00007FF9457A0000-0x00007FF9457A1000-memory.dmp

Download

memory/5632-544-0x00007FF945A00000-0x00007FF945A01000-memory.dmp

Download