hxxps://pcapp[.]store/

Analysis

user interaction
yes
max time kernel
520s
max time network
522s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 17:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://pcapp.store/
Sample260820-v855tsgl3t

Score

7^/10

defense_evasion discovery persistence ransomware spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
4360	Setup.exe
5800	Setup.exe
1140	Setup.exe
2844	PcAppStoreSRV.exe
124	AutoUpdater.exe
5460	PcAppStore.exe
2648	Watchdog.exe
4476	PCAppStore.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	PcAppStore.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Local Storage\leveldb\LOCK	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\c41994b0-5905-4953-9c61-9bda32ae1929.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00006e	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000068	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\3ca894cdb1084203_0	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Extension State\CURRENT	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00005d	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00005e	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad\settings.dat	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\lockfile	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Local Storage\leveldb\000003.log	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies-journal	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\ExtensionActivityComp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00001e	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000061	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\WebStorage\1\IndexedDB\indexeddb.leveldb\000001.dbtmp	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\1a79e59d-79a7-4741-91dc-aa71d74cdc88.tmp	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\shared_proto_db\metadata\LOCK	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\GrShaderCache\data_1	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Preferences~RFe5e2019.TMP	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\VideoDecodeStats\LOCK	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000057	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5e74d0.TMP	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00006b	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Sync Data\LevelDB\CURRENT	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State~RFe5dc0d2.TMP	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\04bc3748-98c7-4d2f-85ea-6c7fb6783906.tmp	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\280fd1a41df566bb_0	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000041	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000058	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000066	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\PKIMetadata\46.0.0.0\manifest.json	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\AutoUpdater.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Web Data-journal	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\43b44517-be8a-4471-b979-61049ae287b8.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000056	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00005e	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000066	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\ff36cc21-e7ac-4ca6-9d6a-536ceb6f8853.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\6e3b4572-8d50-45ae-a987-0e3c112dd585.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\DawnCache\data_0	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00000e	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\EdgeEDrop\EdgeEDropSQLite.db-journal	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000020	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\43b44517-be8a-4471-b979-61049ae287b8.tmp	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad\settings.dat	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\commerce_subscription_db\LOCK	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\Network Persistent State	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\PreferredApps	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\4711085b-a926-43dd-8c32-583e85c1d9b0.tmp	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\ff36cc21-e7ac-4ca6-9d6a-536ceb6f8853.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000075	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\ShaderCache\data_0	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000007	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\cache\3685482583.html	PcAppStore.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\shared_proto_db\metadata\000001.dbtmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\shared_proto_db\MANIFEST-000001	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\280fd1a41df566bb_1	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad\settings.dat	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\GraphiteDawnCache	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000011	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000011	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00001d	msedgewebview2.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_726536319\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_1194646441\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_656171676\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_1444626637\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_1194646441\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_726536319\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_939283444\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_726536319\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_1444626637\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_656171676\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_1444626637\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_726536319\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_656171676\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_1194646441\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_656171676\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_1444626637\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_1989314829\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_656171676\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_1989314829\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_726536319\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_656171676\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3756_263222569\_locales\ro\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4536	chrome.exe
6508	msedge.exe

Checks SCSI registry key(s) 3 TTPs 45 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LocationInformation	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ContainerID	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UINumber	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Security	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Security	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0025	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Driver	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UINumberDescFormat	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ContainerID	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UINumberDescFormat	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UINumber	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0025	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LocationInformation	PcAppStore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Mfg	PcAppStore.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317212551977111"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 17 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\shell\open\command\ = "\"C:\\Program Files (x86)\\PCAppStore\\PCAppStore.exe\" /src=custom_protocol /query=\"%1\""	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{CBAE18BD-E2A7-492C-89D2-CF8C1276A9C2}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\URL Protocol = "PcAppStore"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\DefaultIcon	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\shell\open\command	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\shell\open	Setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{00FF06AE-21C2-434D-8BEA-7501557CED88}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\ = "URL:PC App Store"	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\DefaultIcon\ = "C:\\Program Files (x86)\\PCAppStore\\PCAppStore.exe,1"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\shell	Setup.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
5356	chrome.exe
5356	chrome.exe
4360	Setup.exe
4360	Setup.exe
4360	Setup.exe
4360	Setup.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
4360	Setup.exe
4360	Setup.exe
4360	Setup.exe
4360	Setup.exe
4360	Setup.exe
4360	Setup.exe
2648	Watchdog.exe
2648	Watchdog.exe
5460	PcAppStore.exe
5460	PcAppStore.exe
4476	PCAppStore.exe
4476	PCAppStore.exe
2104	msedgewebview2.exe
2104	msedgewebview2.exe
2648	Watchdog.exe
2648	Watchdog.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3888	msedgewebview2.exe
3888	msedgewebview2.exe
3888	msedgewebview2.exe
3888	msedgewebview2.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe
Token: SeShutdownPrivilege	3760	chrome.exe
Token: SeCreatePagefilePrivilege	3760	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe

Suspicious use of SendNotifyMessage 63 IoCs

pid	Process
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
3760	chrome.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
936	taskmgr.exe
5460	PcAppStore.exe
5460	PcAppStore.exe
5460	PcAppStore.exe
5460	PcAppStore.exe
5460	PcAppStore.exe
5460	PcAppStore.exe
5460	PcAppStore.exe
5460	PcAppStore.exe
5460	PcAppStore.exe
5460	PcAppStore.exe
5460	PcAppStore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
936	taskmgr.exe
4360	Setup.exe
4360	Setup.exe
5460	PcAppStore.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 4116	3760	chrome.exe	89
PID 3760 wrote to memory of 4536	3760	chrome.exe	90
PID 3760 wrote to memory of 2468	3760	chrome.exe	91
PID 3760 wrote to memory of 2468	3760	chrome.exe	91
PID 3760 wrote to memory of 4500	3760	chrome.exe	92
PID 3760 wrote to memory of 4500	3760	chrome.exe	92
PID 3760 wrote to memory of 2424	3760	chrome.exe	94
PID 3760 wrote to memory of 2424	3760	chrome.exe	94
PID 3760 wrote to memory of 1284	3760	chrome.exe	95
PID 3760 wrote to memory of 1284	3760	chrome.exe	95
PID 3760 wrote to memory of 3796	3760	chrome.exe	96
PID 3760 wrote to memory of 2464	3760	chrome.exe	98
PID 3760 wrote to memory of 2464	3760	chrome.exe	98
PID 3760 wrote to memory of 4224	3760	chrome.exe	99
PID 3760 wrote to memory of 4224	3760	chrome.exe	99
PID 3760 wrote to memory of 1008	3760	chrome.exe	102
PID 3760 wrote to memory of 3396	3760	chrome.exe	103
PID 3760 wrote to memory of 1008	3760	chrome.exe	102
PID 3760 wrote to memory of 3396	3760	chrome.exe	103
PID 3760 wrote to memory of 2704	3760	chrome.exe	104
PID 3760 wrote to memory of 1252	3760	chrome.exe	105
PID 3760 wrote to memory of 2704	3760	chrome.exe	104
PID 3760 wrote to memory of 1252	3760	chrome.exe	105
PID 3760 wrote to memory of 4184	3760	chrome.exe	106
PID 3760 wrote to memory of 3464	3760	chrome.exe	107
PID 3760 wrote to memory of 4184	3760	chrome.exe	106
PID 3760 wrote to memory of 3464	3760	chrome.exe	107
PID 3760 wrote to memory of 2864	3760	chrome.exe	109
PID 3760 wrote to memory of 3392	3760	chrome.exe	110
PID 3760 wrote to memory of 2844	3760	chrome.exe	111
PID 3760 wrote to memory of 6068	3760	chrome.exe	113
PID 3760 wrote to memory of 2180	3760	chrome.exe	112
PID 3760 wrote to memory of 6068	3760	chrome.exe	113
PID 3760 wrote to memory of 4872	3760	chrome.exe	114
PID 3760 wrote to memory of 5356	3760	chrome.exe	115
PID 3760 wrote to memory of 4360	3760	chrome.exe	116
PID 3760 wrote to memory of 5800	3760	chrome.exe	118
PID 3760 wrote to memory of 1140	3760	chrome.exe	119
PID 3760 wrote to memory of 5184	3760	chrome.exe	120
PID 3760 wrote to memory of 5184	3760	chrome.exe	120
PID 2844 wrote to memory of 124	2844	PcAppStoreSRV.exe	125
PID 2844 wrote to memory of 5460	2844	PcAppStoreSRV.exe	126
PID 2844 wrote to memory of 2648	2844	PcAppStoreSRV.exe	127
PID 5460 wrote to memory of 3888	5460	PcAppStore.exe	129
PID 3888 wrote to memory of 2580	3888	msedgewebview2.exe	130
PID 3888 wrote to memory of 1156	3888	msedgewebview2.exe	131
PID 3888 wrote to memory of 1156	3888	msedgewebview2.exe	131
PID 3888 wrote to memory of 1156	3888	msedgewebview2.exe	131
PID 3888 wrote to memory of 1156	3888	msedgewebview2.exe	131
PID 3888 wrote to memory of 2544	3888	msedgewebview2.exe	132
PID 3888 wrote to memory of 1936	3888	msedgewebview2.exe	133
PID 3888 wrote to memory of 1936	3888	msedgewebview2.exe	133
PID 3888 wrote to memory of 1936	3888	msedgewebview2.exe	133
PID 3888 wrote to memory of 3900	3888	msedgewebview2.exe	134
PID 3888 wrote to memory of 3900	3888	msedgewebview2.exe	134
PID 3888 wrote to memory of 3900	3888	msedgewebview2.exe	134
PID 3888 wrote to memory of 3900	3888	msedgewebview2.exe	134
PID 3888 wrote to memory of 3900	3888	msedgewebview2.exe	134
PID 3888 wrote to memory of 3352	3888	msedgewebview2.exe	135
PID 3888 wrote to memory of 3352	3888	msedgewebview2.exe	135
PID 3888 wrote to memory of 3352	3888	msedgewebview2.exe	135
PID 3888 wrote to memory of 3352	3888	msedgewebview2.exe	135
PID 3888 wrote to memory of 3352	3888	msedgewebview2.exe	135
PID 3888 wrote to memory of 1188	3888	msedgewebview2.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://pcapp.store/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffcfd91c728,0x7ffcfd91c734,0x7ffcfd91c740
  2⤵
  PID:4116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1940,i,8498264422046378276,17046717977556298654,524288 --field-trial-handle=2020,i,7795029762430520923,11788465853779114576,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,5256957662550708486,4171765545732681180,262144 --field-trial-handle=2020,i,7795029762430520923,11788465853779114576,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,4557335159102454449,14716250551664726857,524288 --field-trial-handle=2020,i,7795029762430520923,11788465853779114576,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:13
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3168,i,1828504762338630434,15755482343821442551,2097152 --field-trial-handle=2020,i,7795029762430520923,11788465853779114576,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3172,i,1190227621283585498,4262019110705888094,2097152 --field-trial-handle=2020,i,7795029762430520923,11788465853779114576,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5344,i,16070732950432532865,14642863298684277867,524288 --field-trial-handle=2020,i,7795029762430520923,11788465853779114576,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
  2⤵
  PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5560,i,17864138996433934346,3480548403864347966,2097152 --field-trial-handle=2020,i,7795029762430520923,11788465853779114576,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5600,i,1339142399503547589,10721481808614723099,2097152 --field-trial-handle=2020,i,7795029762430520923,11788465853779114576,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5552,i,1230884151998573658,7520979150545587852,2097152 --field-trial-handle=2020,i,7795029762430520923,11788465853779114576,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5408,i,5648433011021232452,7738442368433152340,2097152 --field-trial-handle=2020,i,7795029762430520923,11788465853779114576,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5268,i,16370997885369429309,2896781002061612718,2097152 --field-trial-handle=2020,i,7795029762430520923,11788465853779114576,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5760,i,12389323686997194938,307684155734896119,2097152 --field-trial-handle=2020,i,7795029762430520923,11788465853779114576,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5612,i,16158046004901538440,11039106894522554871,2097152 --field-trial-handle=2020,i,7795029762430520923,11788465853779114576,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5320,i,11766163720922017864,10746422096354426475,2097152 --field-trial-handle=2020,i,7795029762430520923,11788465853779114576,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,516253712969054050,10488685020949408233,524288 --field-trial-handle=2020,i,7795029762430520923,11788465853779114576,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
  2⤵
  PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5660,i,14168410048146944398,7175856140994794084,524288 --field-trial-handle=2020,i,7795029762430520923,11788465853779114576,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
  2⤵
  PID:3392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,14365466048306123332,6786369099866567193,524288 --field-trial-handle=2020,i,7795029762430520923,11788465853779114576,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
  2⤵
  PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5856,i,1246700465903545993,6474799865133872662,524288 --field-trial-handle=2020,i,7795029762430520923,11788465853779114576,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
  2⤵
  - Modifies registry class
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5560,i,1423478648040325835,4182507532843922464,524288 --field-trial-handle=2020,i,7795029762430520923,11788465853779114576,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:12
  2⤵
  PID:6068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6240,i,15693791756242838638,15300425048774345386,524288 --field-trial-handle=2020,i,7795029762430520923,11788465853779114576,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6212,i,4165732684014931236,1121723612572117839,262144 --field-trial-handle=2020,i,7795029762430520923,11788465853779114576,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5356
- C:\Users\Admin\Downloads\Setup.exe
  "C:\Users\Admin\Downloads\Setup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4360
- C:\Users\Admin\Downloads\Setup.exe
  "C:\Users\Admin\Downloads\Setup.exe"
  2⤵
  - Executes dropped EXE
  PID:5800
- C:\Users\Admin\Downloads\Setup.exe
  "C:\Users\Admin\Downloads\Setup.exe"
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4572,i,3094854256651369303,18365826371894660564,524288 --field-trial-handle=2020,i,7795029762430520923,11788465853779114576,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
  2⤵
  PID:5184

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4620

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5112

C:\Program Files (x86)\PCAppStore\PcAppStoreSRV.exe
"C:\Program Files (x86)\PCAppStore\PcAppStoreSRV.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files (x86)\PCAppStore\AutoUpdater.exe
  "C:\Program Files (x86)\PCAppStore\AutoUpdater.exe" /i /step=init
  2⤵
  - Executes dropped EXE
  PID:124
- C:\Program Files (x86)\PCAppStore\PcAppStore.exe
  "C:\Program Files (x86)\PCAppStore\PcAppStore.exe" /src=installer
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5460
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2048 --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5460.4728.4109116927405068366 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6
    3⤵
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3888
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" /prefetch:4 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffcf1b65fd8,0x7ffcf1b65fe4,0x7ffcf1b65ff0
      4⤵
      Drops file in Program Files directory
      PID:2580
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2048 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1780,i,9554093819856133530,7502957872270931164,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6
      4⤵
      PID:1156
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2048 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2192 --field-trial-handle=1780,i,9554093819856133530,7502957872270931164,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6
      4⤵
      Drops file in Program Files directory
      PID:2544
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2048 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2440 --field-trial-handle=1780,i,9554093819856133530,7502957872270931164,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6
      4⤵
      PID:1936
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2048 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3316 --field-trial-handle=1780,i,9554093819856133530,7502957872270931164,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6 /prefetch:1
      4⤵
      PID:3900
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2048 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3964 --field-trial-handle=1780,i,9554093819856133530,7502957872270931164,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6 /prefetch:1
      4⤵
      PID:3352
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2048 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4668 --field-trial-handle=1780,i,9554093819856133530,7502957872270931164,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6 /prefetch:1
      4⤵
      PID:1188
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2048 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4912 --field-trial-handle=1780,i,9554093819856133530,7502957872270931164,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6
      4⤵
      PID:6484
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2048 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4840 --field-trial-handle=1780,i,9554093819856133530,7502957872270931164,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2104
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2048 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4872 --field-trial-handle=1780,i,9554093819856133530,7502957872270931164,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6
      4⤵
      PID:6652
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2048 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4948 --field-trial-handle=1780,i,9554093819856133530,7502957872270931164,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6
      4⤵
      PID:6184
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2048 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4264 --field-trial-handle=1780,i,9554093819856133530,7502957872270931164,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6
      4⤵
      PID:6552
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2048 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4860 --field-trial-handle=1780,i,9554093819856133530,7502957872270931164,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6
      4⤵
      PID:1880
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2048 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=5112 --field-trial-handle=1780,i,9554093819856133530,7502957872270931164,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6 /prefetch:1
      4⤵
      PID:6440
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2048 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4228 --field-trial-handle=1780,i,9554093819856133530,7502957872270931164,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6
      4⤵
      PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.gamivo.com/product/call-of-duty-warzone-500-points-xbox?glv=ipo2oh6a
    3⤵
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:3756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x31c,0x7ffce89bc188,0x7ffce89bc194,0x7ffce89bc1a0
      4⤵
      PID:6452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1936,i,7298782885312446305,313179748524944502,262144 --field-trial-handle=2416,i,4988964091566526202,12929035068517530438,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:2
      4⤵
      PID:2528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,18094609692562512651,591250808377872760,524288 --field-trial-handle=2416,i,4988964091566526202,12929035068517530438,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:11
      4⤵
      System Time Discovery
      PID:6508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2680,i,5938639110238913535,8307966809142456325,524288 --field-trial-handle=2416,i,4988964091566526202,12929035068517530438,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:13
      4⤵
      PID:3056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,12381901192101631394,884209709996109309,2097152 --field-trial-handle=2416,i,4988964091566526202,12929035068517530438,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:6796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,17643581293536928292,132540800659145065,2097152 --field-trial-handle=2416,i,4988964091566526202,12929035068517530438,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:3080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,7002309648375090264,11829872001549655803,2097152 --field-trial-handle=2416,i,4988964091566526202,12929035068517530438,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:9
      4⤵
      PID:5700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,12837101015713758464,10029139893236697275,2097152 --field-trial-handle=2416,i,4988964091566526202,12929035068517530438,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
      4⤵
      PID:5052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,4233971250965578403,6458965798213874900,524288 --field-trial-handle=2416,i,4988964091566526202,12929035068517530438,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
      4⤵
      PID:6284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,11230251229834444561,2160733250128665603,524288 --field-trial-handle=2416,i,4988964091566526202,12929035068517530438,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
      4⤵
      PID:6980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,14971533684189485495,764096999605473709,524288 --field-trial-handle=2416,i,4988964091566526202,12929035068517530438,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
      4⤵
      PID:2084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5924,i,3293362651536644203,10206382988697149357,2097152 --field-trial-handle=2416,i,4988964091566526202,12929035068517530438,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:1
      4⤵
      PID:6632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,1792849328478906270,2861972388452902374,524288 --field-trial-handle=2416,i,4988964091566526202,12929035068517530438,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
      4⤵
      PID:4140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,1792849328478906270,2861972388452902374,524288 --field-trial-handle=2416,i,4988964091566526202,12929035068517530438,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
      4⤵
      PID:6724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6476,i,1386443176136508867,5025571366742858019,2097152 --field-trial-handle=2416,i,4988964091566526202,12929035068517530438,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:1
      4⤵
      PID:3296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,7558470616625368391,2324824559144546208,524288 --field-trial-handle=2416,i,4988964091566526202,12929035068517530438,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14
      4⤵
      PID:6364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,1573608050590699765,5244406626270051041,524288 --field-trial-handle=2416,i,4988964091566526202,12929035068517530438,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:14
      4⤵
      PID:7164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7412,i,16236317459736653624,5630952143671159383,524288 --field-trial-handle=2416,i,4988964091566526202,12929035068517530438,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:14
      4⤵
      PID:6280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7364,i,14634382684068938645,9617118708690429477,524288 --field-trial-handle=2416,i,4988964091566526202,12929035068517530438,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:14
      4⤵
      PID:4724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,2119003504144421643,10481340190687993196,524288 --field-trial-handle=2416,i,4988964091566526202,12929035068517530438,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:14
      4⤵
      PID:1408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,16660979337063337084,14328661078268936854,524288 --field-trial-handle=2416,i,4988964091566526202,12929035068517530438,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:14
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,6590849436781962509,2172305526726235377,524288 --field-trial-handle=2416,i,4988964091566526202,12929035068517530438,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:14
      4⤵
      PID:1320
- C:\Program Files (x86)\PCAppStore\Watchdog.exe
  "C:\Program Files (x86)\PCAppStore\Watchdog.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2648

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:252

C:\Program Files (x86)\PCAppStore\PCAppStore.exe
"C:\Program Files (x86)\PCAppStore\PCAppStore.exe" /src=shortcut
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AutoUpdater.exe

Path C:\Program Files (x86)\PCAppStore\AutoUpdater.exe
Size 1.2MB
SHA256 445041706617d6eb7997858acabd85954bc62d12b96cc2b7dfc9ed4cba8ff97e
MD5 7f35ed59f7c305ca4ee5047a7cdd7f28
SHA1 8f6ad323fecac6a961c0187b44f2803baa2e85ce
SHA512 d581f166862b1de4b723373727721dbc1870525f26a2b3d5cbc290b394c483cc5b086b105addba3c4d0e05fe0a27f3f9718dcebd84f8ed12ec6313e65a2aa87e
SSDEEP 24576:idl68MtdeqT/jpa/0tMKWgdJmP187CeYuqtnoz6b+Z5Ath0lhSMXlq4yuG:idlbnoeErG
TLSH
T156557D1A96A442F8D0FAD27CC656691EF6717C46837127CB0384B9661F377E0AE3E702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PCAppStore.exe

Path C:\Program Files (x86)\PCAppStore\PCAppStore.exe
Size 5.9MB
SHA256 c83e1602987aa76ef2b68b8f9e6d8bdcd5f61e7fc2caf09e00c2b84fbce105c0
MD5 e8940f8f5797437ec9449287f493e36b
SHA1 53382ce29ed67e95827d723295b2000917a20562
SHA512 ea668e6799a0267a567125b3ae9e59eb5b32546399a53d7c70147f68727b4b6c3df60051b021587863a50b900db72c0d668495d8de080817830ae50207d42178
SSDEEP 49152:gNEDnpPQbHt5bihGUvQugvnl8L8Dv1wdNtWiHFr4ZZhyh:gNSQHofvilkYMpin0
TLSH
T19156F8AAD67641D1D4FAE034C662B22BFC713C5EC230A357A741AB576B36760E63E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PCAppStoreSRV.exe

Path C:\Program Files (x86)\PCAppStore\PCAppStoreSRV.exe
Size 841KB
SHA256 fcfb9c5cbd2daea804c875ddc861baa4883cf3de97f5cf656e49bb964960e4f0
MD5 1eebb5411c4cca0687e1112123921789
SHA1 137b2c35ac3a50f93a852a2bde734f8c5f89de27
SHA512 52271cd4678b7a2b9a893606a06b0b5e8bd51d6dce283e3f7cf9c2eb6c997732411d4877c4cab5213c4baf218f6c985111b8812e69fa0cd58423d5765fc07252
SSDEEP 24576:J/m/bETyyu2LyLbgS1ptVh0lhSMXlm++k4h:I/bETyyu2LyLVtMmk4h
TLSH
T104058D1AFBA942E8D077C178C992650AFAB27C5A436167CB0391796B2F336E05D3F701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1ba177f5677748af1a9ed18f18d5558bb33214bb857d6f1ed891118e1484f107
MD5 4b2a79359986de76ec5c852c2d07eeea
SHA1 c00a20ec7d2908c21e8a20a6fce5b198bab29117
SHA512 fc66d2ea2e8a971cfa36cc3ac0a8bb4b3c8466557e69a18083094263ac7bc646b896fabb722899ccd2e8fb0fac13789194fe0cc65b09080b02e1a66d6f935304
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 dd82616c935f35b938db4b657cb3f7f102f7aa51cca55e4cdb4e5e51191e7ae6
MD5 1549183d64b908956c855c901d181903
SHA1 343ac4845681b8bc077950c74fdede4c994165eb
SHA512 19b240e54666cf7dc4cc2a17d1376d3cb71aaa8630ca14da9cb7200ef9890ed2ff20c3e1b78252269cbcc0081b882bb4dfac6982185122307af5e58e1d89c552
TLSH
T1A3D0121637020578C1103073010362080405C20F40064106583C996D2A441A00907491
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

f_00000e

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00000e
Size 173KB
SHA256 3342c8d555b71d1f86fdf1c2655bccdda4a19f9b0eedd3005c178907a5360523
MD5 eb821756e55483e6e2486c7f35ebdbd6
SHA1 c3ca884df6eef8b2e01d56837756422794081c83
SHA512 93381b1c428eb3748a3c2afb80a919e8988316a2835072a1a6b7e5473189f89b92922096d563e8a5f8ced3ab52d9fdca81e6debb132d82ed18afa9d036c1224c
SSDEEP 3072:NH49EtrmyTkVCpSFhBu7+SybjwaSrIp89YcGAsN5ZpToEhqW5rCmZZAVfey+ZCkJ:ByyoHhavswaSw8aAU6ErLZ+fcCkQfrYP
TLSH
T14B0412D1B5B2E6B8E9885F7BC3181DB9CE93B82D7414918C5FB52713F60483864A3E63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000012

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000012
Size 869KB
SHA256 0cb4bc6bfeb778bfe5bc5753ae10b4a2dbb5c4ed3393b1998e4af853d1ecf041
MD5 56503edee2661dad1a2b1d166db53b3b
SHA1 9a6a8cc2e7cf967b51fd06d677658bb7cdb09240
SHA512 faa5ad0a152ce6dd87ad1696ed0973fb6edd239c53bb490a33b65b88c0fd760635b49f239c0fd74b51be2c44c4530550338abb60fd017a688de13d62161c2a4e
SSDEEP 24576:67ptq71dp+pfMycIowww5jKIBHH28d7sNzEXa:UOpdpOMycqww5jRZH28d4NgK
TLSH
T1581523EDD124E608C7267C7ED712242FEA8611A5B7EB739C3BD8BD4BD2150792663023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000013

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000013
Size 1024KB
SHA256 12ab7c7786f1c72a2421326ba46d696073567751fbdd4d7ab5eb9c80ece2a1f9
MD5 9a65a3c6a969ceef2bd214693bfab271
SHA1 3579d52378cbdea959f9ac9d15ac1f0a4c025e66
SHA512 bace16b436c2292db6f3999ac5b3e377cb6eeb468728471a3a1022671d2e192486d92495d211a138d89840feb245cb40b9d5a215659555fe09d1e16931c9b8eb
SSDEEP 24576:xF8jqnI2qpMOlRUD5eyP1do/5CXRV8PjXbyWdM6g1YG:xF2v1lRYDPtRMLMFJ
TLSH
T18C2523CA8E75E340C3C4D875C79755BE8C29845EFFE8BA588A761CA3EC4568E3A04C47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000014

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000014
Size 208KB
SHA256 f21583b567aa75a6ce423887f9d2c9c1349724f1f13af571541853b021a71898
MD5 84178daab91c17f08fb97084011b3947
SHA1 5c54c1841f5092c9c93e5dbd487141ac4c9a7b44
SHA512 26209b65a26533bb83d268fc981d6d54a77418977c435e3645e077b3ec225b82ec6ea5ae3c2d0296ec5583fae4627c18840687d39f4ad54d8ecdb5d66ce018d8
SSDEEP 6144:sYTGCRVTlB7fd3jJ+v12mfVFqYg9De1e1:5GMVlBDd3j0EmNqpe12
TLSH
T1CE242332ED4608A08778A519D30E99CE81972448B34B382E8B51F9DF4D1B74DB67FF4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000015

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000015
Size 197KB
SHA256 3e7a7d1a348094a41facdf7f3f70c4fd00c3ed87bbcdd92d381d3bd6533795de
MD5 bfc3b39293dced7d85366d56b13f147c
SHA1 3737874d0d6532bc63c9898bbab1617ca1991e04
SHA512 06beb751a321574918756c1ee10e8e5b9614f1ae275899876e5671eae326f57d79be4c10714c294340213d5e23a0257b10f1d6e683a294c2ee0e7dc521e353f8
SSDEEP 6144:/Sb7irErFnRvvC8/Gn1vi1CImcOcG/Ak4RASSF2i:/SHiwb/Gn1q1CIm+iz4RASS2i
TLSH
T127141241EAF7799AC89150F1F10982ABF1A1400172BC63B3EF849F21CD3A59D97366DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000016

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000016
Size 1024KB
SHA256 b072dca0169f05ef8e595bd9a68ccf9d05aed396eed6f6ee7036b05cd1115ad1
MD5 ff849ac009c96e864e79846c007f8825
SHA1 9f1612e2c2ec5dd1bbaedeb6929e197e71445a92
SHA512 a790fdbab2f2ee8c923a6fabb0187b50cbb3e08a95b0dc7057f74a3b76354b2937c1c6c2331d1e27304464db6cfea0dc971c84bd3d649e1673225e67fb1f1e4a
SSDEEP 24576:neH341Gn4ZNYQU0GZ5IeYl4KqPWbg1Q5oHu19zb/gRBEG:eHDn4C0a5BYlGPWkmL9HM
TLSH
T1632533045818EA4FF192C77FCDEA396DB83A8BBBA6553415C762D915E01B9F82133C83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000017

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000017
Size 1024KB
SHA256 08a437008e775b1df11703a7506f3f6be71e879def5e0d9b43fefddd5fc74333
MD5 624097deed4d594c88b70b15f06d8b79
SHA1 f6e56af7a074a8a5797a2dd814aba19499f5e048
SHA512 c151b6b6f9898eba2ea543ec548f0038cda0b2ed3071ced695d73b46ac54e357aa09ed141b1336b7e1fe465df8444c5b3a6fee2b23dd96b0597be0e863190b34
SSDEEP 24576:g+l4k7D6/Wwq7FYYmVDHvHUiNXYtfljiDXpMir:guH4WHylDHbX2fljiDJ
TLSH
T1292533AF3170A1BADA4E1C91E75AF3BCBA34E80D60A671311F8670796802F757C5076B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000018

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000018
Size 1024KB
SHA256 fc39f8df736086d41a55e34e8c12384f1adfa6e6b9d59aa1bd10f9da35944e45
MD5 d15d71b9919ebfca3dcf44e076f5df29
SHA1 c5cec4fb09f338a5dfb34df2d289fb3d2ef928c2
SHA512 d01bb1752bfcb83041d530427cc10ec344f238bcc846981e679d61681a933b45f7a4a2c2e77f7977134e48c8175407b23878975aba71cac2089d8c6b14706d9a
SSDEEP 24576:3xpgTdzXYhvOoKovYeio4Fix/DIRSdRgq7TrVye:hpQzIlOKF4FC/D3RfR
TLSH
T18E253377E1C2AD33D92602D1FBD4282AB81A7EFDCF652D640F51AE24B33E5C51A07066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000019

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000019
Size 1024KB
SHA256 a1b64ebdff6d6574291cc61f2f9a7faf5262f276af2725448f5543b4026bf9a6
MD5 015eed03f7d79786e1d8adb1c8dcc5d7
SHA1 68a963c10556e0ae212b15b4ff8bb6964fa1c95a
SHA512 7d23de42b7fbfab4fed13a212dd1d7244c88b2531ed87c76dbac3dfd134a313ba16358a4459f9cc27620f6c9af07e7de3972f34e3d295da25dcb66175d3e7c6f
SSDEEP 24576:+BUC89yjjYTGIj6fjAMC/f86UqSAFfdrsHjlikSV3UM4KN:+BWyYxmjAH/f8xqS+Ghi7D4G
TLSH
T1112533E5D4151C2E25E9E225FB447C3CEAD2D4A296CEF21B2AC7476FD0292E7B0112F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001a

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00001a
Size 1024KB
SHA256 b7fd9914b3e2955321fe891fd41b54a690303454f2cc2a2d8800badac856f076
MD5 32ab36f76feeabefd77c10fc182fe635
SHA1 36df3f8c3ecc5f5cfafe9d435a1c6b8becdc7539
SHA512 1e15e8e620eb16bfd99151b1512201cb6af738db79d52c29ab80f8c5acf1397787de036ab8524b8141760d921d9574c41bcf1b5c0e7120de4664b89f1c072d71
SSDEEP 24576:F30A6COH8k6XNyxj/XGj2BIYCRtBMYJKx86tvD+po3aBPh:Fuyyxj/XSFtBplkEoqBPh
TLSH
T1452533AB47A6A012F15F0A62D36617B9D27C3B2D0A036924B32C6316C53B54EBC7B4D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001b

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00001b
Size 34KB
SHA256 e778ed66ff343e4f196118c8b4bcf4f37e6a589613e399e8678f590a2118504a
MD5 4739cb32ebb882bfb0b4ecc59c18e8ac
SHA1 9136052c5a53281a7fb0ea326c7ca24726d16cb2
SHA512 7b2e9c827a742b4490ca6ed4d63b1bf6bf859eb027bf6ce9f48618eeb7c0f18bbc35d4a4eeabc94768b31cb92cfcf3af0ee609d077b4b619d2c50bc4bce6ad8a
SSDEEP 768:ZPqJ54eMVLE6Uv08PPxrYntosdXBxhUTIJs/7TP+vLYe6OKF:g5zMVL38nB0ntoShUkmf+vLYehs
TLSH
T12CF2E120FD39F1E14D128A641AC62A43DB5D9AD743AF7EB04585D48F2A36DF408CC37A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001c

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00001c
Size 185KB
SHA256 a898ed47931b04517ac1cb5b7ce4ad816d00058cff91833c2e2543550eb41acb
MD5 57b8d1625162a4599d11321a98740a88
SHA1 f706662810e7b2277007814b9b45d077770d2ede
SHA512 69363e0c5cbc4816ae978ef53814dbb3ddfab78411e0179e2022102c95bb90872146df2b22af1dade1642cff12a2b9571f7f86f1dce944248bd88ebd788d33d5
SSDEEP 3072:6WZe2Zieecm7Keioj54jSHrRaqUJ+F9lxwVFXUqMtJ8l5uYFoW+gs2yEkw5XJ6sJ:6WZe24KXzeAL0vlaVFCizp7rnNJp
TLSH
T1FD0423E40F72733ADB1E75B6E7281D4F26A1B145B0E75952EE0A4E23EF8E22C4204257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001d

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00001d
Size 130KB
SHA256 7cbbc0fae6e79216108aa4e361cc6a95ef9192f25a9f289c9181ed4cd4bf967b
MD5 f5ebc68c41ebe3c64f803138b66b5091
SHA1 471125e04233e64f59cf891ea56a7303c7a082a0
SHA512 1ba88e7a4902c17662923dab0934705f7abe3e130c41e416ca21a94be3c357924aedafa046a2af6c94f51be7a573a3c3c65332c8abbd7bae2119d1ccb28baa66
SSDEEP 3072:zbLYun51nZ0KOvLvQHP+P5vdVXDNRRzT4IOfk1i:zznfnZ0KOvLsUvdzRRzTX/M
TLSH
T1A7D3016C46B2F5EAC54B0371D253A66EE70F01C310317826EF6809E5F8AA7DE742785B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000022

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000022
Size 36KB
SHA256 6986b9e1eb4045ddb237711741a4c45854a29381e55dcb0f545a7e674ffe777b
MD5 7252da6cf7f0a12dd1174f5f3eae28f7
SHA1 2976d1a0955e2a366d666a3f90233b1c43f680cf
SHA512 a93889e5bda7be8291d21ac85060535086f1b0279c619499dd33b3eee3501e74aa4c619cee9666bfed97b0cea01cfa27e6aa7350c71502b3c94e35289ae28970
SSDEEP 768:OGuD34JFBt/HHs2hGdN9waKutxbtTovMHmQhWl8aX/uN9Lt:OtDIJF3/HFOuut19oCTsX85t
TLSH
T1E9F2E12F9E53857EFD8789671B88B1ABDB8427916500B91039E1E393B05BC6D4344F2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000066

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000066
Size 1024KB
SHA256 2df3666da3a6a361d008b404b7c34af86cefd17fd592558fe71bc9cf6525bfda
MD5 8578f44b828911bfe7d7c62fe122ce48
SHA1 5e7e7d51b53db40e284a43494e2b25ae42b7f41b
SHA512 8bd7c96c3a2e7e319f45a14b2c44c0fbf9d40297a5609795ff959a926ebf114f3cde32b57c48f37dc74e790ffe330403c087ccd78053eb6595b607be8df7ad4c
SSDEEP 24576:jct1AAuwmQav2fBRH5cBKCsK4MCPwZ6RM:jcTAWxNBPcB8psV
TLSH
T11725239885D6A4B7FE4A00B8CE6FB7CA1B1D344656789419C5B0D1D0F846B8F886F2E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000069

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000069
Size 412KB
SHA256 2f165a97456f0b3214830cc9101c077b92741841237d423926ad24eb3daa8921
MD5 518fc1ea6c3517a10fa5aaf6a7de4df6
SHA1 f0e560f5053c5c3be67b4d27cbdef8d109f4791a
SHA512 1b63920191da0758365faf4467ee601e5df01c59d2a1fc3c9b1d732d9a6b1e09e10894a5223fb7b9228cf6937b1a881fa7e970bb9392592459a52078778ca5c8
SSDEEP 12288:fhDqOaOsoh8cfe2l31xUS+4WQp+WmygAARx2ddPh:8Csqjtl3TRWQYly3AL0dJ
TLSH
T1C594239E8B4A9DD2F4010379C2AFBF46922849853A35C138C935DCE3CD857A29D93D9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 09261f6048b3b4f1b6559a3041a83a162b41bdf9185584b9a45e28c0ae052194
MD5 f88e9d44b15762cf990e87e24341a339
SHA1 1c078e6630021242dae0b0c98f7ad083b5622434
SHA512 56cc3d78bfc324f9016d102ce6a3fb0eeadb897f18ff0788a4bf7f268eeebc5a114aea119d57fd4857a72fa6240173ca0accf457776b90109191595a7081d108
TLSH
T1B8C09B15C84F7041C7D65F705BED0D49757715D101573B1140645D7CC811340B1535C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 312B
SHA256 7f28b625e89d1c9db6a75a482d2c76c41692fe5c32089ea98efe6c6e373cbc15
MD5 994cb296955bcc69d3c4e613eb8bddd5
SHA1 7a151e022e552f8b9a3daa0831d3040d27ca48a8
SHA512 51df720da3f01ff073780a4e32f4ebeccf528ac05508d83713196ad3e0005fdd7ff72f1292f7d80d9f178a205a760dcc9b2de913d05a10a8bd6ea841f3a5f508
TLSH
T150E05E0A808F6001FB555FBA26CD4F48B27B547102175F2341581F3DC922785B802AE1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 3639fa26ff4820b4ec7666b1016a3de67989d2d7114d87a5edffe7d5d4532dc4
MD5 1c0d35d9b68223b59fc920a7f4481ed8
SHA1 41974f6a788d5705c5efe119745104564bd92f3f
SHA512 ced7055c9b298da5c8d91b5610227c1d4fb118e09149233c62ce7824e479f474f0117e37a251c9236e255e6a479163a7046ab741ff950344ac69c0bc4a0cced9
TLSH
T121E05E0B40CFB102EF551FB966DC4E58B2BB847202176B5B42440F3DD9627A6B9467E1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 27cb84545d534a0dffe86ff9bf50b0d64941d8d1bdb0e06c1f7fb011e59e19c9
MD5 9ce477e8fa047759ceab7ffaf28a44b5
SHA1 ef578d3ca87399887610593f6bc10880fb8ebeb1
SHA512 849ece4a63b534e68685c08674a8cfbe813a31a54563d7aadf75b42b79e2ecd7968d2ff856a04ddd1ad2c9bde25e6fd8efdd31b18218aed1e620192aa0ab86af
TLSH
T143D01252808F7002CB9A1F3A6BCD4F4C71BB55A0014B2F238098597EC820B85BE132E8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 456B
SHA256 c47e0e6ebd55712550a130a25770965806b349adcb54cebc04d66cf851600bce
MD5 32a6cf86a22f98bf29118882da4763da
SHA1 46669bf7d8b8fff9450fdd9173d82169d58afea3
SHA512 120f7bcf9ca742903369c2e2cc1d06a71a9fb2414fa3f4e3dc1d77264c0bb9c035e883f297c0e63bd74092af61a4f8e948a260dcb28873a6ea1ed8751bad0560
TLSH
T11AF0D82744CFB042FF411F7956DE0E5876B7507001139F1342443E2FC4233907C461A5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d0801.TMP

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5d0801.TMP
Size 48B
SHA256 3b7150f796f6939d9f52231b75472b1f9bccd1f87abd4e963e46183cb03e33a3
MD5 00ae8f605f85fd2891e0bb69972269de
SHA1 96f395826566118775117e2cfce45419cc53bf7e
SHA512 748779f3c0bbc6c601315bfa32f8a5b3bfefa40e2b1054dacf60556d0f1e3403006970680c91c60062b74ac34574d1e848490a233cf7497132224b42712372dc
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 a12ac11347a50555f81f0d68e330879569e557bbc5c45ab8fb152e669df29b0a
MD5 41ec225be5d2e5fa80cf789bb7c0acab
SHA1 628dae4645c176d8a47c8181315b154619ec8749
SHA512 de99ee8f474079f6ae709ad7325e24d1b60d8c3170eac15cea250bbeebe2dfe4a23836a5aa6d5a81cfa18aed3a24e4978775ce47c0fb8e7e74f156c0564b9020
TLSH
T179217CBA87E4C97DBE8121F83A662D1BCE5D1521035C6B76C5E17F7A97E1860E30060F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 920be07ffda4cd3eb54bff8f63f66dd42bb3e4c047336549411a0c5db45c382c
MD5 6132189590fd536dffaa7105b791a6b5
SHA1 70873d06a77e82510f37788d0498eed1b7cd785a
SHA512 fad3f648cdb313e4b09e00a550fa6caa9d1743841b15ebd1b4bb459b4aa0799f06a43431e200f63162e3cf6cdf27e44ba35a70741f732eff024d423c493e7ec1
TLSH
T179317CAA87E4897DFE8162F92AA52D1BCE5D1524031C6B36C4E17F7A97E0460F30464F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5cda2b.TMP

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\Network Persistent State~RFe5cda2b.TMP
Size 84B
SHA256 712196693e3527ac1131831f1a2108b6c0e5c68967b26d51a452611cdfb86e0c
MD5 32b9dc9cc81d0682e78627c873fdd651
SHA1 46c486386d3e153c3e9b11d54cb52cf0064b71cf
SHA512 f18bc37f8b72411548da247aa1394cc5ac03c3bbd98e82eb8ba290ef239ef5b8625cf4835bd41ce7c52766d0bc3bfe9150dd22dbf62f0f05992ddde5fbfdc811
TLSH
T154A0121490405CFB0308835504146463C3F50002421848A91634318D019209D0004403
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\TransportSecurity
Size 690B
SHA256 ec6c82d967109b03f54bde91d6ba45a4713afe68bc004643fd65f8fa60205d2a
MD5 67460fd91126678a383a049c85018203
SHA1 5fd7fbe3d839d73a361fa87c70f06b322b571a3e
SHA512 7e7a1ba87f6c41254b1cafcfd163c205de72a1cef623d1e840ebf60f36bdaaddbc4fa392d124778a84996cb445b10d52b114ff945ffa77c94a76f116385d22bf
TLSH
T18D017BB380FEF53B5079597F1D92BC012BBDA93050A298F5EA93562DB0456F72B13022
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\TransportSecurity
Size 690B
SHA256 12dd20a7d1573c07cb2731e525e6ee320ee48e7a79a7244b2e78ec30e5926967
MD5 e09e2baae90e8d94dbcd18279fc44288
SHA1 ea2708892b48c1762cb79928b8d869e3a096ea76
SHA512 7a1860e76004244d0e79188d8eff9d02dc3accaa09b526fd33f8da3f96cdb313b909cf27e7f1def7d6c76a413a0d15f5db1282853e48070ca0e64c223a2aba04
TLSH
T11B017BB380FFE93B5079597F1D82BC012B7DA93061A298F5EA93562DB0415F71B13422
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\TransportSecurity
Size 858B
SHA256 f2bbd39823ae2d376adea6126955c00435c30d546a788f608629c7de00426fef
MD5 8577dcaa00f92be75207bcd9841b32bd
SHA1 6f0385ad3db3c1be310e17b75e0a6588c5c2472e
SHA512 9a794622823359e48559f81381a23809f0a4c0eb657495485585f33c6712eacfabbe9e94c6e918542f84bd63d6cdb8fd4c375f3b2ff7a7f80414b5c85370992d
TLSH
T1AF114CA781BEF42B5078986F1D86BC062B7AA9305292A4F4EA93866DB0816F71713412
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5df427.TMP

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\TransportSecurity~RFe5df427.TMP
Size 690B
SHA256 3798ef9547820901483616998db91a29e7593abc50b40e28dd6031b070a3434d
MD5 1e303772fc060ce0573fc05e863d21e0
SHA1 7a9d5abd73bca07d44f91cf26139cd2563a4545f
SHA512 e76a0d4312718f9ef8f1ceae4bfa00529adb172fd94abcac94f9da9632bfaf62fa506c09476693b2e49d086de38607506f2ddac168d956821d21c5b2b1579ce5
TLSH
T118012BA381BEA5376078596F1D57BC011B79693061A2A8F4EA97512DB0454F71B13832
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Preferences
Size 6KB
SHA256 c80f60fc290b2ded58b8c2117b8d183cd11b0dd14f62bd1d2bd249baea1c0a9c
MD5 ba982a9f74368525e3927f727325471a
SHA1 d9f5a70279d950b64f1042caa6cf12c1c0a9d581
SHA512 44bd51874bea63850017d134ba21d6866fc1229a864ff7f106bff3a46566d76f68037e75f2f05ab90a10779c164810c26255b8a7af431a6e46bd4ab08502d236
SSDEEP 96:stx/db52Bb9Hk9o52t16ZEFCs7/x+6MhmuecmzIU1oMrMkkjeRK+gf328XM1C7jL:stlBsAoe4sV+FaMUSMrwjndG6v
TLSH
T1C5D1B7125E28797B4CC6F119BA29BA07E3F5602265D05E58EBFC862C04DB6DC631780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Preferences
Size 6KB
SHA256 d72fc356def6648c8b3227d7295e0f33b53cb7abea2c08f5f7e8d36583348910
MD5 28791236f2296a3d6355cc2a82e2637d
SHA1 7365fbe240e3a2d735404ce7d9d1fa8294238f08
SHA512 ba6b034e86ca4cf127466844258dc08fbe255869e8f0d176e22e45499406c1e6346be8796737d61e9de91e072dfbe2f70d537f84a240996c03b59d9f9c76217e
SSDEEP 96:stx/dZa52Bb9Hkqdo52t16ZEDHCs7/x+6MhmuecmuIL7mLMrMkkjeRK+gfk28XMg:stlysroeDisV+FaPLyLMrwjnGG6v
TLSH
T1FBE1D7026E28797B4CC7F519BA29BB07E3F5606265D05E48EBF8862C04DB6DC631780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Preferences
Size 6KB
SHA256 880f6db0402d7f0da7493072fe991ee55a0e29b9053199d6c953916e5b3171c6
MD5 741491c6f51be0c21d35583f5c6f36f5
SHA1 e0b0f6c19ad645344c29688b911fd49de694dc9e
SHA512 ba684da367b552b85c5b4f3be3f830d994a1727b84793ac3dbf3897a6b39531ec41884ce75270c72180a97dc3f31b5878d7dba95b6e62ddf9771d55a8f002dd1
SSDEEP 96:stx/dZa5NGBb9Hkqdo52t16ZEDHCs7/x+6MhmuecmoHIZRgMrMkkjeRK+gfji28X:stlyqroeDisV+FaooZiMrwjnRiG0v
TLSH
T16FE1B8025E28797B4CC7F11DBA29BB07E3F5602266D55E48EBF8862C04DB6DC631780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Preferences
Size 6KB
SHA256 ba885671d0e9bb9fde65bdfdb26fa393a2b92471e312917941334b736582cd49
MD5 0391c570cb717135a9329dade4c6ee19
SHA1 c2a8724ab6e68903ea5522e049af0da2debbcd31
SHA512 ce880739ec34652b56d362f2a01ad77ac062b4ad0d9520da092561a8f69ed1d5c8a11cc6a148d511452b4c412d54930b5d407fd2f01be7b012e86e86c485f456
SSDEEP 96:stx/dZa5NGBb9HkqFo52t16ZEts7/x+6MhmuecmPlhCMrMkk/hweRK+gfkX28XMu:stlyqfoetsV+FaPlkMrwpwnaG0v
TLSH
T165E1B9025E24797B4CC7F51DBA29BB17E3F5202266906E49EBFC862C04DB6DC631380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Preferences
Size 6KB
SHA256 134134d09b70b7be63c63893644c31aaaf8f92a74e02e8e438395f3f3f2c4dc9
MD5 b679a2cf2f47cc99abe19f3c3ed49636
SHA1 e0ea9d46f341fd2f93b6bc8838b284cd444bdcd9
SHA512 bd171c4affb3e97b3272a2a96d3394b96dcc5f0d196290e89dba952726dade85ae86a2a1f68a03431dddef8051fbdf2d45733732f88b0bcebf7985a109165f64
SSDEEP 96:stx/dK52Bb9Hk9o52t16ZEMs7/x+6Mhmuec4MrMkkjeRK+gfp28XM1C7jL:stlwsAoeMsV+FEMrwjnXG6v
TLSH
T146D1B7125F28787B4CC6F519BA29BB07E3F6602225D55D58EBF8862C04DB6DC6317C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Preferences
Size 6KB
SHA256 a60dcefc877f0b6e02334725c02f93e32af5ca04dd8cf1b3ca296b9f964ad7d7
MD5 1245f533003e5938f76d785791023e2b
SHA1 3e9cb2edb752a82805ce5dbbc9adeff51deb94b6
SHA512 51f8eb9a2e2e9c996aeaec12f20759d0eb6694c7352719fdd5bc80478a4a2ab830ed435365b08c61b7449809a246aac1cb0a2ce5cdf814b57b35d17e80eb4ec0
SSDEEP 96:stx/dZa5NGBb9HkqIho52t16ZEyCs7/x+6MhmuecmkIXZubMrMkkjeRK+gfa28XH:stlyqihoefsV+FaVXZEMrwjnkG0v
TLSH
T191E1C8025E28787B4CC6F51DBA29BA17E3F5602266D05D48EBF8862C04DB6DC631780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Preferences
Size 6KB
SHA256 0ce04f26ed6dd14b6b4648fdbe0416c3acf9330e54ece3afce3efe94b2da2488
MD5 7cf004d8b64047ab7f7f10eb7b8759c6
SHA1 f8a56a33560ea253a532d7c0c5cd919dba0ae453
SHA512 0d784898266c4bc604d41473ebc8c8035effcf8af40dce31da1667cf867eb397a2e8620be21b14c9ae37ed48d146d824ac481ff8267e9c7835c883229aa3344f
SSDEEP 96:stx/dZa52Bb9Hk9o52t16ZEFCs7/x+6MhmuecmtITfsMrMkkjeRK+gf828XM1C7v:stlysAoe4sV+FaGTUMrwjneG6v
TLSH
T104D1B7125E28797B4CC6F119BE29BB07E3F5602265D45D48EBFC8A2C04DB6DD631780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5d08ec.TMP

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Preferences~RFe5d08ec.TMP
Size 6KB
SHA256 5215080373d5cef0ea5d64e27dd5e1111afe1ec366d734cba992de166cc5ab93
MD5 1ff086032559a7e7edb5e3149b3b60db
SHA1 c0a5b53828cc22a3e03611b20ec937aa8d7dcf3c
SHA512 ac93840fa0920e8a970a6d40872b1703ad56ec2adac22ec9c6cb9f9b81eda54e3d070e6824f31f49c58a19cf5c4880aa3c714ea6a150b79d550940acface874e
SSDEEP 96:stx/dMZV52Bb9Hk9o52t16ZEMs7/x+6Mhmuec4MrMkkjeRK+gfp28XM1C7jL:stlOZVsAoeMsV+FEMrwjnXG6v
TLSH
T1A9D1B7125F28787B4CC6F519BA29BB07E3F6602225D55D58EBF8862C04DB6DC6317C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State
Size 17KB
SHA256 9390832268db4d36c7840b5fb33d44c15f5dead901287dc2f87e8980b5487147
MD5 ebe09e870031d74f2e597b2fdfddfd2f
SHA1 c08ecf291fb1c188af33c6126ef00a0ae4bb5843
SHA512 83bac957fdb74dd795b09c01ec1141a740d020a6b29e77208d6fb695afa7eeb9c88effe0eab840f7a3653af638f3992c1674cdd006a737348a9660fcc4c7aad2
SSDEEP 384:8+aQikB+z/xvxjg/qhEeNlk/+yFzVXQEBd3AN9zN:b/UxvxjgC+pzFRFvwNFN
TLSH
T113829E3AD569BE23A4F3E6413A0E678FCBB484A295C19EE44DED6F0D06C32DD0312C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State
Size 17KB
SHA256 410e72e02899d47a78dd33cf8f1ce707b748cb85e62681e8f92ffc1caf23f244
MD5 6e269d93db00c70f2d9086fb2b3e77c7
SHA1 2cbde6a6842aac776e58b76ae7eff4cab5969062
SHA512 7fee5b7887858a6afb1f6e34da66aab234eb863aeb949952e648b64b364f6da7b0cb19b567ce7b881d056a67914b270d6f8435f9c7086c1549472b47c88735db
SSDEEP 384:4+aQikB+z/xvxjg/qhEYNlk8+yFzVuoEBd3AN9zN:3/UxvxjgC+PQFR4vwNFN
TLSH
T19E82AF3AD569BE23A4F7E6013A4A678BCBF485A295C15EE44EDD5F0C06C32DD0316C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State
Size 15KB
SHA256 23ad36c874b33e25eccd3b0fd78ed736b9d540fe18f2b8aff7d9230804a08075
MD5 8974ae4f0da3120eb58f368c8a1f0f3d
SHA1 194b419b2b5669d8107722f34165acf8577c29eb
SHA512 6a5046df7645742b193152620d57be5a72b80d1cb4abfe95c9a692f0386a60b7a793d81e67e518760a7d4a0cb967d76a407a5fa36f7e33cf7edf81018d635def
SSDEEP 384:P+aQikB+z/xvxjg/qhEwNBSkZubzvBd3AN9zN:e/UxvxjgC+MEbLvwNFN
TLSH
T10A72AF2B55797E23A6F3E605794E074FCBB994B291C2AEB44EAD9F0D06C33D80312C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State
Size 2KB
SHA256 c2042a275f5a6be97e6628949d7c5d6724a36c0b10069cad3dac54b48bf29668
MD5 9f94ff1adf7c935a1cf5ec50c77dec1f
SHA1 69cf9055a409533a5e8ca75b12b832295e4bac8a
SHA512 f6843f314c45d085cd907cf3ef6f9be782b7d71ff3b13631faf3cbb2c2526cdb811ff6624296bdbce3b1b5b0285a15fb225b3bf289826ca523dbdae3fb6af705
TLSH
T10051747368146B3396E2A714B94B3B23CF369066DE529F619BDC0B0C01D75AC1322C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State
Size 3KB
SHA256 1b175487ada408d2be357fa5800ccc309d73f625f25188550c793ad769782f51
MD5 8dd6b4e2fedc300f88dd5c79105ee23a
SHA1 411b4c94c3fe3ac52ac52a1ec9136421fcceb5c9
SHA512 8a13d396aa462d55624042428e595880b338f52b21bd6e0fa2f42272b351044cf926a92faa3e1eabb6008677b4da0aa9dc4df4ef754eed72806afbbf74ff881a
TLSH
T1006198336974A6375AE39B04B9863B17ABA58027E9817FA5CBEC0F0C01D72DC1362C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State
Size 17KB
SHA256 93f0632daa710e945aad916a4853d19a5fa087ed96d55493639a21ec42537687
MD5 803a0bc645f1581cd7bb4e9d20942045
SHA1 a202521eaba893888d9278fce6d279973c0ee931
SHA512 41fdf9769931349fe4a0a533a8e1830ff2c43e48c0ed917ffa1b26feb9ec02f7f95fb3718ee014239814f252498355cb3dc8ee81593f68c3effd25305785deac
SSDEEP 384:G+aQikB+z/xvxjg/qhEeNlk8+yFzVuoEBd3AN9zN:R/UxvxjgC+pQFR4vwNFN
TLSH
T12382AE3AD469BE23E4F7E6013A4A678BCBF485A291C15EE48EDD5F0C06C32DD0316C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5caf43.TMP

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State~RFe5caf43.TMP
Size 1KB
SHA256 069b1f968a19944b7824e371bed0e9d48863efd0e97d28841c3e7aaf4401c889
MD5 5d7194541c27b4d68d5253c9111bd583
SHA1 3266d4100a373a5bc396e4e3a8536576f21fb1cb
SHA512 fb62822991983c0a50608888f750c3e99e916ec5dac0cb44fe2518726d4162ef6df47642dc0990324f9c7cc3bed0cecb7b7793fee2e949e1ff0fd5e179157c9f
TLSH
T1232162B2D4551B32BA827315B217BB574F22806AC640CF109BDD8B1D0AD34ECA736C36
MD5 SHA1 SHA512 TLSH

Submit Download

Watchdog.exe

Path C:\Program Files (x86)\PCAppStore\Watchdog.exe
Size 854KB
SHA256 5f64bab1b5c29a4b9ee40ddf0c93812ac830e4000e9065e9420cc5ced7b46593
MD5 95a7eab350971981680197e77b4e51a4
SHA1 9e6cedef051ef32ad2fa4773a0a175f0c2aa8453
SHA512 329d5c3256286e3617e5ee1da24fae087fb6e1a00c5bbe23733b85b1d3eb420518f5d317c17cce14eeabfdf77e0ca01169aa7dd68fa6c95ac83bd63b88e2a7ed
SSDEEP 24576:kmVixB/ANeFzt7iwwpkvnh0lhSMXlcj4ES:kmVixB/ANeFztuwML
TLSH
T16D159D19E7D802F8D57AC17989A6654AF7B27C46436066CF139136AA3F336E04E3F702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2598927455.html

Path C:\Program Files (x86)\PCAppStore\cache\2598927455.html
Size 18KB
SHA256 67e6844b0e631f1183ae7ea5c60d1a78e2da714aa0b79b1b037f444316befde0
MD5 8700fb3225d96ffc34dfc8acfc3e2cb1
SHA1 eaa012b165da88cffffec8948131c387fd5efb93
SHA512 cb12c90c4f5fb4d5d84047281961611864c12d2cddbf6d36897fc8ee372de736b914503c82d386c39b675db989615d1fdcbd877be9054e9888d9a27508052e4c
SSDEEP 384:ZNOguS1uiRRyBT0EsiPwa7F6iHiPg4z47+RjxaysG6VQlAEm4:ZNOWRyBT0E34ahCLljxaysG64AEm4
TLSH
T10A824F0C39F600618177317D4E6FA6083535A0332688CE517D9CD668EF6893E6BFAB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3685482583.html

Path C:\Program Files (x86)\PCAppStore\cache\3685482583.html
Size 18KB
SHA256 56d987306cf87298667d534208073095eb88f5a3c33ec5afc5b8d9330f94b1d1
MD5 2b62fe24d505248b0857785a06dddd6b
SHA1 44e2528cf665b5c187863941297cf90f1c77f498
SHA512 581ce4bd793ce7b1691f7fcb2f1d8b7598c9ff9621049b4623ed629b72485dd14ec2566d82be7d419c7391eb8e4259ef9ecd7c047b73fe402bfb506dc2144df0
SSDEEP 384:eOguS1uiRRyBT0EsiPwa7F6iHiPg4z47+YjxaysG6VQlAE2:eOWRyBT0E34ahCLsjxaysG64AE2
TLSH
T19A82510C3AF600618177317D4E6F96083535A0332688CE517D9CD668EF6893E6BFAB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

929223812.html

Path C:\Program Files (x86)\PCAppStore\cache\929223812.html
Size 19KB
SHA256 3db205a652afc4fbe7b31faefd93570e88c2574c68c4b04698f832f82e3324be
MD5 2c38f8c7e1e8185e865633ed132d6dc1
SHA1 efc64cb113cfb387cd875bf408ba6a6d9bdb01d0
SHA512 3a140806f107c6b18cf17e6f67f20a8dd9ad0c4c8f078742853bff9469282bb8603063e9828ce513cc1d5bef58b3227a491cc2837068365a5678d15545b38cac
SSDEEP 384:VOguS1uiRRyBT0EsiPwa7F6iHiPg4z47+RjxaysG6VQlAEk9d:VOWRyBT0E34ahCLljxaysG64AEkP
TLSH
T14692510C79F600618177317D4E6F96083535A0332688CE51BD9CD668EF6893EA7FAB8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cache_setup.json

Path C:\Program Files (x86)\PCAppStore\cache\cache_setup.json
Size 6KB
SHA256 7035543ea188849e728bfcb946e56bab921ad205e00d86bd720aea50dc9ebc0c
MD5 ab03427095bba130444a5ebe735d1967
SHA1 e1bf1d687a34148120a0caa2fb75f7a377b63d03
SHA512 f3bad56b13cb1d5a502164e7813eb5b16fa2e54c4b8911e762d2c3dae82ed00b061337664f14b2156bbd9092d58db0e15b8cb5b97cada6bbcb20dff86c7a1f7d
SSDEEP 96:0zrXdk+Cm0XPHdNHvj7/RfskosIa/+66q9/vUAzkNyzeQIohCX46lV:0fdkHX/dxvR0k0a/36q9nUG0Qh6j
TLSH
T1BBD1B4BB8C222F1FF012B5CD9E973C0AC36964353F02B5D5D39A1C669462739F89462E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

773CFF2C7835D48C4E76FE153DBA9F81_D9070B80E002B56309375EAD5B6A198F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\773CFF2C7835D48C4E76FE153DBA9F81_D9070B80E002B56309375EAD5B6A198F
Size 471B
SHA256 a362d8311460f7e7d63e2b795962c1771a00a666f81abc417bbbc650d66c3eb5
MD5 7954d428d4a6d3defa51021c66257b7b
SHA1 5a9d9535aefec58c189241a4c602cb2c56993c5a
SHA512 fb0703e4151f3d31eb8aaa29a753fea985e129c124a9f1429d151e48ded6ec7bacafd846008a29ec6ab63a0574f7e9619382f270d12b5f81ff1b9a9e6246c17b
TLSH
T197F0DC8A15E4B4A1F430C08A3DFE94693813A8EC61E6911A782D80668C64DAD9A157F8
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE
Size 471B
SHA256 a60783d8a0ea2beb647e3fd50c145f347801df254d5651f40f828b26b82d44a6
MD5 d67424004894b28b9d83f85ac5a8471c
SHA1 415075aeae98cf99c8dc41becdae2c74fab73ac1
SHA512 beb839cb4841df7e51364ec2143adecae212d66440497d20978c0392e06ab24fa481e84fc58be0336bc2e2843e04e798011eed6bcb70a9709adc7a1a8fc0a9e1
TLSH
T17BF0544141BBC87359BA5CB806F40976F420E06000940009B91D5DA060073D5A58B27D
MD5 SHA1 SHA512 TLSH

Submit Download

773CFF2C7835D48C4E76FE153DBA9F81_D9070B80E002B56309375EAD5B6A198F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\773CFF2C7835D48C4E76FE153DBA9F81_D9070B80E002B56309375EAD5B6A198F
Size 416B
SHA256 ceaa4758febb4e015e9ceeb2ee034e7962579be7a2f9e609bcdd265e17618a6a
MD5 6220d289ced847a33b672039f6881072
SHA1 803913bc916ab54a2738448c9890a35fba6d2da2
SHA512 63944ffadcdbdc7b0107745ef3bf71c2f5f73cca599635ad0a151fece1f3a67e44e1d84ab152deee72c8a9e8aa76feda26e5c6cf75f79ce53f662175e7d71c7e
TLSH
T145E0C00916FE019DFBB1C93982C910668D0BF1231C08D6E32A54470FF62B791FC32564
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE
Size 412B
SHA256 65a4ed9b1ebd5c33151b0097be999ca6aea7ca8ab85bd7d1334569d16df0ca29
MD5 fc8ee3c2cc708bfb754b33b22d979c47
SHA1 a636b0492c0baeb758e9a745e8472babf3e44ad6
SHA512 34708e91ebf4651157ae33540a35833956492c70421edc29efddde1ba0e288fb30197b3f06ba2c0f77419c374d0c8c1bd31bb27474164cf3fb480c2c4ac9261a
TLSH
T115E0C02413FE411DF1E4E4346FC6B031495DF0370449B2B819C05714E706F00DC12E72
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
Size 1024KB
SHA256 5445787c7c85fc5de148c9257cc30392c5b178b8d9fe25c993810636e2cedf55
MD5 c37243749cff5f27b40d151b9245c787
SHA1 c7111feae8028bef9a8498feb4b66e694944570b
SHA512 fe382464c6301a081b93e79b2013f2ba468d34a82d19aa95c4398c2137301ee282941cc504702dc88db18f1e0497d55fd5ecf121683216cc2deeb591da398de8
SSDEEP 24576:1x02ciYqzemOIcqDJ3fRpSKPnq+R7VXIcNOxE8m6:1x02ciPCmOINFf/tqSRIcgXm6
TLSH
T1732533093FC8F91CD45487B2C8C9CD255AAB33B8B518A6E76B9D0392E631D1248DFDD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 672B
SHA256 30038f8c70d66981d3ad64474cda07b300f90a876f3202329fcd830ba21ec28c
MD5 ad6413830939035fc1a2b5d44324110a
SHA1 03b801b20f7abaaf2c59a7f73c41fbec98dc59f8
SHA512 67dede57a4b2b2e3fef0fe9a1a5a99fc23b4da01c9a9243206c58c0fb359c5e09d409136755c441786a5f0bc28f0f89b3ceb3be2950c0e4e09d255c45d5814a3
TLSH
T1C40127581DA84C12DF630FB1ACE0DD35BFF2629B53371B9342C382B97122354B9821C6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 696B
SHA256 e4ee66063057d21a36320823e4c8a4f945d13260aec6ea8db09d8e687b75571e
MD5 cee263fdf8b40ac312bc036d84932d07
SHA1 3ec7de12a4066e138dece39872b9542e63af0795
SHA512 62a8530770504fdbcac39257e100d03c7ea3861f5eaf1efc3abe6d4b1365c3f3f1a56a077becb53d759a4b68100f01e2806fa3a829d42d894003105bd4012316
TLSH
T155012E581DA80C02CF234FB0ADE0C834BFB2219B23370B4341C382B93022344B9820C2
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 a9621fe96d91340df54af18b8722d99edb6e422efea49846bec56f82995eb454
MD5 330ba7dd619a53fca88e598f9a44eff1
SHA1 cbbf085706450faaeb2dad7997fbfb4d598ae50d
SHA512 aebcab6b6acb75cc908f4f2817c8219814d04289421a4cab165068c301189095b1f6fb357a6eb1e230252a8ee03ce55baf964876a85c8d77cd6dc093848c322f
SSDEEP 96:LuBLJX/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E03A:LuHX/tH+bF+UI3iWGVYWNkqp3J
TLSH
T10DF31E5E5F243312CDBD923B68E745A75D7CF02F8B2366C56C6204B5CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 ad97062da8bb2b8acecbb047c0e41f78b2e5edf67dac3ce118fd6029b31f58ef
MD5 e4170d00ea4f0c943042e2a3b2950b6f
SHA1 7cb5ca39828715bcba2bf8e1abaeaedb3350ab84
SHA512 05dbc2cc03f775d1bb050d8c9a3ddbfc6fd71703ba0913462a8822b166df00f5b2d24373813460084bcc1b01891bcc720781dcc3a8896421eaac1e67dd17ed85
SSDEEP 96:Ddu/uYuRFEeuRulvudaIaELhuAuNAuEuQRu0uNVRuNk4uGurHu2E7RuAudiutSuY:DdAP9eKGCaIaELhxIAxZRZoVRok4tGH6
TLSH
T18CC1CCFB87E4C92DE90162F5AB552E1FCE591A24032C3976C8D57F2BA7E1870E20164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 09453c967c3fc0549d8f02377d16cafe5518cf1a985eb24329c7b4b5d21d94ec
MD5 4d0fa5886e98decb7418067f2c4d1502
SHA1 7a1adf2c600afa962897670ac3cd2723087f7eee
SHA512 f9ce400c79b269171998c85848337beecb10e21c85b6255e233e3c75bc5953cf7bba40b0c15b689af4265dc48b11a49b4b259ff89290a98c34314aa1da197cd4
SSDEEP 96:Ddu/uYuRFEeuRulTaIaELhuAuNAuEuQRu0uNVRuNk4uGurNqu2E7RuAudiutiuuT:DdAP9eKOaIaELhxIAxZRZoVRok4tGNqq
TLSH
T139C1ACFB87E4C92DE90162F5AA552E1FCE591A24032C3976C8D57F2BA7E1870E20164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 9b8dd2d5f0930644064697efb78b0cb7cacd6eb9e001e0361867461e8c485abb
MD5 b68867b6a461f8fc5b290ed19756e42e
SHA1 20b35e2a8d0f3598ca22d8a97076e1e3002c5ab6
SHA512 4f31c050a695d67d3cddf967fbbc7cf5f866a443b7c3c74cdf0786b2353d898f0ddc0a0bcfa8df786479e86af39bbb97e7ab370354417f8821bd25128dc8cde1
SSDEEP 96:Ddu/ukaIaELxLuAuNIudiutWuEuQRuou2EHu5iuRuNVduruNk4uGurl:DdAzaIaELxLxIIcieWxZRlcHZsoVdSoc
TLSH
T16CA19AFB87E4C93DE901A5F5AB552E1FCE591924032C3976C8E57F2B67E2860E20064F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 ab773267f2905d42ece01eeca844ebffeb8f8e5e8ba275bf6ebf272aea482b4d
MD5 268380a59bd925f218d54a68c1db475c
SHA1 4af5e31c7832073765769c60224161e9eba510a0
SHA512 0c09914f815246fe997b2572cc5f07bd06e9136f9542629fa2c4a83675233516c068b7164678176891036a27e368be960b7cc17f250f011f7ded35bbb3f3f719
SSDEEP 96:DmuKueu2FEeu6u0vudaIaELhuAuNIuEuQRu0uNVRuNk4uGuriu2ERuAudiutiu5z:DmtBgel9CaIaELhxIIxZRZoVRok4tGib
TLSH
T171B1ABFB87B0C96DE901A2F4EA556E1FCE681924031C7976C8D57E27A7E2860E20174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 49d0291fb755e52926aae686cfd5e3c7c0ee2dfd2283458444d4ae1d128aabd2
MD5 56f210b75f544ab22fd8134f98bb80c5
SHA1 2deae4a32e5583d693297a13cf2a02d0309ca3c2
SHA512 e754c5d52ebe2443222a3440edc4802fd517aeb25ef46bdbda5316d03fde91edaaa6417dcc366c9b8310de052f4ecc11ad81755fd5351fe9e2b7240f4ea4e5b6
SSDEEP 192:5BRdEad8v7jwvKPRpoHm9XxHsb+WNnbDd//EI62qMkwVa5+VyIsnAUgE:5BRdE8ow0Xvfw/5Ev2f1a52E
TLSH
T15842C92EBD10693BADCAD22DF9657753D7F6102161D02E84E7FC8A2C15E75CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c53f80364888634fdf2a91dd83335dd9f34b397fe9a5d48d565b6e3e945e7db1
MD5 8fa81b59c7872f7db6ab08f01b83c07e
SHA1 2df43deb863971f987f40ab1b4662c07ed675472
SHA512 4c09e662a2a7af75a92d59a359bc4b294d4d84b9382e32f3410244e5ffbbf76241a70c4cdce70eb661a6c2b8de9b7f428d401739da69e541f9533bc88f3bd03a
SSDEEP 192:5BRdAad5v7QvAPRp2o9XxHsb+WNnbDPe62qMkwVa2+VyIsnAUge:5BRdA8Z86Xjfw/Pl2f1a22e
TLSH
T11932A62EBE14693B6DCAD229FA617653D7F6102121942E84EBFC8A2C15EB5CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3b1d4cbb1d3a650b0d3b7754489f7a25195b411e301d11c15ab89f38775fc508
MD5 ea1ba6ee3de8b2cac4dabe585f65c753
SHA1 2fd13d28f10d9c5afbf939a84ece590095e03939
SHA512 70d0a7682e771aa8f360d53d4d461ed81147ef667688f94245d40dcbaad19143ad36a44cef2d2f236f3e0a1ed20f9e68f9426c1f2517eddcceeb5b1b786ece39
SSDEEP 192:5BRdEadqv7jwvKPRpoHm9XxHsb+WNnbDd2y8J62qMkwVa5+VyIsnAUgE:5BRdE8mw0Xvfw/B8c2f1a52E
TLSH
T18C42B72EBD10693B6DCAD629F9657753D7F6102221E02E84E7FC8A2C15EB5CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c89dd06952a873b651b517ab91f2683d234b9709442103d3e511d9a98609e384
MD5 c4ecb2de5a34d336463fd03f182216dd
SHA1 067e549fb5d74e6ca0445681c3a07ba3b504ef0e
SHA512 d7b3e7342968b84d9b7e9123a47ee386b6e988e286ac427433f5cca9d06540130466859bb0cf65185c26049a7c3a2717fbebcc03ef1dbc1d77c026ec95cacd7e
SSDEEP 192:5BRdAad5v7jwvAPRp2Hm9XxHsb+WNnbDdrIz2zd62qMkwVad+VyIsnAUgE:5BRdA8Zw6Xtfw/62M2f1ad2E
TLSH
T1B242A62EBD50793B6DCAD22DFA667753D7F6102121902E84EBFC8A2C15EB5CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a93990c59cc19d1d85d6f292ac0cf3bfe92d7e4a5017557c2adb8421e1c52ded
MD5 9feab0f27c4a3d0a6f0c71b5b6bfee5b
SHA1 8d077a63d63d78d79d7d0dfcb56728e307a76eba
SHA512 6c5eab8f97f81e5794c35ba6003ae893dcb5fb69841028fed5fcceda32df488b5a64d823c51412c1ca544e835d84fc04340e3eb63536c99c0f07743da8138d5a
SSDEEP 192:5BRyEadqv7jwvKPRpoHm9XxHsb+WNnbDdSWe162qMkwVa5+VyIsnAUgE:5BRyE8mw0Xvfw/pe42f1a52E
TLSH
T1F042B72EBD10693B6DDAD62DF9657753D7F6102221E02E84EBFC8A2C15EB5CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cd74b6e107b155c78dd584597df3839de7fb11349294887b0cfb19ef5c21d080
MD5 bc500862fc036981009458bde874e6c9
SHA1 e0b24a18656418c8c6d424d94fefba61b093714a
SHA512 548acdd9ddac51ff476c54708633e7a048bfe2d5012b1184dfadbad1aaea840e21b9b9c683a043c0b0aaee669afd98bc806b3da78e0e424d3cbac7c4847b444a
SSDEEP 192:5BRdAad5v7jwvKPRpoHm9XxHsb+WNnbDdwckn62qMkwVa5+VyIsnAUgE:5BRdA8Zw0Xvfw/Jk62f1a52E
TLSH
T1B742B72EBD10693B6DDAD22DF9657753D7F6102221E02E84E7FC8A2C15EB5CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
MD5 17b14bf97159ca9e7782c9d7e031bfcd
SHA1 5412ddbb770ca1e448ec81ffd24d22720b4873e0
SHA512 fa87b1df3588a9d8536d2ca0322b2c03b19cf27561fcd164ff9c5ff208fc0e27dc790a5315f566f02886adf9352dd827c1148a40ca6a9d5dc8c58be7d73dfc76
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9G6jBTK8/T:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNT+
TLSH
T1B332D827A48D9A3F4FD8D519DC036F8B6DF5019272780C24A7FF5D0403A978E115A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 f07951b21024b7615250f584acb8fcf6730554393722aed5654450d6b95f676b
MD5 2771ac4688f65f294f3eb9b9b6c1e20a
SHA1 db1019f4b15fe505c8a0b7627ab14972b2c2a5ef
SHA512 87f4e6ca6ca4f3c94c8bc696a22e20039189746784c7bbecf72c608f028b9bdd5831ae3ee2764458b2bdf5ad82a9a314fc9249c167621f43ce34d1b40a7ea56d
SSDEEP 96:UbJ0d+r2io+TJ/E0f6m934oMM0ESl8h4otop52icDLB6pGyvn0Skhlm+9QHRNC3u:Ut0ITo+TQ0IHIiU2A1NPSkhlm+9QHuCZ
TLSH
T1BEC10975E06D5CBB48B6B485B1132D47CEA8206BAD65BE64FEE90E1C01E74DC1393533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 53207475b1d0b44f1d8ea9742d674c83710478b4df118641ff715b46ae7840d1
MD5 71538c66e203262b31d9aff9fde5123b
SHA1 4b6e0cf165711af20d5526c7bb045d80b9fd4c70
SHA512 3a5d0a69e2e8e404601bb9315f42b28afce458fa6f60ac133b8d921000812a8ad5abef8d471ae47dc37e9f0740e38623b085baf58446418e0a6950c603633927
SSDEEP 96:UbJod+r2io+TJ/E0f6m934oMM0ESl8h4otop52icDLB6pGyvn0Skhlm+9QHRNC3u:UtoITo+TQ0IHIiU2A1NPSkhlm+9QHuCZ
TLSH
T168C11875E06D4CBB48B6B485B1132D47CEA8206BAD65BE64EEE90F0C01E74DC1393637
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 c2bd478540881774810e47d8f3be2f9cf1b6c652ee02867c10d12fd6c14f937a
MD5 6cc317c51298260f2bfab9396673a1e1
SHA1 74f79c0d23c3149c6afa6114594b30aea67883bd
SHA512 9189622f1f5c72a2d14992f2d7d1716b64071402945555e6831566014f46780a8480a8ab6715ccf36091919c412b89a5fb1a3604587ea3c5d54295647b12dcfc
SSDEEP 96:UC0d+r2io+TJ/E0f6m934oMM0ESl8h4otop52icDLB6pGyvn0SvQxwzQuhjm+9QZ:UC0ITo+TQ0IHIiU2A1NPSIxqhjm+9QDV
TLSH
T116C11971A46D5C7755B7E442F1232A57CEB4206BD951AFA0EFDA0F2D01E70EC23A2623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 4f0907ac076f574a880079d2acb9b6b6cc247954944da6db9bd2a7a70dcc7dbb
MD5 7dcb4fb02cd86d133c939f238e21e504
SHA1 4c0cc6ebaaa834dc4c6d8aaff54cceab983b02af
SHA512 4e9b424c5f9689d5145009d18d4c85173a567759b77031b4facdbc015070750a226f372d6b48d349dd08471a1addb67a1d9c1bc48f654c360bb6b1a234a0bcf2
SSDEEP 96:UbJ0d+r2io+TJ/E0f6m934oMM0ESl8h4otop52icDLB6pGyvn0SvQxwzQuhjm+9e:Ut0ITo+TQ0IHIiU2A1NPSIxqhjm+9QDV
TLSH
T1B7C12A71A46D5C7755A7E442F1232A57CEB4206BD951AFA0EFEA0F1D01E70EC2352623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 d142b4f8f56f624a854743140a432ec71a8042eb3221f0b349254955387e2411
MD5 5ba0b52168b2ca211e101522ac737d08
SHA1 0aa338b77789ea7510a8793497a6f1f2d74bb007
SHA512 4549a3e22569e992b4faf4c4f2fbfa3e625695621b03d4c60611d98dbc81787cb904dd1c53f9d0a7004274aca44d597b1299debf11a8c43898d2f5cffe4d8a2e
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok52mDLB6nGyvn0b4T8QybJv4a:xC0ITo+TQ0InDUD91PPb4T8Qybl
TLSH
T131A10935E0684DB74476D486F1626A43CFB97067D972AFD0EAD90E0D15F70EC1351A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

050105d9-ff3d-4372-89f7-f1f7bddaca64.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\050105d9-ff3d-4372-89f7-f1f7bddaca64.tmp
Size 105KB
SHA256 1b8670f90996f99545a359788fc5d532d9f23aee856a494ae16f3b2eb3eb7d66
MD5 3473df85b20ed25665d4bfd6e4859e7f
SHA1 1714d755b1e5af68fa150bbcf4aeb788415e3696
SHA512 82a6dea2559b7e6784dd0f7b9ec38756dc7c7471cac37842e5f77d28fae3fddfa00a995136cd838396b8157fa5783b676969632048d27ca347b0fdb10b5daf08
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
TLSH
T18FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 312KB
SHA256 0b6251fd38152a7a7319d54a8e993417dfe359650a9581c135c3950fe5704861
MD5 932d4b5eb7460fda1f102de6f7149790
SHA1 fadbac31c043b89a72bf3abf502f9ee53ccbf86c
SHA512 eaad89143b37482972189a3ff86698a7ae3332c42248d177fc74e0ec6aa9e1756a0699cb77d3b83cd815e2651df267c0cca4e9866d7a59a26d0dbeadb060189d
SSDEEP 6144:Y87U1JYBYrHsCcjPUrsgrwz9Ot6mjoSF7SI/5Czsl/sfz+IeJqJi:REJYqaQ8QN7p5Cz0jqJi
TLSH
T1786423C8B9A7916BD9F3FEECE0C64958B3FE733433C684798421915B87122D882E45D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 01b9aea8b42fa428401301695955c93d63373b36a0747d4fc77cde15270d6ae1
MD5 200e40d08492ec1f272dc259732374e1
SHA1 11dd1cc48be3059862a7946426edda8e4850c642
SHA512 cdc3fbdc628ab8e3f8f078405d0d63112d15a367838e5455399579430fc3db816c03c6ae040d99f6e9e2b3efce8b27df725dd71379c3d4c1300b99e9a2daeb3b
SSDEEP 96:UNHAbVZs66cdbK+gP1AzY4gnj9eP1aTshvh+/THR0JovKU/FvPp6Oxhfyur:WHAhZs66cdbK+GAzY4I9e9aTshZ+/THt
TLSH
T10D9170B02A1DEBAAF7210FB8F7F2958B3EF860B948072E50D4105EB44686F407DD55A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe617b0b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe617b0b.TMP
Size 2KB
SHA256 e7900f3bb9645597d2f72f5ab1d712a0db26d2004730a67e07c0ffc280897376
MD5 b203fa31190b29206ed5b4993b142ed7
SHA1 4ec4ecd96092cb481ec3f31296413a57ef7df695
SHA512 e1982bfa4955e271c3bb2b4808024e8c7f9f3601c653e3d112cc2986cb51cec6b5aeee18d598156d1c95f80c63862cd23eb3610503a757be177b8c45acdd6cb4
TLSH
T1D8512CB52B2CEBCEF72444B947E6D88B3EF8A4B94A071A01C0156DF44ACAF501DD9993
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.gamivo.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

4b97f555-cd49-486c-bb49-c3afb322f0fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4b97f555-cd49-486c-bb49-c3afb322f0fd.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1a9f84b2d3fbe8157fbdc399e066a150aaceb2b58816acd7dc005a4b1a62b5cd
MD5 2149e78967b231a79e3722298c99a0a0
SHA1 a5aff274a5bab16145d9a142881936f584bb385e
SHA512 25f6aeef4e617bbfcb599e3aae49ecdc3f463c1321da85a740cbd07f34b6df848fde97b1cb8ac0ac461bf56bf0fa5c2d314c8149a3a9f6283e1956997b85c2c3
SSDEEP 192:sxRkRcyM/jK1Ml8wCA/fFsDhVdZDXrzoA8p/dTm/g6+WNfnb/rIvecIflVIyIR2/:sxRki8A/fFsDnT+la/5T/rAMVJc4
TLSH
T16072E916A534697B8DCBE219F555BB53D3FA0823A1905E48AEFCC91C00E7BED612381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 a266de275f3742c51cf222f711c8172349ae73d1b29f826e70bc8d3e2354b7ba
MD5 898ffe665b04000d65e8d5ebc9dfa8a1
SHA1 e960924d18f39a1d381a352fcdf9505d121dca18
SHA512 fba43e41ab24281ec94aac170481b672627e1c8f624e80338045dcf82b7dfb82e5cc8c1b8273b548c5da49eb3381b961c903d50e3ab2bb3ca804317cfa3f5a99
SSDEEP 192:sxRTRcyM/jK1Ml8wCA/fFsfhVdZDXrzoA8p/dTm/g6+WNfq9/XrI2u5xSkIPeot2:sxRTi8A/fFsfnT+la/5+/Xr38WLVlkc0
TLSH
T1DD82D757A5381A7B4DCB9529F550BB27D3F60823A5908E84AEFCC91C00E7BED6122C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 649f347b7eaae4464ffcff0febff05ba7497908ea1a1077b9e38a3bf9454028c
MD5 bb9c085b9ce912e1b30bf157d3888486
SHA1 cb6df2ecebb17e2441bd9b49b0442c444c38c4ee
SHA512 de4dc7df044ae54a8d916e6a6db92a1a921cd55d13580774bc605273842e97ed5c43d8de8b3d519ac8704b49232da72110775afc393205c0ea1f0ad81263d69d
SSDEEP 768:jXwHqe7pLuLzmRWgs2f728F1+UoAYDCx9Tuqh0VfUC9xbog/OVBnKVuGWrockoUw:jXwHqeEzmRWgs2f72u1jaCnK4Gtdih
TLSH
T1FEE20C7B680CCBBE4F404A9DEC29BD9E6DA802CF9698CD5447FA440C03C6BEB51175DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bf3e68f6d45351ac74567a613a998c72f885421c\44f1e8f7-85f2-499f-8610-afb7477b79e2\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bf3e68f6d45351ac74567a613a998c72f885421c\index.txt
Size 417B
SHA256 10a1a178612d32ba24496062f6312ec6d1ae7566547f3d3f1a395131e73e3f2f
MD5 0a3d7518cf9d28a98502648963335c48
SHA1 72210303ff228c42e34bf2d6bc707a366984f257
SHA512 f1774f387029a16eb45a489fc6e670697c89b4f2fcde1fd51e02fbedfe0737fb5ed35ee7e92e1c9b07a7dabe344781a4131a5e50cddc2e98c0be091764d18a5a
TLSH
T199E02B6E44E022353765DF6B743B326B59B3F9817C094C4E40A120526571F57AE27916
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bf3e68f6d45351ac74567a613a998c72f885421c\index.txt
Size 929B
SHA256 48725b337018ef2dde29d0fcd0b9d25b004b10d4abec2d0ef57eab78a44c122a
MD5 4c9f225efee63ca68b475ced55866ad6
SHA1 0487f7c6d9b1d7220832317b63e938b903af8398
SHA512 e3e79ad6d6160f7e374baecbc92a8c57f03aa27c6d90abb93c08bbeb112af1c2feebecee93f75b8d3e94e033514aa5577c1b0f167df9bc4492cf7cd7662d2f1e
TLSH
T1A9113A6C89D42231723ACE6B547B356B2D72B9426C09580D00E115422861F5BE93391A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bf3e68f6d45351ac74567a613a998c72f885421c\index.txt
Size 676B
SHA256 b0f2ec6071c088d387bdf048849651a47987dc6fea4e5c90f2eb8df2b8db78bb
MD5 835fffc135e9d2850dbc6d4e377f2312
SHA1 c5b915075b741d1219a3289a1e8f3abb1ad80d77
SHA512 965becc4cc16441ab2d6a78ec30d68db5ce1740003d9d422d9fd95673b7ad0b1f1aa2a98fabaf490594c3750a0907084f904b6a7174522978c417500ed575778
TLSH
T1030149AD49E42231723ECF6B683F75AA1972B9827C096C4D40E125436C72F5BE93790A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bf3e68f6d45351ac74567a613a998c72f885421c\index.txt
Size 1KB
SHA256 0d07f79d115917373c070fd921ab7b55c26aa1d389fe9a82fc9e29fd8fdf04f3
MD5 8c0327e90b940e70c8918c3d311c7cc7
SHA1 089c85faff12f6ce43067629dbe2c4a7ac66e472
SHA512 1a0615f7ac2a26d284dcf87b7fbd6d7c339b977dcdedcf3cc672a70d6008e2ec2545d6304d05d74a088e8c55afc0944e13d2bb7407f527186badaf295bffca26
TLSH
T134213BAC89D42232A23FCE6B987B35AB2D71B5427C0A9C0D04E115466C61F5BF93790A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe61785c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bf3e68f6d45351ac74567a613a998c72f885421c\index.txt~RFe61785c.TMP
Size 162B
SHA256 73f1dc4b171d9258778b4ab869d585a6384d4fd86b3908c41ae89f1e0b73d45e
MD5 60fb59f6864c41939dcd93f1036c7a2e
SHA1 113c23db519ee2cd3db547472a15b172124bfec9
SHA512 6863d182c62bfac4b090f9971b6a226d57ebf1ffacd401b9518d17be85febe2b5172087468c1a90029a7adaca072569db2a5bdd94200a78d1cfd0643ae756548
TLSH
T1FFC08C7F00B0532037405B9A302B745588739D85FC808EC6C0A1B492E6F1AB7061BF55
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 251b8a6ac71f2c9185a782b30cdbb9fd8ed52eb16e99197751664b74c4112070
MD5 33b3bd1e7358cfd093f93a0d83f944a9
SHA1 8e27c8a1a348d011f2adf5219f5e61a20496a1b6
SHA512 00117927b18b5b98232bd3181a11ec5fd09f96c49fa127d3e212ae23361cbd18e41f59c96f93a9d9dabef8b8a22005de71325130c1262d02158155fe58ad668f
SSDEEP 96:KReTieYgQGWAltgeGK4DgcGcW+9M+XHpm3zBj3TWH0ig7TK4Kg1Tc5xMvCwwKl+Y:CeTieYgQxAl+eODgc1W+9M+XHpm3zBjj
TLSH
T170910801757F02813D7E6A5D80A8C83D53C2B4E63059A93B77A451BA4FA7E134EFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 f27f3c6e59577fd6e6a89a74764d69567e1953f98bbf4667b77931d8aba29a7a
MD5 4eafa369e49b36ddbdd15099f3888a0b
SHA1 805eeb18d18b5cd7ccdb184193eedafbf9f50ff4
SHA512 6b82f124ec60e73f397edfa0dbcb2aab6db341269685f4c46318a6bcea7cdc9391203fefd3883a6ac8a0c4959143d2ceb3e39cedec0b2d615f7fc15dc0432e86
SSDEEP 768:VM3R/w/TBOWOiLQeONXyer1IRCzni97fEw:VM3mxxSIqnUfEw
TLSH
T190F2AE34E4A99D234CE5F3C6B2472393AFF9202795C84B50EDE95F1E0587A5E231B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c241968087f21188b81c1be4da4a2edfeeccf3ab180005bb492b7d970804cc54
MD5 aac34ec08db8090907e5347589c6255f
SHA1 c2e7b0bb4167fe4c56fc534cbd69dde817d41dc0
SHA512 4669d36aa52b5a5e70fddc6a2e1e72e2f424e965b7aed4cc6f7e25adcffc33aca7a4205a8a8a04d95490b85175c2e3bea206a4d7380eb2cd17f544fa324fa7ea
SSDEEP 768:hrv+4UNbdz3l3/TBOWOiL0ONXyer1IRCzniBEeVH1SK7:hbsbV3lx0SIqnPEH1l
TLSH
T14303BE36E4A89E378CE2A3C6B14773037FB8605BC6840790E9DE1F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 20612209c44578d7c0650e4c91a0c4a1a14280b955908f1d15f5a27b9e5bccac
MD5 700365dde0692cf16c9f48329f87741b
SHA1 ec6246c752e99cdc0612379315ea29e8f5851be5
SHA512 119ab5c2182139d4203cf6f959008c22e3ac40951cb757db034008c70fb5d35376c230e17078f8c4b385c9c127ca86c2ac4cd03885bcc973a3d11dea0c1e58bf
SSDEEP 768:3M3Y/w/TBOWOiLQeONXyer1IRCzni97fEw:3M3RxxSIqnUfEw
TLSH
T19EF2BE30E5A99D234CE5E3C6B2472393AFF9202789C84B50EDE95F1E058765E231B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3d0b74c107e95a3ad4e0355e94493c7d9ff81a954cc87db7cf40373f316ebf84
MD5 a6631a932b0f319802560c365ce23463
SHA1 41e5f26d636b17b59f433c36e5559d966360f5bb
SHA512 a5164abce9a5f7a860375d184edf488ad4d0a270f7abac41f95a2d5ac571c73eb92acd3ce94d205f807a0cab4ab28a46e5e16e0ab53477a5447592d3ebe92105
SSDEEP 768:Brv+4UNbdz3YXw/TBOWOiLQeONXyer1IRCzni97TZad:BbsbV3vxxSIqnUVa
TLSH
T19D03BF31E169DE234CE2A2D6B14B73937FB8206789C54B94EDD91F8E058759E230F907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 fa83dd5374154c1d71db956179e90b2d4524871fd3e516cf5480fd0c8c90423b
MD5 74ced919b8c704aed992a4a9dc079a8b
SHA1 86ee262ef317536bf94fc93d7e31fc91f0b7e9c4
SHA512 48019dcf64de861fcdb6015c11ba943b89f85d1201e5ede74d6c603aad2b7707fb65d14f53921819ef2bb318cebde6d658e1033ec4b8c0383283cb949e3f953f
SSDEEP 768:Grv+4UNbdz3Ji/TBOWOiLQ4ONXyer1IRCzniw7eVH1SK7:GbsbV3cx1SIqnPEH1l
TLSH
T1DF03BF31E1A9DE334DE2A396B14B63537FF8206789840B90EDDA1F4E069759E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77c44077-ea8b-41bb-a67b-d932248b1726.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\77c44077-ea8b-41bb-a67b-d932248b1726.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

8ce1091e-7127-4db3-b977-02071bf48832.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8ce1091e-7127-4db3-b977-02071bf48832.tmp
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pixel[1].gif

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\HEUA9JR4\pixel[1].gif
Size 42B
SHA256 ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
MD5 d89746888da2d9510b64a9f031eaecd5
SHA1 d5fceb6532643d0d84ffe09c40c481ecdf59e15a
SHA512 d5da26b5d496edb0221df1a4057a8b0285d15592a8f8dc7016a294df37ed335f3fde6a2252962e0df38b62847f8b771463a0124ef3f84299f262ed9d9d3cee4c
MD5 SHA1 SHA512

Submit Download

049742bb-639d-41ea-a3d8-cd6d7ba253ba.tmp

Path C:\Users\Admin\AppData\Local\Temp\049742bb-639d-41ea-a3d8-cd6d7ba253ba.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3756_1547549671\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

PC App Store.lnk

Path C:\Users\Admin\Desktop\PC App Store.lnk
Size 1KB
SHA256 6bfc5cde57cbe7f7265460bfccdfd3f9c81ea28e963a4c7114dc1abda88cfff3
MD5 b688a72ba3f84802defd23806e536048
SHA1 0db9a180d6a641456b49bb27812d1f77e6ec0d14
SHA512 1d39f0f5b9eb4a0cc432e03a3818a8a7c8fd76eeb386a7815cad7eb8b221cc9ae6fb75c2a7d4d82c8ad77a44d57749d83e8ed9d01d3d372095b513e8da37e4c4
TLSH
T13421ED055BE60A39D6B5C4355BBB11069B27B810EAD80E6D01D5836C1C77208E9DCE0B
MD5 SHA1 SHA512 TLSH

Submit Download

Setup.exe

Path C:\Users\Admin\Downloads\Setup.exe
Size 4.4MB
SHA256 66f484591ef18b6730df7e4c86b58c2bfbd178c5fb6728f30331151900a2b37d
MD5 2e416469a90b3f5e1d3c0eaca7a4257e
SHA1 812f1850a90c19103843b4ff7de59bdde0add70d
SHA512 68a23c4962ee9e81ff68f4a017c1aabeb975bc3a7e97da66372338c6e78fd45bf51aeb54d05fdc24a26bcd996f74a13dbe540bbdc65c4bd780ac5a9ea295c3ec
SSDEEP 98304:xChBjde4klov3ysXTkKGG6ak/DOz+lBIxen:xUjdV8U3ySkK+j/Isn
TLSH
T14726120DD5A702F8DCA7C5BDCE825447DB72B8860335D6EB02D1A6560FE7AE08E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/936-427-0x00000214A7960000-0x00000214A7961000-memory.dmp

Download

memory/936-424-0x00000214A7960000-0x00000214A7961000-memory.dmp

Download

memory/936-422-0x00000214A7960000-0x00000214A7961000-memory.dmp

Download

memory/936-426-0x00000214A7960000-0x00000214A7961000-memory.dmp

Download

memory/936-425-0x00000214A7960000-0x00000214A7961000-memory.dmp

Download

memory/936-423-0x00000214A7960000-0x00000214A7961000-memory.dmp

Download

memory/936-416-0x00000214A7960000-0x00000214A7961000-memory.dmp

Download

memory/936-418-0x00000214A7960000-0x00000214A7961000-memory.dmp

Download

memory/1156-540-0x00007FFD171C0000-0x00007FFD171C1000-memory.dmp

Download

memory/1156-977-0x0000019443380000-0x0000019443496000-memory.dmp

Download

memory/1156-901-0x0000019443380000-0x0000019443496000-memory.dmp

Download

memory/1156-825-0x0000019443380000-0x0000019443496000-memory.dmp

Download

memory/1156-1405-0x0000019443380000-0x0000019443496000-memory.dmp

Download

memory/1188-1070-0x00000210C26E0000-0x00000210C27F6000-memory.dmp

Download

memory/2104-1309-0x0000026941D20000-0x0000026941D21000-memory.dmp

Download

memory/2104-1303-0x0000026941D20000-0x0000026941D21000-memory.dmp

Download

memory/2104-1305-0x0000026941D20000-0x0000026941D21000-memory.dmp

Download

memory/2104-1313-0x0000026941D20000-0x0000026941D21000-memory.dmp

Download

memory/2104-1311-0x0000026941D20000-0x0000026941D21000-memory.dmp

Download

memory/2104-1312-0x0000026941D20000-0x0000026941D21000-memory.dmp

Download

memory/2104-1310-0x0000026941D20000-0x0000026941D21000-memory.dmp

Download

memory/3352-857-0x000001D8A5E50000-0x000001D8A5F66000-memory.dmp

Download

memory/3900-690-0x00007FFD171C0000-0x00007FFD171C1000-memory.dmp

Download

memory/3900-826-0x0000018F59DB0000-0x0000018F59EC6000-memory.dmp

Download

memory/6440-1806-0x000002A749A70000-0x000002A749B86000-memory.dmp

Download

memory/6484-1075-0x00007FFD179E0000-0x00007FFD179E1000-memory.dmp

Download

memory/6484-1076-0x00007FFD179F0000-0x00007FFD179F1000-memory.dmp

Download