67705ebef1a7df037eefa8ddaae86b08d3e1536823b7ba4dbc817ecad5c33795

Analysis

user interaction
yes
max time kernel
257s
max time network
256s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 4.7MB
Sample261006-p4n3vsbv7k
SHA256 67705ebef1a7df037eefa8ddaae86b08d3e1536823b7ba4dbc817ecad5c33795
MD5 90d73de2a9592373e8f243bb0af85120
SHA1 e02977f55051ef6bd75962d4fe42a16d9c08b0a0
SHA512 7b7ebbcf1b1cfec0304079b003557208b6cefb6a60d37fde7c52e1eff7d4c0128f49c91270483ca8c7848f899f622f20d24fc19aa09b963ffaa3856a03b6a6da
SSDEEP 98304:H/0GX8q+2mfmRGAkdauNmzROt9oGCRh+ihqybgS1P61L1Aui:H/0Gsq+IdzROPCRwQ1nui
TLSH
T162360209E6E701F9CCA6C1BD8FD65417DB7278514338DAE702D14B160FABAE18E3E621
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
2124	PcAppStoreSRV.exe
236	AutoUpdater.exe
4704	PcAppStore.exe
2404	Watchdog.exe
2428	PCAppStore.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	PcAppStore.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\860464ef-4a65-4697-bb8f-879db777dcc8.tmp	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Trust Protection Lists\1.0.0.38\Mu\Other	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Site Characteristics Database\MANIFEST-000001	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\25174ffd-a798-4b2f-9ac7-416b51143994.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\54ee331a-b26d-42e4-9a97-fe71226c493f.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Trust Protection Lists\1.0.0.38\manifest.json	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\580dac31-aaf4-4cad-8b7b-6de93c5f43a8.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad\throttle_store.dat	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\ShaderCache\data_2	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Site Characteristics Database\LOG	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\57e4fca4-d7eb-4ee1-83af-29c32003717b.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\e648db9c-92ab-493c-afcc-bd16ed26047d.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\e9aea878-7d39-4a42-b34a-0917390ea4eb.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Preferences~RFe5bd8c8.TMP	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Extension Scripts\CURRENT	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\shared_proto_db\LOG	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00000c	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\optimization_guide_model_metadata_store\LOG	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\Network Persistent State~RFe5af09b.TMP	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\Microsoft.Management.Deployment.dll	PcAppStore.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Extension Scripts\MANIFEST-000001	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\GrShaderCache\data_0	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\DIPS-journal	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\PreferredApps	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\cache\1025217310.html	PcAppStore.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\280fd1a41df566bb_0	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State~RFe5bef9c.TMP	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\Watchdog.exe	Setup.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\ShaderCache\data_3	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Site Characteristics Database\000001.dbtmp	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\commerce_subscription_db\LOCK	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\418adf7b-b6bf-4a42-9635-fc3838d45700.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Shared Dictionary\cache\index	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\data_1	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\39d6e79c-d39f-4dd8-83bc-0a61cd054b82.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\GrShaderCache\data_1	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\4e0cde24a1be65b3_0	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\198bf92ca0c4cbfe_0	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000006	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000010	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000017	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\ad9918b106a26849_0	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\5a4e8534-d977-4e5c-9d3a-2146c7ab3e1c.tmp	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\DawnCache\data_3	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\shared_proto_db\000001.dbtmp	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\25174ffd-a798-4b2f-9ac7-416b51143994.tmp	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Session Storage\CURRENT	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000010	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db-journal	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State~RFe5a03ba.TMP	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\e359a18e-dd52-4abd-950f-03a726f6a5c7.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad\settings.dat	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\lockfile	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Visited Links	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Extension State\LOCK	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Extension State\000003.log	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\optimization_guide_hint_cache_store\LOCK	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Download Service\EntryDB\LOCK	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\edf6cafd-286d-4f87-b144-ff80be3ba0d7.tmp	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\parcel_tracking_db\LOCK	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index	msedgewebview2.exe
File created	C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\shared_proto_db\metadata\000001.dbtmp	msedgewebview2.exe

Drops file in Windows directory 29 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_761032924\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_761032924\Sigma\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_2072378143\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_761032924\Mu\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_761032924\Mu\Other	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_761032924\Sigma\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_761032924\Mu\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_761032924\Mu\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_761032924\Mu\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_2072378143\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_761032924\Mu\CompatExceptions	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_761032924\Mu\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_761032924\Mu\Staging	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_761032924\Mu\TransparentAdvertisers	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_761032924\Sigma\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_761032924\Sigma\Staging	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_2072378143\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_2072378143\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_761032924\Mu\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_761032924\Sigma\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_761032924\Sigma\Other	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_761032924\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_2072378143\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_761032924\Mu\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_761032924\Sigma\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_761032924\Mu\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_761032924\Sigma\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_761032924\Sigma\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_761032924\Sigma\Entities	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AutoUpdater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AutoUpdater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Watchdog.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PcAppStore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Watchdog.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\DefaultIcon	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\DefaultIcon\ = "C:\\Program Files (x86)\\PCAppStore\\PCAppStore.exe,1"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\shell\open\command	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\shell	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\ = "URL:PC App Store"	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\URL Protocol = "PcAppStore"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\shell\open	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PcAppStore\shell\open\command\ = "\"C:\\Program Files (x86)\\PCAppStore\\PCAppStore.exe\" /src=custom_protocol /query=\"%1\""	Setup.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
3120	Setup.exe
4704	PcAppStore.exe
4704	PcAppStore.exe
2404	Watchdog.exe
2404	Watchdog.exe
2428	PCAppStore.exe
2428	PCAppStore.exe
3008	msedgewebview2.exe
3008	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4604	msedgewebview2.exe
4604	msedgewebview2.exe
4604	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
4704	PcAppStore.exe
4704	PcAppStore.exe
4704	PcAppStore.exe
4704	PcAppStore.exe
4704	PcAppStore.exe
4704	PcAppStore.exe
4704	PcAppStore.exe
4704	PcAppStore.exe
4704	PcAppStore.exe
4704	PcAppStore.exe

Suspicious use of SendNotifyMessage 11 IoCs

pid	Process
4704	PcAppStore.exe
4704	PcAppStore.exe
4704	PcAppStore.exe
4704	PcAppStore.exe
4704	PcAppStore.exe
4704	PcAppStore.exe
4704	PcAppStore.exe
4704	PcAppStore.exe
4704	PcAppStore.exe
4704	PcAppStore.exe
4704	PcAppStore.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3120	Setup.exe
3120	Setup.exe
4704	PcAppStore.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 236	2124	PcAppStoreSRV.exe	90
PID 2124 wrote to memory of 4704	2124	PcAppStoreSRV.exe	91
PID 2124 wrote to memory of 2404	2124	PcAppStoreSRV.exe	92
PID 4704 wrote to memory of 4604	4704	PcAppStore.exe	94
PID 4604 wrote to memory of 1296	4604	msedgewebview2.exe	95
PID 4604 wrote to memory of 2888	4604	msedgewebview2.exe	96
PID 4604 wrote to memory of 2888	4604	msedgewebview2.exe	96
PID 4604 wrote to memory of 2888	4604	msedgewebview2.exe	96
PID 4604 wrote to memory of 2888	4604	msedgewebview2.exe	96
PID 4604 wrote to memory of 2072	4604	msedgewebview2.exe	97
PID 4604 wrote to memory of 5240	4604	msedgewebview2.exe	98
PID 4604 wrote to memory of 5240	4604	msedgewebview2.exe	98
PID 4604 wrote to memory of 5240	4604	msedgewebview2.exe	98
PID 4604 wrote to memory of 908	4604	msedgewebview2.exe	99
PID 4604 wrote to memory of 908	4604	msedgewebview2.exe	99
PID 4604 wrote to memory of 908	4604	msedgewebview2.exe	99
PID 4604 wrote to memory of 908	4604	msedgewebview2.exe	99
PID 4604 wrote to memory of 908	4604	msedgewebview2.exe	99
PID 4604 wrote to memory of 4292	4604	msedgewebview2.exe	100
PID 4604 wrote to memory of 4292	4604	msedgewebview2.exe	100
PID 4604 wrote to memory of 4292	4604	msedgewebview2.exe	100
PID 4604 wrote to memory of 4292	4604	msedgewebview2.exe	100
PID 4604 wrote to memory of 4292	4604	msedgewebview2.exe	100
PID 4604 wrote to memory of 4404	4604	msedgewebview2.exe	102
PID 4604 wrote to memory of 4404	4604	msedgewebview2.exe	102
PID 4604 wrote to memory of 4404	4604	msedgewebview2.exe	102
PID 4604 wrote to memory of 4404	4604	msedgewebview2.exe	102
PID 4604 wrote to memory of 4404	4604	msedgewebview2.exe	102
PID 4604 wrote to memory of 3008	4604	msedgewebview2.exe	106
PID 4604 wrote to memory of 4216	4604	msedgewebview2.exe	107
PID 4604 wrote to memory of 4216	4604	msedgewebview2.exe	107
PID 4604 wrote to memory of 4216	4604	msedgewebview2.exe	107
PID 4604 wrote to memory of 4544	4604	msedgewebview2.exe	108
PID 4604 wrote to memory of 4544	4604	msedgewebview2.exe	108
PID 4604 wrote to memory of 4544	4604	msedgewebview2.exe	108

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3120

C:\Program Files (x86)\PCAppStore\PcAppStoreSRV.exe
"C:\Program Files (x86)\PCAppStore\PcAppStoreSRV.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Program Files (x86)\PCAppStore\AutoUpdater.exe
  "C:\Program Files (x86)\PCAppStore\AutoUpdater.exe" /i /step=init
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:236
- C:\Program Files (x86)\PCAppStore\PcAppStore.exe
  "C:\Program Files (x86)\PCAppStore\PcAppStore.exe" /src=installer
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2050g --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4704.5508.16105076491068438057 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6
    3⤵
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4604
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" /prefetch:4 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffbe11b5fd8,0x7ffbe11b5fe4,0x7ffbe11b5ff0
      4⤵
      PID:1296
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2050g --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1780 --field-trial-handle=1776,i,12009872944009410957,4671238360706882572,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6
      4⤵
      PID:2888
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2050g --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2200 --field-trial-handle=1776,i,12009872944009410957,4671238360706882572,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6
      4⤵
      Drops file in Program Files directory
      PID:2072
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2050g --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2340 --field-trial-handle=1776,i,12009872944009410957,4671238360706882572,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6
      4⤵
      PID:5240
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2050g --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3368 --field-trial-handle=1776,i,12009872944009410957,4671238360706882572,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6 /prefetch:1
      4⤵
      PID:908
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2050g --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3972 --field-trial-handle=1776,i,12009872944009410957,4671238360706882572,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6 /prefetch:1
      4⤵
      PID:4292
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2050g --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4664 --field-trial-handle=1776,i,12009872944009410957,4671238360706882572,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6 /prefetch:1
      4⤵
      PID:4404
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2050g --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2160 --field-trial-handle=1776,i,12009872944009410957,4671238360706882572,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3008
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2050g --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4812 --field-trial-handle=1776,i,12009872944009410957,4671238360706882572,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6
      4⤵
      PID:4216
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView" --webview-exe-name=PcAppStore.exe --webview-exe-version=1.0.0.2050g --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4224 --field-trial-handle=1776,i,12009872944009410957,4671238360706882572,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:dd7c076ee12da623643afcf4f2b46c30d8c65cd6
      4⤵
      PID:4544
- C:\Program Files (x86)\PCAppStore\Watchdog.exe
  "C:\Program Files (x86)\PCAppStore\Watchdog.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2404

C:\Program Files (x86)\PCAppStore\PCAppStore.exe
"C:\Program Files (x86)\PCAppStore\PCAppStore.exe" /src=shortcut
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AutoUpdater.exe

Path C:\Program Files (x86)\PCAppStore\AutoUpdater.exe
Size 1.2MB
SHA256 112be38071e36cdcf5f66d092734442da7f08ab01e3a761c894903488dba20dc
MD5 53ef9bc5a05f25ed08e8f5c42c9019e8
SHA1 4a725678bdb4d18c552566e805c92e6a64ecc008
SHA512 06e6d146b79f392ce976f08677f05f9789fe14396556a0234896b26a3227c380a6247ec57d895aab3ca315ed998022b5c2e2673731379f28d61c2cd430835e7b
SSDEEP 24576:AqdMCkdxLsBYl5UPhs5aawQZ//xsjytjDsjkwAuETYCH0h0lhSMXlsBe4QF:ddfeu8H5IW
TLSH
T119556D1AA6A442F8D0BAD17CC652551EFA717C46837127C71384B9B22F377E4AE3E702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PCAppStore.exe

Path C:\Program Files (x86)\PCAppStore\PCAppStore.exe
Size 6.0MB
SHA256 a5f4334508308cdff7ef4a94c779b93cb101718666fb54e75ea1dd2a4236ce2b
MD5 1a65bac93192a9ed8cc47b56452f18aa
SHA1 d168815705a5aba2e8f405eaf6e2f0cd7da150d8
SHA512 6472a9c084169963ca8c26eb50e6cb9c5831a8d67babafd3e18773ac7bfb6d5231aa01ccbd30204595e4013a24278eeddd6f751d6a206ad319a96ba871aa6fdc
SSDEEP 49152:hQpZlgFDoDYREZgOJyocDd9vrYKXc4aVkQY9p4q40gycW2yE:hwNvZgXnh9Ds4IxB
TLSH
T1E256E76AE67641E5D5F9E139C262622BFC713C9EC230A357A7409B176B32721F63E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PCAppStoreSRV.exe

Path C:\Program Files (x86)\PCAppStore\PCAppStoreSRV.exe
Size 844KB
SHA256 d7f30a2be5265d82f61aea313a4ca719bd42cfa91d4da9b4e4d7cc945801a958
MD5 91a933c8fab51f274c801dc528775fee
SHA1 81358cd8f9c7fd772f871bfd181054f313fefbb2
SHA512 65eba97b44b291c3a67147fadc648709fa222d15f62108e7c6fb93c184a6422e877ec10bfbfc02c884cc0412f1700fee0e9378f2ba4503edf7264c10990792f2
SSDEEP 24576:LzqggkcjWdULW0WVonjcbh0lhSMXliQz3B:LzqgvcjWdUabwcqpB
TLSH
T182059E19EBA942F8D077C178C992654AFAB27C9A436067CB0391756B2F336E09D3F701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

21c692c0-60ae-4f9a-ae26-aa41dc341763.tmp

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\21c692c0-60ae-4f9a-ae26-aa41dc341763.tmp
Size 2KB
SHA256 d27a9e296534c62a3fbaf5e1624919e90c014ea94cfda6fb4a9773a3cbe3bb6d
MD5 140a41fb1fed9cbebfce61b2de91cd4b
SHA1 bbb85878e834e047cc8b998c4a8bba70475e2d9d
SHA512 0096dbcfbf0f13f92ad45d1d1951b8fa8d29862eaf7291f201a63d912a8039e4c5420eb53e27b4c073f59c649bbe9420779525ca84da79de106706d53a93f5ed
TLSH
T12F51A533B924AF73E9F3AB487A973F138A7451A2A6922F54A5EC0B1C00D724C5742C77
MD5 SHA1 SHA512 TLSH

Submit Download

418adf7b-b6bf-4a42-9635-fc3838d45700.tmp

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\418adf7b-b6bf-4a42-9635-fc3838d45700.tmp
Size 3KB
SHA256 bcaf79f606f80b82869a2c4feea98a52d1f2b9782eb8a4347050cbc77ae7e991
MD5 32ad39460074f5a694560ab1fe4d5b78
SHA1 0d8e11027e8caa59154f641a19075643fb66732d
SHA512 e23b0db711939a05cee79aa4be17e8777e1f1fb645920755b6b1ec4d565d38924358db4345cd9f699003db8bd92e9545f5c17f6e3f9cb42304876a01725a8077
TLSH
T1CA616237AA34AA779EF3AA0579C62B07A7B55123E5923F99D5EC0F1C01D728C1342C27
MD5 SHA1 SHA512 TLSH

Submit Download

5a4e8534-d977-4e5c-9d3a-2146c7ab3e1c.tmp

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\5a4e8534-d977-4e5c-9d3a-2146c7ab3e1c.tmp
Size 15KB
SHA256 56364e33b7e5e3392181ab7c6addebe7a325be7ba49feee6185e24b07f98bc00
MD5 eb61ac05b5435b070e1f3275a2c7b20d
SHA1 b5715064e2b1644f7ee221e30c9343882b4ed961
SHA512 1b4f9cedf05b0901152159dcdee3bc44a1f5d531c8cb957b02099f88f79c1cbefaa9264533ae49d5ad99867fde7a6ddfb6081038021cbd1adfcddf518db88197
SSDEEP 384:1+aQikB+z/xvxjg/qhEwNBSqyNi7yz/mck3Qly9zB:A/UxvxjgC+CNGL9kgyFB
TLSH
T1A9729D2B55293F23A6F3F6047A5A078BCFB4947291C26EAC89ED5F0D06C73980302C53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 70d9d36ee0a7e6d5e8b38cf389b29b3f098bad80158319e6fe93dee213013bc5
MD5 f60a8bfca4ac33bb3f82da3984574523
SHA1 ff8c404bc1682f773819b432ce9fff33e5b2ad2b
SHA512 1c9579d5f0eccd6b178c72354fb683dec858a984bf663032f89c0634122253cf6e9a9cd7b598e18d9d8f91d4480ca7117ab6c586ee7f06ca40806c09c51fd5af
TLSH
T126D02B7622260571C22431734581E1689400C51F410680001F35FE5C4BC44E10D85C41
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 40fe2a937442110e038cda5fdfc692b047d39168b9e6ce1ce44a05204ef2c291
MD5 a183a56c7a40f9f2f78fe7b112afbcc4
SHA1 1e91bf8cebd139068ea7d74af0d59c8e8881b428
SHA512 3cf6c9c7309ddc2ee481a1f1f27847d115bdad22c9a93ff7134eac195feb9092e0e7698f641fbbdb612add404f4c05877467a00383d0f556884f22de985d28c6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ca8caaf8e7e31b9fb7e7c207419f1e6f0490e775e4ff487c1d6f3bc672759d77
MD5 22e1d9f0c80b5fab4451a91d1e3b8f6b
SHA1 4841ff398ce89a320bdee3d2619b05d43e9a2dca
SHA512 f4a277b53f306a4dae804403c00ce82086479872fe92b210e550fb6cd7e5eaebb311a6bdebdc559a631799679a6a3723a6c2f22d1742f46f0e831e9b38ea1076
TLSH
T11AD0122632124174C0202473050261184800D50F811580005428CE5D5B884505A06841
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

580dac31-aaf4-4cad-8b7b-6de93c5f43a8.tmp

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\580dac31-aaf4-4cad-8b7b-6de93c5f43a8.tmp
Size 6KB
SHA256 99d323230d817b4c322ca3e912b9cf98b40b4792b56ef4ca393966c48e36267e
MD5 7da1b87a6984735108bc9d5d1ed139ca
SHA1 4795e563b79106bc7e24f1a81f1a447863de965c
SHA512 e89f3c1faff9effdec4159433234b7fd6770154988c678c5a28b647e4aa48847309a7c7cc2a7635cbd943d55c2a8cd4307bffc5f3d1520c83376bf1b3528c790
SSDEEP 96:stF/dbMBGib9Kk0o52t16ZEzs7/x+6Mhmuecmf91osz7UjekK+gO4O28XM1C7jL:st5Bf9oezsV+Faf9SszYj4g4OG6v
TLSH
T198E196025E287ABB8CC7F11DBA297A17E2F5607265D11E58E7F8492C04EB6DD630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000006

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000006
Size 37KB
SHA256 d7e8da8c6472c6a9b7fee72511bc35538bca07787d5cb217a0ea0aec4b35ce4f
MD5 b4086f18c8b613c2f99d3e703e1cf6be
SHA1 53fcef91c1d2262bcc3d96129de0ccc6b68d04f5
SHA512 906fb8977c77f10714037d03766302a8d03284447c9515ccc63d369e39d2918f2cfa9f17e3cbf92127b1ba0b6d02e1945a6e6c8bf6ae32c3f836c79c9180ab48
SSDEEP 768:OGuscZx3YSP3BFuPaAT8q+qYC7pMhEXcypWjC+meryPhai:OtscZ6iEPh81HC7uEXc4CCzeryPV
TLSH
T1100302B91C3106B41CAED8510D9EDB4A543CEE91B851D8BE24846FF9FB8C876014FEA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000007

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000007
Size 21KB
SHA256 96b1cf561261e4529c6fdb4f641f4b4393ab7596e5deb7d877c4d822b7c23783
MD5 4ffef3a5eb0f8a457374d519ce15c5f4
SHA1 ba553ff52a24e7002cf6b3a4433bb6fefd95bd46
SHA512 a4c4c40bb77a23528104482add99c824da9643f808eddd54e58e8a353c17cab5a64699e3bb874d77445c6f40b5d3af3b96b2b06c786d30422951177a1778ea90
SSDEEP 384:Sd9Fnu3wG8cdF+640CIGSz+3wqe9HzqqaATf0qvglBhn+CRiyizI:SJu044KUElPaAT8q+qY40
TLSH
T12BA2E1893533C8382E47BF77FADE99C7522C785A650D4889444C65BAB619CBBE303485
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000f

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00000f
Size 828KB
SHA256 e14e2f0e0d85e16c09710ce4b796e2f06c351ebd6b38487a7835e57265c325af
MD5 f9062df925823d7cffeec3555d9193bb
SHA1 9a108ea6416a94ed4d972a73e3c3ad23b835b193
SHA512 662c4cc881ea002f68fd821eeb9778f1d44a2855336ac14667523273d0be3b7584656448081cee6d3ee21cc418482e9872610b1439b02b9fc4533733622768ae
SSDEEP 24576:QyY3jeeEkhTgtCwGlhQkmfd0p4RGfxT4qY6kNS1r:FY3ie3TlGkWd04QxT4B+
TLSH
T1310502CCDDB85D93FD8856F9C3DFC28EA625429B6EB30449AA338621D65E24F110F463
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000010

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000010
Size 378KB
SHA256 3d21de561fd4db81c80adf3ce16a3d1541e0ff09e27eecbf4ada94a9533e7a28
MD5 fa0f8fd97b81385ea1c2365d3e0ad1ac
SHA1 3802b2087059fbabff1dd10721076648b4e9e9c6
SHA512 ce1b5ccb961b0f743e73f2be44719644ca5a593b226483017479c46ff88127d082dd74469e09645d67ae35aa8d302c90541d809e291c3316e249e313258d3292
SSDEEP 6144:33DbTQDjfnp8Q33+6j4ELZNjjUr/DEaDFmbMZGUKc4q7PNKFQMEaoQQrrA//yhoz:3sDLfUWpjKLZE7UN4qbNMQMHozr6G89D
TLSH
T1878423C703E922BBF972E3B8A44D2F1B1C816C0E85B5E4517C4C337A92A0397AA555E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000011

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000011
Size 1024KB
SHA256 3bc3308766a618943f0139164487251bf0e346b4567fbb9d24373ced0dc83ab5
MD5 6a302a819790e7eb24e8fb9783b3479f
SHA1 1b7568a5d35d08b8c0009ba61b11e94501f0e6bc
SHA512 c16f85ead8277b621a30cb1be53a6741003599ec8ccd216bf1ec9e623ed2cb462af2dd4c92c47177605f44130031896f9fde6a55df5592222c0a8fda31011f59
SSDEEP 24576:88LTFOFMVbIVJ/OAYAYWtylcfVp/pS85qptFVF:88nFtOVNvDtm8gFVF
TLSH
T18625238DEDBA4C83FD6566F9C3EBC28EAA5010979F33058C92664704FB2C76E064B547
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000012

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000012
Size 939KB
SHA256 8fb3706d50c57b7305d0500261cc94ed66ac9e8fde1957de3e90b703ecdea653
MD5 46c07f08ad76070e1913c51d6c63a81d
SHA1 52493a32f3ce2cbeccfd90d3e30799f665f8b76d
SHA512 edd3f5edd83e4958022aeabdf5f60d5136724376b7d435aaddd6b2d2f2137fa175ab3870ea911cc8d5fbb4f438b5c6e7b2160e37c0dd631ccdd6518179242dad
SSDEEP 24576:Mk6VGL+W0M4gutgSdmi++M8hBUZJrDuTNgOQD+r9JFZEEt:M0/0n/++/BUZJmJjQarQEt
TLSH
T1D42523D5DC79AEF3D88C28FB87DEC25D561C850E7E33105869A60B25C39D62F622B813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000013

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000013
Size 1024KB
SHA256 cf6ffa63969ae2e3ad2a05a598834db4834528472952d7b1ab0e6b3d399d2fd3
MD5 d656196b1bb66bd836792040b0745bc5
SHA1 3580ae974cf9e7ed1cd75bc046f5eb582cd5b649
SHA512 e5cd524cad915acf0efe371d526ad36c0d053eaff374d6476cd7c459d4dddfa46256b056458ed943ecc9f18c991a4332160b8be3a9a01937d78aa22845d7df55
SSDEEP 24576:v12HNYG5isBfbEmQ1FQ1lYPnsBbQ2eJ44VnjkeDC4:kHNnxQclOnlJ4GnjNDN
TLSH
T1BA2533245F60A709FBF6A070C2209D5D39620EE4ECED5B9BDD1F0B6BA0C8BF49542479
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000014

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000014
Size 106KB
SHA256 63f4b301f3e6e3c43e872f1f0487d0e741729bfc57b17c82771ba3b49f7b748e
MD5 03488470a97bdb8c2fa969650475d1cb
SHA1 252574dafb074db9ec9171d32809e96c9e140b4a
SHA512 8141c12b750f5aee8c6fea087d2623b9e8d6aa1345a6eac478571ae6df107484283239abb092746b9983969bcf3e009268dfba4286121aabce104b7ee7e2e319
SSDEEP 3072:iZ511Wan8NJeqo+AGShAEUuZWFbA4Q1c3w9ILa:g51d95hAEUKWFc4QSA9ma
TLSH
T120B312F55920E8F39E8671B564E19AEB8CCD4FF95C3127818D8B035807CD72CA21C87A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000017

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000017
Size 25KB
SHA256 cdec4cf166addf7f5ed4ca4924b666f6608146e96c49a4267c78b3241834ae69
MD5 8fed412188b9a605290144fc7db8d73a
SHA1 69ce6ffb044d24b4d8ff01ed42fa43eb985ff949
SHA512 af820aa931133b8f8abf4f985c926c08ea644a930b6660763285edf0f5a2599138c676e38e6b1bc263ec7a9d4ac1fcba0ce5fb4ebe607c1a0487873db58d6371
SSDEEP 768:Hk9+w0WkjipeBe2lXpOwoOBgLkNkCP5cIFW5kcsKJ4:Hsr7kWpeBeq5O3tw2CPHJT
TLSH
T10BC2E17D3A5F5C00F5F29E0183D2E5A8CCAEAB59D7E06A8853682901F7E714D03166AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000018

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_000018
Size 129KB
SHA256 a8fe2e0b6d64141ffa055f9270db1c8809ecf1dad0c5098f9a8e80a48c9d935d
MD5 9b5f66c0099cab4b2763ce6a5b6aa6fa
SHA1 850f70d3f449ff695e2c104aa877b974d8653f6a
SHA512 1d5c5e2897d491b6dbe401bfc0d8865465ed066109a3e16efee3db503059fd1c32368a589d0c4145e3ef583040e196cfe9ff19e16ecdf7ed833e50c550b0df94
SSDEEP 3072:MnG9TtG2R5uqfyndUhNCdHBMhshoyeG8386qH:MG9TY2R5u4yn+yhRhoLG8y
TLSH
T10DD312C9F6BF110A858CE69C6BD1CEA40E45DD9E7188F362378D8E56C3B2D81705EC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001a

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00001a
Size 523KB
SHA256 77b30a47769433617478358d075f62a65431162d9d51edf0631a1bb5616c8137
MD5 294780c4e0eef5026a1de8e39b29844f
SHA1 cd258e4cc4ffadc569b19edc3209a8cff3946ea3
SHA512 c9b694bf8449e00fa54b2c4786cdb34f73aae74ea0f9e030645f8019218276d89d33fc63678011c503cf3151853c8ca27d3418d56d5a15b188ab3de36076499e
SSDEEP 12288:z5I7hyurlfUGwMA2jBs6pp6zPdGG+XqUhl16DfLWhfrH:za9y2l8GwMLjBs6pp68GPRqr
TLSH
T1D5B41244C84DD7FBC010B6729B9FF7877B4C012A039605D6A9FA45C2DA89E1DE24AF63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001b

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00001b
Size 967KB
SHA256 6313deebf9c5acdbfb4fd52703c2a74b42013424ea413582b506198c04c4452f
MD5 584a641ccb2890d9b26f0e0c67ea6e29
SHA1 5dd9a7c69cd3d7d93d53a3ed44253c6f87b2dd8f
SHA512 82e31f09059d4211910b4b6cfec9ffa675ea981e9ecf0b380aa07138d6edb6cba631d8270c5ac2cc3079a287ceedac1fc17b559ffe7438f1cc74918ec3ea8030
SSDEEP 24576:+cFyJB0aQGvXTMnzgptkOj0HdXZLoLZ0ltzA1FboAWEg/y:+fPaAAnzg7qHdZot0P8Sy
TLSH
T1B12523A3D323CF39E26A73F7EA863E8E492C118C961B16871F556760C76964C1C36933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001c

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00001c
Size 518KB
SHA256 eb718097678138e218f48dd1f2eba6039305b57c28aa13d63ec96972e73031eb
MD5 6e99ab099273196aa455f17b62112b8b
SHA1 632e7d924fccfcc087af18c0386428870cce5cbc
SHA512 a5b2401f1d1803097b186a206e37fcd03b7b107c9bc07771c8680b8bec4a471746da836c380f78a1e3989351264b1bbbc7355948c590d4cfe59e4facf5928a17
SSDEEP 12288:8rkXQucT0sPuywsdAZw9/8B17Ve6AOO6znoxc1PWGwu3QfIBKjX:zXxQ0xyvAKu706AOO6xkKgwBKjX
TLSH
T11FB41249CE24FFF3C1199271D78FD6823B0C809B47A50047F8E18685DAD8E5C95ABE5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001d

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00001d
Size 355KB
SHA256 5d954a43ce448aa43a9cbc5476968aedff087c7223eb8f0a42dd0a067851cc85
MD5 f5c39ac184f6a47c93954c07b7abedf8
SHA1 344993ad2e649e088b9bfa7bdb5682ce97f97474
SHA512 6ca138d7a775c9fdf4de03e721d58df7af935d5f26f16ffccc8daed858df3285138366af60f0d070cbd8367ee646df736293bbb82ebe372f3840483b897bf1f4
SSDEEP 6144:sq7VsABw2tZfr1wT3Z1TdJja0CRwfIXT/En+1598nJUIe2M14:sesABJpwT3ZZDjaGQCm59EJZo14
TLSH
T18974E194CC19EBB7C568A673E75FE3872B0C441B03D20156B8F292D1DAD8A1CE267E53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001e

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00001e
Size 472KB
SHA256 dc06485362d8382dd1398f6c129a2ef00020c67d12af4aa204a4ff1522586c50
MD5 76395adde1774a8b5d0e5407115ffe2f
SHA1 ac1d012a426eb11ecbb44d1b181e70a63725d68d
SHA512 25f823c3f06f907bf5d13e2b5c07fcb11dc884f09629e5b305f4fc87642468f7493ace95863efad878a9d095cbb2e841e65275e5f20e4ecfd2e163a28a692d23
SSDEEP 12288:q3tTYKn+33es+BXNpYSKRC1xChN1IhGUbWmU69HfpPLi2Rj:qTYKn+Os+lyRC16mpUwHf9Rj
TLSH
T197A41284DE59DBB2C5656572E78BF7463F0C406B03F34A86BCE50881EE88E2C907AD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001f

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Cache\Cache_Data\f_00001f
Size 249KB
SHA256 f169d8821baadf9f76dbcd9582604662e3212918c69d7e46e7bbca2937ecba09
MD5 5c3f1c6a3341611841d5c7af3a7a2917
SHA1 48a8eec126d9cb43c5d4fd3d4a7482c0a5d49737
SHA512 d5095fbcccf0539e3a80c7b66367ed9920e23390cf446c6e7452ae66cb04352095546577694d1b5974e8e95675f6cf7b813347ecc9c393c90e2e64a6fc1e6247
SSDEEP 6144:MBidWztIdbQ3ar/WXjNkJI9HTppS0Ewuq3XkvQPe7:MBoQar/0yJCbFc4kT
TLSH
T1B8442333F5AE080FD0F11A606D110ECAED8F175138629B61385840EA7CA6EFEF755879
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 240B
SHA256 86cf2045d2e56f156d6da60b4591529396636b1f98e58d877bf74c2473f877cf
MD5 30f9c1c29abdb69fbafa9596e4f80f3e
SHA1 15e988a00428ec1261e392bcc732b052579f6558
SHA512 3226d762ba218cd9235615927c9706bc260cdc3e7b9d9321e15c5c54d261e1cbdfa94365474b5daf98b9d6a952743457905795d38e8deff638e30a18471b7291
TLSH
T161D012888C9A01D3CBAB54FA70CC4B4C37B27871318B0F63A38941F0BC3A3D48580628
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 472c36997c431e4ae8c35e802b8aa1d5754e55e7b11e1ac2f914747615ce2ed5
MD5 e2761394d182d87ea2016a02bf148597
SHA1 696517d0fd59dc21382fc59c1d89ddf9a3a5ac94
SHA512 28666366c420c0e98e0080447ba7c184a851bf38185d018df2422266b3fe7c7de2d19a846d0f0dfc699860ff75cd44725f0faa9770d96f1b26ffd30801438927
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

0b95c837-020e-49ec-9203-c5a907d5826a.tmp

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\0b95c837-020e-49ec-9203-c5a907d5826a.tmp
Size 690B
SHA256 2542b679221f2579b857e70ad16f2d0e829a93eb5b37d4581bbfd5db21c0e4e8
MD5 2da4cf7c1adf4e11fa700c4f0a3aa60f
SHA1 6d41b23ac9ea9861839d7c6c7354bf9f3976a1d8
SHA512 54814c9cd266b78ec658a3796a375dbe27f8f6e9823f6f36dc6a579471e7ef46d9917c044b54aa1806a9e32b89a61aad0d2b69cbfc5fef716981c3e62e110d0a
TLSH
T1ED0147E282BFE53710BC596B2A507C02297D7932625290FCFA93966D30858FF4B01813
MD5 SHA1 SHA512 TLSH

Submit Download

1d5950bb-28a3-4512-884b-e05759781435.tmp

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\1d5950bb-28a3-4512-884b-e05759781435.tmp
Size 690B
SHA256 d3f62a81e37aaaeb4bff234cf89d7788af4a6e88e69cf48b878a0544c266ed7e
MD5 1d7a7ec21889417cee3722a59a7a5915
SHA1 4fd22cf69060a92d92614d82dd103f00b4cf27bc
SHA512 abb59fc5b61881d61d8e5419d3b2b32c8bb3570e43ad0ddb5daa70ffe1f2bb1177703e3433ebd551c627fac9be2405f6cfdec103fd6b8f05adf49fe9544201f8
TLSH
T133014CE281BBE57710BD596B2E517C01297D7D36615290FCEA53966D70C18BB0701812
MD5 SHA1 SHA512 TLSH

Submit Download

54ee331a-b26d-42e4-9a97-fe71226c493f.tmp

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\54ee331a-b26d-42e4-9a97-fe71226c493f.tmp
Size 690B
SHA256 668e4f524964b544f5b73be025baa17aad742443ad43f6ff2fd1dd8b34c63ae0
MD5 1addc44c17dfcb73110ac7cca4167078
SHA1 4ce7c05c766c08ca564415b697e3d736867d1b24
SHA512 93e47ecf1b847ee02d4f4c6b9ae14d3c1a1a246771496e0f1094240e30b69d91c650f92b0343c92af02c2a234ccd52c5e84376eb66df2ad53e54077b88dcbf95
TLSH
T10D014CD282BBF63310BC596B1E41BC01297D7D32625290FCEA93976D30818BB4701812
MD5 SHA1 SHA512 TLSH

Submit Download

63a2a535-efd7-41ad-878e-2b391e09d876.tmp

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\63a2a535-efd7-41ad-878e-2b391e09d876.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\Network Persistent State
Size 84B
SHA256 712196693e3527ac1131831f1a2108b6c0e5c68967b26d51a452611cdfb86e0c
MD5 32b9dc9cc81d0682e78627c873fdd651
SHA1 46c486386d3e153c3e9b11d54cb52cf0064b71cf
SHA512 f18bc37f8b72411548da247aa1394cc5ac03c3bbd98e82eb8ba290ef239ef5b8625cf4835bd41ce7c52766d0bc3bfe9150dd22dbf62f0f05992ddde5fbfdc811
TLSH
T154A0121490405CFB0308835504146463C3F50002421848A91634318D019209D0004403
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\TransportSecurity
Size 690B
SHA256 accd7d3b745a1cd5ed3be6eee46dd35446bc1b2871bb3d288ec233ca9fdbf8e6
MD5 32d436caad9165a4c1aae9336e4c7e2e
SHA1 7d608521377abbf14a05ddd59623056ec8c33261
SHA512 bf604402cbbd003d4b67d9da5d75eaec6e69727bf446c9b2dae3799e6a37f6b816fe4c8d189d617adb310c268de219dd5d12c40a7eec65c135fcc853af93f78a
TLSH
T1060147E282BBF53310BC696B1A807D022ABD7D32215290FCEA53966D30818FF0B01813
MD5 SHA1 SHA512 TLSH

Submit Download

edf6cafd-286d-4f87-b144-ff80be3ba0d7.tmp

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Network\edf6cafd-286d-4f87-b144-ff80be3ba0d7.tmp
Size 1KB
SHA256 5978b688d4f83460d3dc11989e473c4ff2871edf50336a338f1a8f7c80b85e3f
MD5 8c7810e61249f5e391b3114c64c428c6
SHA1 157259bf9a2af0ffcf763c7f7b8545fa1328702b
SHA512 71f5f745e2cda0cf357e93ff85cd140b154d933e954719044dfd59d2440e150d6f088fd924a84fdcb6a89370c50f8d7030eebc8d02e2aa611254c9ed146e3ed6
TLSH
T1B231ACEA4BE4897DFE8122F97A612C1FCE5D1521031C6B3AC4E07F6A97E0460E30460F
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

e359a18e-dd52-4abd-950f-03a726f6a5c7.tmp

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Default\e359a18e-dd52-4abd-950f-03a726f6a5c7.tmp
Size 6KB
SHA256 0a7f20f480a0532c68553648552550c18a2493441cd9f9ba40750051d3e4c80f
MD5 bd277972ff6d2fa1acaddba18610d35e
SHA1 ccbb63ea8e7ae68fc1e7de6255756f7318536fa2
SHA512 91a622358bbce6f00835f9457b815ecedf345ca8798003c1c283a360b8f38b961d048321341ed8a1bb348101d6686bd8dd24896bcbfd8172bea1ecfa866385b7
SSDEEP 96:stF/dbMaib9Kk0o52t16ZEzs7/x+6Mhmuecmf91oyrM1JjekK+gO1P28XM1C7jL:st5B19oezsV+Faf9SyrCj4g1PG6v
TLSH
T190D196025E287ABB8CC6F10DBA397A17E2F5612275D11D58EBF84A2C04DB6DD6307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Program Files (x86)\PCAppStore\UserData\Admin\EBWebView\Local State
Size 1KB
SHA256 261c0450ba74b1d37eeb337d90048b037e1bfbb5d6d96604df96ea2f24ebefdb
MD5 773744d2e2d77b80507e8684f6f8732d
SHA1 fe032d13059367da5b86f17e1b2055718a026e6b
SHA512 d48e414fc83ebfe224a814d9c6812637262d9a571affa6ba8eb3306004458a6d6e6dae931655a42b6aa838be11210a98d3c90f7c7bcc2c6839affea0a9a2c267
TLSH
T1E62112B2E2285B73FD97774622966A070E7011A782514F4865DD8B1C01D714DD96AC37
MD5 SHA1 SHA512 TLSH

Submit Download

Watchdog.exe

Path C:\Program Files (x86)\PCAppStore\Watchdog.exe
Size 871KB
SHA256 b3d44f7beb5942ae5c1bb07518891cf436a9641e790c4457975bf13ba6502e9d
MD5 cfb51a1c8ee1699a04e6f2358c338184
SHA1 bc1b8ac81458a143a6ef248da781829035b46c85
SHA512 95592ecae326418550c7838691a66d3ab9c43b3899d8395890acdade41d9468be7bbcdac1be9bedb6ce97206c7d371785bdb6c76394c34132330e5ef3eaddbab
SSDEEP 24576:WD4RyI3SibBot1LuFlcgKh0lhSMXl6Ik6:c4RyI3SibBot1LMZ
TLSH
T16E159E1AE6A942FCD07AC1798AA66546F7B27C46432156CF039136A73F336E05E3F702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2046527703.html

Path C:\Program Files (x86)\PCAppStore\cache\2046527703.html
Size 56KB
SHA256 d44c4c8718d308f92c3dddc3211bc64a33cac3e75237f53c7c5747466e56001c
MD5 fd0f568b4ae8c4f8d0b8f8dd6035f8e9
SHA1 7fa45feeea8fa5d924c761103f1a65ffab1f7a0b
SHA512 dfae6346c56ca3d5a24cb53efb77a375c5518d62add6e79745a443eed98e72f47cc54ba559c2bcb85c795bfbaf4fd99bc4fc2a13f224d78b59dde560e7c4d4f4
SSDEEP 768:rWRyBT0E34ahCLYjxakc64AXmDmC9aJCTHIY4wvmlLmlPpncDImlNgeoGmU4BoVl:iRyBT33ZCiy69qeFSnEma
TLSH
T1EF43C54DBAFB50748023717D4F6F8A443234B0272589CC14BE9C89A4AF5453D9BB6EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cache_setup.json

Path C:\Program Files (x86)\PCAppStore\cache\cache_setup.json
Size 8KB
SHA256 a0116dfc85f8ec4296fd318048379294722e683f1395a42275b5b15e33ad1616
MD5 da67d79c26aab66635bc57e262bf56f4
SHA1 34ca0afd3fd582e0243d1b58ffd769cc75d06bc0
SHA512 4e563fbb4dc6cc1ba84af7c320a5e709b8eb0512f6a49fd853ca071936893e22fd49b5f40d08ffb843285300875e345b82d8fcc25471db9247d676224a0653c8
SSDEEP 96:WF1DkRlCDQII+PN5BOEE2fCfvDEjYUzjszrQckuEwXQ2/vjIhUEvCj1vulceQI99:WnIC7BqXDE0cwDnPGWlGcbQXMIpjNBN
TLSH
T17702A3B78C111F5FB012A6DD8C9B3C49C7A994313F5275E5D79A28629060678F8CA21F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

773CFF2C7835D48C4E76FE153DBA9F81_D9070B80E002B56309375EAD5B6A198F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\773CFF2C7835D48C4E76FE153DBA9F81_D9070B80E002B56309375EAD5B6A198F
Size 471B
SHA256 d4a45789bb5c5ae6c1aad0e96b99f34d889265ebeadb4c8555f860ca08884258
MD5 646c3f9e2dfa21f31f42a27a2b84098f
SHA1 9d916006dc8a56341dfb143e8955f15ef33b4746
SHA512 2ffb65d0b7115d46d9e5a792b0cd72c7531f29e95f9126328516df042a949a43ff59bbdb65e051f6da039e76f3ec7443e54bd45744646e996ff6dda8c499a7c0
TLSH
T112F0544303D174602D7788D52F6981053C879C794000D07096A8859B0816F851C14143
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE
Size 471B
SHA256 1f772cec489e79f226950f56a85928cc09a504b967ee5f71687a7212cdf73852
MD5 12211e10030cbda5ee7f650c2ca85e2b
SHA1 6d0219586ddb28d66c45b9f06db0a787d62efb3f
SHA512 ad164138ceded813d0c21f7932118cd2ae31cf26cadac586fdac1ee7dee7bff1b1eb35cd23ca85a5cb7632005f0b2954e4d254f5395673a594106b0fbd2e075d
TLSH
T1A6F0DCA6602FFA2C2F8258FC244A4839B432F0784588A5827CB808C359905AD6CAC9EC
MD5 SHA1 SHA512 TLSH

Submit Download

773CFF2C7835D48C4E76FE153DBA9F81_D9070B80E002B56309375EAD5B6A198F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\773CFF2C7835D48C4E76FE153DBA9F81_D9070B80E002B56309375EAD5B6A198F
Size 416B
SHA256 d37c9b49e5c4aff95d415c390a1af655f4077e7aa12c59f7726f648fd18115a4
MD5 f1e602ce776e10466c23441b940617fc
SHA1 8a89cd86f168a3755ab6de2fba585ba234e6a98b
SHA512 6cea805da7332aea528fc654cb6ea86a13dfe702ea755403d59517ee44f1ef629e30cd62fd8c0143703a8e6d5adf4c9309dcd8a25702da789cf72109866d81e8
TLSH
T1B6E0C0191EFE81DCF272DC3743E945668E0EF0334C058AA22B78530FA66B640FC32524
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_C39E9DBC666D19C07EEE7CD1E11AF8BE
Size 412B
SHA256 913003d3e69c376ce5cc2232de6ce7bb9edf7bb2e62f61140cfc450919379ed3
MD5 c90b9e43055c1a5a21de3a354b14df2a
SHA1 039d44293f53d295d6bd0431a52441d51940644c
SHA512 4aec1aae8756d263ddcd6a5b48531980b44a497cf74db5499ee72073fd36be22a13fe536d17e15dd079e769efebcc9a8cf2e67e68566fd6f32931997da791ffb
TLSH
T109E0683822FE411CF1B5E8349BD8B43285ADF1250816A2B029C06700A216A00DC669B2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_2072378143\manifest.json
Size 102B
SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
MD5 19322c8a94f1ac01a70f8c58cdbbc720
SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
TLSH
T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
MD5 SHA1 SHA512 TLSH

Submit Download

Other

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_761032924\Sigma\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_761032924\manifest.json
Size 132B
SHA256 de864bf0ab8abacfba536d4e9764eca658f903bd2457f955e128c4ee181c7e58
MD5 c9209ab189a035569ba3c65d7375d220
SHA1 1987aaec8f436325415fe36c168c9a37829523f9
SHA512 60495e096f78de05c6025a9d7b69aef9dce0d08ec1abbd4ccba206827a8c25d8449f54f93637599649762ec09a034d32fc8afc06199b1b57cd010ff1a0c850c0
TLSH
T17FC092615802797A14DEB7F00D29CB926AB3CB2E18A4650546F5C228ED2DCDFB5B330B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/908-217-0x00007FFC02B10000-0x00007FFC02B11000-memory.dmp

Download

memory/908-422-0x0000019D68C10000-0x0000019D68CC2000-memory.dmp

Download

memory/2888-87-0x00007FFC02B10000-0x00007FFC02B11000-memory.dmp

Download

memory/2888-404-0x000002DB0F870000-0x000002DB0F922000-memory.dmp

Download

memory/2888-769-0x000002DB0F870000-0x000002DB0F922000-memory.dmp

Download

memory/3008-649-0x000001A16F630000-0x000001A16F631000-memory.dmp

Download

memory/3008-647-0x000001A16F630000-0x000001A16F631000-memory.dmp

Download

memory/3008-643-0x000001A16F630000-0x000001A16F631000-memory.dmp

Download

memory/3008-641-0x000001A16F630000-0x000001A16F631000-memory.dmp

Download

memory/3008-648-0x000001A16F630000-0x000001A16F631000-memory.dmp

Download

memory/3008-650-0x000001A16F630000-0x000001A16F631000-memory.dmp

Download

memory/3008-651-0x000001A16F630000-0x000001A16F631000-memory.dmp

Download

memory/3008-652-0x000001A16F630000-0x000001A16F631000-memory.dmp

Download

memory/4216-660-0x00007FFC02670000-0x00007FFC02671000-memory.dmp

Download

memory/4216-659-0x00007FFC02990000-0x00007FFC02991000-memory.dmp

Download

memory/4292-451-0x000001C7CE970000-0x000001C7CEA22000-memory.dmp

Download

memory/4292-461-0x000001C7CE970000-0x000001C7CEA22000-memory.dmp

Download

memory/4404-456-0x000001B5EFD50000-0x000001B5EFE02000-memory.dmp

Download