da36b5cd45c5d5cfe2a89376c43e3c2ac741aebf8fdd3b98d4ffab260b90a168

Analysis

user interaction
yes
max time kernel
298s
max time network
291s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/08/2026, 23:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Harmless Asset Manager_3.8.0_x64-setup.exe
Size 4.0MB
Sample260830-3yn3kasbre
SHA256 da36b5cd45c5d5cfe2a89376c43e3c2ac741aebf8fdd3b98d4ffab260b90a168
MD5 688b47864c03dd10e5b5df2619a6d638
SHA1 e6e8eed2d1e3cf14ba94b49d21935e42bdd28e09
SHA512 58f453c2e40177962c415255b0ff56569cc62de0dcadfa215420ff83bc6e1b196cdd596714c2770eb9a56d7d49ceaec12678b7fc158af84862fa5c7e25a21178
SSDEEP 98304:i7OxBKiq2Kl2Zewe93M2eYfVFg0T6ZOwTRDZ54HGA:iiXKiqecc2e8g0eZtD/4x
TLSH
T1061633A57A73C623CC48BE36880BD4E6151A9ECA47F492D1F34285FE635E994D01B2F3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery trojan

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4800 created 3204	4800	Harmless Asset Manager_3.8.0_x64-setup.exe	54

Executes dropped EXE 3 IoCs

pid	Process
4960	harmless-asset-manager.exe
2232	harmless-asset-manager.exe
1936	harmless-asset-manager.exe

Loads dropped DLL 8 IoCs

pid	Process
4800	Harmless Asset Manager_3.8.0_x64-setup.exe
4800	Harmless Asset Manager_3.8.0_x64-setup.exe
4800	Harmless Asset Manager_3.8.0_x64-setup.exe
4800	Harmless Asset Manager_3.8.0_x64-setup.exe
4800	Harmless Asset Manager_3.8.0_x64-setup.exe
4800	Harmless Asset Manager_3.8.0_x64-setup.exe
4800	Harmless Asset Manager_3.8.0_x64-setup.exe
1120	msedge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	harmless-asset-manager.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	harmless-asset-manager.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	harmless-asset-manager.exe

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
50	discord.com
58	discord.com
72	discord.com
24	discord.com
25	discord.com
36	discord.com
41	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_887048796\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_1463168391\Sigma\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_887048796\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_984298199\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_1831929174\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_1175581894\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_1175581894\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_1463168391\Sigma\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_1463168391\Sigma\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_1463168391\Mu\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_1463168391\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_887048796\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_1463168391\Mu\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_1463168391\Mu\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_1463168391\Sigma\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_1463168391\Mu\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_1463168391\Mu\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_1463168391\Mu\TransparentAdvertisers	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_1463168391\Sigma\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_887048796\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_1463168391\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_1463168391\Mu\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_887048796\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_365442032\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_244183068\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Harmless Asset Manager_3.8.0_x64-setup.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2688	msedge.exe
1932	msedge.exe

Enumerates system info in registry 2 TTPs 15 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326078100743206"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{925AC197-3CA8-4AE1-85C6-6F4AFE909D7F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\harmless-asset-manager	harmless-asset-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\harmless-asset-manager\ = "URL:com.harmless.asset-manager protocol"	harmless-asset-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\harmless-asset-manager\DefaultIcon	Harmless Asset Manager_3.8.0_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\harmless-asset-manager\shell	Harmless Asset Manager_3.8.0_x64-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\harmless-asset-manager\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Harmless Asset Manager\\harmless-asset-manager.exe\" \"%1\""	harmless-asset-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\harmless-asset-manager\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Harmless Asset Manager\\harmless-asset-manager.exe,0"	harmless-asset-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\harmless-asset-manager	Harmless Asset Manager_3.8.0_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\harmless-asset-manager\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Harmless Asset Manager\\harmless-asset-manager.exe\",0"	Harmless Asset Manager_3.8.0_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\harmless-asset-manager\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Harmless Asset Manager\\harmless-asset-manager.exe\" \"%1\""	Harmless Asset Manager_3.8.0_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\harmless-asset-manager\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Harmless Asset Manager\\harmless-asset-manager.exe\" \"%1\""	harmless-asset-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\harmless-asset-manager\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Harmless Asset Manager\\harmless-asset-manager.exe,0"	harmless-asset-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\harmless-asset-manager\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Harmless Asset Manager\\harmless-asset-manager.exe\" \"%1\""	harmless-asset-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\harmless-asset-manager\shell\open	Harmless Asset Manager_3.8.0_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\harmless-asset-manager\ = "URL:com.harmless.asset-manager protocol"	harmless-asset-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\harmless-asset-manager\URL Protocol	harmless-asset-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\harmless-asset-manager\shell\open\command	Harmless Asset Manager_3.8.0_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\harmless-asset-manager	harmless-asset-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\harmless-asset-manager\shell\open\command	harmless-asset-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\harmless-asset-manager\DefaultIcon	harmless-asset-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\harmless-asset-manager	harmless-asset-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\harmless-asset-manager\ = "URL:com.harmless.asset-manager protocol"	Harmless Asset Manager_3.8.0_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\harmless-asset-manager\URL Protocol	harmless-asset-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\harmless-asset-manager\URL Protocol	harmless-asset-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\harmless-asset-manager\DefaultIcon	harmless-asset-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\harmless-asset-manager\shell\open\command	harmless-asset-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\harmless-asset-manager\DefaultIcon	harmless-asset-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\harmless-asset-manager\ = "URL:com.harmless.asset-manager protocol"	harmless-asset-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\harmless-asset-manager\shell\open\command	harmless-asset-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\harmless-asset-manager\URL Protocol	Harmless Asset Manager_3.8.0_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\harmless-asset-manager\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Harmless Asset Manager\\harmless-asset-manager.exe,0"	harmless-asset-manager.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{D1226D87-0DCD-4426-B258-ECE9E5A79CC7}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{3F4A6894-0BEF-41E3-B8CB-924C6458FDF1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4800	Harmless Asset Manager_3.8.0_x64-setup.exe
4800	Harmless Asset Manager_3.8.0_x64-setup.exe
1120	msedge.exe
1120	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1956	msedgewebview2.exe
1956	msedgewebview2.exe
3216	msedge.exe
3216	msedge.exe
1200	msedgewebview2.exe
1200	msedgewebview2.exe
6028	msedgewebview2.exe
6028	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4960	harmless-asset-manager.exe
3216	msedge.exe
3216	msedge.exe
2232	harmless-asset-manager.exe
1936	harmless-asset-manager.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 4960	4800	Harmless Asset Manager_3.8.0_x64-setup.exe	79
PID 4960 wrote to memory of 1956	4960	harmless-asset-manager.exe	80
PID 1956 wrote to memory of 5336	1956	msedgewebview2.exe	81
PID 1956 wrote to memory of 488	1956	msedgewebview2.exe	83
PID 1956 wrote to memory of 488	1956	msedgewebview2.exe	83
PID 1956 wrote to memory of 488	1956	msedgewebview2.exe	83
PID 1956 wrote to memory of 5252	1956	msedgewebview2.exe	84
PID 1956 wrote to memory of 3160	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 3160	1956	msedgewebview2.exe	85
PID 1956 wrote to memory of 2068	1956	msedgewebview2.exe	86
PID 1956 wrote to memory of 2068	1956	msedgewebview2.exe	86
PID 1956 wrote to memory of 2068	1956	msedgewebview2.exe	86
PID 1956 wrote to memory of 4152	1956	msedgewebview2.exe	87
PID 1956 wrote to memory of 4152	1956	msedgewebview2.exe	87
PID 1956 wrote to memory of 4152	1956	msedgewebview2.exe	87
PID 4960 wrote to memory of 3216	4960	harmless-asset-manager.exe	88
PID 3216 wrote to memory of 4344	3216	msedge.exe	89
PID 3216 wrote to memory of 2688	3216	msedge.exe	90
PID 3216 wrote to memory of 2600	3216	msedge.exe	91
PID 3216 wrote to memory of 2600	3216	msedge.exe	91
PID 3216 wrote to memory of 2600	3216	msedge.exe	91
PID 3216 wrote to memory of 5700	3216	msedge.exe	92
PID 3216 wrote to memory of 5700	3216	msedge.exe	92
PID 3216 wrote to memory of 4080	3216	msedge.exe	94
PID 3216 wrote to memory of 5156	3216	msedge.exe	95
PID 3216 wrote to memory of 4080	3216	msedge.exe	94
PID 3216 wrote to memory of 4080	3216	msedge.exe	94
PID 3216 wrote to memory of 5156	3216	msedge.exe	95
PID 3216 wrote to memory of 5156	3216	msedge.exe	95
PID 3216 wrote to memory of 5440	3216	msedge.exe	97
PID 3216 wrote to memory of 2364	3216	msedge.exe	98
PID 3216 wrote to memory of 5440	3216	msedge.exe	97
PID 3216 wrote to memory of 2364	3216	msedge.exe	98
PID 3216 wrote to memory of 1004	3216	msedge.exe	100
PID 3216 wrote to memory of 4052	3216	msedge.exe	101
PID 1004 wrote to memory of 5876	1004	msedge.exe	102
PID 3216 wrote to memory of 3536	3216	msedge.exe	105
PID 3216 wrote to memory of 3088	3216	msedge.exe	106
PID 3216 wrote to memory of 3088	3216	msedge.exe	106
PID 3216 wrote to memory of 1120	3216	msedge.exe	107
PID 1120 wrote to memory of 1624	1120	msedge.exe	108
PID 1120 wrote to memory of 1932	1120	msedge.exe	109
PID 1120 wrote to memory of 2324	1120	msedge.exe	110
PID 1120 wrote to memory of 2324	1120	msedge.exe	110
PID 1120 wrote to memory of 2324	1120	msedge.exe	110
PID 1120 wrote to memory of 3896	1120	msedge.exe	112
PID 1120 wrote to memory of 3896	1120	msedge.exe	112
PID 1120 wrote to memory of 2584	1120	msedge.exe	114
PID 2232 wrote to memory of 1200	2232	harmless-asset-manager.exe	116
PID 1200 wrote to memory of 3964	1200	msedgewebview2.exe	117
PID 1200 wrote to memory of 780	1200	msedgewebview2.exe	118
PID 1200 wrote to memory of 780	1200	msedgewebview2.exe	118
PID 1200 wrote to memory of 780	1200	msedgewebview2.exe	118
PID 1200 wrote to memory of 5164	1200	msedgewebview2.exe	119
PID 1200 wrote to memory of 4468	1200	msedgewebview2.exe	120
PID 1200 wrote to memory of 4468	1200	msedgewebview2.exe	120
PID 1200 wrote to memory of 2712	1200	msedgewebview2.exe	121
PID 1200 wrote to memory of 2712	1200	msedgewebview2.exe	121
PID 1200 wrote to memory of 2712	1200	msedgewebview2.exe	121
PID 1200 wrote to memory of 2348	1200	msedgewebview2.exe	122
PID 1200 wrote to memory of 2348	1200	msedgewebview2.exe	122
PID 1200 wrote to memory of 2348	1200	msedgewebview2.exe	122
PID 1936 wrote to memory of 6028	1936	harmless-asset-manager.exe	126
PID 6028 wrote to memory of 2260	6028	msedgewebview2.exe	127

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3204
- C:\Users\Admin\AppData\Local\Temp\Harmless Asset Manager_3.8.0_x64-setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Harmless Asset Manager_3.8.0_x64-setup.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4800
- C:\Users\Admin\AppData\Local\Harmless Asset Manager\harmless-asset-manager.exe
  "C:\Users\Admin\AppData\Local\Harmless Asset Manager\harmless-asset-manager.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.8.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4960.1900.14314766050232090940
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:1956
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x174,0x7ffb5d98b078,0x7ffb5d98b084,0x7ffb5d98b090
      4⤵
      PID:5336
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1688,i,7953307210237126337,15445046470194802555,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1712 /prefetch:2
      4⤵
      PID:488
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1376,i,7953307210237126337,15445046470194802555,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:11
      4⤵
      PID:5252
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1704,i,7953307210237126337,15445046470194802555,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:13
      4⤵
      PID:3160
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3576,i,7953307210237126337,15445046470194802555,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:2068
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3856,i,7953307210237126337,15445046470194802555,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:1
      4⤵
      PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/oauth2/authorize?client_id=1404156965248307261&response_type=code&redirect_uri=https%3A%2F%2Fdsc-oauth.harmlesscreations.com%2Foauth%2Fcallback&scope=identify%20guilds.members.read
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffb4a5fc188,0x7ffb4a5fc194,0x7ffb4a5fc1a0
      4⤵
      PID:4344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,2550913488495265762,17557241069695385030,524288 --field-trial-handle=2184,i,11511434069133357451,8035487908477823102,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
      4⤵
      System Time Discovery
      PID:2688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,11005647639638985493,6832765917621587507,262144 --field-trial-handle=2184,i,11511434069133357451,8035487908477823102,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
      4⤵
      PID:2600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,16926413808075565569,17216141617688888466,524288 --field-trial-handle=2184,i,11511434069133357451,8035487908477823102,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:13
      4⤵
      PID:5700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,9432956783651961412,4841100416531936585,2097152 --field-trial-handle=2184,i,11511434069133357451,8035487908477823102,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:4080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,7610520604347096101,1698959472601179449,2097152 --field-trial-handle=2184,i,11511434069133357451,8035487908477823102,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      PID:5156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,4614230523281060867,12767283468187621233,524288 --field-trial-handle=2184,i,11511434069133357451,8035487908477823102,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
      4⤵
      PID:5440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,8526680122508963124,723741578627489518,524288 --field-trial-handle=2184,i,11511434069133357451,8035487908477823102,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
      4⤵
      PID:2364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,3828604703549584520,14783666023862878117,524288 --field-trial-handle=2184,i,11511434069133357451,8035487908477823102,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
      4⤵
      PID:5800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,4420364882550293995,6109003256540946332,524288 --field-trial-handle=2184,i,11511434069133357451,8035487908477823102,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1004
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1136
        5⤵
        
        PID:5876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,3828604703549584520,14783666023862878117,524288 --field-trial-handle=2184,i,11511434069133357451,8035487908477823102,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
      4⤵
      PID:4052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,14713119679833036280,3037371514630766803,524288 --field-trial-handle=2184,i,11511434069133357451,8035487908477823102,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
      4⤵
      Modifies registry class
      PID:3536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,14244497611441334192,12536609914156363002,524288 --field-trial-handle=2184,i,11511434069133357451,8035487908477823102,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:12
      4⤵
      PID:3088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Loads dropped DLL
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ffb4a5fc188,0x7ffb4a5fc194,0x7ffb4a5fc1a0
        5⤵
        
        PID:1624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1724,i,5679314035333213509,9062314055251231413,524288 --field-trial-handle=2208,i,16462733068859642379,5999548879780834724,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:1932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,14242061895038174044,15498186166459692689,262144 --field-trial-handle=2208,i,16462733068859642379,5999548879780834724,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
        5⤵
        
        PID:2324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,1560052476512288590,13022305932003584524,524288 --field-trial-handle=2208,i,16462733068859642379,5999548879780834724,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:13
        5⤵
        
        PID:3896
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,840538249931723360,2930580567516001247,524288 --field-trial-handle=2208,i,16462733068859642379,5999548879780834724,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
        5⤵
        
        PID:3052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,840538249931723360,2930580567516001247,524288 --field-trial-handle=2208,i,16462733068859642379,5999548879780834724,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
        5⤵
        
        PID:2584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,1812060953258504034,12048703388513043686,524288 --field-trial-handle=2208,i,16462733068859642379,5999548879780834724,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
        5⤵
        
        PID:796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,5024174865228664535,5641209000076275410,524288 --field-trial-handle=2208,i,16462733068859642379,5999548879780834724,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:14
        5⤵
        
        PID:3320
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,13470952121833926258,13816789548932629220,524288 --field-trial-handle=2208,i,16462733068859642379,5999548879780834724,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
        5⤵
        
        PID:4608
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,16193861258186387403,12243736478890010072,524288 --field-trial-handle=2208,i,16462733068859642379,5999548879780834724,262144 --variations-seed-version --mojo-platform-channel-handle=1848 /prefetch:14
        5⤵
        
        PID:6096
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,7200165208790245883,7031842102135030102,524288 --field-trial-handle=2208,i,16462733068859642379,5999548879780834724,262144 --variations-seed-version --mojo-platform-channel-handle=1848 /prefetch:14
        5⤵
        
        PID:1108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,16428859587958044312,6907474189559150486,524288 --field-trial-handle=2208,i,16462733068859642379,5999548879780834724,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
        5⤵
        
        PID:2264
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,10197368954425110092,5981605525833048967,524288 --field-trial-handle=2208,i,16462733068859642379,5999548879780834724,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
        5⤵
        
        PID:2784
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,458927412429836659,7613435432161060701,524288 --field-trial-handle=2208,i,16462733068859642379,5999548879780834724,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
        5⤵
        
        PID:5392
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3108,i,5107019763910992981,18005324482164077259,524288 --field-trial-handle=2208,i,16462733068859642379,5999548879780834724,262144 --variations-seed-version --mojo-platform-channel-handle=780 /prefetch:14
        5⤵
        
        PID:4160
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5132,i,12320976913824112893,4293253363278444191,262144 --field-trial-handle=2208,i,16462733068859642379,5999548879780834724,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4128,i,104552915386231248,17035873453513480577,524288 --field-trial-handle=2208,i,16462733068859642379,5999548879780834724,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:14
        5⤵
        
        PID:668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3864,i,2166123288174683321,261846053724968132,524288 --field-trial-handle=2208,i,16462733068859642379,5999548879780834724,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:14
        5⤵
        
        PID:2900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4132,i,1208203476738835272,13827054077710397863,524288 --field-trial-handle=2208,i,16462733068859642379,5999548879780834724,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:14
        5⤵
        
        PID:1684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,16082975013624101612,5387635034240064305,524288 --field-trial-handle=2208,i,16462733068859642379,5999548879780834724,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:14
        5⤵
        
        PID:1552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3468,i,3318445760498869463,9197229145687338751,524288 --field-trial-handle=2208,i,16462733068859642379,5999548879780834724,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
        5⤵
        
        PID:2580
- C:\Users\Admin\AppData\Local\Harmless Asset Manager\harmless-asset-manager.exe
  "C:\Users\Admin\AppData\Local\Harmless Asset Manager\harmless-asset-manager.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.8.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=2232.3088.5397913173472386266
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:1200
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x174,0x7ffb5d98b078,0x7ffb5d98b084,0x7ffb5d98b090
      4⤵
      PID:3964
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1904,i,12630943597037322126,1096034060212441440,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
      4⤵
      PID:780
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1916,i,12630943597037322126,1096034060212441440,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:11
      4⤵
      PID:5164
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2244,i,12630943597037322126,1096034060212441440,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:13
      4⤵
      PID:4468
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3444,i,12630943597037322126,1096034060212441440,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
      4⤵
      PID:2712
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3984,i,12630943597037322126,1096034060212441440,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:1
      4⤵
      PID:2348
- C:\Users\Admin\AppData\Local\Harmless Asset Manager\harmless-asset-manager.exe
  "C:\Users\Admin\AppData\Local\Harmless Asset Manager\harmless-asset-manager.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.8.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1936.5000.7647672197366653294
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:6028
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0xfc,0x19c,0x7ffb5d98b078,0x7ffb5d98b084,0x7ffb5d98b090
      4⤵
      PID:2260
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1824,i,11500214886805552176,5227329298028545816,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1820 /prefetch:2
      4⤵
      PID:720
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1728,i,11500214886805552176,5227329298028545816,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:11
      4⤵
      PID:2708
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1640,i,11500214886805552176,5227329298028545816,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:13
      4⤵
      PID:5116
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3488,i,11500214886805552176,5227329298028545816,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
      4⤵
      PID:3244
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4040,i,11500214886805552176,5227329298028545816,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:1
      4⤵
      PID:5948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4068

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

harmless-asset-manager.exe

Path C:\Users\Admin\AppData\Local\Harmless Asset Manager\harmless-asset-manager.exe
Size 11.9MB
SHA256 ec23f530ddb783c446387176d9ce9f5940a2c6d92fb0d3df5def3d34e46d9316
MD5 0d1c0e4f1524e700c94bd75390bfd8a8
SHA1 c5421200362cbfeb97e03db2bb80989150e971d9
SHA512 fdf4df4ae785080d2837fcdfc624c2a970f227ef84ba16190a8ebdcc43d7ce8f7a88d7909cd82e0589b78aca36a2e33990461a57766d8d5f5f6fe945c25d6c12
SSDEEP 98304:f/iV854u2QoMajpH3YtWlf9X0959SRwvvmH8VmsDBHjwN7bAF40ETHT/BBSn+:f+uMtYkf9s5UicAFSTHT/BC
TLSH
T11BC67B43F38184E9D0AEC574C76B9B72BB32F88D4521735B1BE44A222E1AB905F1C7D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 1c02e2feba3b2af3c045d1ed01f8a67e0923f7e357b32c434e567eef6aac4138
MD5 f05b0294ae4949feed0706bc80fa6418
SHA1 346bb7d2d99251c193652ad4ae7ef2964565b98d
SHA512 348366e162f3a037e74d0e9ff422ba7ca3e14c2b170f50bab2a4b88b29a572028e56965c332bc63cbe89de1a3467c215893ecf3cac514d786ec7ea30c08bcc05
SSDEEP 12:bHiUXhV0xosfxCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:blRqxosfxWMk8xVZ4YWI30otWn
TLSH
T139257D85B34494FFC8C35A7189BD17903774F6DE5F42835B6A377A0E2E671D44B48220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 69a5da5a3467246d30055adb94dcfb1ccec11e1f0e250a52c1a936657957829b
MD5 0a77ebd6a7af40ccc82332a65a6e7ebf
SHA1 5783631d22635cab0a6498ce6ff1d6fee64dceff
SHA512 27b82f2d2887e8b0d64b2c60b17e7cbe049bb6f9cacdb9e8ff29b4094b4a7fc3de480495b2ba3f5087a8fa808b737b909efcfeaf879d97beb0ff56cab261f155
TLSH
T15FD023646B5EBD83D00328399180534331CF8850AC13F1029050D05C9C085F393E84E3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 06b5a9b990aecf05673499b31dd01d641342ccf1b57077783f9cb0234d468906
MD5 d0a9f1c1f2a780f9eb62d3d9370f70e3
SHA1 d16a5e11e84e283cbab990f2d6df5b0eaa6c5ed5
SHA512 f77be8b0299ec64ef430891546d1f341cdfb6627728a0e8d20dc6e5b6af269177d93062f676bc6954facecdf4d3cf982f45bb4206b9ea64ae8c7b95c516bf30b
TLSH
T12ED023A865ED7457F326257DB151530373CE8D517D53E102D051920E5F1E5B393E50D2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e7263f201d7ea73258dcd131dfca74e6e4be397c89f2d508a93a692a7e405bdd
MD5 fef2c1ce0b14b05422c66d1c733d7def
SHA1 20a04022ef77c8944974ad40e9594d0a2ea9199a
SHA512 8fc4e71b3f8e60c7d6e9a4438605a685654fe918d7f00f3075382b07e439712627ab2e4064f04e401711d63cbd102f367284b9f0f82c0df5b4a0b4b0bd3bccaf
TLSH
T14BE02BAAC961EC2725FE0B1EE0550747EA5013571680885F3B3E450C8FB073A828A81C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 80KB
SHA256 b918e4edb232a5d44fc9641a0398ba73eb4e3dea2c99ef6a6313b3ad183e5847
MD5 bde237f4e9ded6b273d0801b118856cc
SHA1 1ed1f884ff0c4f202699f46b4572917693336cce
SHA512 b178417c33f4817fd2416aec7430a8fe4c02a4e6ae897713a1a81a43ca20008c7250ee80a47276851ebd8320adc3c5d1410d7fa6b80646ee35686ea0e8c8748e
SSDEEP 1536:AM0X1llreT3EjYEKXBu7pJ4B1RwM3eCce:pSveWSIpgv
TLSH
T1F083567DA9683CDBD8C657FC490B0EA8032E8D66F9895637E265790CBDEE70A5C1C00D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 1.0MB
SHA256 3e8830992e0894d68c5a069866d016f240b8150b853178db405d37183b5ed439
MD5 6720d91bb023e43d8dfe1b4edbb5f72a
SHA1 0b7a67241ec20f383ca2be2e2201925c9ea9cbfe
SHA512 feef5c11f9248bec5d5a52840f13c06c89bd39a6796136e6adb7137bcb809a3e96042ec37035b0085f993ee45141f88373b085ae0348382a1d703d70f5e6cf57
SSDEEP 12288:bL/jL/RdzYTL/+L/zGuCB4C/G/unRU0eYJRk8PyHWtcdpUPbkGl:5dzYGCBeYJeajtcdpGA
TLSH
T1BF25C4F78400982ACB7C12F95343367CD237418D2CDAE9EAF5761C99285DF22B5A4DE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 5.0MB
SHA256 3ed3be880e24e428c984b3f8533ed7e0d6be6bf829c291fde3226bc740e74a74
MD5 ab77e03f769b6eacb31fffc5e68e0a50
SHA1 dd16f9d10222eb1fa933cc959131d783a912c7ea
SHA512 d83209eb0cb74ec33bd9cbbcd868a6ecd5f4554006554d5780c402115fe9db0c4e3d028b010fdba34119a8d0016e0acd641f4f05a64b1d34acf32e6c7884a929
SSDEEP 12288:5RPLLlFw5rEZNQXinImaeMiATsg7w1FVOPwb8ACPqqcmsFClO8A8ifG3:rPvlFUYb4iTao42UIKiL6A8oG
TLSH
T1D03629DB8B645AD1D7ABDFB0BDC4CC697E7421C1AEC6E043A442C77A00C37C62A5658E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 670a426e66ac0ef0f06aead28f344a73971f58ba5c11c84835d9ef14d3838642
MD5 be0b00578a34ccc26c7125c9f0dddbbd
SHA1 f9e0b95230fae25832ae2fc4858a2278b30a8a67
SHA512 21f51dbadf780a00c2af6c6aba87bc0ed529ff9240be8119a5b1a25f5d7bc029bfe6405e89f45f811d8046178a3ff822131c0ee142e5dcb57a21812e3f3d8b66
SSDEEP 49152:vYpeT72ivXqVuF44Xihb9tMlBM3Y6juvm:vl7wVe3k6KY4uvm
TLSH
T19F868DEDCA6898C3CD639970B0F0ED477C7413C3F995C1D68898C584026BBC5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 913070a3fe96cca28045ae0f90c534a6e3a612ff3375fbeb53dfca03c08b0f7f
MD5 4effd9a1c0357f8b1e90a7f35ef2245c
SHA1 24b771caa628da99be059a4a7b46179872aa5d41
SHA512 40875cc6dd9b0f07fcde943a4ce667d1b9d8f972f51d346c55a8945b8a8f6aa4a8005da16b63e5ff7a329e5f39eba21f91b7a88837ca3babd737c530eab30784
SSDEEP 192:CHu1tku8tk6JC2K2MoW9fN9pwwoL2ooZ8:mG6JTK2MoI/wzL2FZ8
TLSH
T1893203AD396E20C3D3141F7D6DE8C80971B5684B196F3F121A881C3FA9F1782DC8696B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe589798.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589798.TMP
Size 3KB
SHA256 6db4f6c70a46443a11068d112a747f7771d50be1ed0e6f5d9a11209e8008ae47
MD5 079f2aa6dde96fc23c111766726861d8
SHA1 e61ac63a4f4bc3ef015af4b0ac72fa480da91855
SHA512 3625740f3d8632cf2c2565c42a7b7825c38dd2a7b04e7c735dc7aa999375279efdd0228172b3c0791ef63e6f55d17d56841119ab2cbff7d0772943a27d1221d3
TLSH
T187713DFE3A7165D3F319223092D01102B7E048543D47BD661F5848B9FA3A790D2C6EC7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 340B
SHA256 ce2a09e72f811421588d19d467c0def47ef506fef1e090dd77cba4974c522e79
MD5 e026c147802cb9b1ddd302fda473d9be
SHA1 0a68b589995e6832d8cc230dc1f8eb07ec983f14
SHA512 334498a55427b6fbbafdb453ef89c6e3a29bc629331a2a6994ae171ca7adcd12927e31c403725ebe3d2b372dd48343893b687abd4a4bcdd41e9e7917f05e9342
TLSH
T196E0D89494CAC21DEA5434A752386B08C2803456D7C7EE07270488C07743441B24278B
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 142d3d99b7d553c8f5c91dfce8e2dab01b0c08e002c50892f06aa9938ced4879
MD5 92081042bdc5c117d0e2bb29c6d26cf7
SHA1 27eaeef74227564491e79824086290e95a9717e3
SHA512 e45484c2f751cf25a070dc4e9daba09bc7d549e6d3d3b3ba1fc33fce2b59071826045335f13fcf997250731fb9f3611d60dcce833f5e09ae4f2ad617152c659e
TLSH
T173E0204445CCC32EE61874D3D67D530CD2E13542A2CCBA051B49D848610254762553C9
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 56KB
SHA256 7022b3529642987d5f8fef8ecf4b313a394747048ce8292bbf8848f8936ed73a
MD5 b1437ec037a2ecadb12e5667f9cba51e
SHA1 cabbc6b174cd451512c7ee7655ba2f5bf77211d9
SHA512 92332adf866f34d43bba81706c9049930fe095b8551df096872a916f41cdb451c950c8c098a6a2ea88591fbbea7cde32e72beeb0bede6a4a978a79bb1f41aa19
SSDEEP 768:MQJQSEbG+Q3wJMHTFcyg2Yte5pbEbGnP3w+MHTFcK+G2YEgJ5Is:MA8i4kTFcyg2EeTwiIpTFcKl2dgzI
TLSH
T1F543D068AE3130C3C35607762B5F15B60F5843C7CC6849B2740785BA8CE9A73B7AB759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 f3118c5d8e1b66b680d092d8f3b55ed945ace4b4d8a70b0fdaf46435b3c73ceb
MD5 e41fd04b34d7c5d28f0617aa4631d3f5
SHA1 c8705ee562d835b5b8011e9f65b7126040d201bb
SHA512 f30648bde763cc86989807abffb91e9dcc1879970b86d7261ba4051db074e79110e031c4ac4e618d2b1ae5102c4962903c50eea50d371825b6d5de45bdd090cf
SSDEEP 96:xj7aChHU+bGz83uxDLjGQLBK31NfR4J+MCXkFr+MFcjtk4Q9/2jR70bXdEbjBHMF:xbh0+G83uxXBBK31GkSJ9EJH7DNspUy
TLSH
T12314625F1F342711CD7D8136A9EB44E35DADF03F8B2666DA78610474CEE3642A02C8EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 14KB
SHA256 39fd492f5a96c0cb94697a053478d89b1e161a6eb3bafbd191805ebd34cdf675
MD5 2a3cc3efc5612ba5fd3272e2333d7c88
SHA1 36e2aeead9f37586d09d4b36d83a22cce7475cf1
SHA512 f525e26ab3d5f623c28b1db31ee709d2fb0ea0acbe943fd87480603827abf8b8eb1103fbccb5de302f4c1f8e5ebf657143a79c41570513651340cd8c93dd6eff
SSDEEP 192:rGjJkaUOX9wWJuU3Ronzyi/wwsMChWjv2OS8MH1Ss:A1U+uUhonR+Y2OvMH1V
TLSH
T1D1521F7BD01888BE476B8377964B352DC7B725BE184DF59AE0D31D0C01AE2AE22119DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 fecc990dd72d4759ff2f04ea79d396d541d0bc69d89ffd9405ca9bf1c00407b8
MD5 d257c406f7481e34f91fc8e36d4cac5f
SHA1 77fa70b3e29e097d866b28237daf69486db6e2ab
SHA512 723188840a3f1424d61afafb9f0b4b69fd33a7a7809a8f00b2dfb2b8063466505096cb6753391f972ae18c69dcfcd1a837fe7629650e0cfef72c64c4faa61694
TLSH
T19FE0D86085CEC22DE60C208B6229B70CC3A03507DEDDAA161B05F840B442004E3826C1
MD5 SHA1 SHA512 TLSH

Submit Download

25708c29-440b-45ab-93a1-9f33bc838090.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\25708c29-440b-45ab-93a1-9f33bc838090.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 9fd3859f60f1f7a40882dd70afc17210bf134e6ff7a98ab6cdf4799d8ced15b5
MD5 597410a79ab635ae866d27414b4a8631
SHA1 10bdde4333ab5935c75f55724a14c89aa75709ee
SHA512 53fb1fd6facac2f693b2ae0d43a0aeb31baf84d30d1836a7e1458bd1d02354eef583e7555247293bb2bf5b7fba6ef97c6e2d6d9657c82c1391937d70cb036a33
SSDEEP 48:T2SLopFMatSaw/auUOt8BPYv58k2tRxkLwFw6yHHNHl8kHaCHNfARX+oMgWAG4o9:iSeMatUaAKPYBUtvLVmaUWAlp0ju4dA
TLSH
T11792E90F1B502211C279DBB7CDA989521F2C115CD7776A8BBE38E1F34CA1657B4015EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5ef38094de5b31e514941ccfcc99f66d06ea5636dde54a4526fbf6dcb82a9495
MD5 1afc2badb37b818bd4dd4db34095d05f
SHA1 3d8c9f3118938220231ebd05a4f2f78ea26fe31c
SHA512 422f148d4272ac89571418200885b12432bf8bbc786ca5655f92ac71a586d61872ba07a686ceb322237d90f1fc9a114ede1902a718a431a6c9059cd57e3c0515
TLSH
T131519FF3C7E4866DCA1156F09A147E1FCE2D0914432C3D6EC9E4AE5BA3E2571E14168F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1d6a9fa36fc755ff2fa856b788b907ab7a5ef37ee3a9f57f81c3b308631a3609
MD5 4de927e291c3687bfa07f17807c1857f
SHA1 eea65ecea01d4602bde35024beb2456f865f2bf9
SHA512 639b5c8c19a5bd9ef87f394be1d031cddb2c10428e958885ec83499c097146472ed8b2a92ba7a8b7755a002244f9c892d0203fdbae68640ab41a2c960a3dfb4b
TLSH
T10A517CF387F4866DCA1152F09A187E1FCE2D0914432C3D6AC9E4AE5B93E2571F141A5A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c855ebbae4fe8e8eab3eeeab509d09b43a54d4b56f9c91e7cefe11329cc93775
MD5 f31c5cbcf46514ef70d2ea40689732ae
SHA1 32d0032357f41f48a0f583c379a9fa85ca05b98c
SHA512 c929ea0e37010fdab43f5025f9d891f9621cd9ef42aeb07b3a782c4d87efa6fd535248b9ff5e5666c417f423c1cc203ccfbe73e05bee49a4065f014189ad92f3
TLSH
T15A318EF783F4856ECA1196F0BA18AE2BCE2D0515432C3D9A85E4AF1B93E2471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 689B
SHA256 59136f21838a14486998f357f035fb84c6a9ef4cf3f11172d251bff3292ec93e
MD5 da5012538cb03f5bd07ec71c1e982873
SHA1 6c8aff4e35fefba44d0dbb1639352371194b73dc
SHA512 b01cbde43b44d6a3e428b98c568cd46b624cc4b6407f9b6382e17f561790f51d294426d329740a7a862cc4f61f9fb057c553bfee86e1ecd186b9c0d5bcc436e7
TLSH
T14901FCA7C5BDE8AB10380D7F1E88780566B6A5740291ACE9DA6AC73C60914F74B0743A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 00e187074d19ad4fa62841da312e78eedc7e9a09187870ab14c3ea1886622510
MD5 8debe4659ded8afaf9c33e7e210f1250
SHA1 27e1d5ce904891bd0b80a29a6780826de3dafe9b
SHA512 e89b5a1877060b71df7caab665eb4ede987d17ffc2f92e430c1e357b27e2fd053b3b6856d736109386cfa473fce1df668ca0cda629f453fa61cb1a17ed290ccf
SSDEEP 384:sxZ7s2v/f0seWvOc60Ly8Qc/bhcf54khP:sDNv/fWYOT0L/bh651
TLSH
T1FA72F806AA34997B8CDBD219FA457F53D3F9152392905E449AFC8E1C00E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 27264874ce1666157d3f475f42daa9e09464ab9e63436d177ca20618943797b2
MD5 b4bf91ed3812b5f563074d84ad73335a
SHA1 de72237a69e1a8872b5b7134dc1347862eaf9ffc
SHA512 d5e333e02e26bd3c1e347df75dc98a0919cc03b60a2968da020fffb469c71c8f08b4224ad2f3945fc0c97adb85a6106e0e2ffb07883d45944119e4e81fa2a750
SSDEEP 192:sxZ7RPyMqZjK1Ml8Mcv/f0s88v3kxE0CXUyynDLzodpxO/W6+WNzv8/Y0d0xcgXL:sxZ7s0v/f0s88c60Ly8Q8/bo/5x0jP
TLSH
T13962F806AA3499778CDBD209FA457F53D3F9552392904E44AAFCCE1C04E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 d574bcf1172220f2efc0fc2f7a0be84e8c22fe10af6e7ff1a5a0090d49f75bdc
MD5 adb7f3d50c9bc383880f383b44caa650
SHA1 5af609bca5d1fb37860c0a65fc402959c07722a2
SHA512 0a16ae3f5ea3ecd8c42935908ee8ec544cec55b6e497656306cf3c75627ef7ac8bf97816275a71fbdcc54540af1b398dc6e6cf7d198359f4246bf26b4ca74771
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQg78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3t3pQLl2:ciWKy8Eq2ADEn5dWRm5rQg7u1jaKt3pJ
TLSH
T1A6030B3B680CCB7E4F804E9CED266F9A6EE8018B6698895447FA444C03C76EF55174DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\6632a6f1-a231-4538-acc9-ecc99c133c0a\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 aa5f3bc2f98d2cf22d5d14592f6e27465054f8cc60e8e962b6ca65838c2ba6b0
MD5 fd371d3d4231cfe9f25b1dc98bb7d5c1
SHA1 cfd9737a2278f52d296ff4a3e5cef5301595eabd
SHA512 a4c4a24c8eb35c204517217422dc74c8a381ea22220936bf234b3fa1712614947e87b67d1208d727dd9179b9a3ab958ed6dc626d1154b4861b6293385b40004f
TLSH
T127D0A7ABB0544690D7BA4BD20BA2112E4A543D8C5588998890320B2D58E9A93E341FA7
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 9b84be0ab705bd887df4ea275c6cc1b9e66308509455cdf742b65b9455068375
MD5 922c13318f4d68a90fa820bb6e91b6e4
SHA1 3640a9e42bc233b43d5c53ea8671f7e88481c105
SHA512 fe51212de85f61420722936cde3561c8c15cebf1d83a8aa94ea5ddaac750f8330cc3daf4e511702069d5a02cf87f2403d88b5e443a7846e43ac4a3331d3edc85
TLSH
T151D0A7ABB0550590D7BA47D20BB2116E4A546C8C59899988D0322A2D24F8A83E351FA7
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe587896.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe587896.TMP
Size 138B
SHA256 0c21bc22b3637d4fa0d18c6b299a113d0b413a5ab252a33c7456214ed285f226
MD5 59bf09bfde48803df442fa110522cc87
SHA1 930df8cb5e6badb500e435e1fd4a2b7ff9aeeee6
SHA512 5dec68c7b929818818419f3aa37573b6628d9a353ce5e3f243a525f5c4e5879defac14fee1f882365e38d5cd84e1f91f6397b326d03e8784201d78201aecc589
TLSH
T134C09BEBB5550915C72507520332555D47052CCC5A85C4DDE073396D24F9E637305EE3
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 d094638085df1f28b4e9cf325bf0890a6736033a702cfa61273c7e618affdb9c
MD5 7124e60294736c027ffa0c42aca8b014
SHA1 f6507a59ae114138851226ced89e5e0418f48f95
SHA512 6b27a89d35ac891fdd89a1097fa10eb64bd75ee16b8ca47b5882d9bd8e3cd609cffa75a845defb6d98b2de1c5c5b8da38f0da52165ee12f2101741c419c27211
TLSH
T12AE026584ACCC27DB21FA04312AB930CC2E4B507D2CCBE362F81DA806983509B1A22C0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 a41ad668b0018dfee6b28eb2939bcaff27c7d333ff985214604e0b886628f2fc
MD5 9143a78f7f54def042f81efe1ae8dc73
SHA1 f6dd8871fb275937de922c6ca1b1a302d8dffacd
SHA512 4e382f7d49889fab3dfea838f27e0d8358af40b78e8ee885fcc49b880330c2149c23c845d41684557bbd4ffc564c42902eb543d2d4bd628cafb09606000b9b26
TLSH
T183B0129C7B209712C4C4053613E587805B28E0511081D513C808DF930F466D83F818C1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 9e4fe1d763217127bf2c35ebeab9c85cfb4caf49314509597267e7569b2c2134
MD5 db8faac74bf9e40997fab7bd8c455139
SHA1 47b4d4ef610943b6f6fe1eec81294babf656e64b
SHA512 3856bf76860b5ecbe2a603e8e6fe50f01426cb151c0193b98b97862556ffee9227c9b9f3180fc809273ac7e9e8bb7deadc358d20c3758e433521e5cad3e97acf
TLSH
T191E0D82456CDC33EB28A208B7215E70CC1A2B603D6CDA9352F1EA580A207140F243280
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 f0f56f418b514fa88015126c1e8308a47d10d86abe5b0d49131498944a2a42d5
MD5 a0e7e83941aaf4bcdf272522d43cb145
SHA1 2566f0e1b9bd94789f46e8a727047621931411a4
SHA512 dec2c7708d5e2fd5e80b0848fd33ad9a1cafb99638f9c5449b86116da824a4106114bfcbb8a79a774627eb7e45ee87af7fb5c20bf4d5e294ef944c46094073f4
TLSH
T101E0267096CCC37DA60CA4835264A70CC2F1B90793CFBA6A97085494A502111B2E62C0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 91c6bde1c44d0c7d0f94432a98f1682c97dc80940629d733f055d1b7788bab2b
MD5 85188597a2bcdb69aba6cc1922ad7d8c
SHA1 617a9de824ece0b6770c2ff588f73ec491594f6d
SHA512 da3eaca77986394de2b6755b69957ae967566a0beceb7cb6b8cb4f9ef68f220711ec83efabd240e128b2f8cb7b5075f622e4eb74fb062e8cb23e372c4d3afc91
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7A7S:AFBHhTofhno2mB21q3Llbfe3sLDdeEpH
TLSH
T11BB27F56717B12023C3E291CA7929B370E8272A33458A57F7BB900BA4E67E515DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 cc727b1af1fc49fe791c45fb9e6423ee0a7dd338f1cf0e36d1ddbbbc0515b922
MD5 c6a6239f6d20a8e0eb23631c387a33ef
SHA1 7aa1a10e0cd3747e5074ced0b9c5a0644476880c
SHA512 b1020949cde47693a96ce85089877b810c80432663041cd767b5ce2f35d6ff3bfec0b97e2de1ebeb643713ffd5486f6cd77d887e44bea8478e7ea6a4a9f053ff
SSDEEP 192:FvoWcJHaWBpfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:aTkOpfQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T14724640A7B747001DDE7D9725CB080771A3CB16ECF22A6915DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 7af545f76a9e8a2e4f156293fdacbcc3b56940e8e2d900a60cb5b24de8361d8e
MD5 f2250431baa5c1d64a3bf6b1f8ef86d9
SHA1 bf9ec74070cd6579774bbce42eb5279feb066eae
SHA512 f11619dc2c23a428df6edc880d13ab1f561723d15493176f0389703ab63db3eb5b1df81fed0e502f16bc63b2ab94bc21f7b02dd4ec578b8b7d82b2e10ca16230
SSDEEP 48:DEK3tjkSI5IUltGhp22iSBgEsSfnnn0Oj0eGfvqsSfnnvj0eSW:DEtSyGhp22iSZ7027X
TLSH
T12E529787BD742002DDE69331FB4105D8FF99803A4DDDC6936C52012B0FA5B11A30E6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.22\data.txt
Size 151KB
SHA256 2c027ecf97af4f6aca54bd9288250459ecfc55623b40100ca34c096d82812d4c
MD5 e0449f01bc8652a575fab19a5d92d65c
SHA1 a09570407906be9ce974e0f209735098752585cd
SHA512 34113e86b4e2fd7211415895829b752b17c072d7d11897ec63b3bed55bb9a0bbc97cde982bed346b839e3058aeffa621b0522924063f01e83b5bf3cea0f6848f
SSDEEP 3072:/PAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEl0DyP2dYbfGHO0v4bLG:XX1aI5aZoKzMJ07NSwdDG/
TLSH
T1A3E301318A841BE8CF1D291DA0FE0F1D73D0C7998467B985F7A3BD0AAFA760852274D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 1f75ff41e23a0cfcd124c2b7b290bfaac98f809b65a37b544c1cfcf62436c513
MD5 05d2c8bebb83e0067cc91065497bbbcf
SHA1 b70a8a65ac36e12df6218b7093e15e92e18e2d22
SHA512 31a697ae741833d91e73b0656d3decc774e84a6d0bdaca14bf107e5c1b542502024b7166848c515830c9ae90cdd0478f9f5a86a7bc4c80c34567cc06586f8d51
SSDEEP 3:MsEllllkEthXllkl2zEfllIZ3g/l:/M/xT02zPg
TLSH
T1AE4404457FC03507C54030304051C3503371F4104D1557533CD307335CC7540DC00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 36d6cc8e793714b76f3dcee1b884c0b07d3345661f3b38368dc683e737c25eef
MD5 7fb2262ee489f55df348996d9376176f
SHA1 ccfc0b86a7665352efed6267a1208d982a7d3eaf
SHA512 282ed5d96c88f12c196ef557abaa15110ce9ddb9a3faab40fbbb916c139decdd8d5e42821865dff3d14a12b9b0d0579f54ff0119701f62efe3fb9b0054f1b7e7
SSDEEP 768:4FWU4wgCwioZ0xU87uYG1KGck3/uQ6PvU:NUhs83KYG1KTk3/uQ6PM
TLSH
T15EF22979CC94CA7F98EE7B88A70E35229CE44133C5B89998D7D84F4D80B659DF30B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 b4c4e48f01717a4849d12e196b3c11ca603251798196f759f016cd80f2923124
MD5 e790a30a2853b272fa28d5c16e3cec25
SHA1 97a4b1d424c108f32dc4b60187e137970c30e758
SHA512 598c168e5b8aea643f759a6af7c001c33aac70695693734b49bcfbc8d2ed1df32a7e383952299c4b3e49f203e8d580ced1f02e47468c8196bec12cca109d5bba
SSDEEP 768:4FWU4wgCzioZ0xU87uYG1KGck3/uQ6PvU:NUhh83KYG1KTk3/uQ6PM
TLSH
T11AF22979CC94CA7F98EE7B88A70E35229CE44133C5B89998D7D84F4D80B659DF30B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 5430fed2d08d5f23d75ec3e05d4c6218700dc6b347773a128c8b18fd49eeb680
MD5 7b285335704f8523854f696e339a7ada
SHA1 dbb111d64901f1918e2c0dd57e4fd15e677fa070
SHA512 c50241f646b139323c71b4d6a1fdb600759c0dacb6374e6b0c86fe62913198e2137ead5ba43acc37ba27086f285ce8dc71fb1b5f4e6e40a29d65f3671d1656cb
SSDEEP 384:n5oiF9CcmyWCs38Nm8TUNTUlIxBydvFo/ajGfb7o130cKr/wLaJCra5eTQQIOHyS:RFccps3VwgwIxoZ0xr/wLaArX3
TLSH
T157B24B36DC58CAA7EDE74F99E74E3603EEE01163959C9AD4DAD81E0C009B1DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 55b224a57069a69d75b8c267aecbe328508ee70ece752512ea4e9e3f774c26e6
MD5 85ca27d01bee405056d010af7f985c3b
SHA1 826e83d92049af5cc23bc6f76209bb99d14a8a7f
SHA512 809a95cfc50aa02125d6ed153346e408d23ab6d7a06e2690cf2477f622e208d3550b1d28c3bd1a4973b76d44771febb07a6e95408591426e059d09428e849950
SSDEEP 384:n54iF9CcmyWCs38N/8TUNTUlIxBydMNsjGfb7o130cKzs4wLaJCra5eTQQIOHy/6:FFccps3IwgbPoZ0xw4wLaArX3
TLSH
T105C24A31D898CDABEDD78E95F34A3643EEE051A3998C9ED4DAC95E1C008B1DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 97edbb20f050f6bacaa41f678d4d8f764dda2a087874194b2bc96c3fe940aa2c
MD5 3d5e6df4731a73e228049fc3a6ecf144
SHA1 41a2c52f99f1bffde7c301b5ed3db2a7a14252a6
SHA512 f874d7ef388fce2b7376d19de9504c19fd86dd3b58490cf9331acaf2229b4f3143c753c00b0aaaf6c3a0a413dd3da943ecb075b0632c556049e40ea806f03775
SSDEEP 384:n6iFoZcIU8N+8TUNTUlIR2yAixHvjGfb7o130cKzAZu+t4/OHQvdCxLsIzs8eJ:xFWUxwgCcioZ0xU76PvT
TLSH
T155C25B31DC94CDABACFB5A99F74A7603DEF44163889C9ED4E5C89D1D009729D070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d8237a72dd69fa3415030877791e403b57767c50d030339f228f4c24133b5af9
MD5 5926ea148ea4da72c2eb62e86cdf3aa1
SHA1 f0d82edecc365447657ac28f3bda8d1a214ca9b8
SHA512 6b659ce020445ae0681b79a58a98fc22500f812765fcea15a14fe0b3ebab3b4992e4aee2e0c36f4134603796a740902571251e07e169af350af504822c113a68
SSDEEP 384:n5PiFiZcII38NL8TUNTUlIR2yrCvjGfb7o130cKzQ4t4/OHQvdCHy/7Igs8et:4FQI34wgMioZ0xU46PvU
TLSH
T1F7C25B31DCA4CDABACFB5A99F74A7603EEF44063889C9AD4D5C89E1D00972DD070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 e231af68186b305b91b55799e034cf690f571943841c2ad867ac654442f739a1
MD5 c105f92c2a6ba243d74eec9cea82b755
SHA1 dc8350feb8bcb0265fe1bef3d01793961b2a8a53
SHA512 a900abd22827f9171482275ad35891ac0c0e2fdc8174e64fb4c7cfa657d5a9d4274e194c8c20d4f6517a42e91e28fdd96c7034bbaa9e31a262035e883327f9d8
SSDEEP 384:nfiFoZcIU8N+8TUNTUlIR2yAixHvjGfb7o130cKCvSuNXVFH8g0cTF4/OHQvdCxg:qFWUxwgCcioZ0xCaeXVFH8g0cTCPvT
TLSH
T1CDD23B36DC94CEBF9CEA6B88A64E7612DDE44133C5AC9AD4D7C85E0C00A75AD9307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 d8f9b2b3aebb5269fd1119779949fbc7196dd2d9b60afa64582d7dfa3cd0ae15
MD5 2e18d7df1a187ffa8f15b496aafe8628
SHA1 99138f4f28f43f1049633d17b96574eebff114a9
SHA512 ee2014106b5176904216ebf26cbe6a8a543f9f1674d171754a615429bbf764f095ce394ca35251bc328cb0c6791fc1b6ef59a0d2a7c33bf9aff9ceaab61611d4
SSDEEP 12:TLpOPFUxOUDaaWZXiDiIF8izX4fhhdWeci2oesJa/Si3is+zAXrdLfmQQtud+PUY:TL85UOl0afDdWec9sJ+XFPq7QB5fc
TLSH
T1C692DC23AD312033E8DB4B36BC4345910EBC125EC9A7B8459E9089611DB1BC2A2551F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 d68ad9ab43d31787ff5edd027fa11af1a3a5a652e1e541dda9be7b02eeb29021
MD5 7c1cd632a93080f21c86590e239ee75f
SHA1 274fd9efb4cb118239e627e2e72d2567c30c0359
SHA512 6dd2b130f43776061f92849b03ce219c6449da2718a36ebb474d75e4db9901b64a4687d246bc27f28b0559d4a5acd75a5c40f95a8b3d6c2511284a001c5e4c64
SSDEEP 3:MsEllllkEthXllkl2zEfl4K//l:/M/xT02zVK1
TLSH
T1B34404C47FC4040FCD00153440D1C7513371F5101D15574334D105335CC75404C00001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Advertising

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Advertising
Size 19KB
SHA256 231be4e0be45f588b161634c816b9a5a49f530c0dcb55461d37715a94482dca1
MD5 897eefe311c18078a34e06f3cf624a6a
SHA1 98246e769fb513b8aead588024d1ceadc65422d9
SHA512 0fad93ec06d6cadb4c2e72b3355b509d5b9995706d6b7e9e69df21d9907dd3d4156eaba62a6c64ed34a6747046ffff841cc79020aff0a29690258ab487bbd6cd
SSDEEP 384:/j+Vafk2xyJEYoAYiQZU8rYvepdFhQXVVRwjSTV2quzxmVUiKF4EysZ4y5:zfEHoAYiQHriepdFWlVmjSTV2qwFOs1
TLSH
T16A926151887035622F2F50CDE0583F8E1199667540AEE6DE9FE48666F28C0F37894EFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analytics

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Analytics
Size 3KB
SHA256 bba2063d20d70f4ab06dc2ae04c2564cc2b8c631b6dab68248957dbdf107fdd2
MD5 b55f84fa839160086b8b337b59f80ded
SHA1 0fde6cb65ef56264517aab0eb5ea93667f5985c2
SHA512 6750626e0efca608abafe63926229887a68c9f3e657cb78921daf9c6b3ce11d6bfe1ba83fac775a8d1b6b69cbc00dc193fcb818c70ded3ea159b6241fd2823ce
TLSH
T1CF815415A4A014433E2E5668E03C76B912E8253880E9FBD9EFB19965F30C0D778E597E
MD5 SHA1 SHA512 TLSH

Submit Download

CompatExceptions

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\CompatExceptions
Size 689B
SHA256 5b462316a51c918d0bae95959bf827cb9c72bbd84ffb0e43b750aa91fbf3ba53
MD5 108de320dc5348d3b6af1f06a4374407
SHA1 90aa226d3c9d50cf4435ecdd2b8b0086d8edeb8b
SHA512 70f30c45e20b7cddd0cba6476af9338975cec8e40b8b19603af5fa859a34c6eb2138957daaa263633fe65213e2186402d05d9d29ad53e8f311335555116314c2
TLSH
T1E101E6F18EBD58313C74967C876C0E8FB9A5636F2898F2E96502CC87E3C054761A6C78
MD5 SHA1 SHA512 TLSH

Submit Download

Content

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Content
Size 4KB
SHA256 9a63f38e22b8573cbd47a4ef7b67ccb0934b87239e075c5cfafc7a1014e340c6
MD5 0e3ce75aaf5e674dcd7508251bb839c5
SHA1 35d4a84a8d946263e6b1d06fadc31c5753a946f0
SHA512 80d49bfdbcce2ac21c5c39c6c538135a9768b5fadd73137f6b5916fe6740827fda06c154508c0f9810723c397a22f3d93542f3e972ed3b736f7478ea2e6dc0a9
SSDEEP 48:lAHJBLfUUIAPMsb2zIEcySe00woiyKIdw5uZWhDNB+jS+3NrSA6CdM+3+1oH:lApdOAP7bercySB/1ylw5usB+WB8x+yH
TLSH
T13991B7037E4409276E95D105C0ED209E2C71ABB0C85DEDC99B964B7FBBC8C8BA4961FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cryptomining

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Cryptomining
Size 552B
SHA256 bdee796bf07922c152d770cd5928955f1b12c12515c4db6fc0ab8d2ad0c44c4e
MD5 39461c6ea4ff09d663a65d133eb47c98
SHA1 c41f5b5ac9a202ec7dd12122e64b858379a9a815
SHA512 a8e195fb9bfa68dbb064a0f8a41cd86aef5fca43349388294d364b5fd556f0a01674bffcbb5eb2a36e3fea9c64bf575b5e7ed674661dcb7544ed7a961686d4f8
TLSH
T14AF0C0E5C82197766FD544A1E05E7389F4844BB26094F3D50B56321996E8A432684DEC
MD5 SHA1 SHA512 TLSH

Submit Download

Entities

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Entities
Size 68KB
SHA256 f6e93c83d9e3cfdff064535647cee76fc85aa1c86fd22a93dcf3d2c377346d94
MD5 478a605d5578236f2d1ddc93c2f22456
SHA1 917f05453d497b3e3de684a905e141972c34a267
SHA512 26d75309976fac0bd03ffe7596209c50ead7518584dd9f27d12a86d80ecec0889bb58da1b8dc8cdb38fc6bfdca7928a54c5a15903c4b8d293633d4d58ec147b5
SSDEEP 1536:Wz20p1W8VMVLwecMFUh+oP9jt1PNEOjy+in:W2W1WUMzUT1jpw
TLSH
T152630877BC500D3384FB804BB09D2D6C21249FE5D8ABFED89BB1516612839C4B5D86FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fingerprinting

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Fingerprinting
Size 1KB
SHA256 05b29240a28bb75b4535d558edc510eb92df0ac27e9502498b99cdbc576b8298
MD5 f665b35df3c2a7b4efd9dc396f2af9bf
SHA1 2833c37d7d92a4cd1e413eba0d6717e90e69f973
SHA512 e7930341af55bae220962d79ce9aa056bbd1c9fe3cfaf0fd4181d9aa4257b5679648e4aa19561c2f9b5c8fcc6e6757d3616726eb28e77a2b899fa25f7d1b6706
TLSH
T1DF211F8295D038716E6E1488D55C3F9C129A2B7001E6F5DCCEF486A1B61489F7180C67
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\LICENSE
Size 34KB
SHA256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
MD5 d32239bcb673463ab874e80d47fae504
SHA1 8624bcdae55baeef00cd11d5dfcfa60f68710a02
SHA512 7633623b66b5e686bb94dd96a7cdb5a7e5ee00e87004fab416a5610d59c62badaf512a2e26e34e2455b7ed6b76690d2cd47464836d7d85d78b51d50f7e933d5c
SSDEEP 768:Mo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7D:Mhcycsrfrnoue
TLSH
T1B6F2735FB74413B2018206A26A9F68DEE319D07A73664095785DC15C27B3E3483BFBED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Social

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Social
Size 754B
SHA256 4955c3e7f56641a4ae0ce9c79b4ceee4b21733b0f6dedc980bf8d822a792eba2
MD5 1d06d58fe9131c14ba5ba5ff740b020f
SHA1 e6ed812e23e201b20170e928686a5d612165df85
SHA512 2854c73c6ef4d271d0e992113732ad65e406d6310711551952b4d451e2c577a2c3dcb06052e3ab30003b01619a39e87e5dd28d54f459f94efe879d1a79039b8f
TLSH
T14E0126DB1A1450027FAAC495E4458B6948B00630445DFDE582B8D27BA08EC97F39F7B9
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

TransparentAdvertisers

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\TransparentAdvertisers
Size 105B
SHA256 d2cd0bef5f45daf490c53e705d6f67dfe12390c72a00efa6f5117432bd8edb8c
MD5 57d5a3548911886de2f3bd3172e808ed
SHA1 ca932af3b25f245ce931fbc6cf10299e5fbe35a7
SHA512 933194509d305b2a60b38c149ba1d74e142ef15647242b287844d263006d33ffa38b6ea263c89cb821a9277d41f0cfda95a0eda830f3a5ef8df5ba80d3bbc818
TLSH
T1FEB00170D480008ADF4062C1D032DD98E08D5377A138C4CAAAF80C66F2433CAD1A38F9
MD5 SHA1 SHA512 TLSH

Submit Download

Advertising

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Advertising
Size 21KB
SHA256 5c62ee354070033dba1bad40dcde115a81db45943b2274fae7059a5aa5c61d33
MD5 452f3e9d40539cd65cafbd008308b5b8
SHA1 34203b4a803009ff56bb28d3a14305348082990f
SHA512 08504c06b603db3cb12f0ed6e30e733c2a2c830cad1124771c64b0e7b8480113383440325c56116fb57bde458b393ce182a3af75f0cef146ad6a8872ab9a964b
SSDEEP 384:oQh4q3kwr8CPLo3AptN7NoTn5LTDq3ZXmRHAez/GRQMKWxV1R:wqRr82LKAptNJoTNT2JXm1AezO2MKWx5
TLSH
T16CA2B361996025513E6F009DF1993FCD5AA8233080E9FAE9CFA0C676B35D4D335948FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analytics

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Analytics
Size 3KB
SHA256 d303be86132f8d7131941d41736694c2e29647ebaeccb38c0976fe66616ec8af
MD5 c4c782264f4a6a6ba84801c8c148afdd
SHA1 f138b8f526133c5dd612f79825f4706569fd18b2
SHA512 e1d3b123a7eabfe72d4df981e1015ca616c51fe7d94de91223e9c7f4eb98ed7d3ebcf7b5c7e08579db502c7b3529e095d314dc71b8cf5e79081c678e73aa646e
TLSH
T1F261C814312434212E1A126ED55E3E8E6AF8223904FCF7E14FF18A71B2194DB38E873B
MD5 SHA1 SHA512 TLSH

Submit Download

Content

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Content
Size 5KB
SHA256 70c295600066e9d3feeacd6bfc735bbcac6243694e4259477822d3db252729e1
MD5 7c5f5e42e885211f783a06b1317ba145
SHA1 079ab890b012120b89f776e4bfe67f3789f67096
SHA512 ec581f41917ee010d71a021cf16648fa757327198113dc3daff3adb33ee739da3f40d87a6f3e49004106770ea705e6b800fe263d21eccd33d7883fd1ed8c82eb
SSDEEP 96:02KCCvwLR/tE1LYSeyTPXD7fOiCrC400uvuJEjchVEy8Upy4uILrqNaRq3:02KCMwtWLYSe8miZHvui68kRBg3
TLSH
T169C183B2495079522F3E01C6F9E6265488E483715CBEEBC787E0C62CDD0E9E335A835B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cryptomining

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Cryptomining
Size 32B
SHA256 696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5
MD5 4ec1eda0e8a06238ff5bf88569964d59
SHA1 a2e78944fcac34d89385487ccbbfa4d8f078d612
SHA512 c9b1ed7b61f26d94d7f5eded2d42d40f3e4300eee2319fe28e04b25cdb6dd92daf67828bff453bf5fc8d7b6ceb58cab319fc0daac9b0050e27a89efe74d2734e
MD5 SHA1 SHA512

Submit Download

Entities

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Entities
Size 128KB
SHA256 a5409d2c6a8cbd9339a95a5e09fcaedd4546a49d47fc4ebeda2d8749cfc66987
MD5 87b4b75312dedc7106ac746153153c1a
SHA1 54fd4b67eb16620ce0dafe8eb641f6a256dfc4f0
SHA512 f594a5039c73db236f97dd50c3eb007f2fa2ff44d558222cf983dcd703d89f9b1e832bd3c249a20bfa592656e9c2e61a41f90df1b927fdd8f490d36734f92d30
SSDEEP 1536:e9nKLDxqghS81HcmcgqPvD2E/FwoqtK1Gmbpq6CXkkqGqnuP7Sr:GnANN1Pt3/oqtKAWvCJqGqnuPK
TLSH
T1A8D30938FE60C8185CEB041B91296DDC5B801BDA5AA6FDC9EF7F78190242DDD33285B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fingerprinting

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Fingerprinting
Size 2KB
SHA256 5306139881e81eebffd97de016130fdbb04e3ae976d94ad7a74e5dee63fbafcd
MD5 427724f72baa3d5c91671853a89245e5
SHA1 a33deaa88143c298e0732ecb233663c372cb0e2b
SHA512 bd0027e9bd25fa3426dfe85f67bac14bc3124bbbd6493c1d1aafc33343dcb008a8a418134deda235b71377ff970fcdc45ce4e6b1eae79fd3adf1bc3ba2e2103e
TLSH
T19441552354202051BEBD498CF59A3F4D29E5623984DDF6D5DFE08936721A8E734908A7
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\LICENSE
Size 66B
SHA256 44071e0fcffb9a9a32e8fa7010bb18dbc41afd0b176f81bf700b15b638a88a51
MD5 5b7baf861a48c045d997992424b5877b
SHA1 2b2bd9a13afe49748abf39faf9eb29ed658f066e
SHA512 4820b41aa5ff4d934a583e1f0b93b1512631102bb2dfdb74792a2f0dcf9907da7680c02a5ddd2492a1e6d58cdada3453d9e38bb8deab6ce831ff36a7f8de016c
TLSH
T1A8A0025216021A6312E295EA5E589B4FA50A1AD5255C0341164904D898B01D995E87AE
MD5 SHA1 SHA512 TLSH

Submit Download

Social

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Social
Size 3KB
SHA256 28ac79097cf67587a228fdfe4746a1a9b31dae94d5a63bb3fcaa82443d69e7af
MD5 af4c6f2598c45087a32c4f410f242553
SHA1 cad2a50e20ee6f699e21e78c58991a6a25a55ec0
SHA512 7d378b90e3cb7feac3580bc7858b6d8a4967c77196be5b7d94ef076a7e1e8166156e62954998fa6931593db5c8a8dcaacdfe3421bd39e6517f6c6094caf4f4a1
TLSH
T17B61DC32C550A9932E5D0C81EDC55E704DD8067ECCA6F4E287B082F8F0AD8977D90BAB
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Staging
Size 1KB
SHA256 f90f4cb0976a046e93978971b58fba24bc93b0129e8612fdd0e5646a1bebed22
MD5 5d7f5a0c242d9d1290c8ad0bd57be3e7
SHA1 d454811443284aeaa0294d30caf65e624182b150
SHA512 5d36ffb2ec4d162c49e5dd1207bee8b51f36d91ab38d23ff85d4467ced3a7e0f4f639b230623804260d8b03e49ef124e6ae9714f63c896c024215bfbd13dbc88
TLSH
T1A621E2194E908CB11E596745D20A535ABDEA617D38E7F4CB8EA8DE7FC2CE85702344A0
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.8.3.1\keys.json
Size 8KB
SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
MD5 ee666d1b2290efa6cdbc89ea3d317333
SHA1 a8bdd2c1d7e76fef48a735a80524243cd453e0bc
SHA512 7b2b577c9a168f626a687ee158cc20fa0ad0f816fb0583abfe45f89222d1762eb4fc619e029856618479fb6096a02eb2f9934cb46334fa781cea5cbcec992ee9
SSDEEP 192:uNtGbR0m0GflPAyR9Pm4lOvMwkoR9PuGMXcy:O7mZpKjA
TLSH
T17F02B6BF14A41182CE7FC16D9F0774B78FB03C066BCA3A83925BEA49484196D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.8.30.1\typosquatting_list.pb
Size 852KB
SHA256 3d4f9996f26a79caee8c500f1075e3e144bf88cbea35f7a54d397d4c87c960c2
MD5 8758cdde77583a4bd4e18b46012d76f8
SHA1 71a8206cadca22cdf2f55cce71554d513cfcf1fe
SHA512 64dfc1f7f94d9022a2dc94991bf2dd994b690bb4694e8749400906b91c2e5e3260b795505159f4eba422dbb37bad286e1cf49e8f056e054f9dbd267ab2993e17
SSDEEP 6144:AqRNpg4aWHpzjZMRj+MjKIaq0GSpz+J6SRj/6b8r8c+dagmdL17jfRw0J8:jNpg4aWHpqkIFrSlbipR7jfRw0J8
TLSH
T11F05B5B5DFC00194DBB8112D20BE71D8181412A580E9DFEAFE7C855F2BC6AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3804abd25219202fc1d4fab6e5cff19055c3af44ce0e8074df4f46e6f58e2fc3
MD5 69df4a6c435725916fecc8df73021da9
SHA1 139829b5156e8b2a62743460c020a61f0705692d
SHA512 66581da303557f0e1488f02423cbc85375211f851cb932acfeaba48384e97e32cd8cd3765d83729c12e5f93815714dd4ff0cfaecd323ea3d790611773ba51b4d
TLSH
T1E5414FE05C3C1AC2D5BD0E6E748B38FC82ECC725F4A4353CA858E9991A7A25D308487F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b75425b68da2a501b8a2b925afe7213dac14888fdbf72310c88996c183b30f8d
MD5 628fd03cd3608f3a8c5e316b26499925
SHA1 01325a927ed3e08b55e002878c36302bed8b0a3f
SHA512 1e440fa64807bcc1ad6ca2ed32afc1743194a1565ca4e2e85ac13ef6fa2334900e6e40e4c575f40a653b156918152e857b8c253334e540b0df9130384a9460d1
TLSH
T18F4141E05C7D1AD2D5BD0E7EB08738FD91EC9721B8A035396859ED985A7E21D309083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a676d28f37985572af58cb2ec6bad9d5da923eb0fdbc547a06799b87813ea2cb
MD5 f0d9462fa5e0debf7f0b330073d94175
SHA1 2c569da035f98e0e029e435a7931a7cc7caaa95d
SHA512 138180360a4b471e8f5d6d2d4c5a363f971c0c96d31a6728353d4b8afbdd7336031e2c7273fa3b94faf09f22c0b20dc2f1ba26110dee76fe69dc38fa1b41213b
TLSH
T1704141D04C3C1AC2D5BD0E6F748738FC82EC9725F4A035386898E9981A7A25D309487F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c500627cab47211a9ef34c64c856048601adb0d5f20c827448c3ad26cd3bc584
MD5 add51b001aab7f33416894eaafec55bd
SHA1 359b83cd27c9dac6f7ad515f91edb9b85a83b76a
SHA512 3d1daecfd13b217777f1ae64ac9bee17e785684b6c04e9774118adbe2a38e30abb239cc303f68fa6b47f1ede07f01748342684f5adc00714ffdb760f4d76ca73
TLSH
T1B84152D04C3D0AD2D5BD0E7EB48738FC82EC9725F8A034386898E9985A7E21D309487F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 df72f37c6fbd388e9a1586d72cd24537857f3b057e804d76a4c7d2acc40d91f3
MD5 489a53b997c2c0ca20b636e3ffceed7c
SHA1 852a9cdc401917a610cdbe2b04bd6314fb9418df
SHA512 0d89cef362a8e87d443f9cd452c5ce47b5967b226ea73175e84540fbe9ddca8d6f6e0b86e5bf8aa8de41c2f63eb90b0c6d4c2068c787008ae40b18079380e292
TLSH
T1544161E00C7D2AC1D5BD0E7EB18738FC81EC9721F8A034382859D9995A7A21D309083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 980e4979c65d0e700bfa0b32115054d851240c5fd3710da9ee8aca44eec3f0d4
MD5 a50af31002381f2cbb604e4169b20f6d
SHA1 44a7a4ec5c6391a5456f73c368349ad73d780937
SHA512 3b1f3e7420d81bb56bc93ce58deb53ff3ca6da7f50941197e34496513c1cc1233a3f96c0eac29602069656a0b0ee0253bc9b65963110faaa7ef9f43aafa604aa
TLSH
T15E4141D05C7D1AD2D5BD0E7EB08738FD82EC9B25F8A034386899E998597E21D709087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a7658cc39a27543d60896ba4f26c48e73f177c6d809d046a1510fc66c072b75e
MD5 917496db8245a092f9beae076ef7204d
SHA1 8d2ac7c6805a14617afa746c6219c38c31410187
SHA512 71dbb83cd5db70846e2c4ff7ca8746744316559126ac59577a9f5e2b318037d345fc4d8367ff5f7b1228f5ccbc29262889e7d6f2540eeee8b8f46c40c5d64c69
TLSH
T17A416FE05C392AC1E1FD0E7EB08738FC81EC9721F89434392858DA985A7A21D309087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 39901bbe3ba1896049dbe825a1c53090e11c92af3686bd8648c376064d256f4f
MD5 be18b7b6301338cb17fc66eb4db71ae9
SHA1 ef5af0e84b17cb2ff71b122627895484c8e87149
SHA512 3fb1ef62c01ce4cb87ce6f0fb697fcf9d30f90e0eed65bda6c13e4293fb8bbe6b90cfb6fe721299edfe7a1523914c174fbc8f3f9d06b1a86b39c71c916b3d81e
TLSH
T1E04152D04C3D1AD2D5BD0E7E748738FC82EC9725F8A034386899E9995A7E21D709087F
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

e5126ed2-1cd0-4728-a45c-8b47e65b441b.tmp

Path C:\Users\Admin\AppData\Local\Temp\e5126ed2-1cd0-4728-a45c-8b47e65b441b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nszEA81.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nszEA81.tmp\modern-wizard.bmp
Size 150KB
SHA256 514d8179f9014c612d1c5475e43cf97e1b656c9b607bb89e055388552aded24a
MD5 30bb7644d21019b16dfa6cc5be87d129
SHA1 c6ed96eeecfd243109a4dd8034586c2f4bc5c650
SHA512 05d3f506c2c607741f053ebd04b475c0971e30ce5bc825a0123c6200a5e950f9890a85744d1dba7400295fa5d82353324d0f478f3c14354470b118e63e467947
SSDEEP 3072:sLOP2PTTjOZGlkXCab/BCgK/4Lvz4ckMl+VAch/SkX:sLOP2PyZGlkXCab/BRvz4ckU+VAch/SE
TLSH
T112E3440A91BF901CED1FF4548E86678786408B5DAB9FEDD687DB052138EC23C71AD0E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nszEA81.tmp\nsDialogs.dll
Size 9KB
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nszEA81.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 3697d11bdbe1e34daa26b1e89d84276d9ff28148906943d0fe888354c3b13620
MD5 acde70f73d3b71b1c4222b763537780d
SHA1 b053b2e5fdb97257954c8f935d80964f056520ae
SHA512 598fc58a5f561e7995eccccb065faf2a2386bce0cfc4199fa95ba9fb74e9fcb291914676996c90728dd283223c2180de9fe073a4c936e60fbabe036d7e0a40de
SSDEEP 768:L8+c2MM0Hxd1fBTsRmMZdauVKAFKpnp0jdhK7R+qVQTxM:L8+DMfHPxAIMtXIVQTx
TLSH
T144F24A18FCC47EB6E6DF0570080D4A7E826FC8181B14CE9BD3A51EA2D5A63729EE501F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1702eaec-024a-4d89-b7f0-151db0b3784f.tmp

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\1702eaec-024a-4d89-b7f0-151db0b3784f.tmp
Size 17KB
SHA256 79fc2b78cfbf33625721457fd2510bca2454054c843672d315673fb761808d01
MD5 f3045581518b1474c92f3093c6f6b9fc
SHA1 95c48685e57d3948758b22373a580b1a9cc16a9a
SHA512 10c03ce8585dd26e387238a960100ecc4f73a8f12b4f5c1be5b5a21d8468358e2ea5922bda3484c560892e381390e766bb9c2379c859e540699273ca3b74c456
SSDEEP 384:zP+aQikB+z/xvxjg/qhEVNb9hYQkQm2IQukDzsyuEK:C/UxvxjgC+Vy+4
TLSH
T166729D2A98687D2399F3E505FA6D1B0BEAF98072D0C06EB84AEC5F0D168B3D40347D56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4c53391289cd9f7c4aa23313bfcba0d2bbdbefbfa12e0f95b8cae440ed57aa8b
MD5 0574f68c58ca475cad0a5b326f26d5d2
SHA1 da6a9e19d95de363aafbe2e0774167dcbc345704
SHA512 4ed15e1eb6cf7746ad5c28de72132552292048921d1cf2890446936807b0c42dbb5ee92eb2f949725c57d4f2bbe662a66e4c395ddd820610b67062a9c129f317
TLSH
T1CDD0126732814374C4103033019372080900C50BC0454040542DC52D5E4A4900902491
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7118a07a1d819ec7117e84d790ce31cc1b50baa0f5e886fec1ab3c7b7c4a5403
MD5 55770aef7e8aaba32561241a8f70830b
SHA1 e3003da85b58950bc63ebc35da2d4864270ee7b8
SHA512 cf6dc7d8a4d48fe13be031a3ae833f15e0d09e8747b29d5dbe7d47db6b97e33d68ce06c7edbb78ce67f712289d96eda90d064841bb7bc7ed3dd4e933afea18cd
TLSH
T13AD0C0FB33052B32C320303380C3E1442640C91B508645681D35EB7C0DE9CD308D84C0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5e823f952f1f3a44bc2c5e6cf45d8d0e18c47b6446060d2d26ea5ca8fdb0efdc
MD5 199bb7b56a7ccacb35d9cac049e8a5ef
SHA1 724e2b2aac06e78b986eee9b6fb7c59b93b59b45
SHA512 9ae4ac5ec2450a610eba48d8f96fc2453a1030d305d231ec93a57d758280ac4910000f6b7bb9f70f5e961fc8c5d6c601ba8a9b1739d1af397269cbe59ff22158
TLSH
T10FD0C0FB33053732C320313380C2E1442740C81A508646681D35DB7C0DEACD308D84C0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8d56be12eeca2d448972c5bf456e654e44140862a1778314d6f6c26cb088b457
MD5 9729d21a2c0362eff9fb97a1bb537b95
SHA1 72c5fb11a4cb33df2db7f5d13217e8da749a05ff
SHA512 e47697b28376fa777e4b427757ccd4f80afe8e1bce68473693c9fafc8e03d50293661f4f0cdb03bcd41b56fba2c84c04c26023d7dd49f360b1aa777a122315ac
TLSH
T115D0C0FB33052732C320303380C2E1443640C81B508645681D39DB7C0DE9CE308D84C0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8c979d38670967d7a4f31a7d7431e960a2e89e93c71acfcb6a652472134299f8
MD5 3454dfbf1a22fb27abdebfd5833cf58b
SHA1 9d81ac03979e317cb04009024b072c469b0e0215
SHA512 706f8b8646a1600aaa6bb78e3744912186d565fc7679bfa8f6d82cdc45ace4dcbf2eb7494ba4f82543f29304d8602a57d1be80a72b188107de59c1243fe33f07
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

8c7142e8-3a55-4c82-b54b-bb3fcbefc1f4.tmp

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\8c7142e8-3a55-4c82-b54b-bb3fcbefc1f4.tmp
Size 6KB
SHA256 f0bff05caba86e7069484d2ca5ca29fd046279eb6d61bd8c70a449ee3c0747c4
MD5 5a9e41699ff2de0986eab0d46b739af6
SHA1 1b1ba56afbb4e64dcee72a2c53f9b48c5bb74431
SHA512 96e4d4a59d11357192a84322043383f3e619c883f86d78e4f01061b49afcf6d4e940217f5e4e5fd36c8b83daf99c2067ce7efc3b898928351c50940bf027f0f3
SSDEEP 96:st605FFQ1b9offgZ8i0vhE4EDkt1Om/7qx+WVHMSm+uecJ1IxU1idQjd+gZ9J+M8:st603nfIZ8paoN/S+WiTeawdoH+M8
TLSH
T1B5D186029F7869774CC7E619BA35BB12E2FA506161D40E98EBFD851C04E66CC530794F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 9c0b635492c3fc8479994aa7dadda96d45a4c374e6763e681fa741b4fda6e0f4
MD5 29251e352d1fd25cfac56d91f91126cf
SHA1 984bce3eec7a5b7d981873603027ac18227b0ed3
SHA512 7d2164475ab16cfa375fc6fe7bb7f4c283baea33c17948defb680fd378849ff206f948dd5b430b1fdf05286232c0b064bd4f79938d83a8f2289ee8eb72a8d416
SSDEEP 3:MsFlTlrllkl2wKHnK/8kfll7U4+adHI3MzOAl:/F02wina8kNBFQA
TLSH
T14C13129CAC800E07C695033834AB86B05231EC308112C36301F8143B54153A2CD0C000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 6d9ba1e1f2a5f9d8d1996e78d0d7e90a1978601831f6d8e3f213f17780c91c83
MD5 c3c90b8a8707f77511fe9560049a8ed6
SHA1 e9547a9d54d91a3b890b4824dc2d957b3bedf667
SHA512 d42c1de11d4c68a74a117c6654a266efa83505070c6c3a1ed56d7b7b7657091853347570758ffeacdac4b0804f81ca90d88882789bb0ab51bf06616ee57a187a
SSDEEP 12:U/UkIic74GKSekQkAPkS8Kr/KQkQkAPkStZTD:mc74GKja7K1aWd
TLSH
T12B4455EA3B14120ACA1257F230D717BE7B36C82081AA27879DA08810BA403B40583781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 388675ebb703cfc3ce7f4c8b88810caa834060d2a0a4d43e9ed4d114be83029e
MD5 29a6d6c42a3a152d8030263bf653c40c
SHA1 ff5e2a652fb1d556f98bb3ef40bbcfb97989eec5
SHA512 e8a225684929f85cf4c2fbf70735d7aca7a0a51ea67f6839766c4709bef369c01511131f7854b7e9a33b4266b7970ddf2d4272ad732122f632181f5885f658ef
SSDEEP 96:Tnflcw39631jYGJavxfbnuTB3HqPfVXk6MT:T9cTmwulu93ek6W
TLSH
T162255CCEAB34605BCA766E7274C6E4017FB86AD1F683B68344C549697C807C4AF8319C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 8e80fdfdc5350e0f4328aaca140013310878972c5c0b0fadd37bc60e468786fa
MD5 5d305e19800a1aa2f1cf170e94e823a9
SHA1 09cff7e31b2a3f0bc8e10c2401f0c4c4f0983d86
SHA512 9d09f026ddc6f96a8a3ad736dc26da54824540d4a4d93178e8af7d52ef67d7c6a573cf88f058520b3864d97315eba79c9253de1df8a81360ce04ecd40ecb3ac8
SSDEEP 96:TpGdGSGnGyGsGgG5GAG2GxJ0PIyIuRZGGxIDarbgpbnuTB3HqPfVXk6MT:Vu5gr110TV0J0PrhGNgb4u93ek6W
TLSH
T1D816F8C51F989026DF92BDB374A0E1015EF8F7827A8575D990810569AFC3BF867C26CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 9b98ef93c84169f092852452a99977950e09d8837742403d2139b6e7f5c7f1fb
MD5 db91e92b882888b46ea7bcded5ec19a6
SHA1 cfd24154c472f6c7b3e7f2168c2f5dd1f3e3c6e7
SHA512 64ae43b3407ca5f8f2fd2cd6a6a2a97e698eba908aef2648574b1f39f880c3f6c2581d86a87c8d8950a160fac87662aac346987beb4bb13d8c20aed417016f54
TLSH
T129B011382802882AE3028338320802802B2028C2CB0A22A28BF0380888A838A0B02020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 01332e11f5087aadfe9682cbb714356bb46d651d6495a194efa81a3f5da9b5e5
MD5 9151f4fd0dead4190256f8ae63ecf8df
SHA1 f0a72ac8c675872027908fdc09a3ff53d358916a
SHA512 e01246db9b0606965213c07dcf7192a0cce6c9417ca5ee9f723b69b80640effc4b1989c3a06f8f17d9cba3964d9a9489b2fd3246b8a1b552e9da98a5e1d142e9
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 50ffe40edd56a9034db533b39af5014818499fb113265fa9353e270a547bf1e8
MD5 600dfd9cac1e8c51446a521ef424ade0
SHA1 08772d3e57e7adc992bdf61ab0bf0e704a10f761
SHA512 33cd453d18cb3523f30e122eda2387038ba36fc626bc5225bac661ddc168396719caa7810a641bd96731fb5e18aad3b811f6c9f0859543145fd661761c3536d2
TLSH
T141B024341D575403F3100370F10D00C015301CD1D73717C153F07C0454153CC0F01110
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 9c67b77104cf03ecd2dfd155b9b54ed4bcc3333e4364958bb587e18bf77030ab
MD5 9608eb74200a4b7b272c95237f1fe2ac
SHA1 c79941bc09be41ee72c5455a7f3e9aea4fb15df6
SHA512 6d2b5fa8b8b6aa015faa69a7558a3eebe599255cc058080fcb9d8ce0793c231dbc60fd8c054c2d0e0230630e4ea24f31197e83de0f0284fb9d86557d5a5c21e4
TLSH
T1B0B001386CA86807E6115B7431CA45807A742CA28B932A96ABA53964A8A97D84A02955
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Network\Network Persistent State
Size 589B
SHA256 cdf274c656170ff3de7eadd1efe2abc953ba1c7267c4c941f6670a4a3b5ce340
MD5 624ea07d69f2f0bda9c07fbfbbe6af2c
SHA1 6372335ccd7570a2221f81103f59aba0a3cbc5a2
SHA512 0e3046fc213e8a80e0b908aae68dd62c543ba6558c460bcc2b5c50ee3c59db344a1ae38ed512d31de2682758c99369954f7b75d0e19dd1a1b06ba09d63c0b98d
TLSH
T1F1F0ACD1D5E886FE4A4213E03931BC53C83A090542283E22DDE9E79587E1074C01118E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Network\Network Persistent State
Size 589B
SHA256 f2dc3e1867554429d50f67161f0e3c3a6541a5c849b1846c7ccafe8208efbfed
MD5 f94f8c6e2d96b4daaab795895f69eabf
SHA1 abd3e96d0648e86dc13d609cac78872cb6df4e04
SHA512 4598ba908370556fb2ba86cf53fc76fcc36d57ab4a4f9ae6cbd14330cfef08fe3b93b51aa9416004de69979fec53930bca2de7d74c2db0c87c6b9bb1cbf5dbe7
TLSH
T1D1F0AC91D6E886BE4E4223E63A317853CC39080542283E26DDE9EB9597E1074C00218F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Network\Network Persistent State
Size 589B
SHA256 97e5c4e1d02d81def742f33694e80e69347df486a1b8f82ec0a1f1a30998ec94
MD5 96aff12b186847c079ee8acccac7fbeb
SHA1 10f9e18dccba052a20b9c897b0f9c62aefb09b35
SHA512 c82bbcacd45a6a607e55249e73fc02730bf2d95fcd68d50bac5f5810be14ba189ca57c4843591ecf145c5e70975f3a5d59cf48135efededea387cb52e83e0eda
TLSH
T19EF0AC91D6E886BE4A4217E035317C53C8390805422C3E26DDE9F79597E1074C00218F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe58a14c.TMP

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Network\Network Persistent State~RFe58a14c.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Network\TransportSecurity
Size 355B
SHA256 25a1491d67ef24021083f8af8f0833478a5f6c022cca31bc644ed0f6b5867a81
MD5 49694508ea96245e609a2de78291d7c7
SHA1 5a584f9275813d186435ea070e3968c970e197be
SHA512 52407a2b9807c8c3c3f6c77fb0f9fe17b8cbba3bf7841c1ced373d461cc4b1b29b1859ca42aa9f12396e6a8beba515ad9f8f37b5d771e5138c65d114627f58b3
TLSH
T14EE02067D57FAC2A203C45271D88BE096D76F038414166E8DE62476CA0446F24907433
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Network\TransportSecurity
Size 355B
SHA256 631f5636a4726eaeccc3372a8a210ea99773ee1de420cb5bde4e7f83d023f574
MD5 569f00f98e2aaa001739d7c314b8db2f
SHA1 72b99f1b270074196011eb116bce264af696af56
SHA512 95a874d2792451c4be43c16c7ff579bec4a66034769422c23e2c151940801762d35bb051cde400756481600b46e6d8a01e0160ee4b4363a32b47da5ea48f9ec8
TLSH
T117E02063D9BFAC3A203C45271DC87D055E7AF034424064F4EE62C76CD0846F24517563
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Preferences
Size 7KB
SHA256 7157ff69d2cfafe343ef149728f162286248e8349ddb091fb39c48037349337c
MD5 0c288544c5ffbb2f8b1f97007b754e7e
SHA1 9c893f6f98a32061a24e59cfab690cc833ea401c
SHA512 fec56c9adca106b58178b7e940111448ca88491825b207dc8ca45b12f69dfeb0cea555de2fb89a3b6c0f5dd5994aad6a2af1676e3105918e64827554239c1ea2
SSDEEP 96:st605FFQ6x3bDbffqKZ8i0vhE4EQkt0m/7qx+WVHMSm+uecJgBSMk8dQjd+gDSyJ:st603TLf5Z8patd/S+WiTgQQdo4yKC
TLSH
T178E197069E68697B4CC7E51DFA36FB53E2FA506261C44E48EBFC851C05E66CC530790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Preferences
Size 6KB
SHA256 ee17d12533bdeeeab8706ee18f31b556a5327504c6f66a995aa3bb349537623b
MD5 d6a7ff5f32a731116b33e7ab3be72f19
SHA1 cd51b49c77cb02ccd8f5cff1b82f4b8c119e7564
SHA512 0915886da56ceac05c409242ff328bfe0d42fa2dac8dc4a9c76cfe501afeeb592d799b365c276c7566834d5093a194fb3e2c36f14b62a62e307a724e5f01983d
SSDEEP 96:st605FFQ1b9bffqKZ8i0vhE4EDkt1Om/7qx+WVHMSm+uecJ1IxU1idQjd+gH5EDJ:st603If5Z8paoN/S+WiTeawdo8DKC
TLSH
T148E1A802AE78697B4CC7E619FA35FB13E2FA506261D40E58EBFC861C05E66CC530790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Preferences
Size 7KB
SHA256 c84ef9c65cfd66efedddbb8f65d7f6a301843ddc4789a3f48164b5ce3b12c59c
MD5 0a21ae0ef5556ddc8496a2405730fcf6
SHA1 04aae85182490e07c407cacd7788716cfd7812c0
SHA512 e9b03a88158a4fd471fdc5bb83c6ec82a9a481045a32001bdc15dc6dd33cf6131ce2aa669c32db804515d2852ea63e59b2caf467216d9a523dcd231bf839f0b6
SSDEEP 96:st605FFQrObDbffqFZ8i0vhE4EQktgm/7qx+WVHMSm+uecJIgSOXdQjd+gbbzKOB:st603QofYZ8patZ/S+WiTI/qdoNzKC
TLSH
T1FFF186169E68697B4CC7E51DFA36FB53E2FA502261C04E48EBFC851C15E66CD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State
Size 16KB
SHA256 3715eb0a3e2e704960fbab756ec33d3cc7eff348c4343747a0440920f9816bc4
MD5 91a6ee515ff8aec0a81df33ee23ff781
SHA1 bb434f231b00c1286b54b0d1eb7af317d7f21fa9
SHA512 77e7e8fd70ae905f3a1ecd0fc1521117f63d005b61d67b8b2cd25e1bb631e1cb3c62bfe7d8992a70b89e19103fb06934c2c1abb5e8c3766ecd21e7fd13e7e2e5
SSDEEP 384:zm+aQikB+z/xvxjg/qhEY3Nb9hVQkha2IkyuEp:N/UxvxjgC+Y7rfO
TLSH
T1CA729D2B98787D2399F3E505FA5D2B4BDAB9C0B290C16EB84AEC5F0C068B3D41307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State
Size 1KB
SHA256 8d81d715e45719e36441af5eb0f211eef7e54478d059a4beee830928ec93d068
MD5 af5a528886ea1c3736b25d61f6a0b648
SHA1 496910234af366ea76416510f49b733e8e997e3d
SHA512 be00cb140237cb1b167d0d83e801e218d4032a6a054911c54a2376d5b0751e5bfc2cecea56dd82d6579cd68c3d28e8cc0d92f2f6bfe43c55dba0f0cf50ecc732
TLSH
T1D531237398A03AB15DD36642F28A77472D11906681909F44A2CD4E1D12972DC562FD3A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State
Size 2KB
SHA256 45e501eab00a1d12fd2cbf779e75ecf95fd12ad69fa2386a80dce4d27d5dd9ad
MD5 19665c80d903b6068f84cb4ddbe54e7b
SHA1 12caba397f2c70b4767cff2d51543d4220e01b9b
SHA512 93507d530cc53801d411819a8b4ef6c40837174f61a7b27771cbfc070840882f71bf7fa975d59f908c943dff86dd24d4cb92e3f122591c8c393a11eb58c7f35e
TLSH
T1AE519673AC64BA774AE35644F68A7B13A9229162D5912F9096DD0F1C01CB2AC231BC3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State
Size 3KB
SHA256 86ce1aa765eca605b19b0113521862c727dc587ebb8f350549dc40f0b7fb106d
MD5 ef5bcda24b4bb1b299fcf1b042646b8b
SHA1 cc1b89ae60f1a8320daac4434cc34abf6ed18b8d
SHA512 36a6ef50af5d21a55a1b6c01f19332263163a0b0568122360f75687b435347d05bed14784f8904701d792580d9d49c6c86c77110100aba7580ec889d718f005e
TLSH
T18F717362A8B4A9774EF3AA01F9C93B06B6619127D5D03F95D6DC0F1C02CB3D81356C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State
Size 16KB
SHA256 1c1901af44a0d39fd48d1e08884f43f3ad517c1da574c3d52c9ee7cc3f65d105
MD5 398ca185d51ee3a28aa139f345241ae6
SHA1 c5df79ca121bb7e8d61e7e0be351f18caf9d936b
SHA512 e14ae2ca1bda20d4b3714f31a7b31739d3d27342e99984676ba12d29573e85effa218f86879b661322f430cb51b69e8df0b19ca1b40c2a6b54f4c454daf08302
SSDEEP 384:zG+aQikB+z/xvxjg/qhERNbwnDQkhq2IkyuEp:F/UxvxjgC+0Dfe
TLSH
T1C8729E2B98787D239AF3E505BA5D2B0BDAB5C4B290C16EB84AEC5F0C068B3D40302D57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State
Size 17KB
SHA256 85163d8f9da03bdacb7b300ebd929de3af061adbfc954533392d2f3460cbe09b
MD5 1e8e6279b810cf73ca4459d04102be02
SHA1 ad77c275a1183b00a699d7dbea32007110b11b09
SHA512 ccf396af8c60f17dd1d90eea2d6ec4c3c6475147183aa38a44e7d5bda1fd8e3ae2f30b22a4db55aa333646e3f238653014edc94f7ad3e8efed31c56eccc4b8c1
SSDEEP 384:zx+aQikB+z/xvxjg/qhEFNb9hIQkPc2IQukDzsyuEK:o/UxvxjgC+l+xW
TLSH
T11A729E2A98687D2399F3E504FA6D1B0BEAF5C072D0C06EB84AEC5F1D168B3D41347D56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State
Size 16KB
SHA256 87360780ce46baf8fd755086a06d45a4447fe6a82d7cf639be640bbeaff06a4f
MD5 79989f7570ef8be3372ab4d47022eb47
SHA1 b7267cbeef9c1db7d83561d3c10cdaf054c92dd8
SHA512 8745cb7b8b0a7ec1a1c66f72cb755e5df546907e519afeaaa63caf9469e364fac7ad29328b7aefd35b2d1f6633638d42efc54cfd663dc57e83bae7833676369a
SSDEEP 384:zg+aQikB+z/xvxjg/qhERNbwnDQkhq2IkyuEp:T/UxvxjgC+0Dfe
TLSH
T1A9729E2B98787D239AF3E505BA5D2B4BDAB5C4B290C16EB84AEC5F0C068B3D41302D56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5814ac.TMP

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State~RFe5814ac.TMP
Size 1KB
SHA256 1bd63f3c330ada18ac9ecf67d2090408d1eff769904a4a0d49b8e5c9b2341a1f
MD5 563025ecbe686bb6ab62b7bc27b30a70
SHA1 f73ba849c40a764fb608ba56e535d3d420f8aec1
SHA512 205869ae5cfc9e36d05bc35aef7ca4462d49d1b797592097dc6a3fed77f22277cc86f024c31ba73b93405485323406e36517fcbf4abf52f2ba5e1a50a29e3be3
TLSH
T198214273C8E47AB16ED32541F28AB74B2D41906681909F48E2CD4A1D128B2EC573FC3A
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_1175581894\manifest.json
Size 165B
SHA256 880b2b81f96f7ec0799e2939e82955327f65a8e4edadfdd89cfebb70d8fb6f2e
MD5 3ef32f0bc4059ed77b8df1ddc1bd32d6
SHA1 180f08a503c8145e50e715a1dbe202b491de0011
SHA512 036d08f722ca62b9f5a21d79d9d6d0585f7255ff736ce717f72aff31ef0e194adb3481da6c690be7306818947efcdf1e6745d0d14de0c32bd088a5f93415805b
TLSH
T1EEC080029400197419CE47150D5CF388A722D7152D80B0165BD7C218DC3DC8B68F3B4D
MD5 SHA1 SHA512 TLSH

Submit Download

Other

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_1463168391\Sigma\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_1463168391\manifest.json
Size 132B
SHA256 de864bf0ab8abacfba536d4e9764eca658f903bd2457f955e128c4ee181c7e58
MD5 c9209ab189a035569ba3c65d7375d220
SHA1 1987aaec8f436325415fe36c168c9a37829523f9
SHA512 60495e096f78de05c6025a9d7b69aef9dce0d08ec1abbd4ccba206827a8c25d8449f54f93637599649762ec09a034d32fc8afc06199b1b57cd010ff1a0c850c0
TLSH
T17FC092615802797A14DEB7F00D29CB926AB3CB2E18A4650546F5C228ED2DCDFB5B330B
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_1831929174\manifest.json
Size 78B
SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
MD5 259f068207f60fb9d4448c02c27b74ba
SHA1 99131d95cce94750a928738a99caa5c710bbc924
SHA512 fa41eac9d1ca244d06083e3d4230dd94700861155359722c1d815d0d9933dcd39c113b6f0f6ea02ff7ee1acd2fbc6ed40267d557afde16f417e80b678e8136bd
TLSH
T173A02230AC02E23320C803B002B083C383A02C02302A388C0B0320A232C823BE2F323C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_244183068\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_311166657\manifest.json
Size 53B
SHA256 138f15e92672b6401fdc51bb1eea7d109b49643f15fb85c56115a679b15510c0
MD5 43aa1629d5c538b9d58200ba8848cb7b
SHA1 174dde5f762fd24128864eccc93d67031a4beae0
SHA512 fb14d96f8b0546fb4b6aa282a80fd5d1d58b06e54e53d202e9d6a31776c2b96e7f01ceaa1304953d97adececf5b666c496e9fe2938ec1be62995d1990b2c90b1
TLSH
T18A9002600414921716C10E506570B885A391661955850D1D04451658029586CE0502D8
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_413911042\manifest.json
Size 118B
SHA256 6ac273e9928afbd1818c9e8a4def714248450746f9c90b7ec7147f7526924584
MD5 dd6d69dfbde32696cc424185d74f4e52
SHA1 fceaca87b32ddbd6c26085469725c4453bcd8860
SHA512 6106ee1efb46b91fae8c5a34109871d5ebad592f2a10d15ffd100d4847bfaa2f22f233e5f463aa28ee860668db76b0225cfce01f9f8fb26c1b053a90f7e3dd4f
TLSH
T126B092B00C0AA03B22849320ECA066C283F80618E8425B1E099036491F88178C0366B2
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_887048796\edge_checkout_page_validator.js
Size 1021KB
SHA256 4bd84a271e6aeee39cc614bb6fa9e60ad465f61b6a305f9f69b995f9af910219
MD5 84017bbd252b4e3da14c6c6f7966da0c
SHA1 619a6e18fddfe2003aa3799e48a30d4e4d1be2ba
SHA512 719563802aa0f7154333295cad12e0184c2da0108bcd5e009e0828326094e9d49fe16b1fd5de874ce583896c32a85659d554d1816670ba17bc07b4f7a97f657d
SSDEEP 24576:j142AzAtsJvGxkVKA8nG8O4cELKXnhw5BD6Nc6U2y8enpBtSLVzhEiJsfaWZPS6Z:j142AzA+JvGxkVKA8nG8O4cELKXnhw57
TLSH
T174252B80E1E2253466D74CB960B7D2C4B5DC04587399F1E8FA6C68CADB0F94723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1120_887048796\manifest.json
Size 146B
SHA256 7e765ccd9f7f89bc111ef17d12194e83940dace4320e67bd582211969f117da1
MD5 ec88e92109abcf84de7911dd22725ce2
SHA1 b8a7b83f5ec59289282350824653b73712e89896
SHA512 b8f7e86d56f579a0b2b2c7b852e9322fa0424954f308587734ed2e5e8e3f7c8c38b7ecc42a92871885a9fb53695572ac687d5b92d67a9f6a87a3d29980c3ab13
TLSH
T174C02B33CC31AC300D3007E408F08601EB34134FF500B0163730008D0B3C470D0206D0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/488-338-0x000001A58D880000-0x000001A58D8A9000-memory.dmp

Download

memory/488-81-0x00007FFB7BA80000-0x00007FFB7BA81000-memory.dmp

Download

memory/720-1591-0x0000015E07AC0000-0x0000015E07AE9000-memory.dmp

Download

memory/780-1440-0x0000023DE24D0000-0x0000023DE24F9000-memory.dmp

Download

memory/1200-1441-0x000001C680000000-0x000001C681000000-memory.dmp

Download

memory/1956-268-0x000002C197040000-0x000002C198040000-memory.dmp

Download

memory/2068-200-0x00007FFB7BA80000-0x00007FFB7BA81000-memory.dmp

Download