Edit tour

Windows Analysis Report
https://pcapp.store/pixel.gif

Overview

General Information

Sample URL:	https://pcapp.store/pixel.gif
Analysis ID:	1546627
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Blob-based file download detected

Creates multiple autostart registry keys

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

OS version to string mapping found (often used in BOTs)

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries keyboard layouts

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Tries to disable installed Antivirus / HIPS / PFW

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 2848 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7000 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2008,i,7092667227049171613,2672400075963886792,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7568 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3228 --field-trial-handle=2008,i,7092667227049171613,2672400075963886792,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7580 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4020 --field-trial-handle=2008,i,7092667227049171613,2672400075963886792,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7964 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4208 --field-trial-handle=2008,i,7092667227049171613,2672400075963886792,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

Setup.exe (PID: 4204 cmdline: "C:\Users\user\Downloads\Setup.exe" MD5: CE1DA93BC7DF56983CE05CBC5E83C4B1)

chrome.exe (PID: 1436 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://pcapp.store/installing.php?guid=0CC82742-52E4-CC1D-A08F-D3A4823E8F04&winver=19045&version=fa.1092c&nocache=20241101044703.142&_fcid=1730450804060690 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

nsrDE1D.tmp (PID: 4060 cmdline: "C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp" /internal 1730450804060690 /force MD5: 84EE733F8014D22DAD2DFEF725489980)

PcAppStore.exe (PID: 5960 cmdline: "C:\Users\user\PCAppStore\PcAppStore.exe" /init default MD5: 4B88D8ADA8D22622C30D581FC38EAA52)

explorer.exe (PID: 4380 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

PcAppStore.exe (PID: 7984 cmdline: "C:\Users\user\PCAppStore\PcAppStore.exe" /init default showM MD5: 4B88D8ADA8D22622C30D581FC38EAA52)

PcAppStore.exe (PID: 3788 cmdline: "C:\Users\user\PCAppStore\PcAppStore.exe" /init default showM MD5: 4B88D8ADA8D22622C30D581FC38EAA52)

NW_store.exe (PID: 7584 cmdline: .\nwjs\NW_store.exe .\ui\. MD5: E472E46BDFD736351D4B086B4C4CA134)

NW_store.exe (PID: 8000 cmdline: C:\Users\user\PCAppStore\nwjs\NW_store.exe --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\pc_app_store\User Data" /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\user\AppData\Local\pc_app_store\User Data" --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\pc_app_store\User Data\Crashpad" "--metrics-dir=C:\Users\user\AppData\Local\pc_app_store\User Data" --annotation=plat=Win64 --annotation=prod=pc_app_store --annotation=ver=0.1.0 --initial-client-data=0x240,0x244,0x248,0x23c,0x24c,0x7fff32eda960,0x7fff32eda970,0x7fff32eda980 MD5: E472E46BDFD736351D4B086B4C4CA134)

NW_store.exe (PID: 4048 cmdline: C:\Users\user\PCAppStore\nwjs\NW_store.exe --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\pc_app_store\User Data" /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\pc_app_store\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=pc_app_store --annotation=ver=0.1.0 --initial-client-data=0x1b4,0x1b8,0x1bc,0x194,0x1c0,0x7ff76bd58a60,0x7ff76bd58a70,0x7ff76bd58a80 MD5: E472E46BDFD736351D4B086B4C4CA134)

NW_store.exe (PID: 4736 cmdline: "C:\Users\user\PCAppStore\nwjs\NW_store.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\user\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2036 --field-trial-handle=2052,i,9912710646978768218,3650411500597378476,262144 --variations-seed-version /prefetch:2 MD5: E472E46BDFD736351D4B086B4C4CA134)

NW_store.exe (PID: 8064 cmdline: "C:\Users\user\PCAppStore\nwjs\NW_store.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\user\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --start-stack-profiler --mojo-platform-channel-handle=2268 --field-trial-handle=2052,i,9912710646978768218,3650411500597378476,262144 --variations-seed-version /prefetch:3 MD5: E472E46BDFD736351D4B086B4C4CA134)

NW_store.exe (PID: 7380 cmdline: "C:\Users\user\PCAppStore\nwjs\NW_store.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --no-sandbox --user-data-dir="C:\Users\user\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --mojo-platform-channel-handle=2504 --field-trial-handle=2052,i,9912710646978768218,3650411500597378476,262144 --variations-seed-version /prefetch:8 MD5: E472E46BDFD736351D4B086B4C4CA134)

NW_store.exe (PID: 7320 cmdline: "C:\Users\user\PCAppStore\nwjs\NW_store.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --nwjs --extension-process --no-appcompat-clear --no-sandbox --file-url-path-alias="/gen=C:\Users\user\PCAppStore\nwjs\gen" --no-zygote --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1730444082539097 --launch-time-ticks=6808286653 --mojo-platform-channel-handle=2604 --field-trial-handle=2052,i,9912710646978768218,3650411500597378476,262144 --variations-seed-version /prefetch:2 MD5: E472E46BDFD736351D4B086B4C4CA134)

NW_store.exe (PID: 1608 cmdline: "C:\Users\user\PCAppStore\nwjs\NW_store.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-GB --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\user\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --mojo-platform-channel-handle=3980 --field-trial-handle=2052,i,9912710646978768218,3650411500597378476,262144 --variations-seed-version /prefetch:8 MD5: E472E46BDFD736351D4B086B4C4CA134)

Watchdog.exe (PID: 716 cmdline: "C:\Users\user\PCAppStore\Watchdog.exe" /guid=0CC82742-52E4-CC1D-A08F-D3A4823E8F04 /rid=20241101044756.2806793562 /ver=fa.1092c MD5: 11F3801CB9FF046D6075F681971C4EB8)

chrome.exe (PID: 6640 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://pcapp.store/pixel.gif" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\PCAppStore\PCAppStore.exe" /init default, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp, ProcessId: 4060, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PCAppStore

Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	ReversingLabs: Detection: 37%
Source: C:\Users\user\PCAppStore\Uninstaller.exe	ReversingLabs: Detection: 29%

Source: https://pcapp.store/pixel.gif	HTTP Parser: No favicon
Source: https://pcapp.store/	HTTP Parser: No favicon
Source: https://pcapp.store/	HTTP Parser: No favicon
Source: https://pcapp.store/	HTTP Parser: No favicon
Source: https://pcapp.store/	HTTP Parser: No favicon
Source: https://pcapp.store/	HTTP Parser: No favicon
Source: https://pcapp.store/	HTTP Parser: No favicon
Source: https://pcapp.store/	HTTP Parser: No favicon
Source: https://pcapp.store/	HTTP Parser: No favicon
Source: https://pcapp.store/	HTTP Parser: No favicon
Source: https://pcapp.store/	HTTP Parser: No favicon
Source: https://pcapp.store/	HTTP Parser: No favicon
Source: https://pcapp.store/	HTTP Parser: No favicon
Source: https://pcapp.store/?p=lpd_installing_r2&guid=0CC82742-52E4-CC1D-A08F-D3A4823E8F04&_fcid=1730450804060690&_winver=19045&version=fa.1092c	HTTP Parser: No favicon
Source: https://pcapp.store/?p=lpd_installing_r2&guid=0CC82742-52E4-CC1D-A08F-D3A4823E8F04&_fcid=1730450804060690&_winver=19045&version=fa.1092c	HTTP Parser: No favicon
Source: https://pcapp.store/?p=lpd_installing_r2&guid=0CC82742-52E4-CC1D-A08F-D3A4823E8F04&_fcid=1730450804060690&_winver=19045&version=fa.1092c	HTTP Parser: No favicon

Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	File created: C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.js.LICENSE.txt			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	File created: C:\Users\user\PCAppStore\ReadMe.txt			Jump to behavior

Source: chrome.exe, 00000000.00000003.2424688887.0000700C04A99000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000000.00000003.2424688887.0000700C04A99000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000000.00000003.2424688887.0000700C04A99000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000000.00000003.2424688887.0000700C04A99000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)

Source: vulkan-1.dll.16.dr	Static PE information: Number of sections : 11 > 10
Source: libEGL.dll.16.dr	Static PE information: Number of sections : 12 > 10
Source: vk_swiftshader.dll.16.dr	Static PE information: Number of sections : 11 > 10
Source: node.dll.16.dr	Static PE information: Number of sections : 11 > 10
Source: libGLESv2.dll.16.dr	Static PE information: Number of sections : 12 > 10
Source: notification_helper.exe.16.dr	Static PE information: Number of sections : 13 > 10
Source: nw.dll.16.dr	Static PE information: Number of sections : 15 > 10
Source: ffmpeg.dll.16.dr	Static PE information: Number of sections : 11 > 10
Source: NW_store.exe.16.dr	Static PE information: Number of sections : 13 > 10
Source: nw_elf.dll.16.dr	Static PE information: Number of sections : 14 > 10

Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Mutant created: \Sessions\1\BaseNamedObjects\mfx_d3d_mutex
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ChromeProcessSingletonStartup!

Source: C:\Users\user\Downloads\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Downloads\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Downloads\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Downloads\Setup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor

Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: nsrDE1D.tmp, 00000010.00000002.2164256961.0000000002C6B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000015.00000000.2062339851.00007FF7D1432000.00000008.00000001.01000000.00000016.sdmp	Binary or memory string: SELECT sql FROM%d UNION ALL SELECT shell_add_schema(sql,mainNULL,name) AS sql, type, tbl_name, name, rowid, AS snum, AS sname FROM .sqlite_schema UNION ALL SELECT shell_module_schema(name), 'table', name, name, name, 9e+99, 'main' FROM pragma_module_list) WHERE %Qlower(printf('%s.%s',sname,tbl_name))lower(tbl_name) GLOB LIKE ESCAPE '\' AND name NOT LIKE 'sqlite_%%' AND sql IS NOT NULL ORDER BY snum, rowidSQL: %s;
Source: nsrDE1D.tmp, 00000010.00000002.2164256961.0000000002C6B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000015.00000000.2062339851.00007FF7D1432000.00000008.00000001.01000000.00000016.sdmp	Binary or memory string: INSERT INTO sqlite_schema(type,name,tbl_name,rootpage,sql)VALUES('table','%q','%q',0,'%q');%s
Source: nsrDE1D.tmp, 00000010.00000002.2164256961.0000000002C6B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000015.00000000.2062339851.00007FF7D1432000.00000008.00000001.01000000.00000016.sdmp	Binary or memory string: CREATE TABLE ColNames( cpos INTEGER PRIMARY KEY, name TEXT, nlen INT, chop INT, reps INT, suff TEXT);CREATE VIEW RepeatedNames AS SELECT DISTINCT t.name FROM ColNames t WHERE t.name COLLATE NOCASE IN ( SELECT o.name FROM ColNames o WHERE o.cpos<>t.cpos);
Source: nsrDE1D.tmp, 00000010.00000002.2164256961.0000000002C6B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000015.00000000.2062339851.00007FF7D1432000.00000008.00000001.01000000.00000016.sdmp	Binary or memory string: SELECT type,name,tbl_name,sql FROM sqlite_schema ORDER BY name;
Source: nsrDE1D.tmp, 00000010.00000002.2164256961.0000000002C6B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000015.00000000.2062339851.00007FF7D1432000.00000008.00000001.01000000.00000016.sdmp	Binary or memory string: SELECT key, quote(value) FROM temp.sqlite_parameters;
Source: NW_store.exe, 0000001A.00000003.2206408972.000001BAEC491000.00000004.00000020.00020000.00000000.sdmp, NW_store.exe, 0000001A.00000003.2211510307.000001BAEC491000.00000004.00000020.00020000.00000000.sdmp, NW_store.exe, 0000001A.00000003.2196934902.000001BAEC487000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO 'main'.sqlite_master VALUES('index','stats_origin','stats',#1,'CREATE INDEX stats_origin ON stats(origin_domain)');page=#2
Source: chrome.exe, 00000000.00000003.2416598935.0000700C049E8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: NW_store.exe, 0000001A.00000003.2206408972.000001BAEC491000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO 'main'.sqlite_master VALUES('index','sqlite_autoindex_psl_extensions_1','psl_extensions',#4,NULL);
Source: nsrDE1D.tmp, 00000010.00000002.2164256961.0000000002C6B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000015.00000000.2062339851.00007FF7D1432000.00000008.00000001.01000000.00000016.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: nsrDE1D.tmp, 00000010.00000002.2164256961.0000000002C6B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000015.00000000.2062339851.00007FF7D1432000.00000008.00000001.01000000.00000016.sdmp	Binary or memory string: SELECT * FROM "%w" ORDER BY rowid DESC;
Source: NW_store.exe, 0000001A.00000003.2206408972.000001BAEC491000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO 'main'.sqlite_master VALUES('index','sqlite_autoindex_psl_extensions_1','psl_extensions',#4,NULL);H
Source: NW_store.exe, 0000001A.00000003.2196934902.000001BAEC487000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO 'main'.sqlite_master VALUES('index','sqlite_autoindex_meta_1','meta',#4,NULL);
Source: NW_store.exe, 0000001A.00000003.2206408972.000001BAEC491000.00000004.00000020.00020000.00000000.sdmp, NW_store.exe, 0000001A.00000003.2196934902.000001BAEC487000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO 'main'.sqlite_master VALUES('index','sqlite_autoindex_masked_ibans_1','masked_ibans',#4,NULL);
Source: nsrDE1D.tmp, 00000010.00000002.2164256961.0000000002C6B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000015.00000000.2062339851.00007FF7D1432000.00000008.00000001.01000000.00000016.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: nsrDE1D.tmp, 00000010.00000002.2164256961.0000000002C6B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000015.00000000.2062339851.00007FF7D1432000.00000008.00000001.01000000.00000016.sdmp	Binary or memory string: SELECT max(length(key)) FROM temp.sqlite_parameters;
Source: nsrDE1D.tmp, 00000010.00000002.2164256961.0000000002C6B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000015.00000000.2062339851.00007FF7D1432000.00000008.00000001.01000000.00000016.sdmp	Binary or memory string: SELECT 'CREATE TEMP' \|\| substr(sql, 7) FROM sqlite_schema WHERE tbl_name = %Q AND type IN ('table', 'trigger') ORDER BY type;
Source: NW_store.exe, 0000001A.00000003.2211510307.000001BAEC422000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO 'main'.sqlite_master VALUES('index','index_on_eq_groups_set_id_index','eq_class_groups',#1,'CREATE INDEX index_on_eq_groups_set_id_index ON eq_class_groups (set_id)');
Source: nsrDE1D.tmp, 00000010.00000002.2164256961.0000000002C6B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000015.00000000.2062339851.00007FF7D1432000.00000008.00000001.01000000.00000016.sdmp	Binary or memory string: INSERT INTO selftest(tno,op,cmd,ans) SELECT rowid*10,op,cmd,ans FROM [_shell$self];
Source: nsrDE1D.tmp, 00000010.00000002.2164256961.0000000002C6B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000015.00000000.2062339851.00007FF7D1432000.00000008.00000001.01000000.00000016.sdmp	Binary or memory string: SELECT * FROM "%w" ORDER BY rowid DESC;Warning: cannot step "%s" backwardsSELECT name, sql FROM sqlite_schema WHERE %sError: (%d) %s on [%s]
Source: nsrDE1D.tmp, 00000010.00000002.2164256961.0000000002C6B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000015.00000000.2062339851.00007FF7D1432000.00000008.00000001.01000000.00000016.sdmp	Binary or memory string: INSERT INTO sqlite_schema(type,name,tbl_name,rootpage,sql)VALUES('table','%q','%q',0,'%q');
Source: NW_store.exe, 0000001A.00000003.2211510307.000001BAEC422000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO 'main'.sqlite_master VALUES('index','index_on_eq_groups_set_id_index','eq_class_groups',#1,'CREATE INDEX index_on_eq_groups_set_id_index ON eq_class_groups (set_id)');g
Source: nsrDE1D.tmp, 00000010.00000002.2164256961.0000000002C6B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000015.00000000.2062339851.00007FF7D1432000.00000008.00000001.01000000.00000016.sdmp	Binary or memory string: SELECT tbl,idx,stat FROM sqlite_stat1 ORDER BY tbl,idx;
Source: nsrDE1D.tmp, 00000010.00000002.2164256961.0000000002C6B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000015.00000000.2062339851.00007FF7D1432000.00000008.00000001.01000000.00000016.sdmp	Binary or memory string: SELECT 'EXPLAIN QUERY PLAN SELECT 1 FROM ' \|\| quote(s.name) \|\| ' WHERE ' \|\| group_concat(quote(s.name) \|\| '.' \|\| quote(f.[from]) \|\| '=?' \|\| fkey_collate_clause( f.[table], COALESCE(f.[to], p.[name]), s.name, f.[from]),' AND '), 'SEARCH ' \|\| s.name \|\| ' USING COVERING INDEX(' \|\| group_concat('=?', ' AND ') \|\| ')', s.name \|\| '(' \|\| group_concat(f.[from], ', ') \|\| ')', f.[table] \|\| '(' \|\| group_concat(COALESCE(f.[to], p.[name])) \|\| ')', 'CREATE INDEX ' \|\| quote(s.name \|\|'_'\|\| group_concat(f.[from], '_')) \|\| ' ON ' \|\| quote(s.name) \|\| '(' \|\| group_concat(quote(f.[from]) \|\| fkey_collate_clause( f.[table], COALESCE(f.[to], p.[name]), s.name, f.[from]), ', ') \|\| ');', f.[table] FROM sqlite_schema AS s, pragma_foreign_key_list(s.name) AS f LEFT JOIN pragma_table_info AS p ON (pk-1=seq AND p.arg=f.[table]) GROUP BY s.name, f.id ORDER BY (CASE WHEN ? THEN f.[table] ELSE s.name END)
Source: nsrDE1D.tmp, 00000010.00000002.2164256961.0000000002C6B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000015.00000000.2062339851.00007FF7D1432000.00000008.00000001.01000000.00000016.sdmp	Binary or memory string: SELECT 'CREATE TEMP' \|\| substr(sql, 7) FROM sqlite_schema WHERE tbl_name = %Q AND type IN ('table', 'trigger') ORDER BY type;ALTER TABLE temp.%Q RENAME TO %QINSERT INTO %Q VALUES(, %s?)UPDATE %Q SET , %s%Q=?DELETE FROM %QSELECT type, name, sql, 1 FROM sqlite_schema WHERE type IN ('table','view') AND name NOT LIKE 'sqlite_%%' UNION ALL SELECT type, name, sql, 2 FROM sqlite_schema WHERE type = 'trigger' AND tbl_name IN(SELECT name FROM sqlite_schema WHERE type = 'view') ORDER BY 4, 1CREATE TABLE x(, %s%Q COLLATE %s)CREATE VIRTUAL TABLE %Q USING expert(%Q)SELECT max(i.seqno) FROM sqlite_schema AS s, pragma_index_list(s.name) AS l, pragma_index_info(l.name) AS i WHERE s.type = 'table', %sx.%Q IS rem(%d, x.%Q) COLLATE %s%s%dSELECT %s FROM %Q x ORDER BY %sSELECT %s FROM temp.t592690916721053953805701627921227776 x ORDER BY %s%d %dDROP TABLE IF EXISTS temp.t592690916721053953805701627921227776CREATE TABLE temp.t592690916721053953805701627921227776 AS SELECT * FROM %QSELECT s.rowid, s.name, l.name FROM sqlite_schema AS s, pragma_index_list(s.name) AS l WHERE s.type = 'table'SELECT name, coll FROM pragma_index_xinfo(?) WHERE keyINSERT INTO sqlite_stat1 VALUES(?, ?, ?)ANALYZE; PRAGMA writable_schema=1remsampleDROP TABLE IF EXISTS temp.t592690916721053953805701627921227776ANALYZE sqlite_schemaDROP TABLE IF EXISTS temp.t592690916721053953805701627921227776:memory::memory:SELECT sql FROM sqlite_schema WHERE name NOT LIKE 'sqlite_%%' AND sql NOT LIKE 'CREATE VIRTUAL %%'Cannot find a unique index name to propose. -- stat1: %s;%s%s
Source: NW_store.exe, 0000001A.00000003.2211510307.000001BAEC422000.00000004.00000020.00020000.00000000.sdmp, NW_store.exe, 0000001A.00000003.2195717842.000001BAEC5AA000.00000004.00000020.00020000.00000000.sdmp, NW_store.exe, 0000001A.00000003.2196934902.000001BAEC557000.00000004.00000020.00020000.00000000.sdmp, NW_store.exe, 0000001A.00000003.2196934902.000001BAEC526000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: nsrDE1D.tmp, 00000010.00000002.2164256961.0000000002C6B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000015.00000000.2062339851.00007FF7D1432000.00000008.00000001.01000000.00000016.sdmp	Binary or memory string: INSERT OR IGNORE INTO "%s" VALUES(?,?);Error %d: %s on [%s]
Source: nsrDE1D.tmp, 00000010.00000002.2164256961.0000000002C6B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000015.00000000.2062339851.00007FF7D1432000.00000008.00000001.01000000.00000016.sdmp	Binary or memory string: SELECT name,seq FROM sqlite_sequence ORDER BY name;
Source: NW_store.exe, 0000001A.00000003.2196934902.000001BAEC487000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO 'main'.sqlite_master VALUES('index','sqlite_autoindex_meta_1','meta',#4,NULL);ked_credit_cards', rootpage=#2, sql=
Source: NW_store.exe, 0000001A.00000003.2206408972.000001BAEC491000.00000004.00000020.00020000.00000000.sdmp, NW_store.exe, 0000001A.00000003.2211510307.000001BAEC491000.00000004.00000020.00020000.00000000.sdmp, NW_store.exe, 0000001A.00000003.2196934902.000001BAEC487000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO 'main'.sqlite_master VALUES('index','stats_origin','stats',#1,'CREATE INDEX stats_origin ON stats(origin_domain)');

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2008,i,7092667227049171613,2672400075963886792,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://pcapp.store/pixel.gif"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3228 --field-trial-handle=2008,i,7092667227049171613,2672400075963886792,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4020 --field-trial-handle=2008,i,7092667227049171613,2672400075963886792,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4208 --field-trial-handle=2008,i,7092667227049171613,2672400075963886792,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\Setup.exe "C:\Users\user\Downloads\Setup.exe"
Source: C:\Users\user\Downloads\Setup.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://pcapp.store/installing.php?guid=0CC82742-52E4-CC1D-A08F-D3A4823E8F04&winver=19045&version=fa.1092c&nocache=20241101044703.142&_fcid=1730450804060690
Source: C:\Users\user\Downloads\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp "C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp" /internal 1730450804060690 /force
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	Process created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PcAppStore.exe" /init default
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	Process created: C:\Users\user\PCAppStore\Watchdog.exe "C:\Users\user\PCAppStore\Watchdog.exe" /guid=0CC82742-52E4-CC1D-A08F-D3A4823E8F04 /rid=20241101044756.2806793562 /ver=fa.1092c
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PcAppStore.exe" /init default showM
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process created: C:\Users\user\PCAppStore\nwjs\NW_store.exe .\nwjs\NW_store.exe .\ui\.
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process created: C:\Users\user\PCAppStore\nwjs\NW_store.exe C:\Users\user\PCAppStore\nwjs\NW_store.exe --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\pc_app_store\User Data" /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\user\AppData\Local\pc_app_store\User Data" --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\pc_app_store\User Data\Crashpad" "--metrics-dir=C:\Users\user\AppData\Local\pc_app_store\User Data" --annotation=plat=Win64 --annotation=prod=pc_app_store --annotation=ver=0.1.0 --initial-client-data=0x240,0x244,0x248,0x23c,0x24c,0x7fff32eda960,0x7fff32eda970,0x7fff32eda980
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process created: C:\Users\user\PCAppStore\nwjs\NW_store.exe C:\Users\user\PCAppStore\nwjs\NW_store.exe --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\pc_app_store\User Data" /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\pc_app_store\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=pc_app_store --annotation=ver=0.1.0 --initial-client-data=0x1b4,0x1b8,0x1bc,0x194,0x1c0,0x7ff76bd58a60,0x7ff76bd58a70,0x7ff76bd58a80
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process created: C:\Users\user\PCAppStore\nwjs\NW_store.exe "C:\Users\user\PCAppStore\nwjs\NW_store.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\user\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2036 --field-trial-handle=2052,i,9912710646978768218,3650411500597378476,262144 --variations-seed-version /prefetch:2
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process created: C:\Users\user\PCAppStore\nwjs\NW_store.exe "C:\Users\user\PCAppStore\nwjs\NW_store.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\user\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --start-stack-profiler --mojo-platform-channel-handle=2268 --field-trial-handle=2052,i,9912710646978768218,3650411500597378476,262144 --variations-seed-version /prefetch:3
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process created: C:\Users\user\PCAppStore\nwjs\NW_store.exe "C:\Users\user\PCAppStore\nwjs\NW_store.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --no-sandbox --user-data-dir="C:\Users\user\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --mojo-platform-channel-handle=2504 --field-trial-handle=2052,i,9912710646978768218,3650411500597378476,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process created: C:\Users\user\PCAppStore\nwjs\NW_store.exe "C:\Users\user\PCAppStore\nwjs\NW_store.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --nwjs --extension-process --no-appcompat-clear --no-sandbox --file-url-path-alias="/gen=C:\Users\user\PCAppStore\nwjs\gen" --no-zygote --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1730444082539097 --launch-time-ticks=6808286653 --mojo-platform-channel-handle=2604 --field-trial-handle=2052,i,9912710646978768218,3650411500597378476,262144 --variations-seed-version /prefetch:2
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process created: C:\Users\user\PCAppStore\nwjs\NW_store.exe "C:\Users\user\PCAppStore\nwjs\NW_store.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-GB --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\user\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --mojo-platform-channel-handle=3980 --field-trial-handle=2052,i,9912710646978768218,3650411500597378476,262144 --variations-seed-version /prefetch:8
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PcAppStore.exe" /init default showM
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2008,i,7092667227049171613,2672400075963886792,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3228 --field-trial-handle=2008,i,7092667227049171613,2672400075963886792,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4020 --field-trial-handle=2008,i,7092667227049171613,2672400075963886792,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4208 --field-trial-handle=2008,i,7092667227049171613,2672400075963886792,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\Setup.exe "C:\Users\user\Downloads\Setup.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://pcapp.store/installing.php?guid=0CC82742-52E4-CC1D-A08F-D3A4823E8F04&winver=19045&version=fa.1092c&nocache=20241101044703.142&_fcid=1730450804060690	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp "C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp" /internal 1730450804060690 /force	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	Process created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PcAppStore.exe" /init default	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	Process created: C:\Users\user\PCAppStore\Watchdog.exe "C:\Users\user\PCAppStore\Watchdog.exe" /guid=0CC82742-52E4-CC1D-A08F-D3A4823E8F04 /rid=20241101044756.2806793562 /ver=fa.1092c	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process created: C:\Users\user\PCAppStore\nwjs\NW_store.exe .\nwjs\NW_store.exe .\ui\.	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PcAppStore.exe" /init default showM	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PcAppStore.exe" /init default showM	Jump to behavior
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process created: C:\Users\user\PCAppStore\nwjs\NW_store.exe C:\Users\user\PCAppStore\nwjs\NW_store.exe --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\pc_app_store\User Data" /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\user\AppData\Local\pc_app_store\User Data" --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\pc_app_store\User Data\Crashpad" "--metrics-dir=C:\Users\user\AppData\Local\pc_app_store\User Data" --annotation=plat=Win64 --annotation=prod=pc_app_store --annotation=ver=0.1.0 --initial-client-data=0x240,0x244,0x248,0x23c,0x24c,0x7fff32eda960,0x7fff32eda970,0x7fff32eda980
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process created: C:\Users\user\PCAppStore\nwjs\NW_store.exe "C:\Users\user\PCAppStore\nwjs\NW_store.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\user\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2036 --field-trial-handle=2052,i,9912710646978768218,3650411500597378476,262144 --variations-seed-version /prefetch:2
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process created: C:\Users\user\PCAppStore\nwjs\NW_store.exe "C:\Users\user\PCAppStore\nwjs\NW_store.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\user\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --start-stack-profiler --mojo-platform-channel-handle=2268 --field-trial-handle=2052,i,9912710646978768218,3650411500597378476,262144 --variations-seed-version /prefetch:3
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process created: C:\Users\user\PCAppStore\nwjs\NW_store.exe "C:\Users\user\PCAppStore\nwjs\NW_store.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --no-sandbox --user-data-dir="C:\Users\user\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --mojo-platform-channel-handle=2504 --field-trial-handle=2052,i,9912710646978768218,3650411500597378476,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process created: C:\Users\user\PCAppStore\nwjs\NW_store.exe "C:\Users\user\PCAppStore\nwjs\NW_store.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --nwjs --extension-process --no-appcompat-clear --no-sandbox --file-url-path-alias="/gen=C:\Users\user\PCAppStore\nwjs\gen" --no-zygote --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1730444082539097 --launch-time-ticks=6808286653 --mojo-platform-channel-handle=2604 --field-trial-handle=2052,i,9912710646978768218,3650411500597378476,262144 --variations-seed-version /prefetch:2
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process created: C:\Users\user\PCAppStore\nwjs\NW_store.exe "C:\Users\user\PCAppStore\nwjs\NW_store.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-GB --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\user\AppData\Local\pc_app_store\User Data" --nwapp-path=".\ui\." --no-appcompat-clear --mojo-platform-channel-handle=3980 --field-trial-handle=2052,i,9912710646978768218,3650411500597378476,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process created: C:\Users\user\PCAppStore\nwjs\NW_store.exe C:\Users\user\PCAppStore\nwjs\NW_store.exe --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\pc_app_store\User Data" /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\pc_app_store\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=pc_app_store --annotation=ver=0.1.0 --initial-client-data=0x1b4,0x1b8,0x1bc,0x194,0x1c0,0x7ff76bd58a60,0x7ff76bd58a70,0x7ff76bd58a80

Source: C:\Users\user\Downloads\Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Section loaded: mskeyprotect.dll	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: PC App Store.lnk.16.dr	LNK file: ..\..\..\..\..\..\PCAppStore\PcAppStore.exe

Source: vulkan-1.dll.16.dr	Static PE information: real checksum: 0x0 should be: 0xe0b14
Source: System.dll.16.dr	Static PE information: real checksum: 0x0 should be: 0x3d68
Source: nsJSON.dll.16.dr	Static PE information: real checksum: 0x0 should be: 0x6718
Source: nsJSON.dll.14.dr	Static PE information: real checksum: 0x0 should be: 0x6718
Source: libEGL.dll.16.dr	Static PE information: real checksum: 0x0 should be: 0x7ddc6
Source: vk_swiftshader.dll.16.dr	Static PE information: real checksum: 0x0 should be: 0x44caa7
Source: inetc.dll.16.dr	Static PE information: real checksum: 0x0 should be: 0x13c41
Source: inetc.dll.14.dr	Static PE information: real checksum: 0x0 should be: 0x13c41
Source: System.dll.14.dr	Static PE information: real checksum: 0x0 should be: 0x3d68
Source: e74cc629-2643-4c2d-83a5-14cbab20c252.tmp.0.dr	Static PE information: real checksum: 0x3937f should be: 0x33912
Source: nsDialogs.dll.14.dr	Static PE information: real checksum: 0x0 should be: 0x2f9b
Source: libGLESv2.dll.16.dr	Static PE information: real checksum: 0x0 should be: 0x7b9652
Source: notification_helper.exe.16.dr	Static PE information: real checksum: 0x0 should be: 0x11edb8
Source: NSISFastLib.dll.14.dr	Static PE information: real checksum: 0x0 should be: 0x30512
Source: ffmpeg.dll.16.dr	Static PE information: real checksum: 0x0 should be: 0x1f8136
Source: NW_store.exe.16.dr	Static PE information: real checksum: 0x0 should be: 0x23ab08
Source: nw_elf.dll.16.dr	Static PE information: real checksum: 0x0 should be: 0x124d11
Source: Math.dll.16.dr	Static PE information: real checksum: 0x0 should be: 0x155a8
Source: NSISFastLib.dll.16.dr	Static PE information: real checksum: 0x0 should be: 0x30512

Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Code function: 32_3_00007FFF76444110 push ecx; ret	32_3_00007FFF76444136
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Code function: 32_3_00007FFF764470A7 push ebp; iretd	32_3_00007FFF764470A8
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Code function: 32_3_00007FFF76446720 push ecx; ret	32_3_00007FFF76446746
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Code function: 32_3_00007FFF76408267 push eax; ret	32_3_00007FFF7640826D
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Code function: 32_3_00007FFF76407D52 push ecx; retf	32_3_00007FFF76407D53

Source: vk_swiftshader.dll.16.dr	Static PE information: section name: .gxfg
Source: vk_swiftshader.dll.16.dr	Static PE information: section name: .retplne
Source: vk_swiftshader.dll.16.dr	Static PE information: section name: .voltbl
Source: vk_swiftshader.dll.16.dr	Static PE information: section name: _RDATA
Source: vulkan-1.dll.16.dr	Static PE information: section name: .gxfg
Source: vulkan-1.dll.16.dr	Static PE information: section name: .retplne
Source: vulkan-1.dll.16.dr	Static PE information: section name: .voltbl
Source: vulkan-1.dll.16.dr	Static PE information: section name: _RDATA
Source: NW_store.exe.16.dr	Static PE information: section name: .gxfg
Source: NW_store.exe.16.dr	Static PE information: section name: .retplne
Source: NW_store.exe.16.dr	Static PE information: section name: .voltbl
Source: NW_store.exe.16.dr	Static PE information: section name: CPADinfo
Source: NW_store.exe.16.dr	Static PE information: section name: _RDATA
Source: NW_store.exe.16.dr	Static PE information: section name: malloc_h
Source: ffmpeg.dll.16.dr	Static PE information: section name: .gxfg
Source: ffmpeg.dll.16.dr	Static PE information: section name: .retplne
Source: ffmpeg.dll.16.dr	Static PE information: section name: .voltbl
Source: ffmpeg.dll.16.dr	Static PE information: section name: _RDATA
Source: libEGL.dll.16.dr	Static PE information: section name: .gxfg
Source: libEGL.dll.16.dr	Static PE information: section name: .retplne
Source: libEGL.dll.16.dr	Static PE information: section name: .voltbl
Source: libEGL.dll.16.dr	Static PE information: section name: _RDATA
Source: libEGL.dll.16.dr	Static PE information: section name: malloc_h
Source: libGLESv2.dll.16.dr	Static PE information: section name: .gxfg
Source: libGLESv2.dll.16.dr	Static PE information: section name: .retplne
Source: libGLESv2.dll.16.dr	Static PE information: section name: .voltbl
Source: libGLESv2.dll.16.dr	Static PE information: section name: _RDATA
Source: libGLESv2.dll.16.dr	Static PE information: section name: malloc_h
Source: node.dll.16.dr	Static PE information: section name: .gxfg
Source: node.dll.16.dr	Static PE information: section name: .retplne
Source: node.dll.16.dr	Static PE information: section name: .voltbl
Source: node.dll.16.dr	Static PE information: section name: _RDATA
Source: notification_helper.exe.16.dr	Static PE information: section name: .gxfg
Source: notification_helper.exe.16.dr	Static PE information: section name: .retplne
Source: notification_helper.exe.16.dr	Static PE information: section name: .voltbl
Source: notification_helper.exe.16.dr	Static PE information: section name: CPADinfo
Source: notification_helper.exe.16.dr	Static PE information: section name: _RDATA
Source: notification_helper.exe.16.dr	Static PE information: section name: malloc_h
Source: nw.dll.16.dr	Static PE information: section name: .gxfg
Source: nw.dll.16.dr	Static PE information: section name: .retplne
Source: nw.dll.16.dr	Static PE information: section name: .rodata
Source: nw.dll.16.dr	Static PE information: section name: .voltbl
Source: nw.dll.16.dr	Static PE information: section name: CPADinfo
Source: nw.dll.16.dr	Static PE information: section name: LZMADEC
Source: nw.dll.16.dr	Static PE information: section name: _RDATA
Source: nw.dll.16.dr	Static PE information: section name: malloc_h
Source: nw_elf.dll.16.dr	Static PE information: section name: .crthunk
Source: nw_elf.dll.16.dr	Static PE information: section name: .gxfg
Source: nw_elf.dll.16.dr	Static PE information: section name: .retplne
Source: nw_elf.dll.16.dr	Static PE information: section name: .voltbl
Source: nw_elf.dll.16.dr	Static PE information: section name: CPADinfo
Source: nw_elf.dll.16.dr	Static PE information: section name: _RDATA
Source: nw_elf.dll.16.dr	Static PE information: section name: malloc_h

Source: C:\Users\user\Downloads\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	File created: C:\Users\user\PCAppStore\nwjs\nw_elf.dll	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\e74cc629-2643-4c2d-83a5-14cbab20c252.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	File created: C:\Users\user\AppData\Local\Temp\nsl346B.tmp\nsJSON.dll	Jump to dropped file
Source: C:\Users\user\Downloads\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsyBD07.tmp\nsDialogs.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	File created: C:\Users\user\PCAppStore\nwjs\notification_helper.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	File created: C:\Users\user\PCAppStore\nwjs\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	File created: C:\Users\user\AppData\Local\Temp\nsl346B.tmp\Math.dll	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Unconfirmed 997642.crdownload (copy)	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Setup.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	File created: C:\Users\user\PCAppStore\nwjs\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	File created: C:\Users\user\PCAppStore\nwjs\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	File created: C:\Users\user\PCAppStore\Watchdog.exe	Jump to dropped file
Source: C:\Users\user\Downloads\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsyBD07.tmp\NSISFastLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	File created: C:\Users\user\PCAppStore\Uninstaller.exe	Jump to dropped file
Source: C:\Users\user\Downloads\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsyBD07.tmp\inetc.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	File created: C:\Users\user\PCAppStore\nwjs\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	File created: C:\Users\user\PCAppStore\nwjs\node.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	File created: C:\Users\user\PCAppStore\nwjs\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	File created: C:\Users\user\PCAppStore\nwjs\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\Downloads\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsyBD07.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	File created: C:\Users\user\AppData\Local\Temp\nsl346B.tmp\NSISFastLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	File created: C:\Users\user\PCAppStore\nwjs\nw.dll	Jump to dropped file
Source: C:\Users\user\Downloads\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsyBD07.tmp\nsJSON.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	File created: C:\Users\user\PCAppStore\AutoUpdater.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	File created: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	File created: C:\Users\user\AppData\Local\Temp\nsl346B.tmp\inetc.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	File created: C:\Users\user\PCAppStore\PcAppStore.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	File created: C:\Users\user\AppData\Local\Temp\nsl346B.tmp\System.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdater	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Watchdog	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PCAppStore	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk	Jump to behavior

Source: C:\Users\user\Downloads\Setup.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\PcAppStore.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	Dropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsl346B.tmp\nsJSON.dll	Jump to dropped file
Source: C:\Users\user\Downloads\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsyBD07.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Downloads\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsyBD07.tmp\nsDialogs.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	Dropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\notification_helper.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	Dropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsl346B.tmp\NSISFastLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsl346B.tmp\Math.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	Dropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\nw.dll	Jump to dropped file
Source: C:\Users\user\Downloads\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsyBD07.tmp\nsJSON.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	Dropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	Dropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Downloads\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsyBD07.tmp\NSISFastLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	Dropped PE file which has not been started: C:\Users\user\PCAppStore\AutoUpdater.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	Dropped PE file which has not been started: C:\Users\user\PCAppStore\Uninstaller.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsl346B.tmp\inetc.dll	Jump to dropped file
Source: C:\Users\user\Downloads\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsyBD07.tmp\inetc.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsl346B.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	Dropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\libGLESv2.dll	Jump to dropped file

Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 1436	Thread sleep count: 197 > 30	Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 1436	Thread sleep time: -11820000s >= -30000s	Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 6056	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 1436	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe TID: 7384	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\PCAppStore\PcAppStore.exe	Last function: Thread delayed
Source: C:\Users\user\PCAppStore\Watchdog.exe	Last function: Thread delayed
Source: C:\Users\user\PCAppStore\Watchdog.exe	Last function: Thread delayed

Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	File Volume queried: C:\Users\user\AppData\Local\pc_app_store\User Data\Default\Code Cache\js FullSizeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	File Volume queried: C:\Users\user\AppData\Local\pc_app_store\User Data\Default\Code Cache\wasm FullSizeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	File Volume queried: C:\Users\user\AppData\Local\pc_app_store\User Data\Default\blob_storage\6a40f284-062c-47bc-a022-d0c99940c1ef FullSizeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	File Volume queried: C:\Users\user\AppData\Local\pc_app_store\User Data\Default FullSizeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	File Volume queried: C:\Users\user\AppData\Local\pc_app_store\User Data FullSizeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	File Volume queried: C:\Users\user\AppData\Local\pc_app_store\User Data\Default FullSizeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	File Volume queried: C:\Users\user\AppData\Local\pc_app_store\User Data\Default FullSizeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	File Volume queried: C:\Users\user\AppData\Local\pc_app_store\User Data\Default FullSizeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	File Volume queried: C:\Users\user\AppData\Local\pc_app_store\User Data\Default\Cache\Cache_Data FullSizeInformation

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://pcapp.store/pixel.gif

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000015.db

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\p[1].gif

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\p[2].gif

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\p[3].gif

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\p[4].gif

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\p[5].gif

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\90SNK17T\p[1].gif

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\90SNK17T\p[2].gif

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\90SNK17T\p[3].gif

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\90SNK17T\p[4].gif

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\90SNK17T\p[5].gif

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\p[1].gif

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\p[2].gif

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\p[3].gif

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\p[4].gif

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\p[5].gif

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\p[6].gif

Windows Analysis Report
https://pcapp.store/pixel.gif

Source: C:\Users\user\PCAppStore\Watchdog.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exe	Thread delayed: delay time: 60000	Jump to behavior

Source: PcAppStore.exe, 00000025.00000003.2322581029.000002375DB54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: stringComputer System ProductComputer System ProductSZMER10CC82742-52E4-CC1D-A08F-D3A4823E8F04VMware, Inc.
Source: PcAppStore.exe, 00000025.00000003.2320041335.000002375DB84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: stringComputer System ProductComputer System ProductSZMER10CC82742-52E4-CC1D-A08F-D3A4823E8F04VMware, Inc.NoneOCESSOR_LEV+
Source: PcAppStore.exe, 00000025.00000003.2320100588.000002375DB4F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: explorer.exe, 00000017.00000000.2109377461.000000000BFF2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&
Source: explorer.exe, 00000017.00000003.2077159872.00000000089C9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00lT8
Source: credits.html.16.dr	Binary or memory string: * Neither the name of the VMware, Inc. nor the names of its contributors
Source: NW_store.exe, 00000022.00000002.2366756696.00007FFF0C64C000.00000002.00000001.01000000.0000001D.sdmp	Binary or memory string: vmncVMware Screen Codec / VMware Videovp5On2 VP5vp6On2 VP6vp6fOn2 VP6 (Flash version)targaTruevision Targa imageimage/x-targaimage/x-tga
Source: explorer.exe, 00000017.00000000.2067327465.0000000000B14000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Setup.exe, 0000000E.00000003.1768990124.000000000069A000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 0000000E.00000002.1770691866.0000000002A60000.00000004.00000020.00020000.00000000.sdmp, nsrDE1D.tmp, 00000010.00000002.2183625720.0000000003980000.00000004.00000020.00020000.00000000.sdmp, nsrDE1D.tmp, 00000010.00000003.2159551577.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000016.00000003.2151515505.000001D2CAD04000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000016.00000003.2121658597.000001D2CACF9000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 00000016.00000003.2166617606.000001D2CAD04000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000000.2093659592.00000000088D7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000000.2093659592.0000000008888000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: PcAppStore.exe, 00000019.00000002.2119379626.000001D5B1281000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: stringComputer System ProductComputer System ProductSZMER10CC82742-52E4-CC1D-A08F-D3A4823E8F04VMware, Inc.None+
Source: explorer.exe, 00000017.00000000.2067327465.0000000000B14000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000q;
Source: Setup.exe, 0000000E.00000003.1769321991.0000000000639000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware%2C+Inc%2E
Source: nsrDE1D.tmp, 00000010.00000002.2163365560.000000000066B000.00000004.00000020.00020000.00000000.sdmp, nsrDE1D.tmp, 00000010.00000003.2159551577.0000000000625000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SeE
Source: explorer.exe, 00000017.00000003.2077159872.00000000089C9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}9d2}i
Source: credits.html.16.dr	Binary or memory string: Copyright (c) 2011, VMware, Inc.
Source: PcAppStore.exe, 00000019.00000002.2119379626.000001D5B1281000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWs\%SystemRoot%\system32\mswsock.dlla\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=4OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common File
Source: NW_store.exe, 0000001B.00000003.2198879236.000001FD1AC54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: explorer.exe, 00000017.00000000.2093659592.000000000893A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: explorer.exe, 00000017.00000003.2282205383.000000000C0D7000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}+
Source: explorer.exe, 00000017.00000003.2077159872.00000000089C9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000T
Source: explorer.exe, 00000017.00000000.2073568677.00000000071FF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}W6
Source: PcAppStore.exe, 00000025.00000003.2320100588.000002375DB4F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: stringComputer System ProductComputer System ProductSZMER10CC82742-52E4-CC1D-A08F-D3A4823E8F04VMware, Inc.Noney*
Source: explorer.exe, 00000017.00000003.2083502571.00000000088E3000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTcaVMWare
Source: nsrDE1D.tmp, 00000010.00000003.2043521399.000000000398D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: LstringVMware, Inc.4
Source: explorer.exe, 00000017.00000000.2093659592.0000000008888000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000nf
Source: explorer.exe, 00000017.00000000.2093659592.0000000008770000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWUSm32\DriverStore\en-US\usb.inf_locK
Source: PcAppStore.exe, 00000025.00000003.2322581029.000002375DB67000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll.
Source: explorer.exe, 00000017.00000000.2093659592.0000000008888000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00
Source: credits.html.16.dr	Binary or memory string: ARE DISCLAIMED. IN NO EVENT SHALL VMWARE, INC. OR CONTRIBUTORS BE LIABLE FOR
Source: Setup.exe, 0000000E.00000003.1769321991.0000000000639000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.I
Source: nsrDE1D.tmp, 00000010.00000003.2043521399.000000000398D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.]'z
Source: explorer.exe, 00000017.00000000.2067327465.0000000000B14000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000017.00000003.2077159872.00000000089C9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: NW_store.exe, 00000022.00000002.2366756696.00007FFF0C64C000.00000002.00000001.01000000.0000001D.sdmp	Binary or memory string: VMware Screen Codec / VMware Video
Source: nsrDE1D.tmp, 00000010.00000003.2159551577.0000000000625000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware%2C+Inc%2EY

Source: explorer.exe, 00000017.00000003.2313950661.000000000BF97000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000003.2266932706.000000000BF7F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd23
Source: nsrDE1D.tmp, 00000010.00000002.2164256961.0000000002C6B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000015.00000000.2062217764.00007FF7D13EB000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: C++/WinRT version:2.0.220110.5productr_binErreCode=%dproductcreate_shortcutshortcut_erroroid=%luSHGetFolderPath_error_code=%X&oid=%luQueryInterface_error_code=%X&oid=%luCoCreateInstance_error_code=%X&oid=%lu.lnknfinityan.lnkindsnanproductshortcut_delete_erroreC=%XnfinityanindsnanShell_TrayWnd0p+00p+0unknowninfnan(ind)nannan(snan)infnan(ind)nannan(snan)infnan(ind)nannan(snan)infnan(ind)nannan(snan)unknownLTRRTLLTRinfnan(ind)nannan(snan)infnan(ind)nannan(snan)type must be string, but is type must be number, but is type must be number, but is \\\HKEY_CLASSES_ROOTHKEY_CURRENT_USERHKEY_LOCAL_MACHINEHKEY_USERSHKEY_CURRENT_CONFIGCurrentBuildBuildNumberSOFTWARE\Microsoft\Windows NT\CurrentVersionSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon%lu%02X\/Software\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\RunSoftware\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\RunSoftware\PCAppStoreAppParamdefaultauto_start_oncontextual_offersperiodical_offerspersonilized_notifications%us%5B%5D=\uparamsnametype must be string, but is paramsnameurloidentryAppfilePath0e+000e+00RoGetActivationFactorycombase.dllCoIncrementMTAUsagecombase.dll^(https?://(?:www.)?([^/]+))(/.*)?$.dllDllGetActivationFactoryURL format is not valid : %wsWinHTTP 1.0handle initialization failuretimeout init failurehandle connection failureGEThandle request creation failurehandle request or response failurefile creation failurequery data not availableurloidlastTimeoTypesessionIdtagretmessageRoGetActivationFactorycombase.dllCoIncrementMTAUsagecombase.dll.dllDllGetActivationFactoryiconnamepathoidanimationsoundmenu_storemenu_searchhttps://pcapp.storenamepathmicrosoftIdregpathkeydisplaycountblinkingnotificationIconrunParampathalt_linkmicrosoftIdregpathkeyidwinGetParamsaltActionaltActionParamsid
Source: nsrDE1D.tmp, 00000010.00000002.2164256961.0000000002C6B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000015.00000000.2062217764.00007FF7D13EB000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: productui_creation_failedcreation_error=%wsui_termination_errordirectory_switching_error.\nwjs\NW_store.exe.\ui\.ENDING_EVT_HANDLERWindows Default Lock ScreenLocalPCAppStore\productsystem_eventmsg=shutdownshutdownproductsystem_eventmsg=logofflogoff{"app":{"menu_search":{"search_request":"", "page":"b"},"show_window": "menu_search"}}ClosingEventproducttaskbar_handler_erroreCode=%luShell_TrayWndStartTrayDummySearchControlTrayButton
Source: explorer.exe, 00000017.00000000.2073045024.0000000004550000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000000.2068166275.0000000001111000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000017.00000000.2098635300.0000000008A18000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000017.00000000.2068166275.0000000001111000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: nsrDE1D.tmp, 00000010.00000002.2164256961.0000000002C6B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000015.00000000.2062217764.00007FF7D13EB000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: list too longStartMenuExperienceHost.exeShellExperienceHost.exeexplorer.exeSearchApp.exeSearchUI.exeSearchHost.exe{"app":{"menu_search":{"search_request":"", "page":"a", "top":%d,"left":%d,"bottom":%d,"right":%d},"show_window": "menu_search"}}{"app": {"hide_window": "menu_search"}}Shell_TrayWndStartTrayDummySearchControlTrayButton
Source: explorer.exe, 00000017.00000000.2067327465.0000000000AF7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: *Progman
Source: explorer.exe, 00000017.00000000.2068166275.0000000001111000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: bProgram Manager]
Source: explorer.exe, 00000017.00000000.2068166275.0000000001111000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: nsrDE1D.tmp, 00000010.00000002.2164256961.0000000002C6B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000015.00000000.2062217764.00007FF7D13EB000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: TTaskbarShell_TrayWnd{"app": {"init":{"direction":"%c","screen_size":{"with_topbar":%d,"t":%d,"l":%d,"b":%d,"r":%d}}}}
Source: nsrDE1D.tmp, 00000010.00000002.2164256961.0000000002C6B000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000015.00000000.2062217764.00007FF7D13EB000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: NWidgetShell_TrayWndTrayNotifyWnd+TrayButtonPNGArial++

Source: C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\package.json VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\package.json VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\favicon-32x32.png VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\favicon-32x32.png VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\favicon-32x32.png VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\favicon-32x32.png VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\favicon-32x32.png VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\favicon-32x32.png VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\favicon-32x32.png VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\favicon-32x32.png VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\favicon-32x32.png VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\favicon-32x32.png VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\favicon-32x32.png VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\favicon-32x32.png VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\favicon-32x32.png VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\AppData\Local\pc_app_store\User Data\Default\Code Cache\js\d87a233b676578ff_0 VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\favicon-32x32.png VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\favicon-32x32.png VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\favicon-32x32.png VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\favicon-32x32.png VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\favicon-32x32.png VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\AppData\Local\pc_app_store\User Data\Default\Code Cache\js\d87a233b676578ff_0 VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\favicon-32x32.png VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\favicon-32x32.png VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\favicon-32x32.png VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\favicon-32x32.png VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\favicon-32x32.png VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\favicon-32x32.png VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\favicon-32x32.png VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\AppData\Local\pc_app_store\User Data\Crashpad\reports\d568d9a6-4397-419e-9348-c22d5887c7d2.dmp VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\AppData\Local\pc_app_store\User Data\Crashpad\reports\d568d9a6-4397-419e-9348-c22d5887c7d2.dmp VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\AppData\Local\pc_app_store\User Data\Crashpad\reports\d568d9a6-4397-419e-9348-c22d5887c7d2.dmp VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\AppData\Local\pc_app_store\User Data\Crashpad\reports\d568d9a6-4397-419e-9348-c22d5887c7d2.dmp VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\AppData\Local\pc_app_store\User Data\Crashpad\reports\d568d9a6-4397-419e-9348-c22d5887c7d2.dmp VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\package.json VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\package.json VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\AppData\Local\pc_app_store\User Data\Default\Network\SCT Auditing Pending Reports VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\package.json VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\package.json VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.bin VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\static\js\main.717b6389.chunk.bin VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.bin VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\static\js\main.717b6389.chunk.bin VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.bin VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\static\js\main.717b6389.chunk.bin VolumeInformation
Source: C:\Users\user\PCAppStore\nwjs\NW_store.exe	Queries volume information: C:\Users\user\PCAppStore\ui\package.json VolumeInformation

Source: en-GB.pak.info.16.dr	Binary or memory string: IDS_WIN_8_1_OBSOLETE,943,../../chrome/app/chromium_strings.grd
Source: en-GB.pak.info.16.dr	Binary or memory string: IDS_WIN_XP_VISTA_OBSOLETE,940,../../chrome/app/chromium_strings.grd
Source: en-GB.pak.info.16.dr	Binary or memory string: IDS_WIN_8_OBSOLETE,942,../../chrome/app/chromium_strings.grd
Source: en-GB.pak.info.16.dr	Binary or memory string: IDS_WIN_7_OBSOLETE,941,../../chrome/app/chromium_strings.grd

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	141 Windows Management Instrumentation	1 Windows Service	1 Windows Service	11 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	111 Registry Run Keys / Startup Folder	12 Process Injection	1 Disable or Modify Tools	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	111 Registry Run Keys / Startup Folder	141 Virtualization/Sandbox Evasion	Security Account Manager	231 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	12 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	144 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\nsl346B.tmp\Math.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsl346B.tmp\NSISFastLib.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsl346B.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsl346B.tmp\inetc.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsl346B.tmp\nsJSON.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsrDE1D.tmp	38%	ReversingLabs	Win32.PUA.Generic
C:\Users\user\AppData\Local\Temp\nsyBD07.tmp\NSISFastLib.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsyBD07.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsyBD07.tmp\inetc.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsyBD07.tmp\nsDialogs.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsyBD07.tmp\nsJSON.dll	0%	ReversingLabs
C:\Users\user\PCAppStore\AutoUpdater.exe	5%	ReversingLabs
C:\Users\user\PCAppStore\PcAppStore.exe	5%	ReversingLabs
C:\Users\user\PCAppStore\Uninstaller.exe	29%	ReversingLabs
C:\Users\user\PCAppStore\Watchdog.exe	5%	ReversingLabs
C:\Users\user\PCAppStore\nwjs\NW_store.exe	0%	ReversingLabs
C:\Users\user\PCAppStore\nwjs\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\PCAppStore\nwjs\ffmpeg.dll	0%	ReversingLabs
C:\Users\user\PCAppStore\nwjs\libEGL.dll	0%	ReversingLabs
C:\Users\user\PCAppStore\nwjs\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\PCAppStore\nwjs\node.dll	0%	ReversingLabs
C:\Users\user\PCAppStore\nwjs\notification_helper.exe	0%	ReversingLabs
C:\Users\user\PCAppStore\nwjs\nw.dll	0%	ReversingLabs
C:\Users\user\PCAppStore\nwjs\nw_elf.dll	0%	ReversingLabs
C:\Users\user\PCAppStore\nwjs\vk_swiftshader.dll	0%	ReversingLabs
C:\Users\user\PCAppStore\nwjs\vulkan-1.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://api.msn.com:443/v1/news/Feed/Windows?	0%	URL Reputation	safe
http://anglebug.com/4633	0%	URL Reputation	safe
https://anglebug.com/7382	0%	URL Reputation	safe
https://deff.nelreports.net/api/report?cat=msn	0%	URL Reputation	safe
http://anglebug.com/6929	0%	URL Reputation	safe
https://anglebug.com/7246	0%	URL Reputation	safe
https://anglebug.com/7369	0%	URL Reputation	safe
https://anglebug.com/7489	0%	URL Reputation	safe
https://issuetracker.google.com/161903006	0%	URL Reputation	safe
http://anglebug.com/4722	0%	URL Reputation	safe
http://anglebug.com/3502	0%	URL Reputation	safe
http://anglebug.com/3623	0%	URL Reputation	safe
http://anglebug.com/3625	0%	URL Reputation	safe
http://anglebug.com/3624	0%	URL Reputation	safe
http://anglebug.com/4836	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
http://anglebug.com/3970	0%	URL Reputation	safe
http://anglebug.com/5901	0%	URL Reputation	safe
https://anglebug.com/7161	0%	URL Reputation	safe
https://anglebug.com/7162	0%	URL Reputation	safe
http://anglebug.com/5906	0%	URL Reputation	safe
http://anglebug.com/2517	0%	URL Reputation	safe
http://anglebug.com/4937	0%	URL Reputation	safe
https://issuetracker.google.com/166809097	0%	URL Reputation	safe

IP	Domain	Country	ASN	ASN Name	Malicious
74.125.133.157	unknown	United States	15169	GOOGLEUS	false
151.101.129.229	unknown	United States	54113	FASTLYUS	false
209.222.21.115	unknown	United States	20473	AS-CHOOPAUS	false
151.101.193.229	unknown	United States	54113	FASTLYUS	false
216.58.206.34	unknown	United States	15169	GOOGLEUS	false
142.250.185.168	unknown	United States	15169	GOOGLEUS	false
216.239.38.181	unknown	United States	15169	GOOGLEUS	false
104.22.45.142	unknown	United States	13335	CLOUDFLARENETUS	false
159.223.126.41	unknown	United States	46118	CELANESE-US	false
142.250.185.202	unknown	United States	15169	GOOGLEUS	false
142.250.181.232	unknown	United States	15169	GOOGLEUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.185.163	unknown	United States	15169	GOOGLEUS	false
18.173.205.24	unknown	United States	3	MIT-GATEWAYSUS	false
142.250.186.132	unknown	United States	15169	GOOGLEUS	false
104.22.44.142	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.184.228	unknown	United States	15169	GOOGLEUS	false
142.250.184.200	unknown	United States	15169	GOOGLEUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
172.217.16.142	unknown	United States	15169	GOOGLEUS	false
104.248.126.225	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
108.177.15.84	unknown	United States	15169	GOOGLEUS	false
172.67.15.14	unknown	United States	13335	CLOUDFLARENETUS	false
172.217.16.206	unknown	United States	15169	GOOGLEUS	false
216.239.32.181	unknown	United States	15169	GOOGLEUS	false
195.181.170.18	unknown	United Kingdom	60068	CDN77GB	false
142.250.185.234	unknown	United States	15169	GOOGLEUS	false
167.99.235.203	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
142.250.185.238	unknown	United States	15169	GOOGLEUS	false
212.102.56.179	unknown	Italy	60068	CDN77GB	false
142.250.181.226	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.196	unknown	United States	15169	GOOGLEUS	false
142.250.185.131	unknown	United States	15169	GOOGLEUS	false
212.102.56.178	unknown	Italy	60068	CDN77GB	false
142.250.185.195	unknown	United States	15169	GOOGLEUS	false
216.58.212.163	unknown	United States	15169	GOOGLEUS	false
45.32.1.23	unknown	United States	20473	AS-CHOOPAUS	false
37.19.194.81	unknown	Ukraine	31343	INTERTELECOMUA	false
142.250.186.42	unknown	United States	15169	GOOGLEUS	false
142.250.185.74	unknown	United States	15169	GOOGLEUS	false
142.250.185.98	unknown	United States	15169	GOOGLEUS	false
169.150.255.180	unknown	United States	2711	SPIRITTEL-ASUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546627
Start date and time:	2024-11-01 09:45:57 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://pcapp.store/pixel.gif
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	37
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Detection:	MAL
Classification:	mal64.spyw.evad.win@58/484@0/45
EGA Information:	Failed
HCA Information:	Successful, ratio: 80% Number of executed functions: 6 Number of non-executed functions: 0