420f3cb8222a5e6cd7dcf4b298cb1bcd1c9155c97e925f0b3c5b3ece9d1d6e76

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_698bdae542dc6143c9d53e11188cbb7f_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
Size 4.5MB
Sample260816-jftesasfkd
SHA256 420f3cb8222a5e6cd7dcf4b298cb1bcd1c9155c97e925f0b3c5b3ece9d1d6e76
MD5 698bdae542dc6143c9d53e11188cbb7f
SHA1 8b6bd29988edf3af8762917ef62821f92441755f
SHA512 6681f5b352078aac193091ceb03e019b41d715ac83c61e20e982b79fd01e601f45180ba82f1286ed034866c9f1e82d8fc6a0432fe6859f80832c41bdcf5d0711
SSDEEP 98304:uVzCTWj5bvoX1bE0LIhyotUVXeg79NziJeK6BKbda63PF8p7:uoTIvsNE0LcUNH2eKtbEv
TLSH
T118261209DAD702F8DDA7C6BD8A965403D772B8860374CAEF02D197160FAB5E09E3B711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1144	PcAppStoreSRV.exe
5524	AutoUpdater.exe
5488	PcAppStore.exe
3432	Watchdog.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	PcAppStore.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\Network Persistent State	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\SCT Auditing Pending Reports~RFe59aec4.TMP	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000001	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Secure Preferences	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Extension State\MANIFEST-000001	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\GraphiteDawnCache\data_1	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\data_3	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000007	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\90339b0b-445e-4ec7-b0aa-4d5050bc0cef.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Extension Scripts\LOG	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\cache\1259544006.html	PcAppStore.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\discounts_db\LOCK	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Sync Data\LevelDB\LOG	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\5427ba99-c6d7-450c-8deb-a8d5c0c211bc.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\shared_proto_db\000001.dbtmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\data_0	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\data_1	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Local Storage\leveldb\CURRENT	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\optimization_guide_hint_cache_store\LOG	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Extension Scripts\000001.dbtmp	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\90339b0b-445e-4ec7-b0aa-4d5050bc0cef.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\SCT Auditing Pending Reports~RFe59aed4.TMP	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Session Storage\CURRENT	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\ExtensionActivityEdge-journal	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\EdgeEDrop\EdgeEDropSQLite.db-journal	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Preferences~RFe5abdd3.TMP	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\ZxcvbnData\3.2.0.0\test.txt	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\data_2	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\cache\974480378.html	PcAppStore.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\TransportSecurity	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\PreferredApps	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\AutofillStrikeDatabase\LOCK	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Site Characteristics Database\LOG	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\shared_proto_db\metadata\LOCK	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\GPUCache\data_1	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Shared Dictionary\db-journal	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\Reporting and NEL	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Session Storage\MANIFEST-000001	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\93974653-548e-45de-b33f-825970e04cec.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\TpcdMetadata\2025.2.12.1\manifest.json	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Variations	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Visited Links	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies-journal	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\93974653-548e-45de-b33f-825970e04cec.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\TpcdMetadata\2025.2.12.1\metadata.pb	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Session Storage\LOCK	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\GPUCache\data_0	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\GrShaderCache\data_1	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\cache\2633136378.html	PcAppStore.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000008	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00000a	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\History-journal	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Login Data	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\parcel_tracking_db\LOG	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\shared_proto_db\metadata\LOG	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\DawnCache\data_3	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network Action Predictor-journal	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\2ed9ecb3-8a81-4cc3-aa3a-fef144c6fa73.tmp	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad\settings.dat	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Extension Rules\MANIFEST-000001	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000005	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\01e44382a8ffd025_s	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\a49c99a5-8a88-4ab2-93b5-6d6560dc15d6.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\Network Persistent State~RFe5ac0d1.TMP	msedgewebview2.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_1777482713\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_1777482713\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_1777482713\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_1777482713\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_1777482713\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_1777482713\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_112675132\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_112675132\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_1777482713\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_1777482713\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_1777482713\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_112675132\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_112675132\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_1777482713\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3312_1777482713\male_names.txt	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0025	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UINumber	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LocationInformation	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UINumber	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UINumberDescFormat	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UINumberDescFormat	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Security	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ContainerID	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LocationInformation	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ContainerID	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Driver	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Mfg	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0025	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Security	PcAppStore.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\shell\open\command\ = "\"C:\\Program Files (x86)\\PCAppStore\\PCAppStore.exe\" /src=custom_protocol /query=\"%1\""	2026-08-16_698bdae542dc6143c9d53e11188cbb7f_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore	2026-08-16_698bdae542dc6143c9d53e11188cbb7f_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\ = "URL:PC App Store"	2026-08-16_698bdae542dc6143c9d53e11188cbb7f_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\DefaultIcon	2026-08-16_698bdae542dc6143c9d53e11188cbb7f_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\shell	2026-08-16_698bdae542dc6143c9d53e11188cbb7f_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\URL Protocol = "PcAppStore"	2026-08-16_698bdae542dc6143c9d53e11188cbb7f_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\DefaultIcon\ = "C:\\Program Files (x86)\\PCAppStore\\PCAppStore.exe,1"	2026-08-16_698bdae542dc6143c9d53e11188cbb7f_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\shell\open\command	2026-08-16_698bdae542dc6143c9d53e11188cbb7f_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\shell\open	2026-08-16_698bdae542dc6143c9d53e11188cbb7f_blankgrabber_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2752	2026-08-16_698bdae542dc6143c9d53e11188cbb7f_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
2752	2026-08-16_698bdae542dc6143c9d53e11188cbb7f_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
2752	2026-08-16_698bdae542dc6143c9d53e11188cbb7f_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
2752	2026-08-16_698bdae542dc6143c9d53e11188cbb7f_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
2752	2026-08-16_698bdae542dc6143c9d53e11188cbb7f_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
2752	2026-08-16_698bdae542dc6143c9d53e11188cbb7f_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
2752	2026-08-16_698bdae542dc6143c9d53e11188cbb7f_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
2752	2026-08-16_698bdae542dc6143c9d53e11188cbb7f_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
2752	2026-08-16_698bdae542dc6143c9d53e11188cbb7f_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
2752	2026-08-16_698bdae542dc6143c9d53e11188cbb7f_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
3432	Watchdog.exe
3432	Watchdog.exe
5488	PcAppStore.exe
5488	PcAppStore.exe
4808	msedgewebview2.exe
4808	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3312	msedgewebview2.exe
3312	msedgewebview2.exe
3312	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
5488	PcAppStore.exe
5488	PcAppStore.exe
5488	PcAppStore.exe
5488	PcAppStore.exe
5488	PcAppStore.exe
5488	PcAppStore.exe
5488	PcAppStore.exe
5488	PcAppStore.exe
5488	PcAppStore.exe
5488	PcAppStore.exe

Suspicious use of SendNotifyMessage 11 IoCs

pid	Process
5488	PcAppStore.exe
5488	PcAppStore.exe
5488	PcAppStore.exe
5488	PcAppStore.exe
5488	PcAppStore.exe
5488	PcAppStore.exe
5488	PcAppStore.exe
5488	PcAppStore.exe
5488	PcAppStore.exe
5488	PcAppStore.exe
5488	PcAppStore.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5488	PcAppStore.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 5524	1144	PcAppStoreSRV.exe	90
PID 1144 wrote to memory of 5488	1144	PcAppStoreSRV.exe	91
PID 1144 wrote to memory of 3432	1144	PcAppStoreSRV.exe	92
PID 5488 wrote to memory of 3312	5488	PcAppStore.exe	94
PID 3312 wrote to memory of 3688	3312	msedgewebview2.exe	95
PID 3312 wrote to memory of 2272	3312	msedgewebview2.exe	96
PID 3312 wrote to memory of 2272	3312	msedgewebview2.exe	96
PID 3312 wrote to memory of 2272	3312	msedgewebview2.exe	96
PID 3312 wrote to memory of 2272	3312	msedgewebview2.exe	96
PID 3312 wrote to memory of 5880	3312	msedgewebview2.exe	97
PID 3312 wrote to memory of 4800	3312	msedgewebview2.exe	98
PID 3312 wrote to memory of 4800	3312	msedgewebview2.exe	98
PID 3312 wrote to memory of 4800	3312	msedgewebview2.exe	98
PID 3312 wrote to memory of 2328	3312	msedgewebview2.exe	99
PID 3312 wrote to memory of 2328	3312	msedgewebview2.exe	99
PID 3312 wrote to memory of 2328	3312	msedgewebview2.exe	99
PID 3312 wrote to memory of 2328	3312	msedgewebview2.exe	99
PID 3312 wrote to memory of 2328	3312	msedgewebview2.exe	99
PID 3312 wrote to memory of 1284	3312	msedgewebview2.exe	100
PID 3312 wrote to memory of 1284	3312	msedgewebview2.exe	100
PID 3312 wrote to memory of 1284	3312	msedgewebview2.exe	100
PID 3312 wrote to memory of 1284	3312	msedgewebview2.exe	100
PID 3312 wrote to memory of 1284	3312	msedgewebview2.exe	100
PID 3312 wrote to memory of 5640	3312	msedgewebview2.exe	102
PID 3312 wrote to memory of 5640	3312	msedgewebview2.exe	102
PID 3312 wrote to memory of 5640	3312	msedgewebview2.exe	102
PID 3312 wrote to memory of 5640	3312	msedgewebview2.exe	102
PID 3312 wrote to memory of 5640	3312	msedgewebview2.exe	102
PID 3312 wrote to memory of 3384	3312	msedgewebview2.exe	105
PID 3312 wrote to memory of 3384	3312	msedgewebview2.exe	105
PID 3312 wrote to memory of 3384	3312	msedgewebview2.exe	105
PID 3312 wrote to memory of 4808	3312	msedgewebview2.exe	106
PID 3312 wrote to memory of 5676	3312	msedgewebview2.exe	107
PID 3312 wrote to memory of 5676	3312	msedgewebview2.exe	107
PID 3312 wrote to memory of 5676	3312	msedgewebview2.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-16_698bdae542dc6143c9d53e11188cbb7f_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_698bdae542dc6143c9d53e11188cbb7f_blankgrabber_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2752

C:\Program Files (x86)\PCAppStore\PcAppStoreSRV.exe
"C:\Program Files (x86)\PCAppStore\PcAppStoreSRV.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Program Files (x86)\PCAppStore\AutoUpdater.exe
  "C:\Program Files (x86)\PCAppStore\AutoUpdater.exe" /i /step=init
  2⤵
  - Executes dropped EXE
  PID:5524
- C:\Program Files (x86)\PCAppStore\PcAppStore.exe
  "C:\Program Files (x86)\PCAppStore\PcAppStore.exe" /src=installer
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5488
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5488.3728.12989921697343468448 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6
    3⤵
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3312
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" /prefetch:4 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffbd7065fd8,0x7ffbd7065fe4,0x7ffbd7065ff0
      4⤵
      Drops file in Program Files directory
      PID:3688
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1748 --field-trial-handle=1744,i,1186084471270319942,1640320090260148815,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6
      4⤵
      PID:2272
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2216 --field-trial-handle=1744,i,1186084471270319942,1640320090260148815,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6
      4⤵
      Drops file in Program Files directory
      PID:5880
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2300 --field-trial-handle=1744,i,1186084471270319942,1640320090260148815,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3296 --field-trial-handle=1744,i,1186084471270319942,1640320090260148815,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6 /prefetch:1
      4⤵
      PID:2328
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4108 --field-trial-handle=1744,i,1186084471270319942,1640320090260148815,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6 /prefetch:1
      4⤵
      PID:1284
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4296 --field-trial-handle=1744,i,1186084471270319942,1640320090260148815,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6 /prefetch:1
      4⤵
      PID:5640
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4796 --field-trial-handle=1744,i,1186084471270319942,1640320090260148815,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6
      4⤵
      PID:3384
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4860 --field-trial-handle=1744,i,1186084471270319942,1640320090260148815,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4808
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2047 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4448 --field-trial-handle=1744,i,1186084471270319942,1640320090260148815,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6
      4⤵
      PID:5676
- C:\Program Files (x86)\PCAppStore\Watchdog.exe
  "C:\Program Files (x86)\PCAppStore\Watchdog.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AutoUpdater.exe

Path C:\Program Files (x86)\PCAppStore\AutoUpdater.exe
Size 1.2MB
SHA256 aa8edc8a61b064e622fb37e988a1683614a32b522f0b833b3a573bf3e42ec916
MD5 edc31113674c3a798136145748648824
SHA1 65e600875d8087e5a0dbb4626b93015abfc5d092
SHA512 b6d54521e5cae863d6950cb464eca94321875f68498fe57fe3c59c99be7b5c0e448a279e94167ea4658e5a50107aec8eb125513ab69fa0fc05e4c71391169a47
SSDEEP 24576:Jc5Atj2SpMZavtMS6dQ/5OfPMdSSoC2UXPNxUsRKZkh0lhSMXlMJR0:JcWdNRKZJV
TLSH
T115557D1A96A442FCD0FAD17CC657691AFA713C46837027CB1284B9661F377E4AE3E702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PCAppStore.exe

Path C:\Program Files (x86)\PCAppStore\PCAppStore.exe
Size 5.7MB
SHA256 b7b4a17d35f2a1c98e8b22007234846f9e8ae01a40ce4ad56fdd4d16a6c16ac7
MD5 60629bac8098ff65bc20b16e780d0116
SHA1 dfb73952d6f25cb60289175a1ccf997d7db677ad
SHA512 f8df0c015822eff4bf637df62a01f7fd8ac5cd16d1d486f97ad7638cd5c1856b14f1d3fb955a2341125ea11a3c5dfabb0b2d29dd940c89009e7dee66b421096e
SSDEEP 49152:vTjwCCgIJeiEb2tiP5mbtvbFClRGvMsidtLkoY2KLc2Mt1E3TQptD:vICCPEWxvmRGYAQtGCV
TLSH
T13856E85AD6B642E1D4F9D178C626722BFC713C5EC134A70BA781AB175B32760EA3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PCAppStoreSRV.exe

Path C:\Program Files (x86)\PCAppStore\PCAppStoreSRV.exe
Size 841KB
SHA256 427afb52d7032ee760a61c3152323a230d4936eea66ec241121a97b6a48de07b
MD5 15b8741d7e86b55af8f146466ce86b58
SHA1 fd24f83e8d633e81866b337df401384761ab2ea1
SHA512 33981e41c0ea1df5eb25eb60c1c16c37fb94291b954d22573cfad5371a30bfe813dd28d6965fa548817e45980d853b0315e2111f6415e17cafb32f25272d84e2
SSDEEP 12288:Cpv3/MMt0zEQBdtkCHyBvDSBIDph0lhSMXl+pPIbwBxcBXk:Cv3k40zE2dtjHyBbkI1h0lhSMXlyPOv0
TLSH
T1C2058D2AEBA942F8D07BC178C992650AFAB27C5A436167CB039175672F336E05D3F701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e3a04cee5d73a0e6921890dd16dfa0f184f486915c4a86577618a26e2031feb6
MD5 9d3d3ecf09ac87a4fa2bf517c2d6c6d7
SHA1 87244be569f116d9f410b664f9932ee440c68bef
SHA512 a43dade9de2b3803c187b34014f1049254f7c117e7272406990fa81f513663698587c82e84267907aef8b7b2b89bfe32e56e739177739c3a1987355efeee3a3f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 99959a9c236f1000212519aa6fb41821a80fb3429206d5f1eadba23b33f1bd07
MD5 81d2a34417e3322e9974418fdf22ee3d
SHA1 789d67948cf71b6a258cb549a90361f04e5eeafd
SHA512 81019e940e7861488fd22e3958e34c44c6762d2da52e5fe1dd81d94817edac8383d79327699f9037527765e4b4008e33998eaee51dc1703085fdc6f8880aec17
TLSH
T1D8D01212B2110134C8102633140375080401C10B904790005828957E2F050500927881
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

f_000005

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000005
Size 36KB
SHA256 6986b9e1eb4045ddb237711741a4c45854a29381e55dcb0f545a7e674ffe777b
MD5 7252da6cf7f0a12dd1174f5f3eae28f7
SHA1 2976d1a0955e2a366d666a3f90233b1c43f680cf
SHA512 a93889e5bda7be8291d21ac85060535086f1b0279c619499dd33b3eee3501e74aa4c619cee9666bfed97b0cea01cfa27e6aa7350c71502b3c94e35289ae28970
SSDEEP 768:OGuD34JFBt/HHs2hGdN9waKutxbtTovMHmQhWl8aX/uN9Lt:OtDIJF3/HFOuut19oCTsX85t
TLSH
T1E9F2E12F9E53857EFD8789671B88B1ABDB8427916500B91039E1E393B05BC6D4344F2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 1684b4633e185eabd6040eac4ebc7764188f3f3240c9c2754ecfcc97f13a6d9e
MD5 d07696f0aa3b57016766566ef57f88ed
SHA1 f3b64ff3791d28144a3077565363bccebb66042b
SHA512 f76807c101a5f7b16dba1e92d801120911e4d153be9b3ee1d570a3083be1d1c81004a0ab40dfbb52488437d61a0efa6b47958c8244c004025ce37e5ba724e053
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 592c7fe9f00886c69c5b3009fc7ecdec9973c061049114b8bd5588a468ac1890
MD5 08d262e5a5e84a0bb3c10ece611f752d
SHA1 29d9242e44b910fe30e99f5194bdc86373227510
SHA512 e8ef588fb7f048d406f025900394b5e98ad031c2e09571505070fcbd4e242e1401fec0da0f50b40ffbf6c3454d3fc413eb77c75ea45e4a62530172b2c7fad8a0
TLSH
T16CD01205204281B9FB85073E689096683A31396569030FC2CF91ED794450B598312608
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 25bedfab511746f9e5d99046153538ec393e1dc02134f7ebc85616cb2f9de781
MD5 ae28689444da144bc46cc78f94fb3707
SHA1 45ddb34ecb69e9edce5fade2b27bc05356455472
SHA512 1ae43c78b74820901c85aeea127fb7142403fc4aaa9786e84305dd806e9ed59edd8face92b18766ec65fda62260828342433bd00844be45ce3be49daecce4a14
TLSH
T1EC217CFA8BE489BDFE8111F82A652D1BCE5D0925035C6B36C5D47F7AA7E1460E30060F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59d5b5.TMP

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\Network Persistent State~RFe59d5b5.TMP
Size 84B
SHA256 712196693e3527ac1131831f1a2108b6c0e5c68967b26d51a452611cdfb86e0c
MD5 32b9dc9cc81d0682e78627c873fdd651
SHA1 46c486386d3e153c3e9b11d54cb52cf0064b71cf
SHA512 f18bc37f8b72411548da247aa1394cc5ac03c3bbd98e82eb8ba290ef239ef5b8625cf4835bd41ce7c52766d0bc3bfe9150dd22dbf62f0f05992ddde5fbfdc811
TLSH
T154A0121490405CFB0308835504146463C3F50002421848A91634318D019209D0004403
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\TransportSecurity
Size 690B
SHA256 bf5f40f52dbbe34f104679c4980db692224e068e695f64099f5b51e505c96434
MD5 a15e493586818f619ccda4a7c57eb5e5
SHA1 af283c75a302e8fbbc00754c33f37e0f78fcea42
SHA512 5c83baef4cbfe30c4b8c2c7971030edeff16d2d4bda5fd0070dfeb95c4bb210db52bd6badc74d08241f0837dd3435b8bf1ae63813d53dcf85ea091844530c9af
TLSH
T143017BD38A7EE433207D58BB0C86BC121B397530509354E8DBA7C12DB4C98F72603423
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5a2abb.TMP

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\TransportSecurity~RFe5a2abb.TMP
Size 188B
SHA256 33aa6dba042800c3b2a06248f64ca28db6e3c0b21821230c5c1af35f0aa29e58
MD5 7a65269bd10e07ff1a82f7d2f91269a8
SHA1 3a35ae3206711035f37ef9d11c9caa8d7de0b0f9
SHA512 f0a0fcd86f3e1091f1f274981bd65d417c9d3d3646a25f58ebd20078fefba826273dbaa36c3ccd91554abce7aa3800f81e7be2d202364797e112bb16a96852d2
TLSH
T1EEC022A306BDA4721038052228C4AD006F37E0380083A4E886D2892CB08806A9107003
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Preferences
Size 6KB
SHA256 ae5efa6994217d05c687946bce2c04080bcc70322cf797b0d201771937f70d62
MD5 855f5d3a45f2f7097ad3fb403e50cb4f
SHA1 ccf912d3a160680bf404fe4e94813c9a082dba67
SHA512 9fd05afe25518082703276afa767658c3e3abad0729c9d8b1ba51d4be655c8ee7d3d49427ea74e7fb35e0984bdfece1173100f5032a5cd730500b52314fd53e9
SSDEEP 96:stz/dQW3pYGGb9/khZo52t16ZEms7/x+6Mhmuecm1q1oGa4MkkjeoK+gnX28XM1S:striW3iOZoemsV+Fa1qSGa4wj0dG6v
TLSH
T1CBE1B6025E2879BB4CC6F119BA297A56E3F5706265E42D98EBF84A2C04D76DC630390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Preferences
Size 6KB
SHA256 1d2135ab7bcf67a3feaa59dc9f62bb18ef3840e003009d3000234699430f1800
MD5 f83a00389c9eeb7398c014e6810ea1f3
SHA1 1d49374f52e32d9366709aa3c34c3e9f5dcbffff
SHA512 ae36460c60fd0025b644248a168ab7f4069f1b3a0d829e02bfb42f8195fb9324ceb545d840300a75b2a123353fa7d059e7d96ed4017f16a4ad81dfe9c3b4c65f
SSDEEP 96:stz/dQW3pRGb9/khZo52t16ZEms7/x+6Mhmuecm1q1oGa4MkkjeoK+gnf28XM1Cj:striW3IOZoemsV+Fa1qSGa4wj0pG6v
TLSH
T180D1B7025E2879BB4CC6F119BA29BB56E3F5706365D42D94EBF84A2C04D76DC6303D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a2a9b.TMP

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Preferences~RFe5a2a9b.TMP
Size 6KB
SHA256 152e960175762c9f02ed8387b894a050e3e215e3d9b71515eb35ec26c5618f1d
MD5 b8e30232d19a41a20423a85501850d6e
SHA1 94d2af7814f808012104b08ae10e05585ee89542
SHA512 a19a35f656766576db16b1c4f2d7e8d9f8a0e55a99b08d65af82d457e391641b69c3c3cb071df26bccbf8fefdd2c276a03c1ca243baf2c9a04ebd0af61ade1b2
SSDEEP 96:rz/dKW3pRGb9/kJFdoZt16ZE2s7/x+6Mhmuec4Mb1ejeoK+gnS28XM1C7jL:rrwW3I4/ol2sV+FEMbQj0wG6v
TLSH
T1A7C1B8025F2469BB4CC6F119BA297A56D3F5706264E52D98EBF8462C08D75CC6307D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State
Size 2KB
SHA256 c36d3f3820cfab7e6b6a2f29f6d5fe13b45b02410e651d7c9f9ecf58e8aa4558
MD5 5822bc496aeeed59b757c56d59961885
SHA1 341d83e7c9d9baddaf7e3e157fc9144bb0fe3ee8
SHA512 dc75898c4a18666bc4a82abea092c653928587a591dea338c65444d85184d094f0b8dc4cc10301aaea868065e86a95fc89f6fd98c2f82cc997487e606b539bec
TLSH
T12151C8736D245A7755E3970879863F639F3660A29A662F509EDD0B1C01D315C2342C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State
Size 3KB
SHA256 53c20404c9eeb893f771383da23b6956794074ca2dcbb85d7de3000c1b39d501
MD5 11ed71a9d110c4fa5bc24743889215eb
SHA1 aed59de5f392ba836974bbd13b5dd97f54747097
SHA512 8c2f15344179bce569c2b32c5717571d07b755214f270c336697e86811daef6201497d21362f0e32f8b75eccc4be664826ec5e3a5851786aa335b67ed18a69c4
TLSH
T18B71B6376A74A9375DF3EA04B9863B126B655063A59A3F94CAEC0F0C01D729C1382C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State
Size 15KB
SHA256 14eb5543df55f6e8029c10763dc3a069f3daf8c04d2f55caf9ada12bff44653e
MD5 74074da57492ca8738dfb64478359410
SHA1 e126abb9fac2b4748ce560f51854e7600693e01f
SHA512 9c5fa0e0a6516955a331191c1bb36feb4c04b5a3e7bb5aacc2dbe0d075ee1e626bc606c67d79c83548dae371554affa2f9252cf32d4a8ce265b02e3a846d9de5
SSDEEP 384:j+aQikB+z/xvxjg/qhEwNBSWR+8msze7AVdplX9zh:C/UxvxjgC+OR+Lsy7URFh
TLSH
T12772AF2B59397E37A5F3FA047A4D078BCBB894B251C12EA44EBD9F0D06C72A81342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State
Size 3KB
SHA256 c25fea6113b23e3cc48d5a124cd8ed9d39f8abf9f70cbdb4d3af022bfbe60769
MD5 5e083835c9a534d75c2de40c6da6e8a7
SHA1 2f16b862d9fa3af61f84bb5d23fbf2f75c5d70c1
SHA512 7103c4d8a86b4595d47cfac04434b706f192752e94d6be5d63ad0255b8c7042797bef701706a29b5168a184908fd6339eb63f15e5ab77782609e9633876be594
TLSH
T1C861A7776E74A9375DE3DA05B9862B12ABA55063D5953F94CAEC0F1C01D329C1342C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59ac82.TMP

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State~RFe59ac82.TMP
Size 1KB
SHA256 b0bc1bfd5a723c04a37d1bdf76e3bf2d170cc355a22be37963618b13d457b44d
MD5 01f973ca439c7d2ff3617eea66c2075b
SHA1 5737eef05be359a4c5136c66c4f450b359abe9a0
SHA512 ab7b254e6d7594f3ee97fda58321545476d51d38f32b385f1444b85d6f56ce6f8890cbf17f76a73112e71615d486ebff6fdb1f9c67656ac215896b65fc56ebf2
TLSH
T1F52168B3D6741B727C92774A3242AA531F2220B782510F4065EE4B6C05E219CA75AD37
MD5 SHA1 SHA512 TLSH

Submit Download

Watchdog.exe

Path C:\Program Files (x86)\PCAppStore\Watchdog.exe
Size 856KB
SHA256 55366e9e6cf8568701154ea3c6f89b51c992d32d5ab83a15d559d21bac509ef8
MD5 168c21dbb93e68c3c4c106d436643289
SHA1 4b8b1fbf845de64766b089570c71c52269748ba4
SHA512 1dee605859a3d569c97312dd187955c1a9e4c1aaa3ccee6c35ec440552292e2d41de180374ad70a3119799a4c386fc7fb651f8f4b727789e4319bd8a838d3917
SSDEEP 24576:n6dHLN0DHu2CRz+7rbpa0/vTVh0lhSMXlhw4:n6dHLN0DHu/RgvploX
TLSH
T1A5159D1AEB9801F8D4BAC27989A22546F7B27C4647615ACF139135A73F336E05E3F702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2633136378.html

Path C:\Program Files (x86)\PCAppStore\cache\2633136378.html
Size 1.3MB
SHA256 c44c5041f94e4a58855cb5bcdc22f15bfc9bb40b84fd9da0b4d69e787d28fc21
MD5 956ecc265c2db6113e337ca117b96d25
SHA1 149d6802f9404e630c93aed5123dd310f1abb9e8
SHA512 ee4065f556f9648d7d66c47184844db677f4287e5ee76725c5da4a1e2f1f015e3fce15c58ae7f8194484819ebb082a6a80cf27161ad5727c9fdcdcc505593c85
SSDEEP 24576:GwYKQ3/FBg6hcOJwQRbbIQCCtUTIpktLwdkSa:GwYKQ3/FBg6hcOJwQRbbIQCCtUTIpktv
TLSH
T19D55F64BF6EB60289013A02C4F1F262577349407580BDC587DACD6D09FA996987B2BFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cache_setup.json

Path C:\Program Files (x86)\PCAppStore\cache\cache_setup.json
Size 8KB
SHA256 66105ad27e77a93d693d2da035009427713835718e0b94193da2a5b6c91e478c
MD5 fa269014923e8bb3ddef8e298cd95e05
SHA1 81bf8fdf24f06f200dc07e4e780a06aa63b249cc
SHA512 a04643bd1c66f693d6e2631743bb1e125032d5ec3d32af10bb610612df4f76c2d80a750b18584df30dc7d525ac74edcffc8efe1cec6de69f075e41368588313e
SSDEEP 192:0sdIT6/dKZRQw+zLXJtiTxXNNoL5apBwduIC:L2mdtfXrilXXCWG4
TLSH
T1EA02C7BB4D122F0FF011BAC99D9B7C45C765A4743F5232D0E78A1CA2D06173AE8C522E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

773CFF2C7835D48C4E76FE153DBA9F81_D9070B80E002B56309375EAD5B6A198F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\773CFF2C7835D48C4E76FE153DBA9F81_D9070B80E002B56309375EAD5B6A198F
Size 471B
SHA256 cc0ae05c66ae5847548d6ea632ffb6f3e1ad9134e00580e015cf491fe73fe3a2
MD5 5b0b809bbe3f6a067aa4ebcea01cdb66
SHA1 e69367d8518ff5412a6c367b34d09e679f9dadb9
SHA512 18ead66315fc8f18b44d23117d524cd7f3c2a8ca9f882dc57870498583c258f6a546749baa07cd214e6c360d01458249dc6949fa4f3b4b93665a01ae25087c38
TLSH
T1B1F0DC9649DE2DA1A495848D208CF4B13C4385EC017BE087942D9ABA58051B8D5AEBA4
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE
Size 471B
SHA256 1d773137988ea89190b59554184524e85d0aefbd2ba8718be8f4fa16024d81a0
MD5 565596c62af5e518ffe6a97779668ba4
SHA1 76a9ff9b91e8bc0f00c721bac4c78985b638bd77
SHA512 b3adadb6425bc9b19e091dfe8357d719f04921f255247c4ce676f31783617ff0460e104ece0a6c62992e8df8c26050c05321c3b1b053370a770c85f7146e38fa
TLSH
T1EDF09EA651ADE5512141C99D2AF41A31E471D97848400471722CCEF189B7674A91D4BB
MD5 SHA1 SHA512 TLSH

Submit Download

773CFF2C7835D48C4E76FE153DBA9F81_D9070B80E002B56309375EAD5B6A198F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\773CFF2C7835D48C4E76FE153DBA9F81_D9070B80E002B56309375EAD5B6A198F
Size 416B
SHA256 910acbea5f93a4518b3213e1b263d750be3573caa0d1726107327f0e397707a6
MD5 dbaa29c955b3a733f080d32241dca313
SHA1 d8054834a6edbb44654316a158f13a61f59cd8a1
SHA512 98f83c996aac02ed86d22311802a98042999fc460106181c5ae039f794e34a93062e8f7c0ab7c2144674ee2d06c6f25ae111aacc427c362933714c858284406c
TLSH
T1B8E0610516FA01DDF231D83586D60252590EF123180587722545470BA52B690FC31654
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE
Size 412B
SHA256 85ed9acb8e853447094aa4f4244e842c6d3230bf62c855250d03723615cbb26d
MD5 1eecff28cfe5cf9f79a6fb14c53a1ed8
SHA1 3ccd02c259374306f60968ecffee15eda8700271
SHA512 6affc08c3bd55954f8f5e7c3c37a094c5bb8bc1e0e1c9f5215e520f4970a3ef611b58b06cc050ce459cda09995c9128532444e4cf47270289b7f82ff590ebc89
TLSH
T12AE0C02816FE501DF0E4E4749BE5F432497DF1350455A2F01AC45704B706B00EC23E31
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2272-90-0x00007FFBF8110000-0x00007FFBF8111000-memory.dmp

Download

memory/2328-238-0x00007FFBF8110000-0x00007FFBF8111000-memory.dmp

Download

memory/3384-453-0x00007FFBF8840000-0x00007FFBF8841000-memory.dmp

Download

memory/3384-454-0x00007FFBF97C0000-0x00007FFBF97C1000-memory.dmp

Download

memory/4808-505-0x0000017220090000-0x0000017220091000-memory.dmp

Download

memory/4808-507-0x0000017220090000-0x0000017220091000-memory.dmp

Download

memory/4808-511-0x0000017220090000-0x0000017220091000-memory.dmp

Download

memory/4808-516-0x0000017220090000-0x0000017220091000-memory.dmp

Download

memory/4808-515-0x0000017220090000-0x0000017220091000-memory.dmp

Download

memory/4808-514-0x0000017220090000-0x0000017220091000-memory.dmp

Download

memory/4808-512-0x0000017220090000-0x0000017220091000-memory.dmp

Download

memory/4808-513-0x0000017220090000-0x0000017220091000-memory.dmp

Download