cd20c09ce56e406ca5224e6ed5001e11c9d8ec229edc79397b1ae846ee502fa4

Analysis

user interaction
yes
max time kernel
42s
max time network
41s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/04/2026, 16:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
harmless-asset-manager.exe
Size 11.7MB
Sample260419-t4xgfscs21
SHA256 cd20c09ce56e406ca5224e6ed5001e11c9d8ec229edc79397b1ae846ee502fa4
MD5 d7c0b5a195b36e125e82a7c479178dc2
SHA1 937b47d64c7789c4f2cb3f64b6eeb83518fa9cce
SHA512 84da48ccc4879b38dd815092a9b12eabd269194565f2bce3ddb85a2a824da5c86cfd067309edc9ca7796b53c10fee2832170f1033fc999876fa735557f5b6a45
SSDEEP 98304:01ftg1eTxh6X/SPXdIZVrTPP6L9HQO7tgrK5fSC/PwHv8sWtbIoEGkeQ7n+V:xqxNsT3SFA8rtbIjBeQb0
TLSH
T114C66B43F78180E9D0AEC174C76B9737BB32F88D4621736B1BE45A212E2AB905F187D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	harmless-asset-manager.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
64	discord.com
71	discord.com
79	discord.com
82	discord.com
53	discord.com
54	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3784	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134210902666875001"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 13 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\harmless-asset-manager\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\harmless-asset-manager.exe\" \"%1\""	harmless-asset-manager.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-914486190-3969805341-592249730-1000\{8D9D0E9A-F42E-4ECE-B016-594146BB1152}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\harmless-asset-manager\ = "URL:com.harmless.asset-manager protocol"	harmless-asset-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\harmless-asset-manager\URL Protocol	harmless-asset-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\harmless-asset-manager\shell\open\command	harmless-asset-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\harmless-asset-manager\shell\open	harmless-asset-manager.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-914486190-3969805341-592249730-1000\{44E7845E-FC7A-4809-B978-C3BB583FDBB7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\harmless-asset-manager	harmless-asset-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\harmless-asset-manager\DefaultIcon	harmless-asset-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\harmless-asset-manager\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\harmless-asset-manager.exe,0"	harmless-asset-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\harmless-asset-manager\shell	harmless-asset-manager.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5872	msedgewebview2.exe
5872	msedgewebview2.exe
1248	msedge.exe
1248	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4740	harmless-asset-manager.exe
1248	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 5872	4740	harmless-asset-manager.exe	85
PID 5872 wrote to memory of 5088	5872	msedgewebview2.exe	86
PID 5872 wrote to memory of 3076	5872	msedgewebview2.exe	87
PID 5872 wrote to memory of 3076	5872	msedgewebview2.exe	87
PID 5872 wrote to memory of 3076	5872	msedgewebview2.exe	87
PID 5872 wrote to memory of 2420	5872	msedgewebview2.exe	88
PID 5872 wrote to memory of 3468	5872	msedgewebview2.exe	89
PID 5872 wrote to memory of 3468	5872	msedgewebview2.exe	89
PID 5872 wrote to memory of 4176	5872	msedgewebview2.exe	90
PID 5872 wrote to memory of 4176	5872	msedgewebview2.exe	90
PID 5872 wrote to memory of 4176	5872	msedgewebview2.exe	90
PID 5872 wrote to memory of 2276	5872	msedgewebview2.exe	91
PID 5872 wrote to memory of 2276	5872	msedgewebview2.exe	91
PID 5872 wrote to memory of 2276	5872	msedgewebview2.exe	91
PID 4740 wrote to memory of 1384	4740	harmless-asset-manager.exe	109
PID 1384 wrote to memory of 1248	1384	msedge.exe	112
PID 1248 wrote to memory of 6100	1248	msedge.exe	113
PID 1248 wrote to memory of 3784	1248	msedge.exe	114
PID 1248 wrote to memory of 4000	1248	msedge.exe	117
PID 1248 wrote to memory of 4000	1248	msedge.exe	117
PID 1248 wrote to memory of 3364	1248	msedge.exe	115
PID 1248 wrote to memory of 3364	1248	msedge.exe	115
PID 1248 wrote to memory of 3364	1248	msedge.exe	115
PID 1248 wrote to memory of 4852	1248	msedge.exe	118
PID 1248 wrote to memory of 5332	1248	msedge.exe	119
PID 1248 wrote to memory of 4852	1248	msedge.exe	118
PID 1248 wrote to memory of 4852	1248	msedge.exe	118
PID 1248 wrote to memory of 5332	1248	msedge.exe	119
PID 1248 wrote to memory of 5332	1248	msedge.exe	119
PID 1248 wrote to memory of 4812	1248	msedge.exe	126
PID 1248 wrote to memory of 4676	1248	msedge.exe	125
PID 1248 wrote to memory of 4676	1248	msedge.exe	125
PID 1248 wrote to memory of 5804	1248	msedge.exe	128
PID 1248 wrote to memory of 5804	1248	msedge.exe	128
PID 1248 wrote to memory of 4300	1248	msedge.exe	129
PID 1248 wrote to memory of 4300	1248	msedge.exe	129
PID 1248 wrote to memory of 1992	1248	msedge.exe	131

C:\Users\Admin\AppData\Local\Temp\harmless-asset-manager.exe
"C:\Users\Admin\AppData\Local\Temp\harmless-asset-manager.exe"
1⤵
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.4.1 --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4740.4880.10994764513389241991
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5872
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffcbe5ab078,0x7ffcbe5ab084,0x7ffcbe5ab090
    3⤵
    PID:5088
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1748,i,3516078715723928202,12345200698688797226,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
    3⤵
    PID:3076
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2052,i,3516078715723928202,12345200698688797226,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:3
    3⤵
    PID:2420
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1720,i,3516078715723928202,12345200698688797226,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:8
    3⤵
    PID:3468
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3620,i,3516078715723928202,12345200698688797226,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
    3⤵
    PID:4176
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3896,i,3516078715723928202,12345200698688797226,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:1
    3⤵
    PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/oauth2/authorize?client_id=1404156965248307261&response_type=code&redirect_uri=https%3A%2F%2Fdsc-oauth.harmlesscreations.com%2Foauth%2Fcallback&scope=identify%20guilds.members.read
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://discord.com/oauth2/authorize?client_id=1404156965248307261&response_type=code&redirect_uri=https%3A%2F%2Fdsc-oauth.harmlesscreations.com%2Foauth%2Fcallback&scope=identify%20guilds.members.read
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2a4,0x7ffcaa48c188,0x7ffcaa48c194,0x7ffcaa48c1a0
      4⤵
      PID:6100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,8787539418624377822,3880785006134815618,524288 --field-trial-handle=2232,i,17836761024169160468,11175280065876411199,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
      4⤵
      System Time Discovery
      PID:3784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,4575532236209323688,14214839222728263078,262144 --field-trial-handle=2232,i,17836761024169160468,11175280065876411199,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
      4⤵
      PID:3364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,10158825232288112522,2079364722896891710,524288 --field-trial-handle=2232,i,17836761024169160468,11175280065876411199,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:8
      4⤵
      PID:4000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,14287263620569713601,4093931760514516530,2097152 --field-trial-handle=2232,i,17836761024169160468,11175280065876411199,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
      4⤵
      PID:4852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3400,i,9513972781703527770,3428038365717589894,2097152 --field-trial-handle=2232,i,17836761024169160468,11175280065876411199,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
      4⤵
      PID:5332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,3026552391177345543,849187076432014040,524288 --field-trial-handle=2232,i,17836761024169160468,11175280065876411199,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
      4⤵
      PID:4676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,13747517629410063381,9164062098906288572,524288 --field-trial-handle=2232,i,17836761024169160468,11175280065876411199,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
      4⤵
      Modifies registry class
      PID:4812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,16385271733602750402,15478553280647601919,524288 --field-trial-handle=2232,i,17836761024169160468,11175280065876411199,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
      4⤵
      PID:5804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,11029346836088592860,1937677249879060604,524288 --field-trial-handle=2232,i,17836761024169160468,11175280065876411199,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
      4⤵
      PID:4300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,8863561072038043610,14253839637407739053,524288 --field-trial-handle=2232,i,17836761024169160468,11175280065876411199,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
      4⤵
      PID:2008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,8863561072038043610,14253839637407739053,524288 --field-trial-handle=2232,i,17836761024169160468,11175280065876411199,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
      4⤵
      PID:1992

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8b1e4ba6890ec60cfe9f6942acc1937ba6fdde042b45c0a2e0b7e13ade701cfd
MD5 642961cbd4f67f82b3038bc1275d24c3
SHA1 f1df4ba11ac13409c392147b2a9da411bc9cd6eb
SHA512 4f7f98f2ebf15c98a7f379a7975f6dff1c7086a1e3cf81d3daec8c9be6212ba05fb4eefc5fa2c0486a277860dc8b2aecdded5e174409117a0736b1cd3b8443d0
TLSH
T1CCD0805C52B3BC75D4C7997045C53B47373ED493659187317C6274B90C534504D961C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d68b8059d1fdfd8541892ccb136bddd7ec7601b55110e2cdd4c0e5ace97d9da8
MD5 531be76c0b4d3ce6131509c7d95980da
SHA1 8d06c8ade4d281ea8e43a1dd0a469db76987e5cf
SHA512 3f61844b74b97a902b9307c088590e72b7ad0e95c0f14948ae3780aa3e04b871d8e5c5cb6ca5f5fdf524ad8258178623c85c528a35deec8559c2d1d114436d1f
TLSH
T125D0C05C12B3BC35D4CB987004C13B03323ED893659187307C2234B80C0304048960C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 77ed7253c39739d4a5a33df44dad93e78250d288a6278a0b9802c7419a8ea2fd
MD5 6258329da302363f395d8e194eea9dde
SHA1 558ead9c9499456986a5c29f74f647266a652df2
SHA512 7c675a54ac4b104ec0242964a5e3cbaf682ac263d6d04d9d127a30670bfca72c3262f4317255f651b224015e3d5b1498b21cfba1e5b3866b6aae8b200b10d886
TLSH
T160E02BAEDC21EC371CFA075971748745E794134726C09A0F3E3D810D8FB1637458585C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3beba3b6-600d-4731-a7b5-58968b5b42b6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3beba3b6-600d-4731-a7b5-58968b5b42b6.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 854752c16daabf21924ef78f53bec05b1293290fbfa6c368d98ee10266dbcc87
MD5 4248de94fa034038b75f79e51d96a816
SHA1 357860651d49eb1a00e31bc1d58ff0c470164740
SHA512 f62f3bd0cf563edaaf038c8a71447f9a1910613d38b76f1419b04b033cf1d7bfe8334c2854289c59822ffd72ae2aa3e3941c344cf190c9e19e62b7d856b77461
SSDEEP 192:sxZoVROyMqZ/K1Ml8Mj3/fbXspIGrYmDkzodp+SHW6+WNzVj/Yx3wQe+p+IgjrJ:sxZ8f73/fjspIADXhHb1/9xj9
TLSH
T19A62F9196A385D7B8CDBD209FA55BF53D7F90563D1804E4899FCCA0C04E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 ef1582086009070ea3bbc2232205d5bcc18034cfc2459e842f3e6d8bdfe609c9
MD5 0d71fcf1499b489ad0c4b70a0c25b632
SHA1 d3ff72378754d98f819b99f3ff3ca3b5c68fd328
SHA512 76cd737e35ca960ab91d2cd3c8eba56aabf442389b306c9996e92d94ee7ab145d0d3bd8b3afec90af5449eb69014e2c6cb135e9580fa7c74295ad7053271eff3
SSDEEP 768:Jdc+tx27pLuL/VRWvV/gH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVwDFkLlMeNtFroF:Jdc+txWE/VRWvV/gHu1ja9DFkLO6t+zR
TLSH
T11EF20B3B2C0CCB7E4F844E9CEC2A7E9E6EE401CB96988D5447F9885C02C66EB55171DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\d4f0aa05-ae51-4aea-b00b-cccae3359ed0\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 df9e5ac04f62cc3fb85baf869103006e41e57c8c8102e9b2f26601227b6462fa
MD5 d0508600127ecc930170bba84488b1f0
SHA1 4433d4b11c61d7c681be6aa7120d08272fa135ff
SHA512 65062dcbc12f552779af650215a0d02c4576bdf2719f3a51a93b256d5df35a3184458bc685b60f780f5f2401ec300ac289fb61a59b5cb569dd8acb164ffe076c
TLSH
T156D0A767F0620D99DBB746921A71415D42A22D88A461D08C941375398475FD39133FAA
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58cdcb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe58cdcb.TMP
Size 138B
SHA256 de56814971b68390782b1005bcb039ccb0c4120ffd6b8d71ce98b7d6c1fb3d37
MD5 c6c9bd4345afe544f9eb4d746000a4ad
SHA1 082148ea7427d5b76f3db0892d5b04afcb022445
SHA512 7864eb0fa55287b5706001f7309d94d55872d019102e80d628a0233e4d805ef5ef3eb4433a903e339cc3b90d06a7df5897509ebdc0905cd44be760d16dfc8242
TLSH
T152C02B63F0010821CF1603900232411CC7472CCC6DA2C4CD606334741078FB32113ED2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 98da055cdc6b01690dd77093bb1c40f47d59504c92788730334d73a155abece7
MD5 9cbed46a3acda086e347e1f5c3b7811b
SHA1 164aa6a0d02ec5146ca74a37fc97a2da53da44fd
SHA512 b2ce9b857ade98b9b5291c12b8771ed9424d8c148be686be80337905d20836e37c051362aea42d042b757f8b8b130c8071381f88e0c51d8669d6f469eb228e8a
SSDEEP 384:SXEpUTaFkzG/T1ddEtgjzzLlRQbz4BD30LK4xfqJ7:SXEpUTaFkzG/T1ddEtgjzzLlRQbz4BDt
TLSH
T124B22B10313B06803A7E699E95A5B86F62C270633058A93B7BFC00A54F6BE14DDFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 60eef71db36e9c6cc03e17bc62278269804b7c246caab58dbea51756ec4e5f89
MD5 06710b88667c53e04cc517a9941feae1
SHA1 76128ace8db122cb364de0bffbd708c675333a59
SHA512 29b8dc3e7e744baa00b32c243a4bbe96e46c56d2ae1774ef93b40d08b59920c35333732d0a803a6afa0ef5280969581463841ad4fb89871c053cdb46021dbc96
SSDEEP 384:nxiFavqMg3sNX8TUNTUlIm29JCqv34fEP8ufIeCzkF6dnS4mtmkPPrNlk+5vI+L:YFayv3YwgtTP8gIa6dS4smyDP
TLSH
T18CC24B35EC98DABBEDE78FC5A7497A07EEE001A7D98C4AD4DAD81D0D009759E130BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b5e780fbefb2a61ab49ca5bab4ba1dbcff543c3723a0dd34d433f7c8b614d8c0
MD5 157874fa9083b430e9cab7a9eaab4667
SHA1 b0422787703c697237e3a521043e803c2bf0f97d
SHA512 a86d0d05a839582945f72d7ef3d2efce424caa5b63ceb33ac64742537c1115e7beb5d72f00630d29a33dd05a6256777f3c6dc6b88cf296ab4f0f12a1537f4052
SSDEEP 384:n1iFavqMS3sNq8TUNTUlI4D9Jg4f34fEP8ufIeCzk/uoy7WeskrNlk+5vI+g:8Fayt3xwggDP8gIKg7WNcs
TLSH
T169C25C7AE898D96BEDEB8BC9F7097603DEE04163CA8C4AD8D5DC1E0D009B19D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5b93373d0b7a580cd055c05d8990aea70c2f968c1b0d6aa7b786645231510fba
MD5 421950a7ca3a565a6a92963354f34c7b
SHA1 b45f98b815c359004e73f76d3b1638722f87a6ef
SHA512 62aca0a9310b3594f8f021e626fc7054b48c45cc4aa5b1e3e6224f987096b07e3c730867a6315c0303787c120086d0b56d631b784b99471fda71da6a813a3065
SSDEEP 384:ngiFavqMg3sNG8TUNTUlIm29Jbg834fEP8ufIeCzk/uoq7dnS4mtmkPPrNlk+5v/:7Fayv3BwgKGP8gIKg7dS4smyDP
TLSH
T1EBC25B75E898CAABBDE78FC5E7497A07DEE041A3D98C8AD4D5DC2D0D009B59E130BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3760646466789bd3315d229596991b33d83dca7678b4c14112f32fd093946f25
MD5 979dcbdbc8e431e35c5e8a1ddcf934e4
SHA1 7a508b5c2dd7b71b474bfcf7ccb24a7e43a77b7f
SHA512 694a802d20577b77daa66789854bd293ac77a15a903aef4e35de203344ed3cd00c59b730325b395345e791e9d0601952285dfffa20ca2cf3e723319984c15b3b
TLSH
T18C41D798B6F91148B7B7BF569BF668AE447EBD772F07949E00110D4F0A62A40C8B1733
MD5 SHA1 SHA512 TLSH

Submit Download

90cb28b8-eccb-49fa-b042-384399f22038.tmp

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\90cb28b8-eccb-49fa-b042-384399f22038.tmp
Size 3KB
SHA256 1fba42e6efc4497d0a071ff6dae8cd0168678b01b5cd367091fa2f1b266c910f
MD5 36a2d0ad09d67ff1e8aac97502224f8e
SHA1 0b96d96267d0399ef75b768e99b228246aca9b4a
SHA512 056571749d1754feda0333508b4b8da35ac3c46656953f771c8ccc1027c175ea1c0f458b4d37adb94ba6f82c8d58641c77af654b6f7bf8b4f4bce120e3b50a50
TLSH
T1EB7195376968EA270EF38906B9863B0676A51136D6943F98D9FD0F0C01DB3E82342C1B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0532bd70a7471f6016d0eefd760bef42b199beebc47a9513cd5953b116a417a4
MD5 8466c041a0418e1fdf0f9c08eb33c846
SHA1 333fb8d78a88a9dbdfbf651c77bbde544b0bb3d4
SHA512 d15f617a96f799e810946f357e73697605d08e03f0308603d2b05d2a6ed547f9b7caa6b7697e1d94c52f667f8cacf8eb2aeb79fe7edb2f7d3002957ab8182b06
TLSH
T1A9D004D071F54340D1C1F131047045400711C70011111545011410051C54005711F440
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 29b10076c483d0f0a3b0a826a998102ad529873ed3dca24b0276c21772cd0a31
MD5 1e6fe9d54369c15e212893bf8c361d6e
SHA1 04109ee39edcd8e5240d9459699175375a62bec2
SHA512 3ee163c0fbe50987318e78fae44d880877e4481501d1f665c59c8e5aaef597730504448988d8ab49614203ded3c5dfd18071202c5ded15d8bf09ea329282c0c5
TLSH
T187D0125232A24374C0507133046265480901C30B41054045542C951E2E180542A1B881
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 fa69543fae97a46e4ad808b435c3089e61c15529074def2c71e07fe34481c6e5
MD5 4f4b7ec0758c5b6edd9fc8e594003164
SHA1 e8f72d70c2e10edabaa331b00a96880907a224b6
SHA512 fa03a62d8a7b68a1ce3d6159b9979363b0273abe427d9e613468d211b9073bad8e2589d728779da66800a15999fc25db35b2a6457318db4fd62092503ffd8dde
TLSH
T1D2B0110CA838C802FA0003B202EA0080383028020B0B0F8A02E0283AA828380AA03820
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ae7b.TMP

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe58ae7b.TMP
Size 48B
SHA256 c1f9255dba9f677ce3ac31cb17c8d4981b9df5a18f766267af5911dd088031dc
MD5 e43a68438d58abbb3bb06dfb8fbc3efe
SHA1 18753540bdd9c53d6e0fd53296c6b78773849b63
SHA512 0b816dfa3ecac10dc56ce313d56a919c192d34724af2623f9d26f1ed9ce4e21c834cd25d3c2a50afde36261c1e21815690a5bfad021a71607955337e28350e0a
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 7c4b52631ba7f876f108b8f3c68aff21650ef9f45bdd805f20cca773f161fa7e
MD5 b993a91e79506460ec28ab3b25fc5800
SHA1 febf3c6553c42b27a8efcd1f93a6b02d3dc485d8
SHA512 745cd435faca9c93a9b8faafc62c9acad237b0744a3fdf7b36d6e4f1b996d5a1eef67ab6875a9fdfe29c19627ccbeda84bae5048c01f5717657027d44fd5a5ff
SSDEEP 3:LstlNllkll/lGg:LsX3lEt
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Preferences
Size 6KB
SHA256 393619210ceb0e53fc7f393c7bd300af51a077b8de3567ba22dd174347db39b3
MD5 ab4fc1c1fba52f7142b5ab3ab9255df8
SHA1 8e322b8ee9e56d0afbbe92a4386f8dea96f59bd4
SHA512 8a3f5cbea4dfe57c482a220c5c076d446d955ddc93aa4c380d768bceba05adc030ec35f958ca1309d51bfce6dda792039b303a32a08cb8f3996f9c77f57f409c
SSDEEP 96:stQ05Fnypb9CffuZ8i0vhEVkt4m/7qx+WVHMSm+uecJvnjMdQjh+gA1oqfMOB:stQ031f2Z8pa0x/S+WiTvnodAqKqfMC
TLSH
T15CE198579E2869774CC7E61A7A35FF12E2F6106262C50E58ABFC871C08E66DC530790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58f9ad.TMP

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Preferences~RFe58f9ad.TMP
Size 6KB
SHA256 06ee674315558a78f016e534140101b98c716ca13a04751f63d7c02ad106c951
MD5 0f49bf58659ba3dc858d2e7df47a3ae9
SHA1 9e5b8f65e30d7704033fa27ff9a10669569f8fac
SHA512 65db1abfef29822f0d5eaa25ce0c6f6361f765ffd464c38accd3b579c3f911cd6336c878dd6fe667e1e0f5e27ab47817a1b219415a70c172e912dc198a69a42e
SSDEEP 96:stQ05Fnypb9NffuZ8i0vhEVkt4m/7qx+WVHMSm+uecJ+W1idQjh+gA9fMEB:stQ03Kf2Z8pa0x/S+WiT+WwdAq9fM8
TLSH
T1DED195575E2869774CC7E21A7A35FB16E2FA102262D40E58FAFC861C08D66DC220790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State
Size 1KB
SHA256 1fa4c7f4f56a8b8bad59a493ecd58c750c7bed7d9a57a3da17568a6ebe4c4bc5
MD5 ae74bcb74d2035f837574189aed23879
SHA1 6afcd64802795a8ee03858a2193adbdadb0cdee0
SHA512 1bc393efc627a776b3a3f41f7be3d6fb7fd6bf702b8f73558c32d433aa3f86ea6ea4f8eb2d5e7a3a0f62a6e92bf924b2cb8037ab782099151f30106b8860dc32
TLSH
T1823187B3D4585B330DA759477153BB472E70113982504F4CA5ED4F0C01E72EC566AD36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State
Size 2KB
SHA256 bb490b0ae7c9ba1d29b2a837cf19a6c5fd87e131fd8e663859c3742e375a3321
MD5 5b90ed76de3abbf78cadd1f9e4c54213
SHA1 52efda7c9ceff5be43f91c3665a29c9c7ab36972
SHA512 deb684ea3aac98cd7b4fa145819d0e1cce187af2bf5639911e73a7c2d7bae1d16c82720556459a8f90515232e09cb0fb190f378bb490a8f6d0f64875df410266
TLSH
T11251B873BC189B374AF3894679567F136AB5516587912F48A9ED0F0C01DB2AC2352C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State
Size 16KB
SHA256 6e0272c98c8e0e6cee03feae936190285aa907bb10ea6c22fd0bfd193e903e53
MD5 1151ec9f33d3e0bbb916db4df664ea25
SHA1 86e8b6b34166fab15ef8695f7940e817ed5446e2
SHA512 fd9fbfbc5e84443a59d7c9b7a9973c16f1e04667cffc24cd8b3f673517abdd2109035bd579aaff8df1332b2f95e16b82cb1bd9f0a5085ba649c5a40275a59c18
SSDEEP 384:zQfRE5BdEZfr0kuh9Rt/nP9yxNbMJhL8TuV6nvQe:4RkurqhNsMgi6vQe
TLSH
T1EF72AF7349309D275CFB850B390A6B0665F4805D96D62E98BCED1F1C0AD77D90363D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State
Size 16KB
SHA256 a18900d16b52495ad6ea984fe2c06b488f64014cd1f65c892f7a0367e9e6d680
MD5 9be974a559e9cb209ddd1596b78be037
SHA1 d6c0c44ed8fc2cb5cbb3da01f55a27a14f792e58
SHA512 86d09349d3bc1737764c8010c4cf4c4e30ea5d03604539444323d47cdb869ab23de9788f7ec2791314b7116227884e4ee9885abf14d07c01b4f47ba4d621c1b9
SSDEEP 384:zxfRE5BdEZfr0kuh9Rt/nP9yGNbNJhL8TuV6nvQe:pRkurqhNswgi6vQe
TLSH
T12F72AE734930AD276CFB850B390A6B06A5F4804D96E62E98BDED1F0C0AC77D90363D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe585aec.TMP

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State~RFe585aec.TMP
Size 1KB
SHA256 b2fa04058c6237702cb48a0733705a10b23fa4142f99286378987dac9fcda68b
MD5 49f6596a3f3d5f94220c86a16b19fcb2
SHA1 f9bc76ce3b4cec86711e3a712f5ce2984ba217ec
SHA512 7ec864579691de5c01f7a611ca65a8083d44e0ea68de4113d32487c490560796a6c648e0a2503923fae8c068c50fefdd4a661bb6a655f89c9db458ced9942adc
TLSH
T1D6214273C89CAA371AA748477163BB4A2EA0213982504F0CA5EE4B0D01AB6EC5667D36
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2276-243-0x000001EB47C20000-0x000001EB47C8B000-memory.dmp

Download

memory/3076-25-0x00007FFCDA4E0000-0x00007FFCDA4E1000-memory.dmp

Download

memory/3468-42-0x00007FFCD9320000-0x00007FFCD9321000-memory.dmp

Download

memory/3468-43-0x00007FFCD9AB0000-0x00007FFCD9AB1000-memory.dmp

Download

memory/4176-120-0x00007FFCDA4E0000-0x00007FFCDA4E1000-memory.dmp

Download

memory/4176-240-0x000001B951560000-0x000001B9515CB000-memory.dmp

Download

memory/4740-330-0x0000016488900000-0x0000016488955000-memory.dmp

Download

memory/4740-218-0x0000016488900000-0x0000016488955000-memory.dmp

Download

memory/5872-222-0x000001C932160000-0x000001C932187000-memory.dmp

Download

memory/5872-219-0x000001C927A00000-0x000001C927A55000-memory.dmp

Download

memory/5872-220-0x000001C929A40000-0x000001C929A6C000-memory.dmp

Download

memory/5872-221-0x000001C929A80000-0x000001C929A8C000-memory.dmp

Download

memory/5872-223-0x000001C932190000-0x000001C9321CB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads