hxxps://hamdl[.]harmlesscreations[.]com/download/windows/latest

Analysis

user interaction
yes
max time kernel
91s
max time network
89s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/07/2026, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://hamdl.harmlesscreations.com/download/windows/latest
Sample260715-ej2s4sa17n

Score

10^/10

defense_evasion discovery trojan

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 2712 created 3308	2712	Harmless Asset Manager_3.7.1_x64-setup.exe	56
PID 3764 created 3308	3764	Harmless Asset Manager_3.7.1_x64-setup.exe	56

Downloads MZ/PE file 1 IoCs

flow	pid	Process
23	3728	msedge.exe

Executes dropped EXE 5 IoCs

pid	Process
2712	Harmless Asset Manager_3.7.1_x64-setup.exe
3764	Harmless Asset Manager_3.7.1_x64-setup.exe
6088	harmless-asset-manager.exe
5904	harmless-asset-manager.exe
4500	Harmless Asset Manager_3.7.1_x64-setup.exe

Loads dropped DLL 19 IoCs

pid	Process
3764	Harmless Asset Manager_3.7.1_x64-setup.exe
2712	Harmless Asset Manager_3.7.1_x64-setup.exe
3764	Harmless Asset Manager_3.7.1_x64-setup.exe
2712	Harmless Asset Manager_3.7.1_x64-setup.exe
2712	Harmless Asset Manager_3.7.1_x64-setup.exe
2712	Harmless Asset Manager_3.7.1_x64-setup.exe
2712	Harmless Asset Manager_3.7.1_x64-setup.exe
2712	Harmless Asset Manager_3.7.1_x64-setup.exe
2712	Harmless Asset Manager_3.7.1_x64-setup.exe
3764	Harmless Asset Manager_3.7.1_x64-setup.exe
3764	Harmless Asset Manager_3.7.1_x64-setup.exe
3764	Harmless Asset Manager_3.7.1_x64-setup.exe
3764	Harmless Asset Manager_3.7.1_x64-setup.exe
3764	Harmless Asset Manager_3.7.1_x64-setup.exe
3764	Harmless Asset Manager_3.7.1_x64-setup.exe
3764	Harmless Asset Manager_3.7.1_x64-setup.exe
3764	Harmless Asset Manager_3.7.1_x64-setup.exe
4500	Harmless Asset Manager_3.7.1_x64-setup.exe
4500	Harmless Asset Manager_3.7.1_x64-setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	harmless-asset-manager.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	harmless-asset-manager.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
133	discord.com
134	discord.com
136	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Harmless Asset Manager_3.7.1_x64-setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Harmless Asset Manager_3.7.1_x64-setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Harmless Asset Manager_3.7.1_x64-setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3728	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285615505932491"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 34 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\harmless-asset-manager\URL Protocol	Harmless Asset Manager_3.7.1_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\harmless-asset-manager\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Harmless Asset Manager\\harmless-asset-manager.exe\" \"%1\""	harmless-asset-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\harmless-asset-manager\URL Protocol	Harmless Asset Manager_3.7.1_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\harmless-asset-manager	harmless-asset-manager.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{45D8597E-8650-49AF-9F0D-85CD0206B9E1}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\harmless-asset-manager\ = "URL:com.harmless.asset-manager protocol"	harmless-asset-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\harmless-asset-manager	Harmless Asset Manager_3.7.1_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\harmless-asset-manager\shell\open\command	Harmless Asset Manager_3.7.1_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\harmless-asset-manager\shell\open	Harmless Asset Manager_3.7.1_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\harmless-asset-manager\DefaultIcon	Harmless Asset Manager_3.7.1_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\harmless-asset-manager\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Harmless Asset Manager\\harmless-asset-manager.exe\",0"	Harmless Asset Manager_3.7.1_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\harmless-asset-manager\shell\open\command	Harmless Asset Manager_3.7.1_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\harmless-asset-manager\ = "URL:com.harmless.asset-manager protocol"	Harmless Asset Manager_3.7.1_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\harmless-asset-manager\shell\open\command	harmless-asset-manager.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{BAAC5FB5-16A4-4D60-BACC-D89450E5B233}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\harmless-asset-manager\DefaultIcon	harmless-asset-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\harmless-asset-manager\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Harmless Asset Manager\\harmless-asset-manager.exe,0"	harmless-asset-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\harmless-asset-manager\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Harmless Asset Manager\\harmless-asset-manager.exe\",0"	Harmless Asset Manager_3.7.1_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\harmless-asset-manager\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Harmless Asset Manager\\harmless-asset-manager.exe,0"	harmless-asset-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\harmless-asset-manager	Harmless Asset Manager_3.7.1_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\harmless-asset-manager\shell	Harmless Asset Manager_3.7.1_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\harmless-asset-manager\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Harmless Asset Manager\\harmless-asset-manager.exe\" \"%1\""	Harmless Asset Manager_3.7.1_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\harmless-asset-manager\shell\open\command	harmless-asset-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\harmless-asset-manager\URL Protocol	harmless-asset-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\harmless-asset-manager\DefaultIcon	harmless-asset-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\harmless-asset-manager\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Harmless Asset Manager\\harmless-asset-manager.exe\" \"%1\""	harmless-asset-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\harmless-asset-manager\ = "URL:com.harmless.asset-manager protocol"	Harmless Asset Manager_3.7.1_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\harmless-asset-manager	harmless-asset-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\harmless-asset-manager\URL Protocol	harmless-asset-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\harmless-asset-manager\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Harmless Asset Manager\\harmless-asset-manager.exe\" \"%1\""	Harmless Asset Manager_3.7.1_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\harmless-asset-manager\ = "URL:com.harmless.asset-manager protocol"	harmless-asset-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\harmless-asset-manager\DefaultIcon	Harmless Asset Manager_3.7.1_x64-setup.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2712	Harmless Asset Manager_3.7.1_x64-setup.exe
2712	Harmless Asset Manager_3.7.1_x64-setup.exe
3764	Harmless Asset Manager_3.7.1_x64-setup.exe
3764	Harmless Asset Manager_3.7.1_x64-setup.exe
3764	Harmless Asset Manager_3.7.1_x64-setup.exe
3764	Harmless Asset Manager_3.7.1_x64-setup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
5140	msedgewebview2.exe
5140	msedgewebview2.exe
2416	msedgewebview2.exe
2416	msedgewebview2.exe
3816	msedge.exe
3816	msedge.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
6088	harmless-asset-manager.exe
5904	harmless-asset-manager.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 2156	3816	msedge.exe	84
PID 3816 wrote to memory of 3728	3816	msedge.exe	85
PID 3816 wrote to memory of 3788	3816	msedge.exe	86
PID 3816 wrote to memory of 3936	3816	msedge.exe	87
PID 3816 wrote to memory of 3788	3816	msedge.exe	86
PID 3816 wrote to memory of 3788	3816	msedge.exe	86
PID 3816 wrote to memory of 3936	3816	msedge.exe	87
PID 3816 wrote to memory of 4732	3816	msedge.exe	88
PID 3816 wrote to memory of 4732	3816	msedge.exe	88
PID 3816 wrote to memory of 4732	3816	msedge.exe	88
PID 3816 wrote to memory of 3620	3816	msedge.exe	89
PID 3816 wrote to memory of 3620	3816	msedge.exe	89
PID 3816 wrote to memory of 3620	3816	msedge.exe	89
PID 3816 wrote to memory of 4552	3816	msedge.exe	90
PID 3816 wrote to memory of 2348	3816	msedge.exe	91
PID 3816 wrote to memory of 4552	3816	msedge.exe	90
PID 3816 wrote to memory of 4552	3816	msedge.exe	90
PID 3816 wrote to memory of 2348	3816	msedge.exe	91
PID 3816 wrote to memory of 2348	3816	msedge.exe	91
PID 3816 wrote to memory of 4628	3816	msedge.exe	95
PID 3816 wrote to memory of 4560	3816	msedge.exe	96
PID 3816 wrote to memory of 4628	3816	msedge.exe	95
PID 3816 wrote to memory of 4560	3816	msedge.exe	96
PID 3816 wrote to memory of 1808	3816	msedge.exe	97
PID 3816 wrote to memory of 1808	3816	msedge.exe	97
PID 3816 wrote to memory of 4052	3816	msedge.exe	98
PID 3816 wrote to memory of 4052	3816	msedge.exe	98
PID 3816 wrote to memory of 4052	3816	msedge.exe	98
PID 3816 wrote to memory of 3688	3816	msedge.exe	99
PID 3816 wrote to memory of 2416	3816	msedge.exe	102
PID 3816 wrote to memory of 2712	3816	msedge.exe	106
PID 3816 wrote to memory of 3764	3816	msedge.exe	108
PID 2712 wrote to memory of 6088	2712	Harmless Asset Manager_3.7.1_x64-setup.exe	121
PID 6088 wrote to memory of 5140	6088	harmless-asset-manager.exe	122
PID 5140 wrote to memory of 5184	5140	msedgewebview2.exe	123
PID 5140 wrote to memory of 4180	5140	msedgewebview2.exe	125
PID 5140 wrote to memory of 4180	5140	msedgewebview2.exe	125
PID 5140 wrote to memory of 4180	5140	msedgewebview2.exe	125
PID 5140 wrote to memory of 960	5140	msedgewebview2.exe	126
PID 5140 wrote to memory of 5424	5140	msedgewebview2.exe	127
PID 5140 wrote to memory of 5424	5140	msedgewebview2.exe	127
PID 5140 wrote to memory of 5204	5140	msedgewebview2.exe	128
PID 5140 wrote to memory of 5204	5140	msedgewebview2.exe	128
PID 5140 wrote to memory of 5204	5140	msedgewebview2.exe	128
PID 5140 wrote to memory of 5360	5140	msedgewebview2.exe	130
PID 5140 wrote to memory of 5360	5140	msedgewebview2.exe	130
PID 5140 wrote to memory of 5360	5140	msedgewebview2.exe	130
PID 3816 wrote to memory of 3864	3816	msedge.exe	131
PID 3816 wrote to memory of 3056	3816	msedge.exe	132
PID 3816 wrote to memory of 5464	3816	msedge.exe	133
PID 3764 wrote to memory of 5904	3764	Harmless Asset Manager_3.7.1_x64-setup.exe	136
PID 5904 wrote to memory of 2416	5904	harmless-asset-manager.exe	137
PID 2416 wrote to memory of 4024	2416	msedgewebview2.exe	138
PID 2416 wrote to memory of 1908	2416	msedgewebview2.exe	139
PID 2416 wrote to memory of 1908	2416	msedgewebview2.exe	139
PID 2416 wrote to memory of 1908	2416	msedgewebview2.exe	139
PID 2416 wrote to memory of 4404	2416	msedgewebview2.exe	141
PID 2416 wrote to memory of 2248	2416	msedgewebview2.exe	142
PID 2416 wrote to memory of 2248	2416	msedgewebview2.exe	142
PID 2416 wrote to memory of 5316	2416	msedgewebview2.exe	143
PID 2416 wrote to memory of 5316	2416	msedgewebview2.exe	143
PID 2416 wrote to memory of 5316	2416	msedgewebview2.exe	143
PID 2416 wrote to memory of 2192	2416	msedgewebview2.exe	144
PID 2416 wrote to memory of 2192	2416	msedgewebview2.exe	144

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://hamdl.harmlesscreations.com/download/windows/latest
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff871f1c188,0x7ff871f1c194,0x7ff871f1c1a0
    3⤵
    PID:2156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,13713128442190271347,16281685048681878361,524288 --field-trial-handle=2352,i,11134899502239003900,3620004440411515929,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:3728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,11740657497720519905,10032544377071235006,262144 --field-trial-handle=2352,i,11134899502239003900,3620004440411515929,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
    3⤵
    PID:3788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2208,i,7701546209509279473,11607877196328872107,524288 --field-trial-handle=2352,i,11134899502239003900,3620004440411515929,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:8
    3⤵
    PID:3936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,11893434126279276684,13673741800522224573,2097152 --field-trial-handle=2352,i,11134899502239003900,3620004440411515929,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,18305972344844813562,1255843301911810482,2097152 --field-trial-handle=2352,i,11134899502239003900,3620004440411515929,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
    3⤵
    PID:3620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,17415163089766628447,8252594987793047667,2097152 --field-trial-handle=2352,i,11134899502239003900,3620004440411515929,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4164,i,11333210659905693965,105643440641242104,2097152 --field-trial-handle=2352,i,11134899502239003900,3620004440411515929,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:2
    3⤵
    PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,2350905847291920101,16228399666497620884,524288 --field-trial-handle=2352,i,11134899502239003900,3620004440411515929,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
    3⤵
    PID:4628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,11748367615563803150,14058374109444589951,524288 --field-trial-handle=2352,i,11134899502239003900,3620004440411515929,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
    3⤵
    PID:4560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,16023105874298424162,2907358682805959022,524288 --field-trial-handle=2352,i,11134899502239003900,3620004440411515929,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:8
    3⤵
    PID:1808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5672,i,14912127973212819452,422781710598222655,2097152 --field-trial-handle=2352,i,11134899502239003900,3620004440411515929,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:1
    3⤵
    PID:4052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,7918788256900392410,12140518463128797631,524288 --field-trial-handle=2352,i,11134899502239003900,3620004440411515929,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
    3⤵
    PID:3688
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,17212723130855244551,2265966592295594224,524288 --field-trial-handle=2352,i,11134899502239003900,3620004440411515929,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
    3⤵
    PID:2856
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,17212723130855244551,2265966592295594224,524288 --field-trial-handle=2352,i,11134899502239003900,3620004440411515929,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
    3⤵
    PID:2416
- - C:\Users\Admin\Downloads\Harmless Asset Manager_3.7.1_x64-setup.exe
    "C:\Users\Admin\Downloads\Harmless Asset Manager_3.7.1_x64-setup.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2712
- - C:\Users\Admin\Downloads\Harmless Asset Manager_3.7.1_x64-setup.exe
    "C:\Users\Admin\Downloads\Harmless Asset Manager_3.7.1_x64-setup.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=752,i,13760035654692205845,7479323832087407931,524288 --field-trial-handle=2352,i,11134899502239003900,3620004440411515929,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:8
    3⤵
    PID:3864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,16608934262366534486,13535110115161013442,524288 --field-trial-handle=2352,i,11134899502239003900,3620004440411515929,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:8
    3⤵
    PID:3056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,1241225599265641973,1968764646657852334,524288 --field-trial-handle=2352,i,11134899502239003900,3620004440411515929,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:8
    3⤵
    PID:5464
- - C:\Users\Admin\Downloads\Harmless Asset Manager_3.7.1_x64-setup.exe
    "C:\Users\Admin\Downloads\Harmless Asset Manager_3.7.1_x64-setup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=2204,i,3190335437488883318,10464686469628738902,2097152 --field-trial-handle=2352,i,11134899502239003900,3620004440411515929,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
    3⤵
    PID:2836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,5967229913100394084,10501690731461676368,524288 --field-trial-handle=2352,i,11134899502239003900,3620004440411515929,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:8
    3⤵
    PID:6068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,551329860897047909,5277842357383888635,524288 --field-trial-handle=2352,i,11134899502239003900,3620004440411515929,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
    3⤵
    PID:4380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,13479506087933503204,1547353269291277903,524288 --field-trial-handle=2352,i,11134899502239003900,3620004440411515929,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
    3⤵
    - Modifies registry class
    PID:4628
- C:\Users\Admin\AppData\Local\Harmless Asset Manager\harmless-asset-manager.exe
  "C:\Users\Admin\AppData\Local\Harmless Asset Manager\harmless-asset-manager.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6088
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.7.1 --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=6088.5132.3801772283389130825
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:5140
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ff86107b078,0x7ff86107b084,0x7ff86107b090
      4⤵
      PID:5184
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.7.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1744,i,13036954683724654120,13653547649054342334,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1728 /prefetch:2
      4⤵
      PID:4180
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.7.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2060,i,13036954683724654120,13653547649054342334,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:3
      4⤵
      PID:960
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.7.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2404,i,13036954683724654120,13653547649054342334,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:8
      4⤵
      PID:5424
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.7.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3668,i,13036954683724654120,13653547649054342334,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
      4⤵
      PID:5204
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.7.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4108,i,13036954683724654120,13653547649054342334,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:1
      4⤵
      PID:5360
- C:\Users\Admin\AppData\Local\Harmless Asset Manager\harmless-asset-manager.exe
  "C:\Users\Admin\AppData\Local\Harmless Asset Manager\harmless-asset-manager.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5904
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.7.1 --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=5904.1116.5730429252146528665
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:2416
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x194,0x7ff86107b078,0x7ff86107b084,0x7ff86107b090
      4⤵
      PID:4024
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.7.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1848,i,2811726483583316537,16912421370481240032,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1840 /prefetch:2
      4⤵
      PID:1908
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.7.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2064,i,2811726483583316537,16912421370481240032,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:3
      4⤵
      PID:4404
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.7.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2316,i,2811726483583316537,16912421370481240032,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:8
      4⤵
      PID:2248
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.7.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3508,i,2811726483583316537,16912421370481240032,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
      4⤵
      PID:5316
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.7.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4068,i,2811726483583316537,16912421370481240032,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
      4⤵
      PID:2192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/oauth2/authorize?client_id=1404156965248307261&response_type=code&redirect_uri=https%3A%2F%2Fdsc-oauth.harmlesscreations.com%2Foauth%2Fcallback&scope=identify%20guilds.members.read
    3⤵
    PID:4832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://discord.com/oauth2/authorize?client_id=1404156965248307261&response_type=code&redirect_uri=https%3A%2F%2Fdsc-oauth.harmlesscreations.com%2Foauth%2Fcallback&scope=identify%20guilds.members.read
      4⤵
      PID:2908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

harmless-asset-manager.exe

Path C:\Users\Admin\AppData\Local\Harmless Asset Manager\harmless-asset-manager.exe
Size 11.8MB
SHA256 c6899b7c645cfb6ca878dfec8ebed24307f7f75afddb14509159c5fc0e6012e9
MD5 4dd34df969a6525b4fdf67c7ed7ac025
SHA1 0b4c621007e12d1babb9f5ca2e621ac44a29d83b
SHA512 ca1be897b17ef862eab7d796f932683ce2fa5a0b777420dcfa9e10b0aec8d9607413b47a87c996c94fec5cc8a3a0376591ece921f7d5dee4462fe15f54f69afe
SSDEEP 98304:3cP75aZ0jG3JzZ3B1SamMM7UgXH7G/X7sBTZCVA2BcT6ZfQ8IPJrEhEfieOdn+km:yu0jQM7LbEfQ8IPJAmfFax
TLSH
T115C66A43F78184E9C0AEC574C76B9773BB32F8CD4521736B1BA44A212E1AB906F487D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.exe

Path C:\Users\Admin\AppData\Local\Harmless Asset Manager\uninstall.exe
Size 173KB
SHA256 9e69516084168599865702ea1693934a1c5a07bb0c620cb48017bea9d52dc340
MD5 16faa343b4845bbed47f552565ce2cf5
SHA1 2b955861a4e5ce9e6043e8b5e40e8ceaa7811f2f
SHA512 fb3da81d5c9dc2349237e841825a150fcb9acdc9b15c25d549600080e31b1abe72aee9323d48ee95f9ffb40f76ebd0ac11bd70425b21d42d09112fa9ad94657a
SSDEEP 3072:BfY/TU9fE9PEtuI3YyIc0QOFtDbx7lDIeRyxhwszavtJKf4P3jECtBjzA/Te+H4X:tYa6ahIcknftVXuwh135I/TefYLBVzE
TLSH
T1D604020437E4D8A3C8720A715F7E63B66FB5EE1524601B5B6B007E9FBA76240DA0F361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 4.0MB
SHA256 b3be243573c19555535e0fc3b9dd8569883c92533cf77cff7cb82373f050f4cb
MD5 3d417c448030b7bdc8ffa8cd9dcd97f0
SHA1 16a80ace5537817673e405f7c7e23f85b8061e70
SHA512 8ec6bc6d24d0980b83ff5b6028b730eee7cca51c2931dabf2b2ce242776a6a2e0a3e8cbf02e6fc34cc8470e0d374f8c452f6991fec13764d42642630f337c5c2
SSDEEP 98304:iNWpfOD1OJve9MyuEu5gBZbQE6N1wd3HOKFSHmCVETsB360Uxv7:iNMK1OJVyuNgPbQEd3HOrHmuETsBHav7
TLSH
T1351633985E8654A3E5B21AF06C87006FF73A2AFD5094775E475653BCBA27F42F80CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5d5a09bfaa1168029e3ec834768beda34bdd53e085164bee0aa4c9f165f5cb3f
MD5 40ea1c0d1a7429dc37255d22178a8219
SHA1 defac18f9807beda3d0daa5789f72496a3927e67
SHA512 4fe4b754a08700cf723aed3fc7964af198a0eb220f7487ddeccc79d283d874396c40cd03df12fdc9a94806833334b5016adfb48bdb4b676651463edfcbcf4563
TLSH
T13E719475064EC663E3A50A7252E13337F5FF85DAF6239E4A21548C762618F11861C7FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ac39.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ac39.TMP
Size 3KB
SHA256 dc714a97a0205ea5285b9abc7c66e41663a91828baff66782492fb2820cf902e
MD5 e8e75ef54d0f61a46a54a751c74c72ab
SHA1 3b33356e76cbe1748649b64a8aae3c3403fabff7
SHA512 55807c47e911bf0acc8f9b49519ed4e29178b6dac49c54ddc9b244c91ccdd3784d3eb667271576194916eaff789dc04953eb08d08bf13e33a0ab6e89b19a8cfc
TLSH
T1F171A575064EC663E3A60A7252E13337F5FF85DAF6239E4A20544C762618F11861C7FC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3f4e58af399bf3950969271f57b22e1950e5fc606047d4ef1d727884f0ef79fb
MD5 9ed04bbbab61c48f3998244e0d6d38ef
SHA1 583eee939027a3eed8cd77705da33a5931d71a36
SHA512 f57671215fcc331b1d22ed07a989d284bc3da52023432ccdd861e7469f511ab8677836a836655ca608dec823f5b219a8a0abb3f13833eb90181d9b5402f3a5ce
TLSH
T14D31A2F3C7D4866DC91156F0AA147E2BCE2D0A14432C3D1989E4EF4BE3E2475E10294F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 975de3af3b06ca4c46562b23cbfdee267e3dac22067c7a2333ecc562075d45d0
MD5 3cb0a442305f49128d9abfd631fc230b
SHA1 fee7d19809fe7739a842b4d933c418ac1e654eed
SHA512 a7db2d045572924045f14c96eded3f8c754b55e36f7d0849ca65549ec8efbe160c9d7b02954cfb95bea22887278082944d457684d332d3722dbba3094da8fd65
SSDEEP 192:sxZaREyM/jK1Ml8M94/fSsJEFIdp+BHW6+WNzKp/YIBCvXIg5VJ:sxZam14/fSsJE2iHb8/65
TLSH
T15E52D816AA34597BCCDBD209FA457B93D6F4456393900E44AAFCCA0C05E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 21c645d26e6f1f9a19740f4e683f59a92e3fec707b23683e633211b56774df36
MD5 a62cf875a4523b9b85af3d7f128b999c
SHA1 5efa88dc1a3278d0b0b626f3f6ba4e0d68ad160d
SHA512 8439b1c40a4868ea04c1c82ff4598546ff872ecc40d787d88583555e7cefce83cb4cd0a0e93602cd19891ad3e437c9342c6f647f9b0a3175c3e1ea6c245b0256
SSDEEP 192:sxZaREyM/jK1Ml8M94/fSsjiIIdpJHW6+WNGYIwQR2XIgrJ:sxZae14/fSsji5JHbGY9
TLSH
T16B42D912AB34697BCCDBD209F9557F93D6F5156393900D44AAFCCA0C04E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 9a2dc8d35af1bb6f1e03c5c230c44e13279827f088631bbf71d13a33f4c00dec
MD5 668643df90b574e16bed6e9b08277426
SHA1 d3810e970692e3b306a887b12cdeacf47879bf57
SHA512 2a4d6f79190dfb0e141e57d950a272d974e9a7dde6560010c396b2e04791cb8be9a7f89624359074858b9a820b3b91e7aa3dea9994b32ec06b8aacf5290f18d6
SSDEEP 768:3PsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9kronnL:3PsqxXlWvJD6Tu1ja54LAs9vnL
TLSH
T1ECD21B3B694CC77E4F840E6DEC266FD66ED801CBA7988D5447FA880C02CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\f6ade067-c0f8-481d-b81f-cdde8faa5448\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 060595fc4d3768f8c17db3226a461dd78c858456632599e621ae4bc112f390ab
MD5 1feb0ffff00f69545af108c6999277ae
SHA1 f8a8bede119cd2cf0837c2e59e2ec7c6096d68e4
SHA512 af5251dbd5f3d717f66094da036013ed654359245892f008bc711994ca1c0f35dc4d2ce90fe48144f5ef3113541426351398d2416d81b24f5d28792522d36171
TLSH
T13DD0971BE7490090C3BE4F430E23201E0B682C8818A9C088B003222819BDB47D120FA3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 dca75af40cd110dbf5b864596a9a7cce13ce8067031e86c71a1b26e431c739ee
MD5 f794246d0c42c25ef91552c9c414704d
SHA1 e03f3f5df08e8d9d142c0c0e284da601daf42612
SHA512 07df01a6973680f9b1efb1341e958e4e2a89da2971adf420ec29424586cbd0f0b79025ac818791b62b40a1d44e81a07b2b22383c17b2f7907d22a57c7845cf9f
TLSH
T11BD0A75BE74941A1D6FE8F420E23202E4B597C8814A9909874034625199DB579161F97
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe594c61.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe594c61.TMP
Size 138B
SHA256 c9c3ab76cdc218b97f452b72df41afb15f3d6578bf6ea787669cfc319c553a25
MD5 a5437adbdae3b4dc0a58a039c45a26d5
SHA1 a1032f30540b17b6106727032ac3d26dc3df1744
SHA512 de159da6841584a8aec0714abada172152ff6ced6a62ee97ee58958f6b4b576746eb21000de9084a4a8451f2da012214835c2bf1d7363866a4281bf884f5e31f
TLSH
T123C08C67E284010286380B414623011D8B096CCC1886848C60033124253CE2F2201E92
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 0f45506f36f7eedd4e83c439861dcc9ae4aca01a5041e1cef1e436781aa8019a
MD5 d59f5252874b319d4cb0adc2d0e00239
SHA1 ce16b8715e55250ac2db03925a9bd9d74becb673
SHA512 57b95e37c75e93fca00eaa1d6bf49f3592c3ed1a711163b1b4d1cebcfa70ea7b96b843470c9cc268bd33a9c924bc87ae3ac9279ffe5f97bcf3dded7b9161abe6
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTylDIRK4A0TyRCIfKPKcfyZ2IfKf6cw:KYbaKYIKeDaK4AKiCQKPKOK2gKf6j
TLSH
T1A5C1220A327A1652383D2958B26686770F4239A3301CF47F7FB964E54B67E124CBD4ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594b96.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594b96.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3591d0f6331ad9641e8630613ffac5acc34cf2329bcea11c4d50249d77c31cf2
MD5 a499956a529bea59b616491ca4910b02
SHA1 213ed86763160f1d9fd6e2c920c2ea109de8f5b2
SHA512 8a23d5e77cb74d133f2a37fd3b5b25d339619fcdf09d0963e90db4068be104f8b57fce2875da10584b74f14d2bf5c4d15a6b0e541c408d04207f76b5ca9e301b
SSDEEP 192:tONx6JkRtQmiUy5BW+RNA+Fd10JoLkRh3cRRU6:tONx6UrQW+RNzdTLM2U6
TLSH
T1E202D835AD382C7B9EF26D0AF48B37175FE4216BEA892B84D6E81F0C01D765C1347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 803b9e4ef47a9c4258cf5ddf4e89b387113f2fdb3a990cdb8697f906a9cf206b
MD5 cf9afa37ea0a88194ac74244d721581f
SHA1 4cae8b047b0b8d4071354dc4f4426aca92ebd606
SHA512 d5a6aafc4badf9cd963fee93916caacc2918a9453cc731acb57123c624147bafed7f4cd2fdfd76e756dd53413ed7ee6a56c405648ef6a81424b1fa446d1f8671
SSDEEP 384:ttNn/s3n9S5sNfWnfbMJ/VRNzdTLabScjmwo:tj+9+6tHzROb1j0
TLSH
T1E6928D326C242C6B9ED2A046F84B3657CFF8516797C52F94D5EC9F0D01D66AC0317D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 fa496af498eaeddacfbac543509a353ac37c2dbac3302386279c1cb2b72548e0
MD5 b63c873592f717ae6c42a4fa37ce4620
SHA1 9c2c35f245b6b747d27aabdca251a49d6005b67c
SHA512 eee36fbb4282d751f329395a8d42c95443d573a2fee2d9f869fc4dfd52e18b19a137a029f7c160edd7169b38f9515112df29553c35e614670a2a338324199baf
SSDEEP 384:7tNn/s3n9SBsNfWnfb0J/VRNzdTL7bScjmwo:7j+9WStHzRPb1j0
TLSH
T117927D326C242C6B5AE2A046F84B3657CFF8916397C52F84D5EC9F0D01D66AC0317D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ac259da92716a7a8a68fdfa61e82265608cb1da5490fe4af5534b2b3edff5cde
MD5 3667983cdc3e3abbfc827d941f871cd4
SHA1 e8e12e1a3c12074cad00d6ae9a992db2c1a96da4
SHA512 a91349081ee6ff8b16486a91b8b5cdcfc74d153ce30dd76e2c33fde96cafa12fa65aaf41164c6862acc62e353c2b591f78fa7370fed45212850362a03750b751
SSDEEP 384:giFKtNn/s3n9StVsNB8TUNTUlIlWnfbaAA2VRNzdTLgbScjmwo:7FKj+9wIwg2AUHzRUb1j0
TLSH
T19CC23AF348D7587AD99E9747B73E2E028EBCC163B6842A50B3985A0CCDD61BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 929bbb66e8d24c72e3471b451f13913d22a06b5704a5bc9c0e45edf3215883e7
MD5 8657ca28f7123c127689c170732d0b9a
SHA1 7ab80ea26af0fda0b60d8614296fab2776d8dcb5
SHA512 c436c96986bfe1085c334309fd9c8989a7538859da12e1e2c62ff33975c7350674c975f56fea05c6c8830d1fe65fba6ce14c4364c6b44f2653f5c23c5bbc8971
SSDEEP 192:3ONq6JkRcQmiUy/Bd+RNA+Fd10JoLkGwPGVcrqwrrU6:3ONq6Us2d+RNzdTLGbU6
TLSH
T107120A316C386C7B9ED26806F48732534EE4512BEF897F94D5EC5B0C01EBA9C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 71954b715bc1b26de5a8b9e73a0e0de3a97928ab4ec03b72f9e6680a4c12a8bc
MD5 cbb555ef44ad37a471a122e0bb1b4be6
SHA1 7d392efd81bd9fb2abc8797405b8872906ea5c04
SHA512 467b84dc3ba6efb4bb17b6c022ab0776b17ff7d1353925e12f2b83b8c11b2cc75294e78afaa3d32af7af0a414cccf0be0a2b23022b8249c36573cf32197daf6e
SSDEEP 384:8tNn/s3n9S5sNfXnfbMJ/VRNzdTLabScjmwo:8j+9+JtHzROb1j0
TLSH
T1C1927D326C242C6B9EE2A046F84B3657CFF851639BC52F84D5EC9F0C02D66AC0317D29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a4c1f4a-fa57-4c73-8e54-a31f8cf45a6b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9a4c1f4a-fa57-4c73-8e54-a31f8cf45a6b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1fe27eaf2fa5d398360d26a3c02805a3fd14540e72e1ce76be1482ce1b358360
MD5 59cb1c491a1d4847430851a5f89a68fe
SHA1 3ad8d97b2f3eacbb94ea14f98753abf6c1aaa4f7
SHA512 7c14895fa50b1b23bd668c4ca460c267e7b8d4711a04f1184fa3ea41588d30e4de2f436b39010ec56a811d42b7f12f327f4694b9575b21c1c63156960d925660
TLSH
T11A41285DA6EA1148B3B76F5AABF6A86D887B78372F06D05E10110E4F0633A40CD71737
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn71F1.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-header.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsn71F1.tmp\modern-header.bmp
Size 25KB
SHA256 760690f96a84eee097f8b3412122f5faae3b03b261fdd04567bb049c63ba1e00
MD5 4b1be3872f948128261dcd0e52c41974
SHA1 326f3a2c8bc27e1600b75eeda2b6f4674d389968
SHA512 ad0511f0d9f76761dadfa423ad3643c3c67aa7e7e8e172044b658bf0665cbf8ef53bafe8eb761eb0e7aa9f7cf39736b51205886404e5c7f92515f3fdeee4c3bf
SSDEEP 768:FUVVa6kt66M/RsevDAOI2+BZOC+JTtROuh:F2s6C6xlsOhv
TLSH
T139C2BFF21A515A1BE7DA58FCE0C354623D66EEBCACF75634F5F678A83035A017B48120
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsn71F1.tmp\modern-wizard.bmp
Size 150KB
SHA256 514d8179f9014c612d1c5475e43cf97e1b656c9b607bb89e055388552aded24a
MD5 30bb7644d21019b16dfa6cc5be87d129
SHA1 c6ed96eeecfd243109a4dd8034586c2f4bc5c650
SHA512 05d3f506c2c607741f053ebd04b475c0971e30ce5bc825a0123c6200a5e950f9890a85744d1dba7400295fa5d82353324d0f478f3c14354470b118e63e467947
SSDEEP 3072:sLOP2PTTjOZGlkXCab/BCgK/4Lvz4ckMl+VAch/SkX:sLOP2PyZGlkXCab/BRvz4ckU+VAch/SE
TLSH
T112E3440A91BF901CED1FF4548E86678786408B5DAB9FEDD687DB052138EC23C71AD0E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn71F1.tmp\nsDialogs.dll
Size 9KB
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn71F1.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 3697d11bdbe1e34daa26b1e89d84276d9ff28148906943d0fe888354c3b13620
MD5 acde70f73d3b71b1c4222b763537780d
SHA1 b053b2e5fdb97257954c8f935d80964f056520ae
SHA512 598fc58a5f561e7995eccccb065faf2a2386bce0cfc4199fa95ba9fb74e9fcb291914676996c90728dd283223c2180de9fe073a4c936e60fbabe036d7e0a40de
SSDEEP 768:L8+c2MM0Hxd1fBTsRmMZdauVKAFKpnp0jdhK7R+qVQTxM:L8+DMfHPxAIMtXIVQTx
TLSH
T144F24A18FCC47EB6E6DF0570080D4A7E826FC8181B14CE9BD3A51EA2D5A63729EE501F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d77d9fefcb625b381780cb2efab1265ae2e4966144b30d2c27713cfeaee6c81f
MD5 82f40b33ecdaf17353fd73ea45f139ff
SHA1 04fd6645e9840fa256b2f8c7db83d05d7aaec4ab
SHA512 adb7aa63cfa6c42efa907fba5154eb40390edc611b56c53932f7eba22d2cf44f1cf167e98ee2545bfc5cc7dc40481345a414130c86f0fac3b1579ae064d3a781
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8761c3988269eea28e504e664e1832676f81cfb3274d6bf2ab26ba72e18c98cd
MD5 1fb62f238dd356174bbb07a1282b31ca
SHA1 3cbb6a05df6ef71d4bbc67bd2ee510b01bf2741c
SHA512 fef54cede0be23cf453daa4b4fbde5062afb51dd52dc3628dd639f6335e384c0d65dd4b35e9c3c06c3d80bf21e94bbbb24ba119a4ecbd17128ce1ce57c600f81
TLSH
T1B2D0121232115534C12030B3040261480C00C91B4107C000642DB95D2B440542903842
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0301285081f2ec1f16401de789d2a38f08c5f93043a3f17ddeed4b41e2ef8015
MD5 aa4d4e9e58ed1e266fb9bc754bb35544
SHA1 730b11ae6d71adae689cfdda691357ac05e6de51
SHA512 a5ea0922bc3a89e51d3dfa17b7c791956a0e1f2c36c5ec397400430e339dd9e5d4754970f7fab6da3981692bd6ef72d7433a95c87d6033b68c195a482f16f43b
TLSH
T1C1D02B13F220563DC12030F20141E1381E01B60F1003C025A42DAA5C6A490DB1B82CA2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 74fbc3e48a8f1e1fff52da9fad95bb7fc5aca6cfa6c5bb0d40a1c90ced84e843
MD5 5c2d1dc1a2bd3769ecddb3c8c4bcb7c9
SHA1 520535a6092c904917cc863be5a737a25e025fed
SHA512 9c112f73e27b461a3d5256428dfd4fbde671a0bf3d03d18410c261965c08d9e184cf1d1a41625154193269e24e0194ecfdc557ad0ee6569c837e06ba7134818b
TLSH
T13BD0126AB611663AC22034B14141D5252F41650A2197812AA8289ABC5DA989B56958E1
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 7398b4cf1da33776ee245737b5bc6ec52c474b90b4075b195bdfe1296259e645
MD5 d7cf39a2e9ec3ef001df2ec84fb736c4
SHA1 386e7f85fb8eefb82fad844bc505885b3d28515f
SHA512 7bd3e856211a6824b88d537c05afc0e6824208a15324dcb3ef4b1ca4c64fc828ebb042834afe8f679f6ce88c912d9ca62414887969dba61be17e469f602a37ff
TLSH
T18CB01219F401B819D65403F010CD108076987B220F02025501D0182088743A50106014
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 f7964fd000a38ad6f6dc2273b69e52f3713fc7953d17dc28981e2e641e27a97a
MD5 229b944e3dea59471b1c98c7e63328fa
SHA1 a23c1c713ddca3bcea807c9dfcfb16def4d95f7b
SHA512 1c974621dd76c0ff78428942a453a342940ff9beb12eaddf699253ac2bc9ccbf47f6592c6f54d32a16ba5463003e5405bb0bb959e2ad9a95c760686a0c84d8c4
TLSH
T198B0021AE815B86DE6B486F094CA01C43BB47F733F235E9642E428749D783D48213316
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f2e7.TMP

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe58f2e7.TMP
Size 48B
SHA256 8f004cc0d154a28948876525e98cdabbd66563896e9662c431a07c488aafb696
MD5 7fd84a441225879978c4e09839cb34dc
SHA1 d66e7069a611c8eb6f8660e2d26f28ce04ca7a70
SHA512 29ebeedaf615930ce635c17139f9648806df3bcc506d616538ba29e0a25042aaa7cd8d702f46889c88e56fae23605b6224ee51774034e2de327178f47ec1adf0
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 55ed41933727089a03bdc9de341d3f0ce1bfac012b23cecb684d2c2b762dd79c
MD5 8fa1956aaeb1736391d9ff8ef86ce670
SHA1 d7aaea30487cd7647128cb88d1b4ea10e1cd4963
SHA512 7a193b168e4801704714695b7fba07be87be47e3dd8e762a9ec612330dc99a62c9e0e588503b40ae00ddeeb520a2de172944f4eefcffb341261e9310f1386c3b
SSDEEP 3:LstlNllkll/l/fl//:LsX3lEtl//
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 ac040900afa95317a9450e858d8b274777edecdce9089104dbab6d6556d61372
MD5 3fd932e940ba0341e8c2e48c7344d07b
SHA1 82dd45583ad90647666f3d4b29aef3fd4035ff96
SHA512 e9263551eb87d9d0e3f884906fab96d9951f431dbd1edc4e49f3e83469294384ac4185acdc15e63679b558b6b336a962b6d68bf8a6291d4bb7d4f5c3af4b40b7
SSDEEP 3:LsOllllkll/l/fl//:LsUlEtl//
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

3b721b4c-7ecf-4184-9949-f5643a5a59f8.tmp

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Network\3b721b4c-7ecf-4184-9949-f5643a5a59f8.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Network\TransportSecurity
Size 355B
SHA256 a7aafc1d9b55557bf0387ded5cb7e9ab042ed8c3e1a7ee08d7adb031802a566f
MD5 773beeac153044b263d11d23c148fc9f
SHA1 d53555bf4ea0349a1a2d8db0ce286d14c0c8b92d
SHA512 13b3d0427137b55cf9729132e4028a77faacb9647f6b58c1bbfad5dd1f96c4a6da0bb9961f4452186b42af39ed3b0a4544ad54c73529963e686ba89dceac2ea3
TLSH
T134E02073907EA467203999661E44FC556D7EF434024175E8CE754A3CB0505A25507853
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Preferences
Size 6KB
SHA256 06938ea049aa65cfc884b839e2530a513547ec913efb1a9f5c1753322c0d5c25
MD5 441efffac80a86a3a869a5f22dc64658
SHA1 0c6563b3e8b0ea896a2c333893bdac6e1bf77453
SHA512 02ab052558305e8dc96215817f5910e67700fdd21e83bed5c143ac29de201aa8d83ca822fd76d5f5fa929cc5ff1465e1cd46f069f22aac46dd0ea633c516f6cb
SSDEEP 96:sthb05F5LCbDAX2ffqBZ8i0vhEHkt0m/7qx+WVHMSm+uecJixMk8dQjDP+g9eADx:stR03nmf0Z8paqd/S+WiTixQdwPe2M8
TLSH
T1CBE1A7039E28A93B5CC7E619BA36FB56D2FA112263D54E48EBFC861C04D66CC5307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Preferences
Size 6KB
SHA256 0814e9267aa70ec3b21a06a6ee9bd381a9da326fa4a9ffa66848676f6a3adf44
MD5 b3bb3da8d57b3437965e0ce564da6de1
SHA1 3d2a33a614634d4bffded72a7ddfc70f1de6def9
SHA512 356a281dbe999741b899aaf76e1eda4135beabc93688118ac170323584721835b3f062fca6d9aa4f17ab39febee3c1890eb5a749e0afc335962053ead6586a60
SSDEEP 96:sthb05F5Ltb9AX2ffqBZ8i0vhEiktqm/7qx+WVHMSm+uecJbA1idQjDP+gvQKEB:stR036mf0Z8paBn/S+WiTbAwdwP9QK8
TLSH
T148D1A8039E28A97B5CC7E6197E76FB56D2FA1021A3D40E58EBFC861C04D66CC620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58f2e7.TMP

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Preferences~RFe58f2e7.TMP
Size 6KB
SHA256 8df98483e214c774e82594a44f97b61631d8060be946205d1bd4768ccb152852
MD5 ff5504aa0eb193e076c777bbb20afc15
SHA1 686eeee3037bdc1bbb46fa9430cc2c249acd9884
SHA512 d44727d81cef65d1baca527ef152235b85eeb8e115ea94af5b6bc05846de3a3e45b5c8eaeaa3371e3c5d41297f84dcdfe842e562084b869a50f10ebd4c476c66
SSDEEP 96:sthb05F5Ltb9AX2ffAZ8i0vhEiktqm/7qx+WVHMSm+uecJbA1idQjDP+gRtMEB:stR036mf4Z8paBn/S+WiTbAwdwPvtM8
TLSH
T1B4D1A7439E28A97B4CC7E6197E76FB56D2FA106163D40E58EBFC861C08D66CC620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d11f6a17-03ea-43b5-8011-f0ca7a7e4764.tmp

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\d11f6a17-03ea-43b5-8011-f0ca7a7e4764.tmp
Size 7KB
SHA256 6136255610f8528d1e63923e00b888edb7bccbc6ea09c2cbee384851e234000c
MD5 f351d3b7d1d7bbd009689c27c6260988
SHA1 5491865aca40140ef78f64f856373af4f0a401c3
SHA512 66fd2247b0be7624e76c7c4167449e73c1cc17f33ee302937e69104866a24c10cfd2269f2d32c508e9954cec3d29f1a3bb8671aae9a6c4a87939493638136ea9
SSDEEP 96:sthb05F5LCbD5X2ffqBZ8i0vhEHkt0m/7qx+WVHMSm+uecJ5GEZdQjDP+ghgADMC:stR03Smf0Z8paqd/S+WiT5GWdwPg2MC
TLSH
T181E1A907AE28A97B5CC7E6197A35BB52E2F9106263C50E48EBFC871C05D66CD6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Last Version
Size 14B
SHA256 06205ebe5acf3073d12a4ac419377a3449e6d6b5fa7fa2b1c4201f007c4ddd91
MD5 96fb5f155aee0f8cd88274656c58ca83
SHA1 1fe86d9df188b0f86ae2d8da8f7c1ef663258baf
SHA512 fee0061ef23ef3fc35d050501b47db921f490c2aec2a016304c9f27228d3ecf7df9641fd681d9babd275ffd3dbd20e33e38fa5bf583c2852ffcd4b04bedf015c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State
Size 1KB
SHA256 54c57837cf8bd0fecbf9f107da57ab1ef22cea8d4c626c06da54f9f992997b68
MD5 2a5a66ef832bc7fc1b1df91f538e4fa3
SHA1 e567f16984b13abc18a5932093a7aabab58fd28f
SHA512 5e5e0952eb8d5cfae9f1144eb39d240372ba2db06f8b77e53cb9166f16f0f15b16ee4592fdb89f01c4ed501ab94e88910c4f5b94f5cb9b25326616586fa7a45a
TLSH
T10631A7B3D5941B3B7DD3A586B3827BAB7C616226C3154F48A3DD4B0C02D358C9626C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State
Size 2KB
SHA256 4a7eff158e1694f86ad22a96a99d3bf493efdccbf952663a7bba280b23a3a822
MD5 a33dcd13aea045ed179254b51f81f1d1
SHA1 96a2229f167cef9263142a283c795b3cda9da4f6
SHA512 25fddc300f4f7c5f4971e4c66350dbcd783b44433e9f15337f52ec542d197103221ee56d0bfc405480dc3835566d222c9a16f273601dcbcd82a29f04c4c48673
TLSH
T1FF51C573E908AB3B99E39944BA8A3F63ED756261D7562F5496DC0B0C01D714C2302C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State
Size 3KB
SHA256 834ac19e574757d7d6eed32b9fbcc7870269d4642a149f1b8c6e18a526ee9cb8
MD5 9e4f10ca7cb393b4f1e82585f62f6a1e
SHA1 e1fe69761d186e201270875f9f432c44e46aa6ac
SHA512 90bc9602eb9fe86cea6d082d1d48666fb6f7e1f3307e3142980c13c72da76e2aed5dc2406cc9d6695ebeb29652f6d3fd644ae34c8c694f34d7ce4b16cd91b9e5
TLSH
T1B271A732A964E93B5DE3D945B9C63B16BAA55233D6853F98D6EC0F0C01D728C1341C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State
Size 16KB
SHA256 4b9c87cf9ce22de1776389b92c35af422e4743bce508396b1af7917189fe344b
MD5 56cef5a27a6598b6121b3f19f148b125
SHA1 e6f68383a5dc0081375a9708e2b325d19dae5d82
SHA512 8ffcee875a47a81062523be2ac52be2cd878143ebeb29daaf4d0c5ff29112f0b8186d375b18fff1aa89ed5f19f5ba85a908f1952481712548aedbf34bbb3e5bf
SSDEEP 384:zBsrv+89zHqlDNP9oidw3Nb7zra0NySNH:yrv+4UNbdwtfZNySNH
TLSH
T155729D33E52CA737ADF29845B58A6B0B7B78616695C10BA8DAED0F4C429F0C92316D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State
Size 16KB
SHA256 128acb2a15cd6e385cd1e5391f52e9e2373737067571448ae517ebdc2fd34f71
MD5 a172adacd54cce710c998d2a1dd0ee79
SHA1 f156ff72fc42616015915dbdea5f6d9f808c5fb7
SHA512 a276933957d81065e9699bf896cad4bdf7f40353dbaa3cfe572c8bc36b3d05f8a1a85ceeb0ff2186712d567c1659fce1bdaf12dc305c3a62b79ca9a4c6d3daae
SSDEEP 384:zBsrv+89zHqlDNP9oidw3Nb7zra05ySNH:yrv+4UNbdwtfZ5ySNH
TLSH
T174729E33E52CE637ADF29845F58A6B0B7F78616695C10BA8D9ED0F4C429F0C92316D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State
Size 16KB
SHA256 e47e55f49ea59528fcc42f84be9793818903268a9a25bef8c7a99fac6caf0a77
MD5 be6f72c9ffbc87c8cbacbd348f83956e
SHA1 a4607c93fff2c37cdefdcbc688e97a59fa3b10a0
SHA512 92acaea57327730d1b39a1049ecf7e4e11f7955eaccca054e8d463c0cc7941bea18f956e626f171e0c68eb80bddb257ed38d4a52f9dc4fb2e5a4f3ec816f4084
SSDEEP 384:ztsrv+89zHqlDNP9oid03Nb7blaViysukDz+NA:+rv+4UNbd0tBoiyhNA
TLSH
T187729D33A42CE6376CF39444F65A2B0B7BB86262D5C10AB8DAED0F49429E0C92717D53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58ca21.TMP

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State~RFe58ca21.TMP
Size 1KB
SHA256 3fc2c4e1b86627cdf68d31931c66b478c42064981b43696fe7c9b20ab05b6354
MD5 69485785897aec1bc485f04d4e305c2c
SHA1 34120b951c7230c451d0da71a049881b682283d8
SHA512 322c5386f32bc3b977ffcea9bb774241b9d2487dab282e3d5a07fc43e250d495188a10db14b89761a51f61f5593dd3c36764d44319a5258a711dd10c49cabb92
TLSH
T12B216273C5986B7BB9D2A485B342BBDB3CA06225D2194F0CE2DD470902D758C9626C33
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\ShaderCache\index
Size 256KB
SHA256 dda251ed1acae1c5869b8f8b9fc03040d46be562191727bb480f3ff368c7e121
MD5 7855d58a1b7a4934c54799003871afe2
SHA1 d52a3902e130c9226f6d29b01b5630ae5567e5a8
SHA512 a9a70e022887e4ae90bc8c5b3d6895e040efb819d3f47d8bb2630cd7fe8eaf8598bb74fb056865fa3203cbe484cf13a76e332a99b303b3fec49b94706ddf1477
SSDEEP 3:LsOllllklkXlku/:LsUlPku/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

Harmless Asset Manager.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Harmless Asset Manager.lnk
Size 1KB
SHA256 26559916610fb418f6982ac0c8e6dbeba75706865bcb97c86a9e9fadd97f923e
MD5 def73dc20d37046dcfa32917b5ff9792
SHA1 8c04208aabd74653c60fd54a8b3a04844985e7f5
SHA512 20568138e21e1c5d058e3692cd750f4dbca87ac903831617779c3c11b1962555d9d6ebd9255d8e7bb00d61da5666fbff7bb3c0c60556e7c185a1cf16532623cd
TLSH
T1E221C1005BC92625FE7F9E3569BA1212E271BC62FE62CE1D0041836C1CF1941DE74F2A
MD5 SHA1 SHA512 TLSH

Submit Download

Harmless Asset Manager.lnk

Path C:\Users\Admin\Desktop\Harmless Asset Manager.lnk
Size 1KB
SHA256 4ff50060d01bbb676e555ec0962d51608e24c27d21eb2d061cf4d319591f5290
MD5 a3b377327fd5c7d1f371a88f443bca02
SHA1 0f063d77b756551794f5243bf34c05ef48a12c9a
SHA512 f1d880edf605ccd139b09a9b3008fff6919fdfa8f3c4cc653ad2e3aa56876a5b6632925c4ade03f39ef34316677156326b78e50bd069e7c52dcc3de50a9a97ed
TLSH
T15821AC005BCA1565FEBFAE3529BA2212E275BC61AE56DD1E0041831C1CF2D41DE74F2A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4180-316-0x00007FF87FD80000-0x00007FF87FD81000-memory.dmp

Download

memory/5204-437-0x00007FF87FD80000-0x00007FF87FD81000-memory.dmp

Download

memory/5424-368-0x00007FF8817F0000-0x00007FF8817F1000-memory.dmp

Download

memory/5424-366-0x00007FF880320000-0x00007FF880321000-memory.dmp

Download