63ba1f892dbea1fcbe3d86c60d48ea795c2603be671cca1c10bc77dd5d1451c9

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 10.5MB
Sample260720-mfl79ahs7v
SHA256 63ba1f892dbea1fcbe3d86c60d48ea795c2603be671cca1c10bc77dd5d1451c9
MD5 1cb77f83372b6134b4cd641aebd28463
SHA1 9f32908a251712bc111aa4de33018313b0d07273
SHA512 bb68721f6b4b68475fa229b6049769e02144aa2c35e0d8483e67387b28696f4f9b903312731a5ca4f21018d4300ef312d92c757b5b4840c9e9cad4667df3f4f6
SSDEEP 98304:V80JQcJF7yrOQ95680B+NlpKh/MCHZIEa:VzLH8vtNlpKiia
TLSH
T1A1B64A43ECD955E8C0AEC27189B29562BB317C494F2027D72B60BA383F76BD0AD79750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4712	powershell.exe
4792	powershell.exe
4004	powershell.exe
3812	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
4884	asichub-monitor.exe
1056	asichub-monitor.exe
1140	asichub-monitor.exe
1176	asichub-monitor.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AsicHubMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\AsicHub Monitor\\asichub-monitor.exe\" --tray"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AsicHubMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\AsicHub Monitor\\asichub-monitor.exe\" --tray --startup --no-browser"	asichub-monitor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AsicHubMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\AsicHub Monitor\\asichub-monitor.exe\" --tray"	reg.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2732_930406425\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2732_2014985703\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2732_2014985703\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2732_1154179716\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2732_1154179716\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4692	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4992	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
4636	taskkill.exe
3512	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290166974113693"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{D23B1D1D-019D-4CE8-ABEF-37CD06E2802D}	msedge.exe

Modifies registry key 1 TTPs 13 IoCs

Modify Registry

T1112

pid	Process
1160	reg.exe
592	reg.exe
4836	reg.exe
2184	reg.exe
3084	reg.exe
1140	reg.exe
3780	reg.exe
5092	reg.exe
4528	reg.exe
2568	reg.exe
4152	reg.exe
2784	reg.exe
3436	reg.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4712	powershell.exe
4712	powershell.exe
4792	powershell.exe
4792	powershell.exe
4004	powershell.exe
4004	powershell.exe
3812	powershell.exe
3812	powershell.exe
3360	msedge.exe
3360	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4636	taskkill.exe
Token: SeDebugPrivilege	3512	taskkill.exe
Token: SeDebugPrivilege	4712	powershell.exe
Token: SeDebugPrivilege	4792	powershell.exe
Token: SeDebugPrivilege	4004	powershell.exe
Token: SeDebugPrivilege	3812	powershell.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4884	asichub-monitor.exe
2732	msedge.exe
2732	msedge.exe
4884	asichub-monitor.exe
1140	asichub-monitor.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4884	asichub-monitor.exe
4884	asichub-monitor.exe
1140	asichub-monitor.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 4636	1988	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	85
PID 1988 wrote to memory of 3512	1988	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	88
PID 1988 wrote to memory of 5092	1988	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	90
PID 1988 wrote to memory of 3436	1988	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	92
PID 1988 wrote to memory of 4712	1988	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	94
PID 4884 wrote to memory of 1160	4884	asichub-monitor.exe	98
PID 4884 wrote to memory of 592	4884	asichub-monitor.exe	100
PID 1988 wrote to memory of 4792	1988	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	102
PID 1988 wrote to memory of 4528	1988	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	104
PID 1988 wrote to memory of 4836	1988	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	106
PID 1988 wrote to memory of 2568	1988	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	138
PID 1988 wrote to memory of 2184	1988	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	110
PID 1988 wrote to memory of 3084	1988	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	112
PID 1988 wrote to memory of 1140	1988	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	114
PID 1988 wrote to memory of 4152	1988	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	116
PID 1988 wrote to memory of 2784	1988	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	118
PID 1988 wrote to memory of 4004	1988	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	120
PID 1988 wrote to memory of 3812	1988	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	123
PID 1988 wrote to memory of 3780	1988	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	125
PID 4884 wrote to memory of 3096	4884	asichub-monitor.exe	127
PID 3096 wrote to memory of 2732	3096	rundll32.exe	128
PID 2732 wrote to memory of 2096	2732	msedge.exe	129
PID 2732 wrote to memory of 1240	2732	msedge.exe	131
PID 2732 wrote to memory of 4992	2732	msedge.exe	132
PID 2732 wrote to memory of 1240	2732	msedge.exe	131
PID 2732 wrote to memory of 1240	2732	msedge.exe	131
PID 2732 wrote to memory of 4028	2732	msedge.exe	133
PID 2732 wrote to memory of 4028	2732	msedge.exe	133
PID 2732 wrote to memory of 1496	2732	msedge.exe	134
PID 2732 wrote to memory of 1496	2732	msedge.exe	134
PID 2732 wrote to memory of 3372	2732	msedge.exe	135
PID 2732 wrote to memory of 1496	2732	msedge.exe	134
PID 2732 wrote to memory of 3372	2732	msedge.exe	135
PID 2732 wrote to memory of 3372	2732	msedge.exe	135
PID 2732 wrote to memory of 2764	2732	msedge.exe	136
PID 2732 wrote to memory of 2764	2732	msedge.exe	136
PID 2732 wrote to memory of 2764	2732	msedge.exe	136
PID 2732 wrote to memory of 3076	2732	msedge.exe	137
PID 2732 wrote to memory of 3076	2732	msedge.exe	137
PID 2732 wrote to memory of 3076	2732	msedge.exe	137
PID 2732 wrote to memory of 2712	2732	msedge.exe	139
PID 2732 wrote to memory of 2712	2732	msedge.exe	139
PID 2732 wrote to memory of 376	2732	msedge.exe	140
PID 2732 wrote to memory of 376	2732	msedge.exe	140
PID 2732 wrote to memory of 2112	2732	msedge.exe	142
PID 2732 wrote to memory of 4344	2732	msedge.exe	143
PID 2732 wrote to memory of 2112	2732	msedge.exe	142
PID 2732 wrote to memory of 4344	2732	msedge.exe	143
PID 2732 wrote to memory of 2740	2732	msedge.exe	145
PID 2732 wrote to memory of 4020	2732	msedge.exe	146
PID 2732 wrote to memory of 4020	2732	msedge.exe	146
PID 2732 wrote to memory of 600	2732	msedge.exe	147
PID 2732 wrote to memory of 600	2732	msedge.exe	147
PID 2732 wrote to memory of 1964	2732	msedge.exe	148
PID 2732 wrote to memory of 1964	2732	msedge.exe	148
PID 2732 wrote to memory of 4428	2732	msedge.exe	149
PID 2732 wrote to memory of 4428	2732	msedge.exe	149
PID 2732 wrote to memory of 1860	2732	msedge.exe	150
PID 2732 wrote to memory of 1860	2732	msedge.exe	150
PID 1988 wrote to memory of 1056	1988	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	151
PID 4884 wrote to memory of 4692	4884	asichub-monitor.exe	152
PID 4692 wrote to memory of 1140	4692	cmd.exe	154
PID 1140 wrote to memory of 4928	1140	asichub-monitor.exe	156
PID 4928 wrote to memory of 1516	4928	rundll32.exe	158

C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\system32\taskkill.exe
  taskkill /IM asichub-monitor.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4636
- C:\Windows\system32\taskkill.exe
  taskkill /IM hubtech-monitor.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3512
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AsicHubMonitor /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe\" --tray" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:5092
- C:\Windows\system32\reg.exe
  reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v HubTechMonitor /f
  2⤵
  - Modifies registry key
  PID:3436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "$d=[Environment]::GetFolderPath('Programs');if([string]::IsNullOrWhiteSpace($d)){throw 'Pasta especial indisponivel'};$p=Join-Path $d 'AsicHub Monitor.lnk';$w=New-Object -ComObject WScript.Shell;$s=$w.CreateShortcut($p);$s.TargetPath='C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe';$s.Arguments='--tray';$s.WorkingDirectory='C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor';$s.IconLocation='C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe,0';$s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "$d=[Environment]::GetFolderPath('DesktopDirectory');if([string]::IsNullOrWhiteSpace($d)){throw 'Pasta especial indisponivel'};$p=Join-Path $d 'AsicHub Monitor.lnk';$w=New-Object -ComObject WScript.Shell;$s=$w.CreateShortcut($p);$s.TargetPath='C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe';$s.Arguments='--tray';$s.WorkingDirectory='C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor';$s.IconLocation='C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe,0';$s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4792
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AsicHubMonitor /v DisplayName /t REG_SZ /d "AsicHub Monitor" /f
  2⤵
  - Modifies registry key
  PID:4528
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AsicHubMonitor /v DisplayVersion /t REG_SZ /d 0.1.16 /f
  2⤵
  - Modifies registry key
  PID:4836
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AsicHubMonitor /v Publisher /t REG_SZ /d Rafatech /f
  2⤵
  - Modifies registry key
  PID:2568
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AsicHubMonitor /v DisplayIcon /t REG_SZ /d "C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe" /f
  2⤵
  - Modifies registry key
  PID:2184
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AsicHubMonitor /v InstallLocation /t REG_SZ /d "C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor" /f
  2⤵
  - Modifies registry key
  PID:3084
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AsicHubMonitor /v UninstallString /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\uninstall-asichub.exe\" --uninstall" /f
  2⤵
  - Modifies registry key
  PID:1140
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AsicHubMonitor /v NoModify /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:4152
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AsicHubMonitor /v NoRepair /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:2784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "$d=[Environment]::GetFolderPath('Programs');if(-not [string]::IsNullOrWhiteSpace($d)){Remove-Item -LiteralPath (Join-Path $d 'HubTech Monitor.lnk') -Force -ErrorAction SilentlyContinue}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "$d=[Environment]::GetFolderPath('DesktopDirectory');if(-not [string]::IsNullOrWhiteSpace($d)){Remove-Item -LiteralPath (Join-Path $d 'HubTech Monitor.lnk') -Force -ErrorAction SilentlyContinue}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3812
- C:\Windows\system32\reg.exe
  reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\HubTechMonitor /f
  2⤵
  - Modifies registry key
  PID:3780
- C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe
  "C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe" --tray
  2⤵
  - Executes dropped EXE
  PID:1056

C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe
"C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe" --tray
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AsicHubMonitor /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe\" --tray" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:1160
- C:\Windows\system32\reg.exe
  reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v HubTechMonitor /f
  2⤵
  - Modifies registry key
  PID:592
- C:\Windows\system32\rundll32.exe
  rundll32 url.dll,FileProtocolHandler http://127.0.0.1:8844
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://127.0.0.1:8844/
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffb2940c188,0x7ffb2940c194,0x7ffb2940c1a0
      4⤵
      PID:2096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,4783935120218510337,12153620407925133518,262144 --field-trial-handle=2924,i,10335294853501250935,15405265943059138555,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:2
      4⤵
      PID:1240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,15541283937128437782,7343890394860066143,524288 --field-trial-handle=2924,i,10335294853501250935,15405265943059138555,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:3
      4⤵
      System Time Discovery
      PID:4992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,1368178547811926078,294909684667450611,524288 --field-trial-handle=2924,i,10335294853501250935,15405265943059138555,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:8
      4⤵
      PID:4028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,4960052848353396991,17852785864030910405,2097152 --field-trial-handle=2924,i,10335294853501250935,15405265943059138555,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
      4⤵
      PID:1496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,15613507166023131300,3145632437799172455,2097152 --field-trial-handle=2924,i,10335294853501250935,15405265943059138555,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
      4⤵
      PID:3372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4072,i,383855548649189111,17605492635757593115,2097152 --field-trial-handle=2924,i,10335294853501250935,15405265943059138555,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:1
      4⤵
      PID:2764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4084,i,3120311327534683643,18435796463448722938,2097152 --field-trial-handle=2924,i,10335294853501250935,15405265943059138555,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:2
      4⤵
      PID:3076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,908219805062201594,9475300317042897258,524288 --field-trial-handle=2924,i,10335294853501250935,15405265943059138555,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:8
      4⤵
      PID:2712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,2032667199803143801,16321742112498827625,524288 --field-trial-handle=2924,i,10335294853501250935,15405265943059138555,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:8
      4⤵
      PID:376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,7410122046471099791,13571184124940986233,524288 --field-trial-handle=2924,i,10335294853501250935,15405265943059138555,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
      4⤵
      PID:2112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,726265801890823807,7162695479711653127,524288 --field-trial-handle=2924,i,10335294853501250935,15405265943059138555,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
      4⤵
      PID:4344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,5245388443611428651,803767614376434723,524288 --field-trial-handle=2924,i,10335294853501250935,15405265943059138555,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:8
      4⤵
      PID:1816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,5245388443611428651,803767614376434723,524288 --field-trial-handle=2924,i,10335294853501250935,15405265943059138555,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:8
      4⤵
      PID:2740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,10679173411263822296,15864158657022785158,524288 --field-trial-handle=2924,i,10335294853501250935,15405265943059138555,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
      4⤵
      PID:4020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,11796677505795861612,10006111840692289556,524288 --field-trial-handle=2924,i,10335294853501250935,15405265943059138555,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
      4⤵
      PID:600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,15743133036762898893,13710522598217532677,524288 --field-trial-handle=2924,i,10335294853501250935,15405265943059138555,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
      4⤵
      PID:1964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,17126567472942401101,14543365619906361285,524288 --field-trial-handle=2924,i,10335294853501250935,15405265943059138555,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
      4⤵
      PID:4428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,18439437753420916589,2547412100353194471,524288 --field-trial-handle=2924,i,10335294853501250935,15405265943059138555,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:8
      4⤵
      PID:1860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6464,i,16491087838418697254,16059917650018403208,2097152 --field-trial-handle=2924,i,10335294853501250935,15405265943059138555,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:1
      4⤵
      PID:3044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,5782833636374955640,4710719606769716512,524288 --field-trial-handle=2924,i,10335294853501250935,15405265943059138555,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:8
      4⤵
      PID:4872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4076,i,7219525139179075177,8863643790993846195,524288 --field-trial-handle=2924,i,10335294853501250935,15405265943059138555,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:8
      4⤵
      PID:5088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,7401076651327207447,1300431809608092788,524288 --field-trial-handle=2924,i,10335294853501250935,15405265943059138555,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:8
      4⤵
      PID:4248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,10968604838342070786,4484782109830421412,524288 --field-trial-handle=2924,i,10335294853501250935,15405265943059138555,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
      4⤵
      PID:1056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,3430668881531739422,2934690002943520570,524288 --field-trial-handle=2924,i,10335294853501250935,15405265943059138555,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:8
      4⤵
      PID:3176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,267155066137248703,14151372265281341418,524288 --field-trial-handle=2924,i,10335294853501250935,15405265943059138555,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:8
      4⤵
      PID:3744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,2830989697768281968,3681025565649167125,524288 --field-trial-handle=2924,i,10335294853501250935,15405265943059138555,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:8
      4⤵
      PID:5104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4444,i,7416526515262749356,12355159737622901762,262144 --field-trial-handle=2924,i,10335294853501250935,15405265943059138555,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /c C:\Users\Admin\AppData\Local\Temp\hubtech-update-100084936\apply-update.cmd
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe
    "C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe" --tray
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1140
  - - C:\Windows\system32\rundll32.exe
      rundll32 url.dll,FileProtocolHandler http://127.0.0.1:8844
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://127.0.0.1:8844/
        5⤵
        
        PID:1516

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3464

C:\Windows\system32\BackgroundTaskHost.exe
"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
1⤵
PID:2568

C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe
"C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe" --tray --startup --no-browser
1⤵
- Executes dropped EXE
PID:1176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2732_1154179716\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2732_2014985703\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2732_930406425\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

asichub.ico

Path C:\Users\Admin\AppData\Local\AsicHub\asichub.ico
Size 66KB
SHA256 ef0327555ff3656bce5479242a7928c1ae54c9a1b0834ca86427daed51f45b31
MD5 52276986ac7de4171fd8f0f8a94bab46
SHA1 46552a0c3d5fc964688cd7803a685cc66c1aa2ab
SHA512 75dd3410f8d1ea1ef7692ee93d611204135c86ddbe5d11fd44d465d51dc81abd377276d39de072d273b4dd965e741619b45eaccc3a0dcdb9829af26a4231a57c
SSDEEP 768:BwnrmTraxoYVWP8RGD/2EoVf0TwihutFfRcIC:BwMa2YIIU+E2fdiEfRcIC
TLSH
T17063780A3DD9A145E5035271AD44F2B2D368BD5CF67D8B8B72A17E7B31ECF9AB000188
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 1022ec2fed08ff473817fc53893e192a8e33e6a16f3d2c8cb6fd37f49c938e1e
MD5 223bd4ae02766ddc32e6145fd1a29301
SHA1 900cfd6526d7e33fb4039a1cc2790ea049bc2c5b
SHA512 648cd3f8a89a18128d2b1bf960835e087a74cdbc783dbfcc712b3cb9e3a2e4f715e534ba2ef81d89af8f60d4882f6859373248c875ceb26ad0922e891f2e74cc
TLSH
T10A610E323375B1D4C9567F072E2819C053BF8396EA94AF5CB29C621ED92641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f7c6819e9d5f370be9c21f74e80570988112d37f626df5fb2efece59294f020d
MD5 45f2143cd5cc687a34b557fa3074ba47
SHA1 53c068ba1e3180f36f5e35c608e5a89e4e37b06c
SHA512 0c07a97bba8b1fb8add078ec728247f8aa1e5e60823b7c6c001de75f048729c63723a3cf2ab1d9ea82c68fabe2898ad5c32d72c9ae6a4201a1aadaab4e8b228c
TLSH
T17A61716B0245EBB7D328C931D3F12555BCB180150A2B1F735280867DDF31BE7B16650C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590575.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590575.TMP
Size 3KB
SHA256 6025ac9d5f71e86e23c342eaa4c86386deb7310c5e7f7bd289329a7dd99142d8
MD5 c4cc1d2b7950638fc7fe6d09db40c107
SHA1 493f4d4429ec30075d4424ee0648eeb5a11722e2
SHA512 8a26e593d335a3ff7beaa730ddc8b15d5743f9cd180b70b209d5c0a475b191ae6f95edb7ce0cbccd138ed48edac0f56764d1a8f9075043a96b96586b4faaeb51
TLSH
T1D561715B0256EBB7D329C930D3F12505BCB281160A2B1F7352818A7DDF31BE7B56620C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f2c3d109b4cd0e6709574691d6f03a48c31d9a79070dd3e7c3c83c1067a9c57f
MD5 2376548b1826b46b5038601f9b2daba9
SHA1 ce9678cb6690dd035643b4b2f857213e73f85b0f
SHA512 3b795fa6dd9c185fe8e4b514df35ab400328694124ed28458149a18b4913a01fa487a82b5d4bbba5dc1ad003c06eeaa66341e0652746419f3f609b189a535769
TLSH
T1A551B3F3C3E9856E891156F0BA186E2BCE6D0515432C3D5AC8E4EF5F93F2471D24164E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3b314e4b82a0e85e59c8cd8070513b738112d10f62dae4a024e1b70196a8ae10
MD5 82933d06c674d9ff78a1fed4c5a770ac
SHA1 4af0b3131d77c0f4070eee2015c2a26264f3d530
SHA512 7489ea2e979cb8e00eb77118b55d5911f01fb22318fc429f402a41656fbd44613b8ae9fb8cd0bca6fea453301ab5df4a83f634e9142011899b37577b4b36885b
SSDEEP 192:sxZlRwyM/jK1Ml8MiD/fqs9lxJA1MQIdpdtHW6+WNw2G1/Y4SrqaVIg4J:sxZliqD/fqs9lxJ3x/Hbwt/Sc
TLSH
T11952E616AA34997BCCDBD209BA547B53D6F40473E6900D449AFCCA1C00E6BED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c152b7f8199fa0696d205b09c604b616d28c8f6685101cf23c22eaed64915b24
MD5 ef59aefc2c504c04902d12b850fc2b6a
SHA1 1dc38dc2f05dd8c07af1e7398f4d1246c58c7817
SHA512 804714db828277440ec4a286ae5db68b33342b6846a5dd8977c2a73ce828b242ae9f0d9db83acccbf8b63dc2c973692c53465b9aa765672d4a0f1ff5e5589c09
SSDEEP 192:sxZYRwyM/jK1Ml8MjD/fqslblxJA1+IdpdMHW6+WNw2DIfY4/rqaVIg5ParJ:sxZYi7D/fqsdlxJgmHbwpfXBa9
TLSH
T11A52D716AA34597BCCDBD209BA557F53D6F50473A6A00D44AAFCCA1C04E6BED231382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a1c58532bb7c299d5d6883364783fac8f78a9113b896f65cd31b1dd4b5f44eae
MD5 7ba3cbec65a86a9b32b2d6e67a3c081f
SHA1 69cf1604de2a40ef6e36f0287bc095b026df7ef1
SHA512 d4db7d76fac5aabf3cf8f2bb447cb489b375a6044e3936a930b5a600197183b1541ee2b6e8ce76f76bcd7b1a9acefb1bf63dcca5b4d0f6cd52ea4d524aeffd4c
SSDEEP 192:sxZYRwyM/jK1Ml8UQ7jD/fqslblBJA1+IdpTMHW6+WNw2DIfY4W8qaVIg5harJ:sxZYiqvD/fqsdlBJg4HbwpfBHa9
TLSH
T15E62D716AA3459B7CCDBD609B9557F93E6F4047296A00E44AAFCCE1C00E6BDD231382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 917d634bb24db70723e65d16f58235004dad3fe37d3fdc846f97fce5fde737d5
MD5 3f913926c855854faca433bc6f0a9905
SHA1 39dd0e021ef17614dbaee5cdd2bbf40430b520ee
SHA512 56d173e3c96bcbd391d2084c57db6f2c83843d32d99f384513b07f5bc2db4e73b429646dbf82969dc85437472a790c69e757fe1bd65a61dbcf33d088ff0b572a
SSDEEP 768:ZV8iJxs7pLuLfxNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtzhALl6opd2roh:ZV8iJxQEfxNWvx76ru1ja4zhALocdN5H
TLSH
T17BF2EB3B6C0CCB7E4F804E9CEC2A6E9A6DE801CF5A98895447FA841C03C66EF55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f2417e2bc30c714acc217d29d2f8617561e675b6f3dd6c8aa57ae4517cdccd77
MD5 2470c8c31c400cee7adbbe036268670e
SHA1 a4cc3f5039b24555bc9ee53494919ab3653155c2
SHA512 45592f15f9b68a38f3fed31d593217c1a08c55211f2b6d29b9f2cc136dc2faa74c7b3325b722aedf0c824d77a976dbd0a1ace5194f9a54d9c5d93089bc9b931f
SSDEEP 24:KdeXKmfeXKJeXK6eXK7aeXKodeXKceXKIeXKk4eXKceXKo+eXKPIjeXK+eXKkKik:KwfIlKoK6IfKTiELyp4IXKRGcZOIHK/p
TLSH
T1B891F70271FB42263C3D251CA36587278B817AA3301CE42B77B958B50E6AE345DFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe596c5c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe596c5c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 7a742befcf42f07acb84660568bfa655a4f8476ac83e0d0d8eff31dfa0bb8ab8
MD5 3153053753b8d1f79d497f0bebbfbb68
SHA1 4811f9bd52f9e39414915cafa510fbbbd3814181
SHA512 d94c5b5d313f90a0b2194d23bdfd7f2c06f64e1da9e46bd99964b087603859d62b51d6f60c5322e8d1ac2f65b0a2a42b5a221c65985cfa5a51126448ade231d4
SSDEEP 192:uuibsNO5TIQKNPBNmVsQmiU19uI4k03bb9zUNEjbLIdqjIU8:ncsNOqjvky+3kqbFUi81U8
TLSH
T18D4229716878AC3B9DE3A545F4873753AFA810B7CBC51F94D6E89B1C04C729C270B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 52853dfcf5451b22c29be0ef03b67bd61bd28436c6c44f716b0ee5f3f80c144e
MD5 fbc745fda7fe420c99dc9fe3bf511c1a
SHA1 ea69ffbc22a6f7f22dfbaca689c8ef6052807c9d
SHA512 0d738612a6662710b8474042ce64f5188456535383e6e0a7d449a359e221c3e9e185ad62b44241402a10cae0a71865d8917693246b666f4c1a981fbe29cff8c8
SSDEEP 96:ZqONkxQsjpfmUTmDK5ih/cIPURHl8h4otop5C5DUBhPwivh50xy0SFYK4AxYYCbg:gONZ6kDfQmiUycYZ903bb9XQiiCCU6
TLSH
T1B602F835A8786CBB8EA3AE49F48777275FA8117BEBD42F84D9E81B1C00D765C1302436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 8bb009fddc0f6d3728d10b600ee09a546f26b16f5884c8d0000dc5f9f5e418bc
MD5 dc0ba56e433ea3c3854f0028c1cecd22
SHA1 a3a85dcae0138ff17519d11bf1b51b349ea53683
SHA512 dd90a452a05fd24e39d84e0f5e404d10019d74aff3c9dd6243d9de3ae5404d63bafa23e8c89c58a77e9c5c7bf9476201607b3e7d9701dd5b728bae4a317c78e1
SSDEEP 192:uuiLsNO5TIQKNPBNmVKQmiU19uI4k03bb9zUNEjbLIdqjIU8:nQsNOqjvkA+3kqbFUi81U8
TLSH
T1CF4229716878AC3B9DD7A545F4473753AFA810B7CBC51F94D6E89B1C04C729C270B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 04c4b63d4ffb374e9dcb05ce18996fa386f23c7852394902b5525423c3553ffa
MD5 364b994aac91838d921509837a48074f
SHA1 11718cf57e19b46c5871c33e8988e95d21bc920d
SHA512 edcccd18e73989d69caa8e02eb1db6b6559999541b02b843d72a693557403f1258021a441b26392f37192c130dc416202a71f85d8eb4744be232ed2f36f97b7f
SSDEEP 384:ncsNOAjvkyR42kqbFUi81OObjI9G6w74f:cav34ab8129Mu
TLSH
T146727C7168799C378D93A526F08B3763AFB810BBCBD91F88E6D99F0C09C729C1706416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ba210defd18b98e3865b91a86f375376a0e6dcf8565bd1bbb80938953c68c5be
MD5 1a3bf736b7107fb6f1f12974210fe90f
SHA1 a584dcf40397aa1204273d4e32eee4a9440cb281
SHA512 fd724d6ed814b2cb46aea839530df1133293befbe421bbd3f754e6d28eb79fdf4cf3abc332533f9e22a24923260c519fe4982d210eaadca7789a21569f25b62b
SSDEEP 384:nGtNn/s3n9SXsNOiIjvkyR42kqbFUi81OObjI9G6w74u:Gj+9IwMv34ab8129M9
TLSH
T1FD929D7168299D378D93A566F48B376BAFB810BBCBC51F88E5E89F0C04C369C1B12516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 12258dd97e7a81a4b4f874ca58bc998caff6a59a3e78998f72877eb0b9343159
MD5 f39021f8e4f25afeafaab8b95a64c93c
SHA1 956a1fbe45e360c07fb1f6d415592ab97b3c30f5
SHA512 33fcb68519ed49f81b2d3da4253b1760bcc263f9740ad68d15286a15db8cb50cdd34917a714ebc500851c66ef1772ef2bfeb4c38b529820dbef2f1c9be7bf8c5
SSDEEP 192:/ONn6knQmiUygYF903bb9zUNEj3cRdqjIU6:/ONn6A4F9qbFUis1U6
TLSH
T15612167164A9AC6B9D93A905B08737A35FA8207BDF856F85E5E45B1C04C73882B0B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 80ecbc60c3f9ee9f9b84c53a78cb24291fa9dc94ad9993501dc51139fe212b91
MD5 18124fb014f2dcdeb2bc494166db5b5b
SHA1 4cc0ced842e94e8c6c5bb47f0bd15af48b7f5388
SHA512 f33f2d9311d3db45659085ac370635f4c71bbf3c2c2a10d313ed4d3c18b67db7203eda907afb4a04543562bb4bc04ff01449730ca4466d3c9a4326841c5e535d
SSDEEP 384:n1iF1tNn/s3n9SvDsNe8TUNTUlIliIjvkyv420DfcdqbFUiT1OObjI9G6w74u:8F1j+9YjwgkMvh4wcbT129M9
TLSH
T14FD2B3F598D78A37D89E4783A73E6E569EBCC067B5884A84F7C45E4CCC821BFC606805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

e24614c8-ac4d-47e3-b385-6601f50e4800.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e24614c8-ac4d-47e3-b385-6601f50e4800.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a2dbf756f43ed15cf61c54ae0c2fdaf3bd47e540baf96065de8be2dc1ec986ec
MD5 c25f9c75e7496cdc1b2cfd316812d7b6
SHA1 df0679e5a7e25749864e8e3d480860690cd6330c
SHA512 30dc00ec9d92553fb1cae588d98ca296180601e9feb7380f4a23ef61c658de17a98430dcb79693fcea99c49f2a18c35fc5990d2925c633c82946a77277c001c4
TLSH
T17541EC58ABF91148B3766F5A9BF6A86D487E7C772E06D45D00110D4F0633B41C872737
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e050f40c3ba1f8b1f56d5ba3e29b8e8cca3bacb7c738208fe5eda3dbdb9bcde7
MD5 ba44ca5ff117382eb173d5e507ad6ab5
SHA1 1c5247b524d30d0f49d497acc91b9a95cd8c43c6
SHA512 e7dca0ffb78996093ce4542527337e4ba38bdf7f82d9cb3623825606d8143907b6d183f7e4c6ff52b0bcd50e5cf191a4bc5fe5123f0b4b597dad36e0a3009e96
TLSH
T10121A827B3DC8921CC86163A109D9C1172B283C7809ECF9FAFC0D600A07F598CB31294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 54b8636f970908bf4f36d8db1af07e73a493c9423a67aad0806737f49297a02b
MD5 c15aebf2b4c8b24eae2ff87622d00f0c
SHA1 bd029551cc24b2cfb556c4bb4452a654665e82d8
SHA512 d1fbc4378aff78624501fe50128f6b57e0ea3edcee053f5821b06f87a468618a065adf106b4c92fdb0e2e3063b3db12263f86eff681fcbe5e2292f74692319ef
TLSH
T1A5215627B39C8961DC86163A109D9C1176A783C7809EDFDF6BC0D614A1BF598CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 3a3525fe306f1939e767eb79c1a81dd798f566fa75f33d41a669e8a635c824b2
MD5 1937c627875d42a0e3b95b95b9000da8
SHA1 ba6a8660cfdcd0897b73b431846c3b612bc734ab
SHA512 f221e4513b76763f8a082548f7ca93651ef29f8cdd794e2a1c1744b592aea1e05aa7d9d47bfd0ffdc67430a09b2ce9cbfb053084866ae10fea1f2db12128b672
MD5 SHA1 SHA512

Submit Download

asichub-monitor.exe

Path C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe
Size 8.0MB
SHA256 e7ef477980f02a0ffb5c3793524bdeac80af7d6f4f0f10106a6e0ccb306968ef
MD5 81fb4185c1c87f7e61fffde9413d53f6
SHA1 c830880ae0d38030d9988a4f4d5da621dc035138
SHA512 9ade7264634750e5f0010d3c2d1d764d73492fea69ab50cae2f3a0b9f0314f885e8679d2283d3069159abea1983c46d745ef552cf943cf43e18ce23fbd693dba
SSDEEP 49152:+7lIkiT6hpMdjzQwXY4nGlMEXhCnX6A8QuHx83qjg0ee1AMOF2uKpSKOlHLMVW+K:+7yrOQ95680B+NlpKh/MCHZIEa
TLSH
T125864A43ECD955E8C1ADC17189B29522FB327C494B2127D72BA0FA243F36BD0ADB9354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66ba2f66-07c8-4c77-9b4d-729ad5d2f6d7.tmp

Path C:\Users\Admin\AppData\Local\Temp\66ba2f66-07c8-4c77-9b4d-729ad5d2f6d7.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_s4v2qqe2.jxp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s4v2qqe2.jxp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

b0a19f56-889a-4ba1-ade1-554144b28aed.tmp

Path C:\Users\Admin\AppData\Local\Temp\b0a19f56-889a-4ba1-ade1-554144b28aed.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

apply-update.cmd

Path C:\Users\Admin\AppData\Local\Temp\hubtech-update-100084936\apply-update.cmd
Size 408B
SHA256 c77350cef730b5a5d8f867e15e3ca7f8b2689f037c3e8a547178b24ddcf3dab6
MD5 57086646b630a42757eaeee3bf21b569
SHA1 4ae681e07d92975845eab98b38cfe0b04a31fe15
SHA512 f9127b980b57f84ec7c8ced3584034e3c420dc98a970209900aba608155a9ea29dbb8dbffd6de220a80499aae74bae489e92d45cc3d04f4d2a2f2ab27201f696
TLSH
T141E02B870866961600B53C67DEF6674FE2E63C89BF5D77C15280D01C0707D08DBC6651
MD5 SHA1 SHA512 TLSH

Submit Download

asichub-monitor.exe

Path C:\Users\Admin\AppData\Local\Temp\hubtech-update-100084936\asichub-monitor.exe
Size 11.4MB
SHA256 8edb28dd8e57933c43c903d3862137c35c1c914bed0821ecf2eebbcde54e924c
MD5 f4fb2ccf94c43cb7a4eccee64e244f6d
SHA1 b65dd5c735fc7ff5aaa850792d9614ebadea808e
SHA512 a250ec2f9ab300e11011008033ca497049f0f2d2457f59d46c42a0789116435a68642c0d3939d20b4665d1b798c4bae8bee6ffb8ac8c77577aceb76b2f3e5800
SSDEEP 98304:IhVQvBtp7tLn+voqwG4YRB8PpX3sEuZZEl3sOkvbhz4J3IE1YjvkhWerr2W:IAdqwG0+C8O2tz4rkkoer/
TLSH
T114C67C03EC6555E9C1ADD27089B29262BB717C494B3227D72B90BB383F76BD0AD79304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2732_1095375276\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7324f696-05fa-401c-81d9-d60e09fed467.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2732_872242625\7324f696-05fa-401c-81d9-d60e09fed467.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

remote-sync.log

Path C:\Users\Admin\AppData\Roaming\AsicHub\remote-sync.log
Size 518B
SHA256 7e94bfa17a639a70e959c61f93c65215ad57cd1715eb6d9342b4f62b3d4531b1
MD5 321496282103de8c070cb56236726e99
SHA1 95a40c9e5525254a79cc81ab62c865c494e3a161
SHA512 d5e59032204b7e0a6decbba90214c8a6eb9c7cf4c359c3af24c67df4159ef316374f17d81293fd3cb5c2b3209750b655dc35716161936db8e0fb001f1fc3d76a
TLSH
T140F0598E01BAE97C1FF1A424C049B50DA582B4218CCD00D0ABD00B20C3CFE53AD95CD9
MD5 SHA1 SHA512 TLSH

Submit Download

secrets.bin

Path C:\Users\Admin\AppData\Roaming\AsicHub\secrets.bin
Size 390B
SHA256 0a8ce56f3475f066838d848142ae72053f78d44950f9da1f877a9b7d6adc7bd1
MD5 d9cdc2900d8a32e1d7f5bccf9cb0ab76
SHA1 399d2f1fc955de39bcada084da31e729e743ce0a
SHA512 b262ea3199385924f01bcdd31344a248dd5900a97b42290feed125328ac195878240c2164d99da75601cfbed61604894dd4e8db04f56898305a78b362927e0dc
TLSH
T171E0F1010501115BD4400FB00D6B76DC91A719EC57A2C1D4D2C6319339D7D28AFBE769
MD5 SHA1 SHA512 TLSH

Submit Download

secrets.bin

Path C:\Users\Admin\AppData\Roaming\AsicHub\secrets.bin
Size 390B
SHA256 b0bc049c972f5eb93450ff3586a35a652680b94244c94f4152f6056fe9f614c4
MD5 2ec8a59319447f48c605b049798b7b61
SHA1 337bef9cf32118b665342fc4cd4506ccd2645a0c
SHA512 7b64aa2fdabe79e576cdc74fc899f3f45d00193707220780dd66fabd40efefb036d90cc900ed7e07bfa9c0bc0410f6ff451d3ab517a788ee50d49271af207fbe
TLSH
T15DE0681AAB1B01E7C56C52796C974FA6109F783A6B5482C98C91049531B71424624927
MD5 SHA1 SHA512 TLSH

Submit Download

state.json

Path C:\Users\Admin\AppData\Roaming\AsicHub\state.json
Size 82B
SHA256 efa0ac980579d325d1f73e5bd3e100c1362cecb1f4767c69a1b7e90e84a092aa
MD5 6db8812cba13eafc8df9be9629f2293d
SHA1 386a068c07d0f8d35f02fdad8476af331bdb7a57
SHA512 5d49b68fcd17c91c779f1ca4cd737e28217ab4f234e84615f84e4ec13e498db31d1868d34e4281806a62319b3f2b8dc83330c7a829aecb54743a3e876ed14714
TLSH
T19EA01120C2A80CB20CF002028028A3822830C82A088C883EA0AF00A88B2820A20300A0
MD5 SHA1 SHA512 TLSH

Submit Download

state.json

Path C:\Users\Admin\AppData\Roaming\AsicHub\state.json
Size 525B
SHA256 50d63ea4f6392159aba3f2b85cfecae303af8dec3acd3a471643b094089ce461
MD5 53f5480e11f13b115c680711de8292e2
SHA1 bb9e2a63af1358211e226c813da0b5981e646c4c
SHA512 c211cc07bcc915cbec9e64c766c67799df66ab53c8a75609e6bda95c65f522dfab4bc62d18b3bc431929b4c0f89fe38b240b2bff7ed04f96a690be601b77fb80
TLSH
T191F05953C6691CB34AF0358D85EE7242912189274C8A7C0DB37D818C0F6CF5F64F815D
MD5 SHA1 SHA512 TLSH

Submit Download

AsicHub Monitor.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AsicHub Monitor.lnk
Size 2KB
SHA256 6d49a468f3cf25ce7d3bed30afd88da5ea62c6d28b8089aa97a7d124c7116066
MD5 56ea3cb1490108bfdb09f636d0f1dc30
SHA1 f11a941ee2288c8da8e1a182a720e9b6a6b7e1e3
SHA512 6a637e522cc9cf89175eda7a2673a453aa3ab088c3b0c6eb3062aec88acc7b64e7d8128097c62ed0fb0e765615a96f7d12729cc6c8c980b2a5a3d9e4c849e620
TLSH
T1DF41DF0696F32729E3FAE57586A726B19973B8D0FF159F09000983491F31E408E74F2B
MD5 SHA1 SHA512 TLSH

Submit Download

AsicHub Monitor.lnk

Path C:\Users\Admin\Desktop\AsicHub Monitor.lnk
Size 2KB
SHA256 769aef7d0093e215ef80bffc2b46538f0882b6d77cfc976b8505ed20f71c6afc
MD5 1ca3cebfe58264b39b69ceb554026f49
SHA1 8fe1d062316ab4eafb19f8e7a280ab119285f1b7
SHA512 09fd3eb7b46b53323878ed715e8dae006d920cadedfbd468d18100e5861c7d3813bbe26842cc600bb6677b9cdbe28c354dc95e5f61993e1f1088df2cbd7c70c0
TLSH
T16C41E10296F31629E3FBE57586A716B59A76B8D0BF115E0A0009D34D1F31E40CFB4B2B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4004-49-0x00000183CF580000-0x00000183CF79C000-memory.dmp

Download

memory/4712-7-0x0000022631790000-0x00000226317A0000-memory.dmp

Download

memory/4712-13-0x00000226194C0000-0x00000226194E2000-memory.dmp

Download

memory/4712-6-0x0000022631790000-0x00000226317A0000-memory.dmp

Download