1afccb8f48b6d608a3a3c94754b402ec020fde0a088c6cf74dc6781c176df69f

Resubmissions

10/07/2026, 07:24

260710-h8vymsgv317

10/07/2026, 07:17

260710-h4tj1sgt6v7

10/07/2026, 07:12

260710-h1xghafs4p7

Analysis

user interaction
yes
max time kernel
76s
max time network
77s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 07:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 4.5MB
Sample260710-h8vymsgv31
SHA256 1afccb8f48b6d608a3a3c94754b402ec020fde0a088c6cf74dc6781c176df69f
MD5 932b870effd1a72d4b632096e5ed72b1
SHA1 d87e6d26f95c1d2f2e296f2a08f6142f454b2a74
SHA512 eddcff4edc4a6a279c5c89f0de24acd3b47a5439d4f20ac7f462511cfae17ffd27896188554aa6d713c6b1db88a9898e3490ee0696fa062db5d83425f8fa931c
SSDEEP 98304:uVzCTWj5bvoX1bE0LIhyotUVXeg79NziJeK6BKbda63PF8pc:uoTIvsNE0LcUNH2eKtbEA
TLSH
T161261209DAD702F8DDA7C6BD8A965403D772B8860374CAEF02D197160FAB5E09E3B711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
6000	PcAppStoreSRV.exe
2776	AutoUpdater.exe
4668	PcAppStore.exe
1548	Watchdog.exe
2036	PCAppStore.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	PcAppStore.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\1ab07fe5-1c22-49d9-b7c2-c1e4392b4786.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Session Storage\LOG	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000011	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\cache\2384453744.html	PcAppStore.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\eabab38efe6a494e_1	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\GPUCache\data_1	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\shared_proto_db\MANIFEST-000001	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\GraphiteDawnCache\index	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Local Storage\leveldb\000001.dbtmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00000e	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network Action Predictor-journal	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\8c1c9e45b460f4a4_0	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000022	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Extension Rules\LOCK	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Extension State\MANIFEST-000001	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\cache\1923634691.html	PcAppStore.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00000c	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000012	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db-journal	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000016	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\GPUCache\data_1	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Extension State\MANIFEST-000001	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\data_1	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000003	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000015	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\cache\2850521168.html	PcAppStore.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\eabab38efe6a494e_0	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\History-journal	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Site Characteristics Database\MANIFEST-000001	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\GPUCache\data_3	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\DawnCache\data_3	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\cache\2384453744.html	PcAppStore.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Extension State\LOG	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Session Storage\MANIFEST-000001	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000019	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\cache\cache_setup.json	PcAppStore.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\NetworkDataMigrated	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\Cookies	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State~RFe598d23.TMP	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\cache\4021133564.html	PcAppStore.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00002c	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\df2f86498294570a_s	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\wasm\index	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Extension Rules\LOG	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Favicons	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\LOG	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00000a	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\621ee4d4-730c-4d8b-8e94-ba7497a5f599.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\bd9f572c-9480-4748-9f52-a38cf7fb3af4.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\wasm\index-dir\temp-index	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\GPUCache\data_2	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Extension State\LOCK	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\GrShaderCache	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Top Sites-journal	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\bd9f572c-9480-4748-9f52-a38cf7fb3af4.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\1a41c72b8cb50f52_0	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00002c	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\PCAppStore.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\History	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Extension Rules\CURRENT	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Session Storage\000001.dbtmp	msedgewebview2.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UINumberDescFormat	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Driver	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UINumberDescFormat	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UINumber	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Mfg	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LocationInformation	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0025	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ContainerID	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ContainerID	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Security	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Security	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LocationInformation	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UINumber	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0025	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	PcAppStore.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\ = "URL:PC App Store"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\URL Protocol = "PcAppStore"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\shell\open\command	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\shell	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\shell\open	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\shell\open\command\ = "\"C:\\Program Files (x86)\\PCAppStore\\PCAppStore.exe\" /src=custom_protocol /query=\"%1\""	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\DefaultIcon	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\DefaultIcon\ = "C:\\Program Files (x86)\\PCAppStore\\PCAppStore.exe,1"	Setup.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2632	Setup.exe
2632	Setup.exe
2632	Setup.exe
2632	Setup.exe
2632	Setup.exe
2632	Setup.exe
2632	Setup.exe
2632	Setup.exe
2632	Setup.exe
2632	Setup.exe
4668	PcAppStore.exe
4668	PcAppStore.exe
1548	Watchdog.exe
1548	Watchdog.exe
2036	PCAppStore.exe
2036	PCAppStore.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2328	msedgewebview2.exe
2328	msedgewebview2.exe
2328	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
4668	PcAppStore.exe
4668	PcAppStore.exe
4668	PcAppStore.exe
4668	PcAppStore.exe
4668	PcAppStore.exe
4668	PcAppStore.exe
4668	PcAppStore.exe
4668	PcAppStore.exe
4668	PcAppStore.exe
4668	PcAppStore.exe

Suspicious use of SendNotifyMessage 11 IoCs

pid	Process
4668	PcAppStore.exe
4668	PcAppStore.exe
4668	PcAppStore.exe
4668	PcAppStore.exe
4668	PcAppStore.exe
4668	PcAppStore.exe
4668	PcAppStore.exe
4668	PcAppStore.exe
4668	PcAppStore.exe
4668	PcAppStore.exe
4668	PcAppStore.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2632	Setup.exe
2632	Setup.exe
4668	PcAppStore.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 6000 wrote to memory of 2776	6000	PcAppStoreSRV.exe	88
PID 6000 wrote to memory of 4668	6000	PcAppStoreSRV.exe	89
PID 6000 wrote to memory of 1548	6000	PcAppStoreSRV.exe	90
PID 4668 wrote to memory of 2328	4668	PcAppStore.exe	92
PID 2328 wrote to memory of 2612	2328	msedgewebview2.exe	93
PID 2328 wrote to memory of 5620	2328	msedgewebview2.exe	94
PID 2328 wrote to memory of 5620	2328	msedgewebview2.exe	94
PID 2328 wrote to memory of 5620	2328	msedgewebview2.exe	94
PID 2328 wrote to memory of 5620	2328	msedgewebview2.exe	94
PID 2328 wrote to memory of 5912	2328	msedgewebview2.exe	95
PID 2328 wrote to memory of 2496	2328	msedgewebview2.exe	96
PID 2328 wrote to memory of 2496	2328	msedgewebview2.exe	96
PID 2328 wrote to memory of 2496	2328	msedgewebview2.exe	96
PID 2328 wrote to memory of 1204	2328	msedgewebview2.exe	97
PID 2328 wrote to memory of 1204	2328	msedgewebview2.exe	97
PID 2328 wrote to memory of 1204	2328	msedgewebview2.exe	97
PID 2328 wrote to memory of 1204	2328	msedgewebview2.exe	97
PID 2328 wrote to memory of 1204	2328	msedgewebview2.exe	97
PID 2328 wrote to memory of 4376	2328	msedgewebview2.exe	98
PID 2328 wrote to memory of 4376	2328	msedgewebview2.exe	98
PID 2328 wrote to memory of 4376	2328	msedgewebview2.exe	98
PID 2328 wrote to memory of 4376	2328	msedgewebview2.exe	98
PID 2328 wrote to memory of 4376	2328	msedgewebview2.exe	98
PID 2328 wrote to memory of 1148	2328	msedgewebview2.exe	100
PID 2328 wrote to memory of 1148	2328	msedgewebview2.exe	100
PID 2328 wrote to memory of 1148	2328	msedgewebview2.exe	100
PID 2328 wrote to memory of 1148	2328	msedgewebview2.exe	100
PID 2328 wrote to memory of 1148	2328	msedgewebview2.exe	100

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2632

C:\Program Files (x86)\PCAppStore\PcAppStoreSRV.exe
"C:\Program Files (x86)\PCAppStore\PcAppStoreSRV.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6000
- C:\Program Files (x86)\PCAppStore\AutoUpdater.exe
  "C:\Program Files (x86)\PCAppStore\AutoUpdater.exe" /i /step=init
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Program Files (x86)\PCAppStore\PcAppStore.exe
  "C:\Program Files (x86)\PCAppStore\PcAppStore.exe" /src=installer
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4668.2052.6920641580356483887 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6
    3⤵
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" /prefetch:4 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x198,0x7ffb35c95fd8,0x7ffb35c95fe4,0x7ffb35c95ff0
      4⤵
      PID:2612
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1660 --field-trial-handle=1676,i,15684560870624724816,4107966711634320755,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6
      4⤵
      PID:5620
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2208 --field-trial-handle=1676,i,15684560870624724816,4107966711634320755,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6
      4⤵
      Drops file in Program Files directory
      PID:5912
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2268 --field-trial-handle=1676,i,15684560870624724816,4107966711634320755,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6
      4⤵
      PID:2496
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3316 --field-trial-handle=1676,i,15684560870624724816,4107966711634320755,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6 /prefetch:1
      4⤵
      PID:1204
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3952 --field-trial-handle=1676,i,15684560870624724816,4107966711634320755,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6 /prefetch:1
      4⤵
      PID:4376
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4732 --field-trial-handle=1676,i,15684560870624724816,4107966711634320755,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6 /prefetch:1
      4⤵
      PID:1148
- C:\Program Files (x86)\PCAppStore\Watchdog.exe
  "C:\Program Files (x86)\PCAppStore\Watchdog.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1548

C:\Program Files (x86)\PCAppStore\PCAppStore.exe
"C:\Program Files (x86)\PCAppStore\PCAppStore.exe" /src=shortcut
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AutoUpdater.exe

Path C:\Program Files (x86)\PCAppStore\AutoUpdater.exe
Size 1.2MB
SHA256 4446528c9ddb94c694e73e353cf2389aadb4dab1f9c37cdb8f3955ff0b17a783
MD5 d7ffd0777d56dbb9ad9bf455aca1aedd
SHA1 ac9a5a160ba95a8c29fe5cc627daa788a1af74fb
SHA512 f81d7d7b2746535edf93cbae9a519b8795d07f5aa4e366cd34fa812659b3439f0c7aa774b4440254d0be643852dd7fee95df7822e716e3dc9ded76fbfb9a43b1
SSDEEP 24576:Jc5Atj2SpMZavtMS6dQ/5OfPMdSSoC2UXPNxUsRKZkh0lhSMXlMJRb:JcWdNRKZJm
TLSH
T16C557D1A96A442FCD0FAD17CC657691AFA713C46837027CB1284B9661F377E4AE3E702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PCAppStore.exe

Path C:\Program Files (x86)\PCAppStore\PCAppStore.exe
Size 5.7MB
SHA256 778a37877e86736503d7fd5bebac400c679a0be443d51fc6a487eec86b21b994
MD5 51276f43dcfb15a954db000ecd35780e
SHA1 2dd6cea8650e7206f77736d1e5a651da4b1be0e4
SHA512 7e17e58d3517641d083484da5fa49af09e47b9f354f4deab24a4347e1ac3ead204e2965ffb492171e858665fe2970bb19b93ed9486ddf1fbbbb32dc86a87bd13
SSDEEP 49152:vTjwCCgIJeiEb2tiP5mbtvbFClRGvMsidtLkoY2KLc2Mt1E3TQptM:vICCPEWxvmRGYAQtGC2
TLSH
T12D56E85AD6B642E1D4F9D178C626722BFC713C5EC134A70BA781AB175B32760EA3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PCAppStoreSRV.exe

Path C:\Program Files (x86)\PCAppStore\PCAppStoreSRV.exe
Size 841KB
SHA256 dc261ea6afe7a4b447a799f9abee1cf84df0332a8d505c6a0465dd809117c762
MD5 06038201e29f7c20088f811083f32b08
SHA1 b5089369fd4afeb4be808e412ebdf4b93c926a25
SHA512 0a44dc1002f44f84d7c61590d541177f447bb090218a91f15fe5b9d469ec569b06588de7f1b8ae85ed8007b06aa2e70cc838df89875c644c79f70440ea5613ad
SSDEEP 12288:Cpv3/MMt0zEQBdtkCHyBvDSBIDph0lhSMXl+pPIbwBxcBX6:Cv3k40zE2dtjHyBbkI1h0lhSMXlyPOvq
TLSH
T1C8058D2AEBA942F8D07BC178C992650AFAB27C5A436167CB039175672F336E05D3F701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 87603276e7827578c04c067e291d10701fbe7e05a6cae381f33543fa17cf7964
MD5 27794d4377dd0b90de6bc66fc0baa99d
SHA1 dcb6289e42e68da8d46f986971d0a56a2fc81fb2
SHA512 edb23da4a36558432229631d34bb0b7583b01756eeda3c0d80e46272873ec5815bb20a624c6d84038881f4164052d368e173acc2e9b5e7583c4034d49dd7f026
TLSH
T19AD02B37F250063DD41030B30151E12D2E02B30F20034019942C8E1CAD480DB4F82CA2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f56fdd7c7ad4cadd17f034bbc1553f3e90db6871b676bd6b2dd7072e3df0fbe8
MD5 e61c13cc9597ed69df9822f9cc4b4efb
SHA1 9f7909e417d91429afb5c1efab8df115f7edbe9c
SHA512 18242a54dba02da68995597cfe39bea219b07071dd9d4d4961575432e5b2a1c98feb73091acde7e1b8c17a6d294c216a6961809c71475c3c9086e03e9e8f39e4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b0f2ae234af1341b49300dfc36c8ef368fdd4952308dc2e993ff9a4472f6e3bf
MD5 af4bb5b338af37292b0664d46414dcb3
SHA1 9fee30ddf5f5f65dacffb7b5817926f047eb347a
SHA512 0f5a80e4bcefecfa8a24c387698a46e95d54f33596ff15b0d83ecc573cfe1c52b6bd073354814e5ec24c7ed13492fc80e9c73248f8841ab90c6e0d87fd2d8a51
TLSH
T15ED0243737C1053CC41030730013714D1C01C30F44074044543CCD1D7F440540D03C43
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

f_000015

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000015
Size 36KB
SHA256 65a6c5423c1ac08c7bb2c27777194d24069d9e32bc2dbbe27025f5a507df424f
MD5 2bf267e483e3a3826ff400338eaf2b8a
SHA1 c316cefbc76e89020765b29a2a92f7996b40b887
SHA512 97a0090ce19016538007bab4ca26efc6100f8d57654e126bc65abc465c5b3754afc8a300440991764894764eb995330c856d19139892dfce62afdbb035a49400
SSDEEP 768:A7kKqdDEDmJElRJomS2j7f44cKBngw3YYYYonrE+fny:f0WE6mS2j7fJBnYYirE+fy
TLSH
T1A8F2F1713E632CFBBA50DD36024E78188966B8F59F251DD7BAC921800C225D27B92ED7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 5eb05f83e4f6691a2e3dc1f6c6dfe267b0490116698efd660eca822937fb88b0
MD5 b631e5a63ebd940ae5bff41dc0823363
SHA1 4f553310db4bfe007fc9e26080e2d9909c58c26b
SHA512 1e6e27dfa28b850d6dfd9c1b42e4dd2bfe5ae3d9a26daa4e10d510fcc8f88f94354f492a404c3dbe3283f1204a1f6c9b03db18cde4eaae10627258b400eed80f
TLSH
T1CCE0CD17CF9526DCE7D2517704E0941A7531856005F35A27D8A44179EB423C14354F5D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a231a.TMP

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a231a.TMP
Size 48B
SHA256 581be37536ed39f2ae33a129dbfdeb8cd7951d0e9226f5e40211df906cd74c31
MD5 c3996053f1fb4653dce70a58efc883bb
SHA1 06f5fa92db4bd797602d9e7a7ea3668f8ca24d44
SHA512 cb762f484025e52d5bb5e2f28aa2f942c9fb5e06ad3d070d460e4e027287dca74a32e15391523ed4a40e19ccae00053f57be1aa829d8deaff12f392225d1c24c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State~RFe598f07.TMP

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\Network Persistent State~RFe598f07.TMP
Size 84B
SHA256 712196693e3527ac1131831f1a2108b6c0e5c68967b26d51a452611cdfb86e0c
MD5 32b9dc9cc81d0682e78627c873fdd651
SHA1 46c486386d3e153c3e9b11d54cb52cf0064b71cf
SHA512 f18bc37f8b72411548da247aa1394cc5ac03c3bbd98e82eb8ba290ef239ef5b8625cf4835bd41ce7c52766d0bc3bfe9150dd22dbf62f0f05992ddde5fbfdc811
TLSH
T154A0121490405CFB0308835504146463C3F50002421848A91634318D019209D0004403
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\TransportSecurity
Size 682B
SHA256 fd75bf552c8911a3d4af62a4520585c2a410dc05965c182dbfde0332c8db63a6
MD5 07cbe685193d37e28fb12b13419eeb8b
SHA1 8184c9039c3230490e3e1ac7ed6d55498a6938e2
SHA512 a51898d2b4faf0afe103942ce6e11dd535889d4c4341b424110ed8d8a57013e6ee0c4944c874c5716403da2666fdebaa2e326ba428ba9d81c2d4918f3d36d18f
TLSH
T10901F7A341BAF467107C5ABF5EA1BC023E3AB9354143A8E4D6D6826CB0625FB6611472
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59bc32.TMP

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\TransportSecurity~RFe59bc32.TMP
Size 682B
SHA256 389d5dfe9a50427027e1cd940c81d671c58e1355358f906dcba21fb0f660cf37
MD5 0cff9516555c452a2387eb9ff80d3db5
SHA1 48e9bda128e65449412e2062016809948ed95375
SHA512 c766706492854ac6580ab8d83e5ef525aaaec206d2f70478bc10730d3a75210d96754564cffb04e557940502e09d50ee4019dd9266fc0027b94bebdceb4fd0a6
TLSH
T11D01F7A341BAE467106C1AEF5D55BC027E7AF9318143A8E4DAA6836C70625FB2A11472
MD5 SHA1 SHA512 TLSH

Submit Download

bd9f572c-9480-4748-9f52-a38cf7fb3af4.tmp

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\bd9f572c-9480-4748-9f52-a38cf7fb3af4.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Preferences
Size 6KB
SHA256 391d57b588e23079ad87e6d2527862dfdb192b6b38c27e246a0d1ea807060b19
MD5 14d035f9439bd0d963264e3f2c4641c7
SHA1 ef7e9afc660acd6fa70879e8d75fdd1d4aeedbdd
SHA512 0244fc626199b36ee0c19e0aadad80991820a5977899124d663ceab7cf17a9e4d92ae8e12ddf292538850703dc4c7d22c1d5ba53e6156fa527aba4da15e9e33c
SSDEEP 96:st8/dbxscb97kmo52t16ZEts7/x+6Mhmuecm3kMkGVqMuyjezK+gu5+28XM1C7jL:stwBjtoetsV+Fa3kyVqqjN2+G6v
TLSH
T161D1B5425E28797B4CC6E509FE29BB47E2F5606261D11E58EFF88B1C04EB6DC630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Preferences
Size 6KB
SHA256 3b7d824bdc023ad9e2e8f70ec5c65c87d26c91fe2c6c5c9ab0364bc0ff5708eb
MD5 6bdbe23ac8294b9c2c3b30d74dc70b93
SHA1 ac989fd000f95f58d8b4f7eb2da614cf67bffb85
SHA512 c1ae8cbb6c71fc57c11bdc4b79d2470afd2e359957f41c930c2d3c166923fd81029c0dee1a749a556aaf19d4603dc7d46e7847fcd6eeec23c437815cfcee01d4
SSDEEP 96:st8/dbxscb97kqEo52t16ZEVs7/x+6MhmuecmJ+TOYPM1JjezK+geu5U28XM1C7v:stwBjqoeVsV+FaJ+aYPCjNVUG6v
TLSH
T10AE1B5425E64697B4CC6E51CFA29BB43E2F5606276911E48EFF84B1C04DB6DC6307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59b888.TMP

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Preferences~RFe59b888.TMP
Size 6KB
SHA256 9c90ebc8d437813a7c5137b640d7e83663166a2c34ec65858595aea87a525c7e
MD5 43c09ce8344864a07e17a9b01b78e509
SHA1 f6f5d5bc816c02a91ac9b7dd86329c7d4d688131
SHA512 7bb552298f73bae496fddb1adc6468bea3bad723ad25ca1537103a6855b55b7832869f2bbda472b073023d917002d9463e085d8d17149b59ef9d4ec729d1fbd3
SSDEEP 96:st8/dKxscb97kmo52t16ZEcs7/x+6Mhmuec4ynMkkjezK+gJ+28XM1C7jL:stwwjtoecsV+FEynwjNz+G6v
TLSH
T1D3D1C5425E28697B4CC6E509FA29BB43E2F9607271D51D58EFF8861C04EBADC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State
Size 15KB
SHA256 ecae18bfff49c9b1c8ba6cec1d1e687333e12bfeaf284ea6edd964693a1c165b
MD5 f625cde626f82a4b6432d1c46ee15bd3
SHA1 b10a7538401decd4afe9677b12f59911ce89cb16
SHA512 5fae5d9d9441ca3ac87945a86aad64134db8552c7d17d13974beadb334c6dcba2a51688718e6c4ed5ed36512affe00642e1e4ff3ede474651c7bc2fd930a6dfc
SSDEEP 384:Vsrv+89zHqlDNP9oid6NBSYbJTLzZhbYaHMIk:irv+4UNbdcTLNpYaHC
TLSH
T15572AE73E538AA37AEF38805F9867A173F7C609696C20F94D9994F8D42DB4C92307912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State
Size 1KB
SHA256 557f845a8c9e715b74189e5b5b0c0063aacdd9bab5f23bd0cb423be1376c419b
MD5 1a1d5acf49a78b27d452db16663b1310
SHA1 2b5f55cd0f49ede1cb479302f0be8b61b942ed41
SHA512 60511f8566e5ea4cb4fee5856d70f3b298aa4f2d92d845c299b276d945af0c775a43814fbe69700bef0988dc6e0c19b31556aae41fc0c5d4985b829ccd950fe5
TLSH
T13F3189B394605A31B98799467311FFD7AF3050AE92524F04BACD871D03F744D5A6BC31
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State
Size 2KB
SHA256 35a48f865df1a5a35669407cdf7698cb3af5fec2d0d0c249c486b523cedcd7ae
MD5 0c7be113d87a1ffbd5649a2f7eb01cd6
SHA1 fc4657e44ac6967465898e44386db847478955f9
SHA512 e134814c175401ee4afa09df25a4f40353fbfb7647cb62c7ac3a58e442acf5a074c552b43d451a39e95783e8435afaba3945b6001e4ca29f4df09eacd866367d
TLSH
T18251967368109A3796A38E08BA067F93DF7590A9AA522F14EECC071C02D755D1747C32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State
Size 3KB
SHA256 cde0ba690373d2932821fe9a1585af3703e49dd3ee9a9c0430d71eded8cc8c5a
MD5 d13cdcffaf5993d9b8abb8025a42d960
SHA1 7b43fce697c2593b54312132ea497049ff102bbf
SHA512 7cd530ddf5c722ac7932afc56ac6145466d42b070b77397ce7d0da7f26b3d6cfe232a940251a826f970b7b05ce0836b72c9c975628baf2337c5a6eff3073fee2
TLSH
T1E97195776860993B5AE38D04B9463B57FBA5506AE9D13F65DAEC0F0C02D728C1343C12
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State
Size 15KB
SHA256 a54a76c0414731b5300ca98805e765eaf0f40b817ccdc19e255468bb75aedc8e
MD5 824a3b6296f2c0c8112565ac50cb6819
SHA1 c28b7c1ee8253ae5443eccc00967e9c68e84b5af
SHA512 6e2c17e0c4ab70e6f600527dc18bc83b7c3db8ef7f97c55285b60e9a1b49ad3e945096ffbbe2617db7de5409da18460533de195a39a9facbea79002e58ef95bd
SSDEEP 384:8srv+89zHqlDNP9oidQNBSYO181zZhbYaHMIk:nrv+4UNbdP81NpYaHC
TLSH
T17D72AE33F538AA37AEF38809F9467A177F7C609696C20F94D9984F8D42DB5C92307912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Watchdog.exe

Path C:\Program Files (x86)\PCAppStore\Watchdog.exe
Size 856KB
SHA256 d90f435d7ac73c0ad2221dc0dddd5a99aa26da08ea7976506ae165cc9e2dde7f
MD5 9a39c81d3045ee6724b2e7239420f62d
SHA1 a026ded638c21dcdc577f2365e8f7b97e627ec97
SHA512 de847c66485ffd23019f2d15ac6ec62986d6b7586e1d4cfe8a3b49639f23dea33e5f1e41fb158ade02cf6c4b697ed233e14eb4796b6c98118b4504d80aa7573b
SSDEEP 24576:n6dHLN0DHu2CRz+7rbpa0/vTVh0lhSMXlhwy:n6dHLN0DHu/Rgvplol
TLSH
T11C159D1AEB9801F8D4BAC27989A22546F7B27C4647615ACF139135A73F336E05E3F702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1259544006.html

Path C:\Program Files (x86)\PCAppStore\cache\1259544006.html
Size 18KB
SHA256 53f278fda227f87187fe82969b3974486bfcc84616fed80146ee0d99a2686a02
MD5 f39062f0fc648722db0131ffb89bc66d
SHA1 e112442b5199b770e22ef7649730790507c334a4
SHA512 94fc5be113af4fa1ad35fff168c78f23dd29d486a1aff903704f7b01b85ccb6dac004141ce6cb4865a6d49fe1134e91486f4f8dda856145987b027fdecb5dc59
SSDEEP 384:sOguS1uiRRyBT0EsiPwa7F6iHiPg4z47+tRx4ysG6VQlAq:sOWRyBT0E34ahCLpRx4ysG64Aq
TLSH
T1EC82510C3AF600618177317D4E6F96083535A0332688CE517D9CD668EF6893E67FAB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

173498830.html

Path C:\Program Files (x86)\PCAppStore\cache\173498830.html
Size 18KB
SHA256 e6df85611937797c7f853b14669c3e94981527976eabbb8720a3fb7fee3921d3
MD5 3a2d2dac0f08b71a800ea0ac83ea89f8
SHA1 a6e8ed7cf447f4669210f1636ea52c6ab3107512
SHA512 4d38fd20445fb55a35e5585e90568c6a79c37a4ff26b9bc1abc68821523b4dde1c7f255e16c3b610d9ae0a466dc59a8d0c7635ffbbd0e963e307db634b729174
SSDEEP 384:ZsOguS1uiRRyBT0EsiPwa7F6iHiPg4z47+aRx4ysG6VQlAQ9:ZsOWRyBT0E34ahCL2Rx4ysG64AQ9
TLSH
T1F782400C39F600618177317D4E6FA6083535A0332688CE517D9CD668EF6893E6BFAB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cache_setup.json

Path C:\Program Files (x86)\PCAppStore\cache\cache_setup.json
Size 6KB
SHA256 5375ac878b00a7679e1b6c956223df433eb4683a139f5c015df7f408d3356e42
MD5 e844fb1f83a537dc44217791690b37c5
SHA1 7fd97fb32792c4c83ae811273bd0a278f6afeef4
SHA512 0995641fef4dbb97451cec182fb25991b29c279386e6c935b8b07782c661649d3a8dea3364669c6ec13ca6cc5dc8f1ba4fcc0acc256fb1d0bf0caf9ab55f2ca1
SSDEEP 96:eCIE3zrUdInUuHdZvj+VLHq8tJvxIKqfxOYbvhHvXgndBgk+vXL:e9E3sdInUYdRG7qqgoYLdU/QXL
TLSH
T1B8E133BFCD220B0FF461A1D8DC8B3C08D779943A3F5279E5E7AA1426A051236E88537D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

773CFF2C7835D48C4E76FE153DBA9F81_D9070B80E002B56309375EAD5B6A198F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\773CFF2C7835D48C4E76FE153DBA9F81_D9070B80E002B56309375EAD5B6A198F
Size 471B
SHA256 0ddc6c0b36c6613288a0aa0e2ff450859fdfecdf61d528fc13926e49ac200a25
MD5 322e441c8ce358cde6e392f99bfe2cdb
SHA1 b30afd01d03544e79a963de0892f8373f31d0961
SHA512 7386a8bb9948cbb5ecd246b45fdcc438afa76b459afda25415e5c8069b2c037decb16a406cf6786a60eba71cb7a179da1c5c52252cd906f949733b5707ce458d
TLSH
T1E0F0DC1601E1E8813E1246CC375DB8617E08D0D8AAE2D69E543184ED8C94EFE9819581
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE
Size 471B
SHA256 ef990b4647de418611c64888ecd7c13ff3edbb21d7fd6bc3bc738ca4b10c5b89
MD5 4f3b93bbc0c697c360f22112e41adbd1
SHA1 148ab799244f1d7387eb1667f1b92844b0893962
SHA512 b45be889c755157b65c3833fb754d983300050b60bd7eeb28c3c98d76e942b30aa9e6d23b71104ee2903efab43417e01a959e6bc1a21f01a3055a447dc5ab87d
TLSH
T19DF0D4D5007CF42237874C6D295D57BDF421503134C445D4F17C0AA156709E7E42DA35
MD5 SHA1 SHA512 TLSH

Submit Download

773CFF2C7835D48C4E76FE153DBA9F81_D9070B80E002B56309375EAD5B6A198F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\773CFF2C7835D48C4E76FE153DBA9F81_D9070B80E002B56309375EAD5B6A198F
Size 416B
SHA256 10ff793551fcaf6bc6e646013c466b92020d0a08339cf26d06155bddae8e65e3
MD5 5409b9d289ec66ff88a830b83975ef62
SHA1 7421701b6d7254ec8395600793b5ebae52d9d04c
SHA512 1a6dfbb28993d6c5fb6ce4eb8f748f7bc8a568bb29f03a772242cd536106b68e4d20995826cbdba534ebfb2688fc1b8dc422e4e43a98a55ec92d5abf9db028f9
TLSH
T1DAE0680E1AFE21DDF632D93543CA54615A0EF123081496BE2644470AA62A640FC31664
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE
Size 412B
SHA256 bc9698500fd10393ab5418fcdc56ada99119a15083a5056f3a5dd64ebb2c7a40
MD5 c2fca33cc7f7ec9f4c7b93651353a546
SHA1 b1d41eee7c890aa0fd12de12de6084b593c547b1
SHA512 f1b82af62e496b5dc86e18eab74bbdde2454d851ae89cccfeaacdacdceb5542411918dd6551c80c90ab46d6bef5b871574f97cf1cba92ac5866f745324d6d056
TLSH
T166E0C02413FE401CF4E5E5355FC5B431459DF1250411A27429C51714B706B00DC13A21
MD5 SHA1 SHA512 TLSH

Submit Download

pixel[2].gif

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OVKU0K2R\pixel[2].gif
Size 42B
SHA256 ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
MD5 d89746888da2d9510b64a9f031eaecd5
SHA1 d5fceb6532643d0d84ffe09c40c481ecdf59e15a
SHA512 d5da26b5d496edb0221df1a4057a8b0285d15592a8f8dc7016a294df37ed335f3fde6a2252962e0df38b62847f8b771463a0124ef3f84299f262ed9d9d3cee4c
MD5 SHA1 SHA512

Submit Download

memory/1148-479-0x0000023226DA0000-0x0000023226E49000-memory.dmp

Download

memory/1204-539-0x0000021B91360000-0x0000021B91409000-memory.dmp

Download

memory/1204-212-0x00007FFB577D0000-0x00007FFB577D1000-memory.dmp

Download

memory/1204-363-0x0000021B91360000-0x0000021B91409000-memory.dmp

Download

memory/4376-393-0x000001E59D850000-0x000001E59D8F9000-memory.dmp

Download

memory/5620-86-0x00007FFB577D0000-0x00007FFB577D1000-memory.dmp

Download

memory/5620-449-0x0000021442850000-0x00000214428F9000-memory.dmp

Download

memory/5620-523-0x0000021442850000-0x00000214428F9000-memory.dmp

Download

memory/5620-538-0x0000021442850000-0x00000214428F9000-memory.dmp

Download

memory/5620-362-0x0000021442850000-0x00000214428F9000-memory.dmp

Download