b3be243573c19555535e0fc3b9dd8569883c92533cf77cff7cb82373f050f4cb

Analysis

user interaction
yes
max time kernel
66s
max time network
68s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 21:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Harmless Asset Manager_3.7.1_x64-setup.exe
Size 4.0MB
Sample260809-1jdbeay1ew
SHA256 b3be243573c19555535e0fc3b9dd8569883c92533cf77cff7cb82373f050f4cb
MD5 3d417c448030b7bdc8ffa8cd9dcd97f0
SHA1 16a80ace5537817673e405f7c7e23f85b8061e70
SHA512 8ec6bc6d24d0980b83ff5b6028b730eee7cca51c2931dabf2b2ce242776a6a2e0a3e8cbf02e6fc34cc8470e0d374f8c452f6991fec13764d42642630f337c5c2
SSDEEP 98304:iNWpfOD1OJve9MyuEu5gBZbQE6N1wd3HOKFSHmCVETsB360Uxv7:iNMK1OJVyuNgPbQEd3HOrHmuETsBHav7
TLSH
T1351633985E8654A3E5B21AF06C87006FF73A2AFD5094775E475653BCBA27F42F80CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery trojan

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3344 created 3260	3344	Harmless Asset Manager_3.7.1_x64-setup.exe	56

Executes dropped EXE 1 IoCs

pid	Process
4608	harmless-asset-manager.exe

Loads dropped DLL 7 IoCs

pid	Process
3344	Harmless Asset Manager_3.7.1_x64-setup.exe
3344	Harmless Asset Manager_3.7.1_x64-setup.exe
3344	Harmless Asset Manager_3.7.1_x64-setup.exe
3344	Harmless Asset Manager_3.7.1_x64-setup.exe
3344	Harmless Asset Manager_3.7.1_x64-setup.exe
3344	Harmless Asset Manager_3.7.1_x64-setup.exe
3344	Harmless Asset Manager_3.7.1_x64-setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	harmless-asset-manager.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
53	discord.com
54	discord.com
93	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Harmless Asset Manager_3.7.1_x64-setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1280	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307852672350170"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{6C379907-2F1D-4CC7-A98B-ED0143B5B71F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager\DefaultIcon	Harmless Asset Manager_3.7.1_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager\ = "URL:com.harmless.asset-manager protocol"	harmless-asset-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Harmless Asset Manager\\harmless-asset-manager.exe,0"	harmless-asset-manager.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager	Harmless Asset Manager_3.7.1_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager\ = "URL:com.harmless.asset-manager protocol"	Harmless Asset Manager_3.7.1_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Harmless Asset Manager\\harmless-asset-manager.exe\" \"%1\""	Harmless Asset Manager_3.7.1_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager\URL Protocol	harmless-asset-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{4FF295D6-624F-4307-83F2-FDC0FF008D16}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Harmless Asset Manager\\harmless-asset-manager.exe\",0"	Harmless Asset Manager_3.7.1_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager\shell\open\command	Harmless Asset Manager_3.7.1_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager	harmless-asset-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Harmless Asset Manager\\harmless-asset-manager.exe\" \"%1\""	harmless-asset-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager\URL Protocol	Harmless Asset Manager_3.7.1_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager\shell	Harmless Asset Manager_3.7.1_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager\shell\open	Harmless Asset Manager_3.7.1_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager\DefaultIcon	harmless-asset-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager\shell\open\command	harmless-asset-manager.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3344	Harmless Asset Manager_3.7.1_x64-setup.exe
3344	Harmless Asset Manager_3.7.1_x64-setup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
896	msedgewebview2.exe
896	msedgewebview2.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4608	harmless-asset-manager.exe
4336	msedge.exe
4336	msedge.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 4608	3344	Harmless Asset Manager_3.7.1_x64-setup.exe	91
PID 4608 wrote to memory of 896	4608	harmless-asset-manager.exe	92
PID 896 wrote to memory of 2844	896	msedgewebview2.exe	93
PID 896 wrote to memory of 3972	896	msedgewebview2.exe	94
PID 896 wrote to memory of 3972	896	msedgewebview2.exe	94
PID 896 wrote to memory of 3972	896	msedgewebview2.exe	94
PID 896 wrote to memory of 3932	896	msedgewebview2.exe	95
PID 896 wrote to memory of 1560	896	msedgewebview2.exe	96
PID 896 wrote to memory of 1560	896	msedgewebview2.exe	96
PID 896 wrote to memory of 2696	896	msedgewebview2.exe	97
PID 896 wrote to memory of 2696	896	msedgewebview2.exe	97
PID 896 wrote to memory of 2696	896	msedgewebview2.exe	97
PID 896 wrote to memory of 3940	896	msedgewebview2.exe	98
PID 896 wrote to memory of 3940	896	msedgewebview2.exe	98
PID 896 wrote to memory of 3940	896	msedgewebview2.exe	98
PID 4608 wrote to memory of 3188	4608	harmless-asset-manager.exe	101
PID 3188 wrote to memory of 4336	3188	msedge.exe	103
PID 4336 wrote to memory of 2732	4336	msedge.exe	104
PID 4336 wrote to memory of 1280	4336	msedge.exe	105
PID 4336 wrote to memory of 4480	4336	msedge.exe	106
PID 4336 wrote to memory of 4480	4336	msedge.exe	106
PID 4336 wrote to memory of 4480	4336	msedge.exe	106
PID 4336 wrote to memory of 3380	4336	msedge.exe	107
PID 4336 wrote to memory of 3380	4336	msedge.exe	107
PID 4336 wrote to memory of 4268	4336	msedge.exe	110
PID 4336 wrote to memory of 4268	4336	msedge.exe	110
PID 4336 wrote to memory of 4268	4336	msedge.exe	110
PID 4336 wrote to memory of 1088	4336	msedge.exe	109
PID 4336 wrote to memory of 1088	4336	msedge.exe	109
PID 4336 wrote to memory of 1088	4336	msedge.exe	109
PID 4336 wrote to memory of 5188	4336	msedge.exe	111
PID 4336 wrote to memory of 5188	4336	msedge.exe	111
PID 4336 wrote to memory of 5188	4336	msedge.exe	111
PID 4336 wrote to memory of 5196	4336	msedge.exe	112
PID 4336 wrote to memory of 5196	4336	msedge.exe	112
PID 4336 wrote to memory of 5196	4336	msedge.exe	112
PID 4336 wrote to memory of 5544	4336	msedge.exe	114
PID 4336 wrote to memory of 5544	4336	msedge.exe	114
PID 4336 wrote to memory of 5700	4336	msedge.exe	116
PID 4336 wrote to memory of 5700	4336	msedge.exe	116
PID 4336 wrote to memory of 5944	4336	msedge.exe	117
PID 4336 wrote to memory of 5952	4336	msedge.exe	118
PID 4336 wrote to memory of 5944	4336	msedge.exe	117
PID 4336 wrote to memory of 5952	4336	msedge.exe	118
PID 4336 wrote to memory of 6076	4336	msedge.exe	120
PID 4336 wrote to memory of 5676	4336	msedge.exe	121
PID 4336 wrote to memory of 5676	4336	msedge.exe	121
PID 4336 wrote to memory of 5856	4336	msedge.exe	122
PID 4336 wrote to memory of 5856	4336	msedge.exe	122
PID 4336 wrote to memory of 5368	4336	msedge.exe	125
PID 4336 wrote to memory of 5356	4336	msedge.exe	126
PID 4336 wrote to memory of 5368	4336	msedge.exe	125
PID 4336 wrote to memory of 5848	4336	msedge.exe	127
PID 4336 wrote to memory of 5848	4336	msedge.exe	127
PID 4336 wrote to memory of 5900	4336	msedge.exe	130
PID 4336 wrote to memory of 5900	4336	msedge.exe	130
PID 4336 wrote to memory of 6388	4336	msedge.exe	129
PID 4336 wrote to memory of 6388	4336	msedge.exe	129
PID 4336 wrote to memory of 6188	4336	msedge.exe	139
PID 4336 wrote to memory of 6196	4336	msedge.exe	140
PID 4336 wrote to memory of 6204	4336	msedge.exe	141

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3260
- C:\Users\Admin\AppData\Local\Temp\Harmless Asset Manager_3.7.1_x64-setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Harmless Asset Manager_3.7.1_x64-setup.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3344
- C:\Users\Admin\AppData\Local\Harmless Asset Manager\harmless-asset-manager.exe
  "C:\Users\Admin\AppData\Local\Harmless Asset Manager\harmless-asset-manager.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.7.1 --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4608.2800.15709225583071558181
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:896
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffbf356b078,0x7ffbf356b084,0x7ffbf356b090
      4⤵
      PID:2844
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.7.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1732,i,11020891028702391491,5015840053378594867,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1728 /prefetch:2
      4⤵
      PID:3972
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.7.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1372,i,11020891028702391491,5015840053378594867,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:3
      4⤵
      PID:3932
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.7.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2372,i,11020891028702391491,5015840053378594867,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1708 /prefetch:8
      4⤵
      PID:1560
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.7.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3612,i,11020891028702391491,5015840053378594867,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:2696
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.7.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3912,i,11020891028702391491,5015840053378594867,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:1
      4⤵
      PID:3940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/oauth2/authorize?client_id=1404156965248307261&response_type=code&redirect_uri=https%3A%2F%2Fdsc-oauth.harmlesscreations.com%2Foauth%2Fcallback&scope=identify%20guilds.members.read
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://discord.com/oauth2/authorize?client_id=1404156965248307261&response_type=code&redirect_uri=https%3A%2F%2Fdsc-oauth.harmlesscreations.com%2Foauth%2Fcallback&scope=identify%20guilds.members.read
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ffbf165c188,0x7ffbf165c194,0x7ffbf165c1a0
        5⤵
        
        PID:2732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,9627782116817317770,4207167189612312695,524288 --field-trial-handle=2276,i,5165867062751707965,14361691606444220380,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:1280
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,7095063721622500284,5315033595227399448,262144 --field-trial-handle=2276,i,5165867062751707965,14361691606444220380,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
        5⤵
        
        PID:4480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,3225773989892756306,3523942188837548417,524288 --field-trial-handle=2276,i,5165867062751707965,14361691606444220380,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:8
        5⤵
        
        PID:3380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,3591016381121634049,5582435746593981665,2097152 --field-trial-handle=2276,i,5165867062751707965,14361691606444220380,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
        5⤵
        
        PID:1088
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,1833060085890252333,15150128902218433131,2097152 --field-trial-handle=2276,i,5165867062751707965,14361691606444220380,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
        5⤵
        
        PID:4268
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,2636168776948178595,15468382402287414626,2097152 --field-trial-handle=2276,i,5165867062751707965,14361691606444220380,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
        5⤵
        
        PID:5188
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,1657357021171266832,10566438736372696519,2097152 --field-trial-handle=2276,i,5165867062751707965,14361691606444220380,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
        5⤵
        
        PID:5196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3968,i,7670376451244282061,11347911729386054779,524288 --field-trial-handle=2276,i,5165867062751707965,14361691606444220380,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
        5⤵
        
        PID:5544
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,12830157039225051808,16781908636948362717,524288 --field-trial-handle=2276,i,5165867062751707965,14361691606444220380,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
        5⤵
        
        PID:5700
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,2140350737245202426,1324118706684485930,524288 --field-trial-handle=2276,i,5165867062751707965,14361691606444220380,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
        5⤵
        
        PID:5944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2668,i,13575622623251673089,7232728370002041759,524288 --field-trial-handle=2276,i,5165867062751707965,14361691606444220380,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
        5⤵
        
        PID:5952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,6814015830442926436,15744491650179319681,524288 --field-trial-handle=2276,i,5165867062751707965,14361691606444220380,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
        5⤵
        
        PID:6056
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,6814015830442926436,15744491650179319681,524288 --field-trial-handle=2276,i,5165867062751707965,14361691606444220380,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
        5⤵
        
        PID:6076
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,2377835618267403887,4229870552900610225,524288 --field-trial-handle=2276,i,5165867062751707965,14361691606444220380,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
        5⤵
        
        PID:5676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,14212964146854177457,11739383906860575404,524288 --field-trial-handle=2276,i,5165867062751707965,14361691606444220380,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
        5⤵
        
        PID:5856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,11514198782205791578,18024902430679905235,524288 --field-trial-handle=2276,i,5165867062751707965,14361691606444220380,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:8
        5⤵
        
        PID:5368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,837709417736073840,12278618680664751435,524288 --field-trial-handle=2276,i,5165867062751707965,14361691606444220380,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8
        5⤵
        Modifies registry class
        
        PID:5356
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7152,i,17183569793319786832,15982084676576165212,524288 --field-trial-handle=2276,i,5165867062751707965,14361691606444220380,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
        5⤵
        
        PID:5848
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7208,i,11031330710600429403,6270894832356056778,524288 --field-trial-handle=2276,i,5165867062751707965,14361691606444220380,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
        5⤵
        
        PID:5900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,7029087721098521355,9728274693565263044,524288 --field-trial-handle=2276,i,5165867062751707965,14361691606444220380,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
        5⤵
        
        PID:6388
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,5122557707760414604,17861312008176742549,524288 --field-trial-handle=2276,i,5165867062751707965,14361691606444220380,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
        5⤵
        
        PID:6188
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,10723218134790804376,17522952214802376450,524288 --field-trial-handle=2276,i,5165867062751707965,14361691606444220380,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
        5⤵
        
        PID:6196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,9135688526673451713,4128026579791851477,524288 --field-trial-handle=2276,i,5165867062751707965,14361691606444220380,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
        5⤵
        
        PID:6204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1644

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:5900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

harmless-asset-manager.exe

Path C:\Users\Admin\AppData\Local\Harmless Asset Manager\harmless-asset-manager.exe
Size 11.8MB
SHA256 c6899b7c645cfb6ca878dfec8ebed24307f7f75afddb14509159c5fc0e6012e9
MD5 4dd34df969a6525b4fdf67c7ed7ac025
SHA1 0b4c621007e12d1babb9f5ca2e621ac44a29d83b
SHA512 ca1be897b17ef862eab7d796f932683ce2fa5a0b777420dcfa9e10b0aec8d9607413b47a87c996c94fec5cc8a3a0376591ece921f7d5dee4462fe15f54f69afe
SSDEEP 98304:3cP75aZ0jG3JzZ3B1SamMM7UgXH7G/X7sBTZCVA2BcT6ZfQ8IPJrEhEfieOdn+km:yu0jQM7LbEfQ8IPJAmfFax
TLSH
T115C66A43F78184E9C0AEC574C76B9773BB32F8CD4521736B1BA44A212E1AB906F487D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 26374662fab280ef96eaa929fd16d9c29e3f74bff1e5cdf49f3940b212c74426
MD5 b3d937ce21fb8a9c36b91767a220b12b
SHA1 792049998f48955661735784aa1a6653cfd6d461
SHA512 05958eec7798844717209ca31b3321bd05988e5248f66df4ba666cf3bbad7c9d2a9fd23d375157547fdb301a268f9f7b0a6a6c7b7c9fa62856f0848ecb862773
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7l:fwUQC5VwBIiElEd2K57P7l
TLSH
T190B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 f553fd56e3c502d7c66f00842387869a53264a7be12febc63e263a95ebc13aec
MD5 01698666552636ebc3598c2c321bb13b
SHA1 10d61f1402992c011e130e6c3dab73ddf13a5174
SHA512 6e3561d551f18d39c65b59bfc0499678c0c25b14f3142beeb72ecf5532b6eac319aefcd95f38aa6ee76b32978c4d98fc96573da0cd88f5cf70fb0a738ea63eb0
SSDEEP 96:GSOt+m7MuM6zRYtIiDroD5FleEWzF0DXgOLApiuCFBpdOdbdv1hArekY/My56w5:4+nupzRYy9D56E8F0n44Idbd9hjt6k
TLSH
T14702A47A9AC00986EFDCD136D0E919EA3679DD5504337E8E1730EC7D2909F92B492F24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe594452.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594452.TMP
Size 3KB
SHA256 b8d74cfd99210b3e68b58528b5bfa62e1c9cb7fc2d3d4846c0174ea4fd243c3a
MD5 e1ecb960125f51f4b2070db85b471a51
SHA1 e330920a763648d3227e93c1a11588ebfe95e459
SHA512 281eeaa2e9a45a145a8657b0fb84bf90666b5434ac29583b5d11c6db78e7ab8031906d31db760e95b85b1d9ecd33a46246712625ea28b761f69093de7b1780af
TLSH
T10771706F8D4201D3EF211131D5DA1A03373E8DA94913BED2125498BDB81EB67F1D9D78
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 92725556361873f10e851834ed618871b4905dbce06d250085100eb893f244c2
MD5 6f06b7b73e898976520e861f29e1865b
SHA1 9be56ab4b5fe092ddc19d75409f4d343b3f9f3a2
SHA512 70d58d9399bf5deb9083b9d50b7ea9012a2ba9f4d1001b388e2f28a78098b1ef082012611952a8a38866ca3e22afa6730e556ff872a0eb202e0c055094b00891
SSDEEP 192:sxZ2RhyM/jK1Ml8MiL/fvsWotlJLE0IdpEilHW6+WNzQp2/Yw2pe8Ig4J:sxZ2LqL/fvsWo7utXHbf/Yc
TLSH
T1A7520A06AA349977CCDBD209BA557B53D6F54572E2840D449AFCDA0C00FABEC2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2b4fbbf2f72b2f4fdd931a4219acab06ed0a0d1a0314bc949b634737b98481f7
MD5 74f507ecfd00a617ae1ea0684ce484f7
SHA1 ad867b77b5431c02a7e548fd49ae462fb9196623
SHA512 00d0be2b76f6ef6f501b3631a57d8420e7ad5f2ba6957ff1dbf21a5ef47937ec28c375a8aececcf6be7ab51e34efae07a813973ac20dd2809a7d29d357646087
SSDEEP 192:sxZ2RhyM/jK1Ml8MjL/fvsbAtlJLE0IdpEilHW6+WNzQp2/YwKMre8Ig5FeJ:sxZ2L7L/fvsbA7utXHbf/bdnq
TLSH
T15B520A05AA345977CCDBD209BA567F53E6F94572D1900E44AAFCDA0C00E7BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 c89c043b28df47ea5078fe98e953b31568720a399aa70e0fca06f09ec9b03a06
MD5 569675a95c766183bed7ff0a7ec2e8ba
SHA1 0c9d4517cd7198d551fc082ec4443a4734110dbb
SHA512 3954d7dccb53f6f06ae267041c9a72f648d294d6326eaa59ef30f1db270ee3440a3295ffcafdb7f3ba19c3c827f61f7c6f4167f455a04cbb601aeb0ffb80e9a6
SSDEEP 768:m34jecm7pLuLfmmWvmKxE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVM5NPLlrZ+dlrog:m34jecGEfmmWvmKxEu1ja95NPLZQdeg
TLSH
T1EDF20C7B680CCF7E4F844E9CED2ABE8B6DE8018B5A98895447FA444C03C76EB11175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\96ab7977-808b-43a6-99c0-4a9ff4f0640c\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 8763c57b35cd525bfa8f7f6fefe72baa23367fefb4f50f148ac8e2b944e6aecc
MD5 7f3a061a5a0b0c05fd51c6f9f9d3ce43
SHA1 70e7733b4f442e20e5def81d78228e5c73b2107d
SHA512 7aed9c3a9a474c30db2469a8bcdda7106ef2725b20579de49534663749dd1fff06e89e33604b0fa62f12a8d0f43d4a73176c4e98470e79651cf44a7ac92a5ef0
TLSH
T155D0972BF03D04C0EB6F0BA11F72465F0A282C8C50A5E548E413322E3438613A211EA6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 71ab93156bc88ca9b30bc2e3dd6fc823422640529e4f2724e725ac06ada19604
MD5 053c0b9a36b102c76cab13de257c03c8
SHA1 fadd6a9770ee8ec6c1f9e9559be9cee441150705
SHA512 416bc6cd63bec6fac1ca316b0e7ae68503d26faee6d21c543ee5c40956d898d4efdaa61a9729011eeaf80259e7aa7bdd7fb14e45fa1f4395588f544eb4600bbc
TLSH
T1FFD0A72BF02D04D0BBAE8FA11B72566F47286C8C50A9E958E512162A2848663A512EA6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58cc63.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe58cc63.TMP
Size 138B
SHA256 02b802ce54fa6fea58f3eca8ed298e35dc4cd01ee0fd230f11b4f93d383bc14b
MD5 f21283c4f9f781dec580f91df6479df9
SHA1 e18dcc742e3aebd6c3b78ecf92a5c6e20acae58e
SHA512 0a652c2b0aa5cd827b8ed1e9f21dd03482bd751f2a8ee1035bc70440cf3fdc0834c70436840e8f842a0a61c4f92a32b1bd0af853585ab22bf3ae260c7aee7e40
TLSH
T125C02B77F01C00418F1606F00632484E47082CCC888B9C8C701331153038E236202EF2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 13f18b04f34c03ff2ae0eaa613e8825712d63f083a49c73c1ad3f1fbb36f9f06
MD5 66e295439baa8c0260637557597fa876
SHA1 546810ca9937a88a57e6ade0cd6e35a6f84546d5
SHA512 016675503bb5e76ab9aa4ab230b7a2dc396a89f293980f9b8437cace96222fbdfb52a6c06647f93b7728f398c705840cb30ddf2b589afaa967e2a8f9cfb8d2c5
SSDEEP 96:KMUAKJSayEQK1+sesK7yux2r6m0gMkcgJPa+kKiBaskuGmp09:KHrkL92
TLSH
T184B1A021B9FE12007D3E651C91A89E6BCE5275A7301CE82B7BA914A65F67E015CFCCC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6844dba878daea1d26d22faad3d5f9c74d538aee12c1adc3c34311336e0123d8
MD5 4e4abbcd56792e3e0a20e298881fbd87
SHA1 c83fb97cb7091c54e76b131c9a7e308a8b6979dc
SHA512 fcde4e0c82f92416368cea546250154becff0d76bc1cfcaabcaa5026571d6c0bf78729295a10b2ebc9aa11d703bcf2b3a91f4f784d052ac864209729b1580004
SSDEEP 192:EON86hZ0QmiUyJJpc/+jVIjzorRV5wOZ53U6:EON86ocpu+68R02JU6
TLSH
T15702E935A86C6C778EE2AE45F48727135FE5212BE9956F94D6E81B1C00C779C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8e18fcd442c321d7dfe7230c4c09e7cdc93bf6eb1dfd3dd3f477b29b681b9e06
MD5 945c81cbd758b10fe8e3da6a86962d85
SHA1 62eac2cd3b1aa95ad9a1e3fabf4651948d7b0e77
SHA512 a9b2851dc16c5c3f913f7c7715ec3a8a416014e29f4a9301a37f9be01379f0119f93779ee93e2df1c02c9c1330747a8abd5b4d0891730ccf4de299cadbfb5fd0
SSDEEP 192:tONW6hZ8QmiUyKJKc/+jVIjzorR+XKFuSJrEt5cOq0qWU6:tONW64vKu+68R+XGxJrEY98U6
TLSH
T112120B36A468AC675DE2A551F44732139EE51127FEC97F94D6EC2F1C00DFA6C134AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ec719dc56aa0cb5cbae6773400ea7377ccda8f13c195c17b17ed757b5703925c
MD5 5a29c8f8286852e38739a2068a8d0fc5
SHA1 2e6549fd39d1948581efffac02c20061ee41e898
SHA512 d9a5528a5b233896339e3b818be4cca5a448ae5a5dbbdcca63bd6e006791104d0078e291cbd90a7ee130250a0f1e5474076559504631bea9400ac4f91f77deda
SSDEEP 384:n2AZcIhsNr2aKw2Zluf+68R+XGxJrE2F8nTKwBODNZOCKWR:2+hsKXTeZEhL8newBKZOLWR
TLSH
T129928D76A83C6C775DE2E645F84B32038EF85163F6D53B9496ECAF1C009A66C130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 5d9e330e22654206cf9aa4272cdc200da8c31ef5985e043849c6f38488f1397a
MD5 621465aa7f9360cd441934cd81296824
SHA1 8aa9c575479d10d0f1c0d8fefd508c901e79af55
SHA512 bb845cb813d2121cc273592485a430392fcba46c6654cfe6a637ea3af3cd87fe42f41b40a2842a89596ebb6b73eca1e3c700e8aa61a0fd07ae632276ce6f48a7
SSDEEP 384:nEMZcIosNrDaKw2Zluf+68R+XGxJrE2F8nTKwBODNZOCKWR:EaoBKXTeZEhL8newBKZOLWR
TLSH
T155928D76A83CAC775DE6E245F44B32038EF85163F6C52F9496ECAF1C009A66C130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f826a0ee-bdc0-4ea2-a42f-001ddf719134.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f826a0ee-bdc0-4ea2-a42f-001ddf719134.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d3aa508b390079f141c33309eb0f2b51dc0f3c57cfb7b2fdf7b7c5cc54804f6c
MD5 c46fb314015cee3a826fba83bfd00174
SHA1 738b0f0839641c965dd5b8de3072505ee71223e9
SHA512 51010df77be9067a514c526cc935687bcc677ef9e6d44a8fd445bf2d46b31aa9817e0eb942ad5920b14516fad05c93223b5074127f60f5ff116a2f28b0661eef
TLSH
T143410758B6F91149B3776F4AAFF6686E487FBC772E06946D10010E4E0A63B01C872B37
MD5 SHA1 SHA512 TLSH

Submit Download

0a7d2f9f-42ac-4a08-a461-3e0602994cdc.tmp

Path C:\Users\Admin\AppData\Local\Temp\0a7d2f9f-42ac-4a08-a461-3e0602994cdc.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2ed279f2-e801-4617-8519-e2438c98f7e3.tmp

Path C:\Users\Admin\AppData\Local\Temp\2ed279f2-e801-4617-8519-e2438c98f7e3.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd5939.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsd5939.tmp\modern-wizard.bmp
Size 150KB
SHA256 514d8179f9014c612d1c5475e43cf97e1b656c9b607bb89e055388552aded24a
MD5 30bb7644d21019b16dfa6cc5be87d129
SHA1 c6ed96eeecfd243109a4dd8034586c2f4bc5c650
SHA512 05d3f506c2c607741f053ebd04b475c0971e30ce5bc825a0123c6200a5e950f9890a85744d1dba7400295fa5d82353324d0f478f3c14354470b118e63e467947
SSDEEP 3072:sLOP2PTTjOZGlkXCab/BCgK/4Lvz4ckMl+VAch/SkX:sLOP2PyZGlkXCab/BRvz4ckU+VAch/SE
TLSH
T112E3440A91BF901CED1FF4548E86678786408B5DAB9FEDD687DB052138EC23C71AD0E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd5939.tmp\nsDialogs.dll
Size 9KB
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd5939.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 3697d11bdbe1e34daa26b1e89d84276d9ff28148906943d0fe888354c3b13620
MD5 acde70f73d3b71b1c4222b763537780d
SHA1 b053b2e5fdb97257954c8f935d80964f056520ae
SHA512 598fc58a5f561e7995eccccb065faf2a2386bce0cfc4199fa95ba9fb74e9fcb291914676996c90728dd283223c2180de9fe073a4c936e60fbabe036d7e0a40de
SSDEEP 768:L8+c2MM0Hxd1fBTsRmMZdauVKAFKpnp0jdhK7R+qVQTxM:L8+DMfHPxAIMtXIVQTx
TLSH
T144F24A18FCC47EB6E6DF0570080D4A7E826FC8181B14CE9BD3A51EA2D5A63729EE501F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4336_1831055719\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1b91e537-7ce6-491a-a68d-a67293493e64.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4336_472359139\1b91e537-7ce6-491a-a68d-a67293493e64.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7c2fc5239222c2372be37b414647ae2a91fbe612a0e1c77efc832d1124033e53
MD5 1b7c4b897ad5521e295055578b0f2ad3
SHA1 ae34531aabcc12aa3615b7a2e06e863cbc257524
SHA512 418ba34484b6d72392780924f1d44622c22364b35eed907d0f07898445debe3ce8114567133ddbec5a195cd9bcce21986fd6cfa8a6871f137be116e114db4d97
TLSH
T14FD024133F410177C01030331403770C1501D50F50454005553DDD5F5F0C4D00D03541
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f50090a9565751e57eeb33ed1573874856becb5b45deba0f016fad5c46166f93
MD5 64195d62808a8927b7d20f636f119b99
SHA1 0f069aeed72a0ba1a2ea7965386b11c812b9343c
SHA512 e5dfa6b81b89c21159f07e1b375801558a844224cd879e227ec073c4cbbae6ccff5bca87e1fd99dcae9408ac1f4f6f2367755babc4af006a168a2b43a2f0a06a
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 4957dec450e60fe4d18a1ed7cda59c0770f5a07f4e5a0127ba5df2de4c9d2eab
MD5 721c361f8aa155cacb3ea8fb48e37797
SHA1 339abee23f476979da484fba1f74cc6615f82e28
SHA512 a04eb8986d42ba569ff09e23773f60b1e455dcbe8632b04b12f9ac74702a8e73a40173158d3402a1b9f474633986c860e2ae62eb8bdb84a889bcd0d979c8a347
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 2dfa9e5df4b099421f6fda327b4d2ce9b2bd00db80168a27bfe292060ed6209a
MD5 da0dc853f01e2a17c03aa2b61fec701a
SHA1 3ee301d77fafb0bf00a6a483412f3b11fda630af
SHA512 9f46f9e511c8ebf8c98d93d3b470e3dd3028b4627e6e7910cd1bca2b26e26e537633057511d17bfa1416f3300547948c587f33cc5370af91d1f6745d2e760eed
TLSH
T118B0025654545415D114837058DA5150397439550B03595767521C6AF4737549142195
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 5544ea51df4b98d4746389745fcbeccaa531cb08f29a4469c5432d791d515410
MD5 034042389f674a5f3edf5fe3bf968280
SHA1 4e8ee4388bb6e4df8e1b87e42acafaca08533141
SHA512 94ab184e921eea730e3c27b6588010a2cbd5cbd1622a42f756f0604e014494f77e5bfea4819e67a7fa0e358716e8b3edbaa883c4a212cfe050365c51c4ca2b49
SSDEEP 3:LstlNllkll/lnVll/:LsX3lEtPl/
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Preferences
Size 6KB
SHA256 fbb602da7a10be8b655f5e8492206a193c6964f33cbc6ad7e9fe2306153a4501
MD5 0a94d3040ea98864eb65dbb2d4a476a9
SHA1 14b59f64386ea33695d9a4f7e3c6fd2bcd43c21a
SHA512 24155a520df2d5d291488dca56133452f7157c2112965b59c0b997b5933b141412d50966792b8245e86a23de34ca8be46013174c6c59037db7ac245664534ee4
SSDEEP 96:stXk05FElnGy2b9rffxjZ8i0vhEsLktDcm/7qx+WVHMSm+uecJN6jMdQj+T+giKO:st003MafFZ8paPR/S+WiTN6od9U5MC
TLSH
T1EBE1BA425E24797B4CC7F61D7A36BB52E6F6106265D10EA4ABFC861C05D76CC230790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

b7a0db9d-0940-43f0-83a2-8da8111eeae4.tmp

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\b7a0db9d-0940-43f0-83a2-8da8111eeae4.tmp
Size 6KB
SHA256 30797198771afed7cf380a6bd91a384c02095e460e88e9ecdd2b248043c04b93
MD5 c8514c3e66d886d6acab39a8a328495e
SHA1 2e92e69b40feadb1d538cc3207fdfa20f3fcb17f
SHA512 d6e437a623702713115ceec2faea031f4a546cd381e6e2abc2fa9a159d50ddce72d34db3092d5d0977b3a4222c59fccf7d10a5341427cfdfb9c35257f9580de3
SSDEEP 96:stXk05FElnGy2b9DffxjZ8i0vhEsLktDcm/7qx+WVHMSm+uecJDmv61idQj+T+gz:st003M+fFZ8paPR/S+WiTKywd9t5M8
TLSH
T1C2D1BA429E28697B4CCBE21DBE36BB12D6F6106165D50EA8EBFC852C05D76CC630790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State
Size 1KB
SHA256 22a776251d4d44b38a7a24a0a79031d7c9e7e765d1c83ff8909080b8eae16743
MD5 e01e8ad2552d4e685126ff08a7333690
SHA1 48c3647b2b31a10ec37b504c04ec54ea955bfdb6
SHA512 4c5ed9e3b236eff80bcbc88cd105769368e71b3a607981fd0ccb317879f20adb5fdf556debecd137511207f5e337fa94e1a9c829cfb68e8aeae4506167efc7e7
TLSH
T1AE3182B2E8F43F362CA16652B6166B572D21103BC1608E54A6DD470C12EB2CC622AD32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State
Size 2KB
SHA256 b664d17ad2e778bd67d04e6aef341344ca6be353ac05da1a0763942a6ee2003d
MD5 929f2ac9fefc6dc4551a580d5716004b
SHA1 60c61860e504635e2f3dcb182a33219ec005bab3
SHA512 e50627095ef1811c4775504922a451eca80045e79bcf9838826b36eaaab75a3d9b2c2a428cc1e7ed9c81090d573f6710791a5a409921b2ffab7b8b5b5888e368
TLSH
T117518373BC647B3649F25A44BA4A2B13AE366066D5A15F70AADD1B0C01EB29C2302C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State
Size 3KB
SHA256 b89240534a4c8492975621df5c7bc6968fcf97fc20dc4576c7335158902fa80f
MD5 b4e283f1169fc92add1a656e4b6eac5e
SHA1 295646792a5e190b66a0055cf447964b94bc66bf
SHA512 afc800b36994abb0adaee9ef86cf7891dba8f1e6e8b9ccdf88b85dbf58fe853712255af59c8b614d8ac525de91a04adade261763975bcf02c390f6adb52353eb
TLSH
T1DC719676A8B4BA374DF29905B9862B07BA615127D5D07FA4DAEC0F0C01DB3D82302C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State
Size 16KB
SHA256 0444424c09afff88f6370c543a06771f4571cdab662e276b10482e8b5a43cb7b
MD5 d8619126b2f9084608682dd18ca3ad3d
SHA1 1064d595384f7b89c734d7a46e891ca070aec254
SHA512 d52f312a8f0bb18147ba6231126bab200f84d5e48ddcc158e292cfbb094f4102bc38d670968ec6926458841105d01d35bdc23c8dffd914fd1c8d60363765beeb
SSDEEP 384:zY+aQikB+z/xvxjg/qhELNbY8R/UBr9za:L/UxvxjgC+e+CrFa
TLSH
T107728C2B65783E3798F3FA017A5C0B4BDAB594B2D0C16EB84AED5F0906DB3D81302D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State
Size 16KB
SHA256 8bf5d6d7aea3e00f1d893c85685616cb357ba473230e75be5c662c31d88ece77
MD5 f52436774bebe9385cce79731c90d1eb
SHA1 ca5637eea5e33fdd4745ee9f3ad284739a6ea670
SHA512 77e034934ede0cc245af9dacd42d0253b97a203207ac301125e592568f9f877c765e75e7a62d7edd5c019d756af8badb8619e735b4fce51bbc7c194069e63633
SSDEEP 384:zt+aQikB+z/xvxjg/qhELNbF2R/UBr9za:U/UxvxjgC+vYCrFa
TLSH
T116728C2B65787E3798F3F9017A5C0B4BDAB594B290C16EB84AED5F0906CB3D81302D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State
Size 16KB
SHA256 6560c6f77ce1a318e7b453c1e6e61a4e643ff57c3c64c98cae6d18bb7737a9a3
MD5 87af503cb9f30e474f7c0737f394d13f
SHA1 e5699b817ee0f2ff206760b2c24fd114e37901cc
SHA512 c2c89a33575a16c784023959975aa1d0e01831f6163a437efa21cfbd6e2c232a2be2fec45cb5b8017a1049a63614b2c4e9279604be72fb64469efd01d96ccca4
SSDEEP 384:zC+aQikB+z/xvxjg/qhELNbY8R/UBr9za:R/UxvxjgC+e+CrFa
TLSH
T16D728C2B65787E3798F3E9017A5D0B4BDAB59472D0C16EB84AED5F0D06CB3D81302D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5898c0.TMP

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State~RFe5898c0.TMP
Size 1KB
SHA256 564c47af16ea05a09a8229e1502f4dfe2d3a5aee0e1c7a347e23a95388a72ca3
MD5 2960e83b5f9e1bbb2036c073c39446c2
SHA1 ca13f34a50b1c299aad56d2e189dcb7e3478dc71
SHA512 55d9aa8606f3b0110ac04df89aba5d2287688b3df3fd94f22d167dbcbe2456f8a7ab2f85311d1a7932abcdb7f26f4851dfbdd45afd0166c830a3ed5ae4fdffb0
TLSH
T112213273E8B83B3A6DA55951B612BB4B3D11503BD1608E18E5CD530C17EB6DC5637C32
MD5 SHA1 SHA512 TLSH

Submit Download

Harmless Asset Manager.lnk

Path C:\Users\Admin\Desktop\Harmless Asset Manager.lnk
Size 1KB
SHA256 5495dd37ddfd2788065a9a5de675947ea5f4da20b7b24fb46f8a604b1e1132b8
MD5 ae746bd8ae4d6d98228f556e032971dc
SHA1 bd0836424be0d5bb940448c8e3edad48602ebab7
SHA512 e9f81b808e1a296add37fe93406d6d34ce717793517fca0459fd832bb15552351bcbdc014d26c0b4031c4e191d8dde3cb6bd5f9cca015f4f006bf498f1bf3c7b
TLSH
T12821AC405FC91914F5FF9E361ABB2611E6B0B855AF16DE1D004483180CB3955DFB8B2F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1560-134-0x00007FFC0EE80000-0x00007FFC0EE81000-memory.dmp

Download

memory/1560-132-0x00007FFC10BA0000-0x00007FFC10BA1000-memory.dmp

Download

memory/2696-203-0x00007FFC0EFD0000-0x00007FFC0EFD1000-memory.dmp

Download

memory/3972-82-0x00007FFC0EFD0000-0x00007FFC0EFD1000-memory.dmp

Download