63ba1f892dbea1fcbe3d86c60d48ea795c2603be671cca1c10bc77dd5d1451c9

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 10.5MB
Sample260720-mfl79ahs7v
SHA256 63ba1f892dbea1fcbe3d86c60d48ea795c2603be671cca1c10bc77dd5d1451c9
MD5 1cb77f83372b6134b4cd641aebd28463
SHA1 9f32908a251712bc111aa4de33018313b0d07273
SHA512 bb68721f6b4b68475fa229b6049769e02144aa2c35e0d8483e67387b28696f4f9b903312731a5ca4f21018d4300ef312d92c757b5b4840c9e9cad4667df3f4f6
SSDEEP 98304:V80JQcJF7yrOQ95680B+NlpKh/MCHZIEa:VzLH8vtNlpKiia
TLSH
T1A1B64A43ECD955E8C0AEC27189B29562BB317C494F2027D72B60BA383F76BD0AD79750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3644	powershell.exe
1844	powershell.exe
3312	powershell.exe
1304	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
5660	asichub-monitor.exe
2076	asichub-monitor.exe
5916	asichub-monitor.exe
4856	asichub-monitor.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\AsicHubMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\AsicHub Monitor\\asichub-monitor.exe\" --tray --startup --no-browser"	asichub-monitor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\AsicHubMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\AsicHub Monitor\\asichub-monitor.exe\" --tray --startup --no-browser"	asichub-monitor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\AsicHubMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\AsicHub Monitor\\asichub-monitor.exe\" --tray"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\AsicHubMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\AsicHub Monitor\\asichub-monitor.exe\" --tray"	reg.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5476_153795528\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5476_153795528\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5476_153795528\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5476_592995388\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5476_153795528\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5476_1822400870\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5476_592995388\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5476_1381847067\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5476_1381847067\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
896	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2796	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
4420	taskkill.exe
932	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290167047262513"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{A99E43C1-082D-4D3F-BEC8-19965A470554}	msedge.exe

Modifies registry key 1 TTPs 13 IoCs

Modify Registry

T1112

pid	Process
2448	reg.exe
1376	reg.exe
4796	reg.exe
624	reg.exe
4708	reg.exe
2244	reg.exe
3820	reg.exe
4732	reg.exe
4680	reg.exe
4748	reg.exe
4492	reg.exe
1468	reg.exe
1424	reg.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3644	powershell.exe
3644	powershell.exe
3644	powershell.exe
1844	powershell.exe
1844	powershell.exe
3312	powershell.exe
3312	powershell.exe
1304	powershell.exe
1304	powershell.exe
1200	msedge.exe
1200	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	932	taskkill.exe
Token: SeDebugPrivilege	4420	taskkill.exe
Token: SeDebugPrivilege	3644	powershell.exe
Token: SeDebugPrivilege	1844	powershell.exe
Token: SeDebugPrivilege	3312	powershell.exe
Token: SeDebugPrivilege	1304	powershell.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2076	asichub-monitor.exe
5476	msedge.exe
2076	asichub-monitor.exe
5916	asichub-monitor.exe
4856	asichub-monitor.exe
4856	asichub-monitor.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
2076	asichub-monitor.exe
2076	asichub-monitor.exe
5916	asichub-monitor.exe
4856	asichub-monitor.exe
4856	asichub-monitor.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5648 wrote to memory of 932	5648	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 5648 wrote to memory of 4420	5648	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	92
PID 5648 wrote to memory of 4796	5648	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	94
PID 5648 wrote to memory of 4680	5648	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96
PID 5648 wrote to memory of 3644	5648	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	98
PID 5648 wrote to memory of 1844	5648	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	102
PID 5648 wrote to memory of 3820	5648	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	104
PID 5648 wrote to memory of 2244	5648	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	106
PID 5648 wrote to memory of 4708	5648	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	108
PID 5648 wrote to memory of 1424	5648	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	110
PID 5648 wrote to memory of 1468	5648	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	112
PID 5648 wrote to memory of 4748	5648	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	114
PID 5648 wrote to memory of 4492	5648	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	116
PID 5648 wrote to memory of 624	5648	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	118
PID 5648 wrote to memory of 3312	5648	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	120
PID 5648 wrote to memory of 1304	5648	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	122
PID 5648 wrote to memory of 2448	5648	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	124
PID 5648 wrote to memory of 2076	5648	2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	127
PID 2076 wrote to memory of 4732	2076	asichub-monitor.exe	128
PID 2076 wrote to memory of 1376	2076	asichub-monitor.exe	130
PID 2076 wrote to memory of 5224	2076	asichub-monitor.exe	132
PID 5224 wrote to memory of 5476	5224	rundll32.exe	133
PID 5476 wrote to memory of 4168	5476	msedge.exe	134
PID 5476 wrote to memory of 616	5476	msedge.exe	136
PID 5476 wrote to memory of 2796	5476	msedge.exe	137
PID 5476 wrote to memory of 616	5476	msedge.exe	136
PID 5476 wrote to memory of 616	5476	msedge.exe	136
PID 5476 wrote to memory of 2016	5476	msedge.exe	138
PID 5476 wrote to memory of 2016	5476	msedge.exe	138
PID 5476 wrote to memory of 5868	5476	msedge.exe	153
PID 5476 wrote to memory of 2508	5476	msedge.exe	140
PID 5476 wrote to memory of 5868	5476	msedge.exe	153
PID 5476 wrote to memory of 5868	5476	msedge.exe	153
PID 5476 wrote to memory of 2508	5476	msedge.exe	140
PID 5476 wrote to memory of 2508	5476	msedge.exe	140
PID 5476 wrote to memory of 4356	5476	msedge.exe	141
PID 5476 wrote to memory of 2548	5476	msedge.exe	142
PID 5476 wrote to memory of 4356	5476	msedge.exe	141
PID 5476 wrote to memory of 4356	5476	msedge.exe	141
PID 5476 wrote to memory of 2548	5476	msedge.exe	142
PID 5476 wrote to memory of 2548	5476	msedge.exe	142
PID 5476 wrote to memory of 5828	5476	msedge.exe	143
PID 5476 wrote to memory of 5828	5476	msedge.exe	143
PID 5476 wrote to memory of 1972	5476	msedge.exe	145
PID 5476 wrote to memory of 824	5476	msedge.exe	146
PID 5476 wrote to memory of 1972	5476	msedge.exe	145
PID 5476 wrote to memory of 824	5476	msedge.exe	146
PID 5476 wrote to memory of 1328	5476	msedge.exe	148
PID 5476 wrote to memory of 3000	5476	msedge.exe	151
PID 5476 wrote to memory of 3000	5476	msedge.exe	151
PID 5476 wrote to memory of 3564	5476	msedge.exe	152
PID 5476 wrote to memory of 3564	5476	msedge.exe	152
PID 2076 wrote to memory of 896	2076	asichub-monitor.exe	154
PID 896 wrote to memory of 5916	896	cmd.exe	156
PID 5916 wrote to memory of 2384	5916	asichub-monitor.exe	157
PID 2384 wrote to memory of 1984	2384	rundll32.exe	158
PID 5476 wrote to memory of 4408	5476	msedge.exe	159
PID 5476 wrote to memory of 4408	5476	msedge.exe	159
PID 5476 wrote to memory of 4408	5476	msedge.exe	159
PID 5476 wrote to memory of 3112	5476	msedge.exe	162
PID 5476 wrote to memory of 3324	5476	msedge.exe	163
PID 5476 wrote to memory of 5808	5476	msedge.exe	164
PID 5476 wrote to memory of 3664	5476	msedge.exe	165
PID 5476 wrote to memory of 3664	5476	msedge.exe	165

C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_1cb77f83372b6134b4cd641aebd28463_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5648
- C:\Windows\system32\taskkill.exe
  taskkill /IM asichub-monitor.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:932
- C:\Windows\system32\taskkill.exe
  taskkill /IM hubtech-monitor.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4420
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AsicHubMonitor /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe\" --tray" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:4796
- C:\Windows\system32\reg.exe
  reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v HubTechMonitor /f
  2⤵
  - Modifies registry key
  PID:4680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "$d=[Environment]::GetFolderPath('Programs');if([string]::IsNullOrWhiteSpace($d)){throw 'Pasta especial indisponivel'};$p=Join-Path $d 'AsicHub Monitor.lnk';$w=New-Object -ComObject WScript.Shell;$s=$w.CreateShortcut($p);$s.TargetPath='C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe';$s.Arguments='--tray';$s.WorkingDirectory='C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor';$s.IconLocation='C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe,0';$s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "$d=[Environment]::GetFolderPath('DesktopDirectory');if([string]::IsNullOrWhiteSpace($d)){throw 'Pasta especial indisponivel'};$p=Join-Path $d 'AsicHub Monitor.lnk';$w=New-Object -ComObject WScript.Shell;$s=$w.CreateShortcut($p);$s.TargetPath='C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe';$s.Arguments='--tray';$s.WorkingDirectory='C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor';$s.IconLocation='C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe,0';$s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1844
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AsicHubMonitor /v DisplayName /t REG_SZ /d "AsicHub Monitor" /f
  2⤵
  - Modifies registry key
  PID:3820
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AsicHubMonitor /v DisplayVersion /t REG_SZ /d 0.1.16 /f
  2⤵
  - Modifies registry key
  PID:2244
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AsicHubMonitor /v Publisher /t REG_SZ /d Rafatech /f
  2⤵
  - Modifies registry key
  PID:4708
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AsicHubMonitor /v DisplayIcon /t REG_SZ /d "C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe" /f
  2⤵
  - Modifies registry key
  PID:1424
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AsicHubMonitor /v InstallLocation /t REG_SZ /d "C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor" /f
  2⤵
  - Modifies registry key
  PID:1468
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AsicHubMonitor /v UninstallString /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\uninstall-asichub.exe\" --uninstall" /f
  2⤵
  - Modifies registry key
  PID:4748
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AsicHubMonitor /v NoModify /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:4492
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AsicHubMonitor /v NoRepair /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "$d=[Environment]::GetFolderPath('Programs');if(-not [string]::IsNullOrWhiteSpace($d)){Remove-Item -LiteralPath (Join-Path $d 'HubTech Monitor.lnk') -Force -ErrorAction SilentlyContinue}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "$d=[Environment]::GetFolderPath('DesktopDirectory');if(-not [string]::IsNullOrWhiteSpace($d)){Remove-Item -LiteralPath (Join-Path $d 'HubTech Monitor.lnk') -Force -ErrorAction SilentlyContinue}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1304
- C:\Windows\system32\reg.exe
  reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\HubTechMonitor /f
  2⤵
  - Modifies registry key
  PID:2448
- C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe
  "C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe" --tray
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AsicHubMonitor /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe\" --tray" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:4732
- - C:\Windows\system32\reg.exe
    reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v HubTechMonitor /f
    3⤵
    - Modifies registry key
    PID:1376
- - C:\Windows\system32\rundll32.exe
    rundll32 url.dll,FileProtocolHandler http://127.0.0.1:8844
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://127.0.0.1:8844/
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5476
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x368,0x7ffd1e07c188,0x7ffd1e07c194,0x7ffd1e07c1a0
        5⤵
        
        PID:4168
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,6155877987756233872,7259781680634552861,262144 --field-trial-handle=2412,i,18292556388862746493,15464305073652675566,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:2
        5⤵
        
        PID:616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,12709507123426399197,14871881493019880290,524288 --field-trial-handle=2412,i,18292556388862746493,15464305073652675566,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,9062337492296881483,5145382273460143219,524288 --field-trial-handle=2412,i,18292556388862746493,15464305073652675566,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:13
        5⤵
        
        PID:2016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,10272115038807156344,810061050077363339,2097152 --field-trial-handle=2412,i,18292556388862746493,15464305073652675566,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
        5⤵
        
        PID:5868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,13994737019052852813,2009146091397226473,2097152 --field-trial-handle=2412,i,18292556388862746493,15464305073652675566,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
        5⤵
        
        PID:2508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,1637466219950574505,7938986758862199885,2097152 --field-trial-handle=2412,i,18292556388862746493,15464305073652675566,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:1
        5⤵
        
        PID:4356
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,4687486910240506997,3101421317225427296,2097152 --field-trial-handle=2412,i,18292556388862746493,15464305073652675566,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:9
        5⤵
        
        PID:2548
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,4149004146043409943,16756163994420012040,524288 --field-trial-handle=2412,i,18292556388862746493,15464305073652675566,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
        5⤵
        
        PID:5828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,1301731175381005321,8025766330305342964,524288 --field-trial-handle=2412,i,18292556388862746493,15464305073652675566,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
        5⤵
        
        PID:1972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,12272060333297468974,13741891264636394946,524288 --field-trial-handle=2412,i,18292556388862746493,15464305073652675566,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
        5⤵
        
        PID:824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,14210605765946203011,5176071177389996579,524288 --field-trial-handle=2412,i,18292556388862746493,15464305073652675566,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
        5⤵
        
        PID:2800
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,14210605765946203011,5176071177389996579,524288 --field-trial-handle=2412,i,18292556388862746493,15464305073652675566,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
        5⤵
        
        PID:1328
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,4389788549220728979,7171826453611416152,524288 --field-trial-handle=2412,i,18292556388862746493,15464305073652675566,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
        5⤵
        
        PID:3000
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,9379183185181555979,8733224531209367792,524288 --field-trial-handle=2412,i,18292556388862746493,15464305073652675566,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:14
        5⤵
        
        PID:3564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6208,i,8146170195166781442,5324717777024983566,2097152 --field-trial-handle=2412,i,18292556388862746493,15464305073652675566,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:1
        5⤵
        
        PID:4408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6952,i,13834082875896441461,2747972041010733758,524288 --field-trial-handle=2412,i,18292556388862746493,15464305073652675566,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
        5⤵
        
        PID:3112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,5199591973976376437,17666659516523181402,524288 --field-trial-handle=2412,i,18292556388862746493,15464305073652675566,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
        5⤵
        
        PID:3324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,15758679787057143082,6228652576979039049,524288 --field-trial-handle=2412,i,18292556388862746493,15464305073652675566,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:14
        5⤵
        
        PID:5808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4732,i,4919050665731629715,1147265597418307869,524288 --field-trial-handle=2412,i,18292556388862746493,15464305073652675566,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
        5⤵
        
        PID:3664
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,17168858235932274024,460780243593407466,524288 --field-trial-handle=2412,i,18292556388862746493,15464305073652675566,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
        5⤵
        
        PID:5604
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,2347306126001110404,838796126151000945,524288 --field-trial-handle=2412,i,18292556388862746493,15464305073652675566,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:14
        5⤵
        
        PID:1532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,1301934525902628202,11900998007498057662,524288 --field-trial-handle=2412,i,18292556388862746493,15464305073652675566,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
        5⤵
        
        PID:1064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6708,i,17293084881687342213,6413216949015204844,262144 --field-trial-handle=2412,i,18292556388862746493,15464305073652675566,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,6853509101889223471,18377191969410241650,524288 --field-trial-handle=2412,i,18292556388862746493,15464305073652675566,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
        5⤵
        
        PID:948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /c C:\Users\Admin\AppData\Local\Temp\hubtech-update-493820448\apply-update.cmd
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:896
  - - C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe
      "C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe" --tray
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:5916
    - - C:\Windows\system32\rundll32.exe
        
        rundll32 url.dll,FileProtocolHandler http://127.0.0.1:8844
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2384
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://127.0.0.1:8844/
        6⤵
        
        PID:1984

C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe
"C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe" --tray
1⤵
- Executes dropped EXE
PID:5660

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1712

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv UAQGmPX1AEuizB10sJcTjw.0.2
1⤵
PID:5868

C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe
"C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe" --tray --startup --no-browser
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

asichub.ico

Path C:\Users\Admin\AppData\Local\AsicHub\asichub.ico
Size 66KB
SHA256 ef0327555ff3656bce5479242a7928c1ae54c9a1b0834ca86427daed51f45b31
MD5 52276986ac7de4171fd8f0f8a94bab46
SHA1 46552a0c3d5fc964688cd7803a685cc66c1aa2ab
SHA512 75dd3410f8d1ea1ef7692ee93d611204135c86ddbe5d11fd44d465d51dc81abd377276d39de072d273b4dd965e741619b45eaccc3a0dcdb9829af26a4231a57c
SSDEEP 768:BwnrmTraxoYVWP8RGD/2EoVf0TwihutFfRcIC:BwMa2YIIU+E2fdiEfRcIC
TLSH
T17063780A3DD9A145E5035271AD44F2B2D368BD5CF67D8B8B72A17E7B31ECF9AB000188
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

9a823e4a-b668-4020-aa29-b6cfceb083eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9a823e4a-b668-4020-aa29-b6cfceb083eb.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 10b649ba0c1c474de59c85745cbcadc764bdeea7b406490d0ef6ed1d3c241289
MD5 95d0d55935433e0b20105cdac4b8336f
SHA1 4a37ca1e653e0211711db2e0435b77ea643b957b
SHA512 229bd5d8d8b2b2bf3fdaf6686dc54a012d236cf78b05e7e136a714acc9fc33fd27d056c7cfe883769579de1c3b6c7aaf73a194905a30d7090e377032ad55e83b
TLSH
T1A0410F58837CDFCDEBA40971BCF0C6943ABE98DE0707EE50D4945BBC4A06B840991193
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a2aca.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a2aca.TMP
Size 2KB
SHA256 653fa91e918592ef5688a03b6dd65d649fed48c8cfae70bd79ae8b10708f32d5
MD5 41c6faf55a6f9bfb1c7baa764d5ddc66
SHA1 2d859854727bb9de227e292dfb126a67a92944bd
SHA512 deb977c1ca19d58d3e2cf00df8bbafb922065b40e8281898a7f89fe69bbf1ba6b185ee5cd300df3662e05b62891d071e43a511333365857ad5355d816f287519
TLSH
T117411E5C833CDFCDDBA409B1BCF0D6843ABED8CE0307AE50D4A41BBC4A06B844991193
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 8f86f79c64fa25d2887d525ecfaf5dbe58de1b877088e18e528ca4c388d0d455
MD5 f69c57336bb0cb2b34d7c1c3cc895fa4
SHA1 8f635489fb5ef2b36381db490566b24a289cdaaf
SHA512 3cd2523e5441b3c8253bf0ce25fcf80cc7b493016790b3c8688e29b07a564762e3804fa7482adb92882cb7fd1e08e45f1181333251b7d6f930ba3e3a37aa5ddd
TLSH
T10461D2F7C3E8856E891155F0AB186F1BCE2D0515432C3D5AC8E4EF6BA3E2471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8b0c8bca52e5aa58a1e652b2361a3dece1ad7ec46ef5c6dd73a56729f9e620be
MD5 af1bb0c420fe986786eecf242e75412b
SHA1 51ff75b34d7bd13ecf0caa543298b4505cdf4844
SHA512 d8edb7495300c7cd3fa94872a93eb1d7b46f744f052de450ef2b5f91764dad341d3d46249f3f15d6c54d9e435fc935c855b5e004c2006ec31b32299954af4ee5
SSDEEP 192:sxRWRxyM/jK1Ml8wCz/fcsgluprQ5jZzoA8p+T/g6+WNu2v0/Ynt3haGXIgV/J:sxRWL8z/fcsgluCkQ/5up/cRRX
TLSH
T18A62DA166A749D7B8CDBD20DFA557F53D6F81573A2901E44AAFC8E1C00E6ADD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d45ab9969668476a58e4fc76e6e40e24db86880ea5c5f4a2767da7ac1b7ad126
MD5 89c4846ee712500e66d637f788969e38
SHA1 26b27d47b8bec85485f6d00b8bfb1624142dcd9e
SHA512 3f5d952d5bbfa7abd261aa669fbe0863416f29aae5427ac975e51f77d0c1c9d92d2534d51b40b052986b3db96cef23371657af63ae6de737c22fe3beed32bcbb
SSDEEP 192:sxR4RxyM/jK1Ml8wCz/fcsUluprQ5yzoA8p+Z/g6+WNu2CYfYnA3haGXIgD5a6/J:sxR4L8z/fcsUluA2/5u4fFRRtau
TLSH
T15C62D91A6A345D7B8CDBD209FA557F53D6F81473A2901E44AAFC8F1C00E66DC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 36ca04c0cd0100f13bc151e458ae48316057682d33e5131c2defbeac7e5e8e28
MD5 2fe5ada6581a2263bdfee12e7ba65087
SHA1 5bd70d170b8a9cb21ded119865b3e37c44a84a11
SHA512 cc33f1b60836692d77e9abd4b6b9254d32e5b2e16ad2f2f76b2d2bf7d6d732a549534ce92d9cb17b83818c5aa282a121372956128078ffb6696ff34e6dbf51e9
SSDEEP 768:wGedvg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OV2nOu4YxroSz8oH:wGedvsE7X6WgoufDMu1jaFnOVYKPw
TLSH
T132E2EB3B680CCB7E4F804EDCEC29BE9F6DA801CB5AD8895447EA840C03C57EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 18b80420f790cbfb04167aa755802cfc83fd062313a9edff93bd6cb887c7e398
MD5 1f8f4fc1a5e14e9d2ba22d027a317bbc
SHA1 2d9041b3d82e1ad332982b8f7d79509fdb26df70
SHA512 c9bd656853f5c1a378de0a4071ada5c9efe409860aa834a87f47a168ab54a744927db1ab66e2cd581a708274a0cf9fb4d5926e709eb60b5d62edf7b7197a4c6b
SSDEEP 96:KRwBUAyeSIWWLbgIIK4Ng6Icoob6AFHjsJ9rhhdW18qgjbK4igtbcx50HPoHpm39:CwBUAyeSfWLkIMNg6noob6AFHjsJ9rhh
TLSH
T1FD91D355317E02403C7EAA0581F9991EA3D174E23558B42F77E902E64F6AF038EFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a8bc6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a8bc6.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4f0bbee90e85e1bd5d5495a2f34cf12875aeaa348fd78e60377c1bb7e576908f
MD5 144ab50c4023e5c08343089eba9cbbd2
SHA1 f64e12ef4caafd67c2ce9acdd1dcb62514bb9ed5
SHA512 9376c89a48691bb806519e8cdeb6c1bb13edab2e7ae7b02a80aa517bb4731930aeb705ddafd739065f6709b3a4eeb75fef46308e8441572c4c8d07984aca4293
SSDEEP 768:6rv+4UNbds3FPDZIO0W/Nzc4ReyIsXaeVH1S5D:6bsbS3ltc44bsqEH1Y
TLSH
T1C803CF32E8788977ACF66785B50B76533EF8912782981B90C9DE2F0C4A4B1DD131F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 fb297e5b48485af9e9606871cd18a8015e870608819b8ebeb3455f2df7b7c3a4
MD5 5cdd93251e59d0f7d3af11b67cb3626d
SHA1 45b923b1d122a7507cc393dd86542dc7ddf82195
SHA512 5fde90cee9e87386061db4cd422b07d2708a8aa0536c3b6833547403b91b3db303212acdd3c1cbe1cd253aaa3e803d28d11931da88479a475bcd662a9ab432d3
SSDEEP 768:kj+9z3qXvDZIO0WhTiNzc4ReyIsPErb9ML:z9z3gitc44bsEb+L
TLSH
T1DFF2BF31F829CD639CEA5795B6173692BEF0117B81C92E48DADD5F0C09832DD0B6B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 3be05fccce090b76c325fe229807af9f8f0a4e871a71cf4cf2de1adadde19188
MD5 5d8d120da86468046a83d29faf2e3281
SHA1 872730cac87598a55a54c6237dcd37567dee1222
SHA512 1117425abe3c9eac8260a74b948b0f0b9bc382b019235b439a4f0ed120077adad5d6ec30bf25dbe5e0554abb4c6edcf25e2c8bc51fb0da260f353013bd125f02
SSDEEP 768:3rv+4UNbdt3jevDZIO0WhTTNzc4ReyIsPErb9ML:3bsbX34Ttc44bsEb+L
TLSH
T1F013BF31F828CE739CBA6695B50B35937EF4216B81C91A84DAD95F4C09471DE1B2F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 3cb6eba903792e655ea24d06da0ba507c6a0892ece5b6562ff45001aa64ca5cc
MD5 19c2f6c842c7231e68515399b693cbc1
SHA1 3f3357bac48e1af670d0ef0094628529be78c91f
SHA512 b20038801460c93fb45a8c1624bde97918a5452c26a574ab6f8e39f042cbb4917ff60b0a8ccd4f88011dc8d96cc956e8be94c238b09a79ab3cf0be311de24501
SSDEEP 768:AF1j+90S3hwgnLRYZ15O0WhTWNzc4ReyIsPErb9ML:N90S3rWtc44bsEb+L
TLSH
T1C91317F598D78937D8AE4787A73D2D42ADFCC167B1885984BB885E4CCC821BFC70A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 37c8fc52428d867a1065ac3cedb72ef0645b0a3df302615ac178de350d38f0d6
MD5 ee3308a21be5a59d65de73a385ee498e
SHA1 78b4aef1c2038ea006df7d17c735870936e4033c
SHA512 dec9cffee76bb7da8e6f3cfec9cf47b90d4c3beb57b51c7f31ada0cf4b6ca6165654c4b98db83a31e1fefd35b6cd00c2c970e6b3afe45122ee05640c88a215f8
SSDEEP 768:1j+9z3laRJDZIO0WhTiNzc4ReyIsPErb9ML:A9z3Witc44bsEb+L
TLSH
T1FAF2BF31F829CD639CEA5795B6173692BEF0117B81C92E48DADD5F0C098329D0B6B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

aadfa0ee-6b9f-43bd-a7eb-79308bc0bf3d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\aadfa0ee-6b9f-43bd-a7eb-79308bc0bf3d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0dbeac57026f179d26709feb2ae9e5f39eb66f4120447493b2158f76d3a6b541
MD5 ee8e631f54619583131c3deb7e5eea4a
SHA1 66a0262eb498de6e91c8f2a061edcb336a53cf47
SHA512 bc69913890f94bee57fbae9667d5f950939e2c1706df129ebd907e164e3d85347a0bf5936ae334088fd8071111b6593c4916f9da34dd1a95f33fa8dc6689aeb9
TLSH
T11E218933B3CC8664CC8A413A50CEAC0032B7C7DB409EDFEBBB84D545A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 83a0f6577e2b3a7e6bf374340fa4af3aaf1c8b6aaf253edc831b9c6e7ab14fb9
MD5 3b08940c1585f11f6b77eb2726b18423
SHA1 85ea08da528d9cf341fdba287a632baf34d26f7c
SHA512 e7e2a414a3b70ad203376e6f86d1bb82bd83f7766ec9a29642dc6f9caf7b3c735d2f3506d6bcb39990719b570b5fa5f5f9b0e9c33939bdf936fb7c8aa115aabc
TLSH
T185215633B3DC8664D88A413A50CEAC1032B7C7DB809ECFEBBB84D555A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

asichub-monitor.exe

Path C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe
Size 8.0MB
SHA256 e7ef477980f02a0ffb5c3793524bdeac80af7d6f4f0f10106a6e0ccb306968ef
MD5 81fb4185c1c87f7e61fffde9413d53f6
SHA1 c830880ae0d38030d9988a4f4d5da621dc035138
SHA512 9ade7264634750e5f0010d3c2d1d764d73492fea69ab50cae2f3a0b9f0314f885e8679d2283d3069159abea1983c46d745ef552cf943cf43e18ce23fbd693dba
SSDEEP 49152:+7lIkiT6hpMdjzQwXY4nGlMEXhCnX6A8QuHx83qjg0ee1AMOF2uKpSKOlHLMVW+K:+7yrOQ95680B+NlpKh/MCHZIEa
TLSH
T125864A43ECD955E8C1ADC17189B29522FB327C494B2127D72BA0FA243F36BD0ADB9354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_cmuybnk0.eit.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cmuybnk0.eit.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

apply-update.cmd

Path C:\Users\Admin\AppData\Local\Temp\hubtech-update-493820448\apply-update.cmd
Size 408B
SHA256 3abd60936568fe826ce67af2e3881efe3a66825f4c23a27d6052a0832c615e41
MD5 79076130e52a4593184651c744b26682
SHA1 77afe97d0af986d7c5ea2705ddaf0bc545bd4e52
SHA512 9344e611b111fb046b8ef54857578cb782d650d69013f054b41280fdc0ef8a8b9db338c4edbb68f57f47bbc0f19c99b1588d061f38ac2cc784c2913ba8e0ca12
TLSH
T16FE02B870866A61600B57C67DEF6638BE2E53C89BF5D77C15240E05C0707E089BC6651
MD5 SHA1 SHA512 TLSH

Submit Download

asichub-monitor.exe

Path C:\Users\Admin\AppData\Local\Temp\hubtech-update-493820448\asichub-monitor.exe
Size 11.4MB
SHA256 8edb28dd8e57933c43c903d3862137c35c1c914bed0821ecf2eebbcde54e924c
MD5 f4fb2ccf94c43cb7a4eccee64e244f6d
SHA1 b65dd5c735fc7ff5aaa850792d9614ebadea808e
SHA512 a250ec2f9ab300e11011008033ca497049f0f2d2457f59d46c42a0789116435a68642c0d3939d20b4665d1b798c4bae8bee6ffb8ac8c77577aceb76b2f3e5800
SSDEEP 98304:IhVQvBtp7tLn+voqwG4YRB8PpX3sEuZZEl3sOkvbhz4J3IE1YjvkhWerr2W:IAdqwG0+C8O2tz4rkkoer/
TLSH
T114C67C03EC6555E9C1ADD27089B29262BB717C494B3227D72B90BB383F76BD0AD79304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5476_1191756357\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

remote-sync.log

Path C:\Users\Admin\AppData\Roaming\AsicHub\remote-sync.log
Size 518B
SHA256 0719891781f8bab3d28a81a2966b600af3861e4d7694241b079f11df8eef4d78
MD5 f1123a543f92c0ae453081a440cb9b2a
SHA1 4718877170c1a398f6fad8fef98f977222514168
SHA512 654dfcfdf2fcbd8aba1001e9e76006ec80d64c5004b753cd4b531bb5866f3c2d89f08d0872cbdda6f2d94d9d7c6bd11d4a818abce5333df14419aa71c1b54a16
TLSH
T197F0B4C901F59A780BA5E138C046BA4DB596BA21CCD800E0EBD10A68C7DD9868D95E9D
MD5 SHA1 SHA512 TLSH

Submit Download

remote-sync.log

Path C:\Users\Admin\AppData\Roaming\AsicHub\remote-sync.log
Size 777B
SHA256 630b30d0f7dd7ab982a645fa08a26048b684c68bccc62bb20ce6f88aa45f38e3
MD5 12bab1574974def79fbdd075f3d7b16d
SHA1 c6f0defe60288b8c7c3bb6a17f473dae46b19f56
SHA512 0cee49ad1ea5b0ba452e99cacb810f8c43a7d7b21a1603888536d525d5f651e9ad1664806125c42c6e039ebb3d620ebda52f66072b6a69b67bf7aa4694712871
TLSH
T13E0126C801F59A7C0FA4E128C046BA0EA596BA21CCC800A0EBD10B68C78D9869999D9D
MD5 SHA1 SHA512 TLSH

Submit Download

secrets.bin

Path C:\Users\Admin\AppData\Roaming\AsicHub\secrets.bin
Size 390B
SHA256 699bf88e3c66d98eac8d5ee81b9e3ee94c228fd6f05feef0d864634974a3fdbd
MD5 d02bc9dd6cad37c901728a22029de380
SHA1 e48dfdbfe460760ab148456907ed3b31a5a0d217
SHA512 1f30e171dc6488f3cb743a49615b6706d2d6d4f74ceec506cb0887dc9b27cfb9e5c53a9d879d1c2fc76ba4b0bd96962110eb5f68483ef672fc6215bb8a919bc5
TLSH
T1B6E0F18A8440044EE2184939D7CF0C45678B78CFB2A7754A854040529782BE02B58065
MD5 SHA1 SHA512 TLSH

Submit Download

secrets.bin

Path C:\Users\Admin\AppData\Roaming\AsicHub\secrets.bin
Size 390B
SHA256 80aba9d960de87f39885dcfddd4f78da395b4b25e00f0977b660924f2149ef3f
MD5 541074c427ae3c883d7895cd96e56ede
SHA1 d8ea8867a4d974e885f53ac6e2f0d0b3b3ec993f
SHA512 85c9b3658fa80f46717d0fd52645cfa6bf000de87688b852e2307c94a224d319d96759c55c6e80a2a5e71742ca6be052b330e3e7afda57e8bf09102c15adeb8e
TLSH
T1E8E0681CA4421883F61A8B77248A66D6B5C6C4E0A0ABB3070C03A2937A31DB10E28E52
MD5 SHA1 SHA512 TLSH

Submit Download

secrets.bin

Path C:\Users\Admin\AppData\Roaming\AsicHub\secrets.bin
Size 390B
SHA256 c53be140ca5953fd95f9b1c0ab278ad4254c3032f2e15ef1abb0f6699e1516a8
MD5 09c9ff260dc6e9e65adbae99e55c45f4
SHA1 b75475dd47ed0ee1206c90355e81462b0f6ceb2b
SHA512 0f1b217964adaffa08801ce60d9850b2b809526c6d8c552560399e8a45d0767c0d436fb062aeb290c49b0098d6ceab19173550fb2dbe869522b2726a03ecaa18
TLSH
T1A5E0AB858AA1C481E106013E94670B9A52A90EA86E6AA2E82AC7D421F4E0B518675D27
MD5 SHA1 SHA512 TLSH

Submit Download

state.json

Path C:\Users\Admin\AppData\Roaming\AsicHub\state.json
Size 82B
SHA256 efa0ac980579d325d1f73e5bd3e100c1362cecb1f4767c69a1b7e90e84a092aa
MD5 6db8812cba13eafc8df9be9629f2293d
SHA1 386a068c07d0f8d35f02fdad8476af331bdb7a57
SHA512 5d49b68fcd17c91c779f1ca4cd737e28217ab4f234e84615f84e4ec13e498db31d1868d34e4281806a62319b3f2b8dc83330c7a829aecb54743a3e876ed14714
TLSH
T19EA01120C2A80CB20CF002028028A3822830C82A088C883EA0AF00A88B2820A20300A0
MD5 SHA1 SHA512 TLSH

Submit Download

state.json

Path C:\Users\Admin\AppData\Roaming\AsicHub\state.json
Size 525B
SHA256 50d63ea4f6392159aba3f2b85cfecae303af8dec3acd3a471643b094089ce461
MD5 53f5480e11f13b115c680711de8292e2
SHA1 bb9e2a63af1358211e226c813da0b5981e646c4c
SHA512 c211cc07bcc915cbec9e64c766c67799df66ab53c8a75609e6bda95c65f522dfab4bc62d18b3bc431929b4c0f89fe38b240b2bff7ed04f96a690be601b77fb80
TLSH
T191F05953C6691CB34AF0358D85EE7242912189274C8A7C0DB37D818C0F6CF5F64F815D
MD5 SHA1 SHA512 TLSH

Submit Download

AsicHub Monitor.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AsicHub Monitor.lnk
Size 2KB
SHA256 27c0e9905138a7e630714311fb0a7a311521e5778f2be762096150042691c86d
MD5 b8dbf0bc9864d8956ea83ff6af32c4ea
SHA1 28a2fe3dbaaf788da45c342d6432a0990342c25b
SHA512 73b3bda1428b435601554b59df44019c7766e860a0326d1f3824efa122799099bfa05338238143268811ec715a8291d48ab50bb1cfbf5c42b36c2d76c346e171
TLSH
T1DD41C0065AF61B29E3FA9A7147A629744677F895BF268E0D0005D34A0F30E80DE64F2B
MD5 SHA1 SHA512 TLSH

Submit Download

AsicHub Monitor.lnk

Path C:\Users\Admin\Desktop\AsicHub Monitor.lnk
Size 2KB
SHA256 e2f561626dc375c4bf69b988a5a0ee92079f9e8e7ad99a95d4bfd5d6c1e99cad
MD5 23a1bde20f9477f425b43f06f00daafc
SHA1 295a5075e533c6a74f1ae9dcb6892653b0acf067
SHA512 f7b37d02b32fa5c679a8f626688ce6f575e9cfa12b4ec1f4f78cd67765fbd2b42b49d63becced1f4151d1643262345c32ab083cc3b23214e6a2d1c44c0804492
TLSH
T1C441D1025AF61729E3FB9A7147A629748676F8957F268D0D0005D34A0F31E80DF64B2B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3644-17-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/3644-18-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/3644-6-0x00007FFD1D88F000-0x00007FFD1D890000-memory.dmp

Download

memory/3644-16-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/3644-28-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/3644-15-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/3644-14-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/3644-13-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/3644-8-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/3644-12-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download

memory/3644-11-0x00000252C3CF0000-0x00000252C3D12000-memory.dmp

Download

memory/3644-7-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp

Download