da36b5cd45c5d5cfe2a89376c43e3c2ac741aebf8fdd3b98d4ffab260b90a168

Analysis

user interaction
yes
max time kernel
58s
max time network
64s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 12:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Harmless Asset Manager_3.8.0_x64-setup.exe
Size 4.0MB
Sample260910-n9218ssfnd
SHA256 da36b5cd45c5d5cfe2a89376c43e3c2ac741aebf8fdd3b98d4ffab260b90a168
MD5 688b47864c03dd10e5b5df2619a6d638
SHA1 e6e8eed2d1e3cf14ba94b49d21935e42bdd28e09
SHA512 58f453c2e40177962c415255b0ff56569cc62de0dcadfa215420ff83bc6e1b196cdd596714c2770eb9a56d7d49ceaec12678b7fc158af84862fa5c7e25a21178
SSDEEP 98304:i7OxBKiq2Kl2Zewe93M2eYfVFg0T6ZOwTRDZ54HGA:iiXKiqecc2e8g0eZtD/4x
TLSH
T1061633A57A73C623CC48BE36880BD4E6151A9ECA47F492D1F34285FE635E994D01B2F3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery trojan

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3132 created 3252	3132	Harmless Asset Manager_3.8.0_x64-setup.exe	56

Executes dropped EXE 1 IoCs

pid	Process
3104	harmless-asset-manager.exe

Loads dropped DLL 7 IoCs

pid	Process
3132	Harmless Asset Manager_3.8.0_x64-setup.exe
3132	Harmless Asset Manager_3.8.0_x64-setup.exe
3132	Harmless Asset Manager_3.8.0_x64-setup.exe
3132	Harmless Asset Manager_3.8.0_x64-setup.exe
3132	Harmless Asset Manager_3.8.0_x64-setup.exe
3132	Harmless Asset Manager_3.8.0_x64-setup.exe
3132	Harmless Asset Manager_3.8.0_x64-setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	harmless-asset-manager.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Harmless Asset Manager_3.8.0_x64-setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5152	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335156374421728"	msedgewebview2.exe

Modifies registry class 18 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Harmless Asset Manager\\harmless-asset-manager.exe\" \"%1\""	harmless-asset-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager\URL Protocol	Harmless Asset Manager_3.8.0_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager\ = "URL:com.harmless.asset-manager protocol"	Harmless Asset Manager_3.8.0_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager\shell	Harmless Asset Manager_3.8.0_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager	harmless-asset-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Harmless Asset Manager\\harmless-asset-manager.exe,0"	harmless-asset-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Harmless Asset Manager\\harmless-asset-manager.exe\" \"%1\""	Harmless Asset Manager_3.8.0_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager\URL Protocol	harmless-asset-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager\shell\open\command	harmless-asset-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager	Harmless Asset Manager_3.8.0_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager\shell\open\command	Harmless Asset Manager_3.8.0_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager\shell\open	Harmless Asset Manager_3.8.0_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager\ = "URL:com.harmless.asset-manager protocol"	harmless-asset-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager\DefaultIcon	Harmless Asset Manager_3.8.0_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Harmless Asset Manager\\harmless-asset-manager.exe\",0"	Harmless Asset Manager_3.8.0_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\harmless-asset-manager\DefaultIcon	harmless-asset-manager.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3132	Harmless Asset Manager_3.8.0_x64-setup.exe
3132	Harmless Asset Manager_3.8.0_x64-setup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4744	msedgewebview2.exe
4744	msedgewebview2.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3104	harmless-asset-manager.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 3104	3132	Harmless Asset Manager_3.8.0_x64-setup.exe	91
PID 3104 wrote to memory of 4744	3104	harmless-asset-manager.exe	92
PID 4744 wrote to memory of 3136	4744	msedgewebview2.exe	93
PID 4744 wrote to memory of 4596	4744	msedgewebview2.exe	94
PID 4744 wrote to memory of 4596	4744	msedgewebview2.exe	94
PID 4744 wrote to memory of 4596	4744	msedgewebview2.exe	94
PID 4744 wrote to memory of 4216	4744	msedgewebview2.exe	95
PID 4744 wrote to memory of 4972	4744	msedgewebview2.exe	96
PID 4744 wrote to memory of 4972	4744	msedgewebview2.exe	96
PID 4744 wrote to memory of 2484	4744	msedgewebview2.exe	97
PID 4744 wrote to memory of 2484	4744	msedgewebview2.exe	97
PID 4744 wrote to memory of 2484	4744	msedgewebview2.exe	97
PID 4744 wrote to memory of 3144	4744	msedgewebview2.exe	98
PID 4744 wrote to memory of 3144	4744	msedgewebview2.exe	98
PID 4744 wrote to memory of 3144	4744	msedgewebview2.exe	98
PID 3104 wrote to memory of 704	3104	harmless-asset-manager.exe	113
PID 704 wrote to memory of 216	704	msedge.exe	115
PID 216 wrote to memory of 2304	216	msedge.exe	116
PID 216 wrote to memory of 5152	216	msedge.exe	117
PID 216 wrote to memory of 5160	216	msedge.exe	118
PID 216 wrote to memory of 5160	216	msedge.exe	118
PID 216 wrote to memory of 5160	216	msedge.exe	118
PID 216 wrote to memory of 5340	216	msedge.exe	122
PID 216 wrote to memory of 5332	216	msedge.exe	121
PID 216 wrote to memory of 5340	216	msedge.exe	122
PID 216 wrote to memory of 5340	216	msedge.exe	122
PID 216 wrote to memory of 5332	216	msedge.exe	121
PID 216 wrote to memory of 5332	216	msedge.exe	121
PID 216 wrote to memory of 5304	216	msedge.exe	120
PID 216 wrote to memory of 5304	216	msedge.exe	120
PID 216 wrote to memory of 5432	216	msedge.exe	123
PID 216 wrote to memory of 5432	216	msedge.exe	123
PID 216 wrote to memory of 5432	216	msedge.exe	123
PID 216 wrote to memory of 5440	216	msedge.exe	124
PID 216 wrote to memory of 5440	216	msedge.exe	124
PID 216 wrote to memory of 5440	216	msedge.exe	124
PID 216 wrote to memory of 5892	216	msedge.exe	127
PID 216 wrote to memory of 5892	216	msedge.exe	127
PID 216 wrote to memory of 6064	216	msedge.exe	128
PID 216 wrote to memory of 6064	216	msedge.exe	128
PID 216 wrote to memory of 5788	216	msedge.exe	130
PID 216 wrote to memory of 5788	216	msedge.exe	130
PID 216 wrote to memory of 5796	216	msedge.exe	131
PID 216 wrote to memory of 5796	216	msedge.exe	131
PID 216 wrote to memory of 5292	216	msedge.exe	133

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3252
- C:\Users\Admin\AppData\Local\Temp\Harmless Asset Manager_3.8.0_x64-setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Harmless Asset Manager_3.8.0_x64-setup.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3132
- C:\Users\Admin\AppData\Local\Harmless Asset Manager\harmless-asset-manager.exe
  "C:\Users\Admin\AppData\Local\Harmless Asset Manager\harmless-asset-manager.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.8.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3104.3244.12229171422156323339
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x138,0x160,0x164,0x15c,0x16c,0x7ff8b930b078,0x7ff8b930b084,0x7ff8b930b090
      4⤵
      PID:3136
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1720,i,12474030064185909704,12008025198934570972,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
      4⤵
      PID:4596
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1352,i,12474030064185909704,12008025198934570972,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3
      4⤵
      PID:4216
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2336,i,12474030064185909704,12008025198934570972,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:8
      4⤵
      PID:4972
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3548,i,12474030064185909704,12008025198934570972,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:2484
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView" --webview-exe-name=harmless-asset-manager.exe --webview-exe-version=3.8.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4092,i,12474030064185909704,12008025198934570972,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:1
      4⤵
      PID:3144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://status.harmlesscreations.com/
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://status.harmlesscreations.com/
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ff8b631c188,0x7ff8b631c194,0x7ff8b631c1a0
        5⤵
        
        PID:2304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,4659324267158862107,14617075890365969010,524288 --field-trial-handle=2240,i,16393486299009533245,3147439824078909823,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:5152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,13474964492374268945,10841563583624857008,262144 --field-trial-handle=2240,i,16393486299009533245,3147439824078909823,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
        5⤵
        
        PID:5160
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,14801098078188968467,1730573179332838463,524288 --field-trial-handle=2240,i,16393486299009533245,3147439824078909823,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:8
        5⤵
        
        PID:5304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3368,i,9337812478712330670,14308922044947274869,2097152 --field-trial-handle=2240,i,16393486299009533245,3147439824078909823,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
        5⤵
        
        PID:5332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3372,i,8900752944296017771,17632318283659439652,2097152 --field-trial-handle=2240,i,16393486299009533245,3147439824078909823,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
        5⤵
        
        PID:5340
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,5552007211911727583,17439172112430837191,2097152 --field-trial-handle=2240,i,16393486299009533245,3147439824078909823,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
        5⤵
        
        PID:5432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,13456740160118366997,11499063820646283645,2097152 --field-trial-handle=2240,i,16393486299009533245,3147439824078909823,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:2
        5⤵
        
        PID:5440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,8278852851844526062,9131786963568053970,524288 --field-trial-handle=2240,i,16393486299009533245,3147439824078909823,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:8
        5⤵
        
        PID:5892
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3352,i,5102884884141856971,12352213496190780106,524288 --field-trial-handle=2240,i,16393486299009533245,3147439824078909823,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
        5⤵
        
        PID:6064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,17702919943720577358,2245544282818701415,524288 --field-trial-handle=2240,i,16393486299009533245,3147439824078909823,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
        5⤵
        
        PID:5788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,11242496955962878076,5691123601908934138,524288 --field-trial-handle=2240,i,16393486299009533245,3147439824078909823,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
        5⤵
        
        PID:5796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,1079291085897442456,10435829225217441253,524288 --field-trial-handle=2240,i,16393486299009533245,3147439824078909823,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
        5⤵
        
        PID:5232
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,1079291085897442456,10435829225217441253,524288 --field-trial-handle=2240,i,16393486299009533245,3147439824078909823,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
        5⤵
        
        PID:5292

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

harmless-asset-manager.exe

Path C:\Users\Admin\AppData\Local\Harmless Asset Manager\harmless-asset-manager.exe
Size 11.9MB
SHA256 ec23f530ddb783c446387176d9ce9f5940a2c6d92fb0d3df5def3d34e46d9316
MD5 0d1c0e4f1524e700c94bd75390bfd8a8
SHA1 c5421200362cbfeb97e03db2bb80989150e971d9
SHA512 fdf4df4ae785080d2837fcdfc624c2a970f227ef84ba16190a8ebdcc43d7ce8f7a88d7909cd82e0589b78aca36a2e33990461a57766d8d5f5f6fe945c25d6c12
SSDEEP 98304:f/iV854u2QoMajpH3YtWlf9X0959SRwvvmH8VmsDBHjwN7bAF40ETHT/BBSn+:f+uMtYkf9s5UicAFSTHT/BC
TLSH
T11BC67B43F38184E9D0AEC574C76B9B72BB32F88D4521735B1BE44A222E1AB905F1C7D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 965e5ede1dd95e7182bc6ed8b645e4796c53616af10fe7a02b411984e0f5fca1
MD5 252c38f22d645a5fc39fa9f1fdd92b34
SHA1 70c6079cc3ffdcb0efb6f56834b64311e1e951bc
SHA512 e23e1b164567d933593229d39744ddacb3330f715193f293c7aee9a5a95fc433809933ab830a7a1c5cdf37824965c32650c227083092c2a6488a2ab768744ad1
TLSH
T110D09B7077CDAC11D9450471D45547535D96CA4C24D7DB076011801D58567D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ac940a037c5d54e5c84b146a0dc3f421e18bbcbd80b3d0481e0b0c351d75d89
MD5 938ae7e19e787307f7aa2a307c936cd8
SHA1 699753ff3d3341987d0c525bf5471c1daae4a196
SHA512 d237d2d27fec7e6334e07c976f0d3ee86f319f690436b69bf4cff772a9d4d9d13ef1a408ca63e1a54cc828e06160aa690b311ffe0b867b5df1af2e5ac4a2e856
TLSH
T13DD0C030769CBCD1D0280070C02003015D998A8A20D397073000880D9C742C1B28A4A3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 98044ea7b4215f9527c7a7656125b40f4f212228009ee94cb4cdb4faa558155b
MD5 081cb5f0c6b6ec2d9638e8b54671ff9e
SHA1 64eb24f66bb711cc77f736a455826b27b10496f4
SHA512 1d1a6f3011a42854c546aec92d74ce807456590d2fccff61bbc12e4fe35e8e5bfd44eec86d550b3e53f0d27365b3506958189cc22c1b41831e7707a7b2bed050
SSDEEP 96:SxD6liRXJlTXrlNV8jcnhDZX+u7HORJGl:SBFT5McL+uyRk
TLSH
T1BCA15E9613BB4382FB213738C4DA0923BB334456197B4E73064CE1BD2A3AFB15716E58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe596bd0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596bd0.TMP
Size 3KB
SHA256 f35d17322d83ae2fd67a00342dff9134095e170e429c812e8093eede0ceafa68
MD5 a07d4e8399d7c4ee6c0432dbc3d92c18
SHA1 d408c01f5434aea2e2cf295f4d20d1e4f4c94ff2
SHA512 11111381e10ddb41824a9a769e9f10d8735c751ade04365f9bdaf26b0cb424bfac9407d3f298ceb3dd8375519633916e69099230353bd026edad5da336e77447
TLSH
T1FE61D52A02B35797F322363CD4E30A13F3738488197B8D77564405FE7A38B229729A6C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 004b8ba0a9a3b96aaacde5cc7f8aadcf8e0494de22e08efc18579f1c6572bc8d
MD5 1e1f43ff2f23e58db6d0aac245ebea8a
SHA1 7ad0478079204c8b47ad790df6cce67e1f6ac8d7
SHA512 03c689f8bf58e51ea971aa91ced8205e0ebe737d8c6698e92b86cdd48a06bc3b3cc9418ec726e972a14941ffef2d142a8e6d972fa69a25bdae7bb37ce4dd0124
SSDEEP 48:YXsuzEswS/a0JsR0ocsp0hsg0rse10Msq0M0sJ030IsXffoKsZ/CKstM0E09ZspG:mz3a5j8X81jVteuf2dp+6bER8n4xwQ
TLSH
T1B6817EFBC3E9967DCD469AF4DB196E2BCF6E0910932C3C0E85D89E1B93A24A1D10154F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4ce90bb735116f1aadd8be3dae5a17a8dbd14bc55e9883069952f3dcb403d05d
MD5 88171e7e9671090ee8b2dfef28f3ef12
SHA1 f2cbe028ecc731a2bd3543c18819cd25e013bb65
SHA512 9e03745695afc27c4ac8fa21931453ee31badcb1c64f2dff34d7861e54f838f6bdbb1d1358e1e2b019f1e4ae57998b677b4e72107df81f20f566849d92b8ef7b
SSDEEP 192:sxZgRMyM/jK1Ml8MZSB/f7sHWpV7PfEEdpHGHW6+WN5qbS5G/rI0IBR0TI/0yIgI:sxZge/w/f7sHWvbjmHb5ax/rxoI
TLSH
T18F52E942AB34597BCCDBD219FA51BB53D6F9446296900E84AEFCC91C01E6BEC6203C5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 01bdf19d57b1344f3cb91b41216a78d8b489cfdf4f882484400c3163c0890564
MD5 790ca58ab935bc3ebd4e71ee1b532472
SHA1 84790ad436c96d3e7b41dfab89582319e60cbfab
SHA512 08233c960b9761dff6c765ac54a43a753e064b385a1258a8aae087a4617f48d3e3ef7fb41d18604c4851fc2c1c5535d55f39f2949b5946b5d740c4891f7feccf
SSDEEP 768:pi4jeWmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfPLlrZ+dlrohccnafn:pi4jeWmWvmKLEu1jaAPLZQdelQ
TLSH
T1CFE2093B240CCB7E4F844E5CED2AAF976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f226bf9583bdcb020ab4465933317d3167d8437db76c0995fd265951c51cd726
MD5 def870e24909a98c119b419ed4dc2deb
SHA1 d0c9deb906fef910860988631117d3077563f3e6
SHA512 e26a1ae4441ca68d0e8a09b60638625a1c8bce0226c20d978e7e9a7c8fedf1653ecd1cfe2483754b596368c06b179e683e7c02df07083958a2bf43781a75036c
SSDEEP 192:EON+V6hZ0QmiUy6Mpc/+jV40+Fd9YDJ5wOZweU6:EONw6oupu+2/d9Yk2/U6
TLSH
T1CC02E835A8686C778EE2AE06F48737235FE4112BA9E56F84DAEC1B1D00D765C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 ca6df71bf51a44c6b13b2b3ab392e36441caf813cd1031e12d69286bbcc87421
MD5 4caa1f3fd032245229f3114c6c11b1fc
SHA1 e29524be3cb4eedee769862d8760adb3831d2ee4
SHA512 5265ce5e88330a09b159984c5fd7e619426eba397693ba97223aa6c0a60f3ffa972717fbfbd894a27b0e44f75a16a7378a489d47b289b90935aee9fbc820b756
SSDEEP 384:zMsNTzLV9RdDf+2/d9Y45rF1FAStiI1oAQu96MeAH:w2VZTbZkS2AQu9heAH
TLSH
T108821A70D8642DE748E2EEC5E147E5131EB8013BC9985E4CE6F97B3A309F5F96312816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ae6f3679d6879b13f3f635a3e98fadcd73986a76eefa6749755aa0b1f6590403
MD5 1a7eab760fa0835b43aea64b1cb77f18
SHA1 9bb64d8258d5e3196b839ac4126b6b3ab1e9c36d
SHA512 e5affebe6ac358d62be1d4db8b5c660276a6affb423a6ad627f05079bf52a6dbcfe0546a6876717528ed9585d8a1410c67c82431337df0522a67c084e2f7af0a
SSDEEP 192:mON26hZIPQmiUyhMscc/+jV40+Fd9YD804Ni5cOqPqNU6:mON26aDRu+2/d9Y45N9mU6
TLSH
T1E712EA31A868B86B5DD3B951F08736134EE4922BDEC57FC5E6EC5B1D00DF66C230A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

873566f5-00e2-464e-a83e-23fdf0713c27.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\873566f5-00e2-464e-a83e-23fdf0713c27.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bfaebabda130ba71b4a150ea266302ec3f437240d101cee8e45b6d6629b5f946
MD5 ab57c4254102d902cae2a4121fca916d
SHA1 29654c2bb8ff5601a560068bc7020fe477e8c4cd
SHA512 bbfc4235c0cd0bf9ac1b24df5cda582b93a9f92430ceea476928e4d39c7eef2a063f9cb3d2d8290d1ebd75728113be0e5f65c48d618fe67cd5c5c0bab98944f9
TLSH
T10D415BA8F6F92048B3777E1AABF3A46D487B79272F06D46D10010D4F0A62B00C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc8942.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsc8942.tmp\modern-wizard.bmp
Size 150KB
SHA256 514d8179f9014c612d1c5475e43cf97e1b656c9b607bb89e055388552aded24a
MD5 30bb7644d21019b16dfa6cc5be87d129
SHA1 c6ed96eeecfd243109a4dd8034586c2f4bc5c650
SHA512 05d3f506c2c607741f053ebd04b475c0971e30ce5bc825a0123c6200a5e950f9890a85744d1dba7400295fa5d82353324d0f478f3c14354470b118e63e467947
SSDEEP 3072:sLOP2PTTjOZGlkXCab/BCgK/4Lvz4ckMl+VAch/SkX:sLOP2PyZGlkXCab/BRvz4ckU+VAch/SE
TLSH
T112E3440A91BF901CED1FF4548E86678786408B5DAB9FEDD687DB052138EC23C71AD0E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc8942.tmp\nsDialogs.dll
Size 9KB
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc8942.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 3697d11bdbe1e34daa26b1e89d84276d9ff28148906943d0fe888354c3b13620
MD5 acde70f73d3b71b1c4222b763537780d
SHA1 b053b2e5fdb97257954c8f935d80964f056520ae
SHA512 598fc58a5f561e7995eccccb065faf2a2386bce0cfc4199fa95ba9fb74e9fcb291914676996c90728dd283223c2180de9fe073a4c936e60fbabe036d7e0a40de
SSDEEP 768:L8+c2MM0Hxd1fBTsRmMZdauVKAFKpnp0jdhK7R+qVQTxM:L8+DMfHPxAIMtXIVQTx
TLSH
T144F24A18FCC47EB6E6DF0570080D4A7E826FC8181B14CE9BD3A51EA2D5A63729EE501F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ec8104e2fc0d7420e2e4d51b7aaec64c82153bc60037e1b8442bfaca8366f5c9
MD5 4a674fe7d9103298099f90065b6301ec
SHA1 58b96ddacd36b9b700863374a1a78f0afa25a1b4
SHA512 bfdb2594352a898e47b382c88efbb4cde1f3a7656dacaa409feba2fa9daa84816bcc3a65514fba842e7536479c3b761bc283d35a425d3face9ea90a0222a0545
TLSH
T195D012267E424178C81020330652A10A1410DA2F80054140943C8A3D2F440501A06C41
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f35888c89b434cada56f7a342e514e5977be198bdcbd06853aeb769d4d0d5f6e
MD5 36f8a91149ca9d9cd5ed8de69a43d58b
SHA1 4777b00ef804f13c01a6e6dfd0c5eb7faaa81d55
SHA512 d453f5ff2514b011fbe6a515770b56590c3c83fc4e3491d49ceb789653c2d944978e67a936b4feca7427b55b0edd9f1483d3a78e2c375bb47e6f3bc3f4f6252a
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 a859119c4bf9605ceaa5133befa462817dab2996072e6aaf99eed128e3b8cde5
MD5 9788094751f7b0f671f67af115a35dd8
SHA1 9830db3a3383faa954a3ebbdfc3d0f3236acb6d9
SHA512 3c4c0b0a2cae579c1575bd893cad31bfcd1d21eb7ea627d6320621fac3437e7f846e86f74d196617b30f753aaa07ea0ea02a74e367a38cb5536f0e91798f1aaf
TLSH
T1F9B0125C28005441D10047B010E700E131300C421B235A810152F831BC107404301910
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5916ab.TMP

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5916ab.TMP
Size 48B
SHA256 559b089a6c5518a88b8f189fa1a1564ea8f344c4e95f15e7a46e0a8205ad11b2
MD5 72f3ed01d168377ab6eb33a86f4188d5
SHA1 69c4e434e755c5242fef3b826145135cf3ee0569
SHA512 4ebb918cf8084f66d15c1f8e4423a43802f1a211401b983b4224f7387686424354a654b6fee67dda1ee23d532e3a8229b7696e8019c3228b2ad706adc3aaf10a
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Preferences
Size 6KB
SHA256 4b582cb8fa003aeafad26ba020067bb9a13ad5301793d43906afb56774e4324b
MD5 2514f38da57d357d1ea8118bf144aad6
SHA1 8c7ac54a06333df82dd569aa17f40adbbb6c4d29
SHA512 c97d59650c7ee0c12f5718c10a9ef46ae3d2ccef4b71743516b819c7f0e01e416d4db8ae8ac398cfe749f25db2ef057a32f37f1ef71aabbb7ee2b20ff25547eb
SSDEEP 96:st8Q05FdoM8/b94trffu4Z8i0vhElTkt8Km/7qx+WVHMSm+uecJ86T46dMH9dQjk:stL03jf1Z8paEe/S+WiTHTTdWdyozdMC
TLSH
T1DCD1B902AF2869774CC7FA197E35FB12E2F5502265C10E94ABFDC61C05E66CC630B94B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe596160.TMP

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Preferences~RFe596160.TMP
Size 6KB
SHA256 3fddb8206a3baee3ebd63608dbef667190abb5af0140e124d01b6442748bac7b
MD5 045114d6f4588674fad0089b8b797d26
SHA1 320ee1c1b9e71f9cbcd0537487b0fd42d2bd0514
SHA512 ccd1c196bc284e35be8e015947b0366ec2bc0a98727fe0621ed7dd13c730e00f4048b7612fc9ff493fcbdbc761997ce595944afbff387f746bd42ce8866caaac
SSDEEP 96:st8Q05FdoM8/b94Sffu4Z8i0vhElTkt8Km/7qx+WVHMSm+uecJ8Q461idQj3X+gY:stL03Uf1Z8paEe/S+WiT97wdysdM8
TLSH
T17CD1C802AF6879774CC7E6197E35FB06E2FA602165D40E98EBFD851C08D56CC630B94B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State
Size 16KB
SHA256 a5b5c21a0fe88a1068eae9df0be194bc548804580d8357f61a4bd825e8a61573
MD5 9fdfac6e0da1ea35a6fc4cccaf0d1b0b
SHA1 f5baff9516417d731c876368184830977da9c03e
SHA512 cd977620b05e0e3f760308bffd5c89ad357db75fd5acb2c2605f85f2f290e5563e8a3f4ee53d021367755d759dae1beda2dc585d8c5259ba6d9a922ee77cfa95
SSDEEP 384:zS+aQikB+z/xvxjg/qhEwNbiIttay2UH9zE:p/UxvxjgC+sGy2UHFE
TLSH
T1D7729E2AA1787F2358F3E9047A5C0B4FDBB594A254816EB889FE5F0E03D73D81342C55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State
Size 1KB
SHA256 43426e35e082e45f3a097a381f35cff7f62abe6cc4ff8310e9e3c49074461f81
MD5 a6eb7ac5599e0a060afae4f4a3952102
SHA1 b879b424401a5681cd0d3b51adfe53fa14c20087
SHA512 9acd230b12a091502d8f4c8465e5e5c06871a757af6be2f2bbb972ebc53b87842ee3af109bd8d84cacbb743927259b9f28d80af3e51de3d4e0b72f4b9601f385
TLSH
T1B9316271E0582B335DD39A897256AB4B2E21A066D1409E84A0EF471A03F778C967DD72
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State
Size 2KB
SHA256 90005ccdf1236db834e37db5d172b19ac721821329a615a87b8afbe980484d65
MD5 bebac2c7b99d9a02d8efe84b869ed473
SHA1 f0974c3083ba1e42d8cc2d03d8247bd006cc418f
SHA512 f1c4c38a2754fc78642e89d0a84035ad919d30b668960747d7b20b7b4808e5fb9da86128182f1f8c32c904ee103566d9ddfa5010a45f043a92e48a3bac3ff703
TLSH
T14751D832F818AB374DE38E4479497F179E31A1A59A512FA094EE071E02E739C2356CB3
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State
Size 3KB
SHA256 567688d7a53079e3c03c30d82637a0e33f407a768b53b72c8f056673242c6519
MD5 acc22b9011c71618317cf02a291aa73a
SHA1 e737f2038beaf20a4d850c67fd2f3905e0387389
SHA512 e6c488679c79bd267aff9a6a554f94475184da2c74723037ea32a706d9afde24833477498e426bd2e1635ef7806273c12279dca538028d404f2f1d29df3582f6
TLSH
T14D719632F568A6274DF39E44B9852B0AB6616137E9853FA4D5ED0F0E02E73D81351C53
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58c290.TMP

Path C:\Users\Admin\AppData\Local\com.harmless.asset-manager\EBWebView\Local State~RFe58c290.TMP
Size 1KB
SHA256 f0664b5b248d0ffe0fc47fd6eaed965c47a65e6b76fd141ebb0bb14ee75c3475
MD5 0f31329dfe7fe5876b1bfc81b32e64bc
SHA1 d39b99a9fd444a79692701dc7c8a12a7d12bd845
SHA512 ba5b82084489ff15abeef05ffc97261b14c06800731e5d3ebb325b2255768c8e11a7e8210f941c6ad28b6b2bee1f2c3ed9063d447550ebac7eee50c25c2d181c
TLSH
T17E216572D0586B775DD39D88B152FB4F2D50A0B6A5049E48E0DF031A03F769C9779CB2
MD5 SHA1 SHA512 TLSH

Submit Download

Harmless Asset Manager.lnk

Path C:\Users\Admin\Desktop\Harmless Asset Manager.lnk
Size 1KB
SHA256 20dcbbb898dd426e6a98f2046323385ee2a5f18f58b2b7b2f2403467c9521a91
MD5 38e06cfb9180d9a35bc8c9cf89e6377b
SHA1 d588a0764c8d7c1dfb2d05e33fd6cdacd8e2f760
SHA512 734c0c42084b69432f145ff7ed008c6e0988a4ca151265919070bc9746a59608f4357e122b8788a1644ec03df821a1220ac209fa1c81fa7acbcd691b508e49ce
TLSH
T123217C419BCE1115F7BFED366ABB111696B1F826AE1ACE1D004083181D73A41DF69B2F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2484-183-0x00007FF8D5700000-0x00007FF8D5701000-memory.dmp

Download

memory/4596-81-0x00007FF8D5700000-0x00007FF8D5701000-memory.dmp

Download

memory/4972-153-0x00007FF8D65D0000-0x00007FF8D65D1000-memory.dmp

Download

memory/4972-154-0x00007FF8D6300000-0x00007FF8D6301000-memory.dmp

Download

memory/5292-641-0x0000022FF3600000-0x0000022FF39BB000-memory.dmp

Download