136828d046447d792b9851e7d2ab065eae19568b105d9e8912f3f26dc2234d16

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/07/2026, 09:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_06267b47e40fbbca24837dabf221cc3e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Size 16.2MB
Sample260719-le22msgv9l
SHA256 136828d046447d792b9851e7d2ab065eae19568b105d9e8912f3f26dc2234d16
MD5 06267b47e40fbbca24837dabf221cc3e
SHA1 52aeb04e898fbc2b73429b8f82a3730bfefc1bd1
SHA512 d6db67971cd694c691573d08de3bd4d483c036a1cdb9b2a0e005f9e62687a3817c9fbcbbe44334eb016c483711c6c2d1ab1282ca35556a1945d76537c4853c26
SSDEEP 98304:VZvZtb3VZoM6h53+7IYrYnLUvvyDdbJCW5IavZRqUogilouP95h7DOeoJd6Xg3F:HZt/oMETEvyB9Cpav2KpeoJog3F
TLSH
T176077D13F29651EDE06ED178872A5232B971BC494B30B5EF0790BA251E71FE06B3CB25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{908AAF3D-6DAA-4F36-A9B0-538D90BEC8C1}\StubPath = "\"C:\\Program Files\\Ace\\Ace\\Application\\148.0.7786.0\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{908AAF3D-6DAA-4F36-A9B0-538D90BEC8C1}\Localized Name = "Ace"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{908AAF3D-6DAA-4F36-A9B0-538D90BEC8C1}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{908AAF3D-6DAA-4F36-A9B0-538D90BEC8C1}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{908AAF3D-6DAA-4F36-A9B0-538D90BEC8C1}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{908AAF3D-6DAA-4F36-A9B0-538D90BEC8C1}\ = "Ace"	setup.exe

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	ace.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	ace.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	ace.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	ace.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	ace.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	ace.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	ace.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	ace.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	ace.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 45 IoCs

pid	Process
4404	updater.exe
4316	updater.exe
3708	updater.exe
4480	updater.exe
3376	updater.exe
2228	updater.exe
4976	mini_installer.exe
2520	setup.exe
1600	setup.exe
5952	setup.exe
5980	setup.exe
2044	elevation_service.exe
4340	ace.exe
6100	ace.exe
5260	ace.exe
5308	ace.exe
4152	elevation_service.exe
5900	ace.exe
2508	ace.exe
2500	ace.exe
4812	ace.exe
3916	ace.exe
1964	ace.exe
5468	ace.exe
1868	ace.exe
6024	ace.exe
1404	ace.exe
2000	ace.exe
4952	ace.exe
6040	ace.exe
5656	chrmstp.exe
5364	chrmstp.exe
4552	chrmstp.exe
1764	chrmstp.exe
4948	ace.exe
956	updater.exe
1648	updater.exe
4544	updater.exe
4040	updater.exe
5624	updater.exe
1160	updater.exe
3372	updater.exe
1084	updater.exe
984	updater.exe
3044	updater.exe

Loads dropped DLL 36 IoCs

pid	Process
4340	ace.exe
6100	ace.exe
4340	ace.exe
5260	ace.exe
5260	ace.exe
5308	ace.exe
5308	ace.exe
5260	ace.exe
5260	ace.exe
5260	ace.exe
5260	ace.exe
5260	ace.exe
5900	ace.exe
5900	ace.exe
2508	ace.exe
2508	ace.exe
2500	ace.exe
2500	ace.exe
4812	ace.exe
4812	ace.exe
3916	ace.exe
1964	ace.exe
3916	ace.exe
1964	ace.exe
5468	ace.exe
5468	ace.exe
1868	ace.exe
6024	ace.exe
1404	ace.exe
1404	ace.exe
6040	ace.exe
6040	ace.exe
4952	ace.exe
4952	ace.exe
4948	ace.exe
4948	ace.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AceAutoLaunch = "\"C:\\Program Files\\Ace\\Ace\\Application\\ace.exe\""	ace.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 9 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-19_06267b47e40fbbca24837dabf221cc3e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Ace.lnk	setup.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\es.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\hr_FEMININE.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\ur_NEUTER.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Ace\AceUpdater\updater.log	updater.exe
File created	C:\Program Files (x86)\Ace\AceUpdater\2f9bcacb-d4ab-4c10-a18d-e3fb9fee23da.tmp	updater.exe
File opened for modification	C:\Program Files (x86)\Ace\AceUpdater\updater.log	updater.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\lt_FEMININE.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\lv.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\nl_FEMININE.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Ace\AceUpdater\updater_history.jsonl	updater.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\hu_FEMININE.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\pt-PT_FEMININE.pak	setup.exe
File created	C:\Program Files (x86)\Ace\AceUpdater\9330e1a4-776e-4886-ba4b-256d839bed7a.tmp	updater.exe
File opened for modification	C:\Program Files (x86)\Ace\AceUpdater\9330e1a4-776e-4886-ba4b-256d839bed7a.tmp	updater.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\kn_FEMININE.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\sr.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\te_NEUTER.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\id_FEMININE.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\th_MASCULINE.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\uk_NEUTER.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\zh-TW_FEMININE.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Ace\AceUpdater\updater_history.jsonl	updater.exe
File created	C:\Program Files (x86)\Ace\AceUpdater\70e353ce-ddbb-4bca-aa95-ffaf97a40292.tmp	updater.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\et_FEMININE.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\resources\ace_adblock\acePagesBridge.ts.js	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\resources\ace_adblock\assets\active_light.png	setup.exe
File opened for modification	C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\Crashpad\metadata	updater.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\am.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\en-US.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\it_MASCULINE.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\ur_FEMININE.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\VisualElements\Logo.png	setup.exe
File opened for modification	C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\prefs.json	updater.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\dxcompiler.dll	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\libEGL.dll	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\nb_NEUTER.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\sk.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\vi_FEMININE.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\resources\ace_adblock\assets\shield32.png	setup.exe
File opened for modification	C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\Crashpad\metadata	updater.exe
File created	C:\Program Files (x86)\Ace\AceUpdater\0afbf1dc-a558-4a64-8425-ee4a6000fce4.tmp	updater.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\c033d185-fc2f-446c-8af5-1efadb297411.tmp	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\resources\ace_adblock\service_worker.js.js	setup.exe
File opened for modification	C:\Program Files\Ace\Ace\Application\SetupMetrics\5952_13428926929126632.pma	setup.exe
File opened for modification	C:\Program Files (x86)\Ace\AceUpdater\updater_history.jsonl	updater.exe
File created	C:\Program Files\AceUpdater_chrome_Unpacker_BeginUnzipping3376_264889127\CR_61688.tmp\CHROME.PACKED.7Z	mini_installer.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\de_NEUTER.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\en-GB_NEUTER.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\id_NEUTER.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\lv_NEUTER.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\nl_MASCULINE.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\MEIPreload\preloaded_data.pb	setup.exe
File created	C:\Program Files (x86)\Ace\AceUpdater\0f5d1971-9797-4067-8273-c3d4a766b285.tmp	updater.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\ja.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Ace\AceUpdater\updater_history.jsonl	updater.exe
File created	C:\Program Files (x86)\Ace\AceUpdater\4a82fe14-33c9-46e1-a1c1-aa965af47f91.tmp	updater.exe
File created	C:\Program Files\Ace904_442078170\updater.7z	2026-07-19_06267b47e40fbbca24837dabf221cc3e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Ace\AceUpdater\prefs.json	updater.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\am_MASCULINE.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\ar_MASCULINE.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\bn_NEUTER.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\fr_NEUTER.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\lv_FEMININE.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\zh-CN.pak	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2520	setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5308	ace.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ace.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ace.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	ace.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	ace.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	ace.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	ace.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Ace\Ace	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ace	setup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Ace\Ace\InstallerPinned = "0"	setup.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	ace.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289268755991983"	msedgewebview2.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F8197F77-DE9C-4BB0-9F63-459A001154C6}\ = "IPolicyStatusSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D734C877-21F4-496E-B857-3E5B2E72E4CC}\ = "IAppBundleWeb"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{87DBF75E-F590-4802-93FD-F8D07800E2E9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE5D3E90-A66C-4A0A-9B7B-1A6B9BF3971E}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BE5D3E90-A66C-4A0A-9B7B-1A6B9BF3971E}\1.0\ = "AceUpdater TypeLib for ICurrentState"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{47C8886A-A4B5-4F6C-865A-41A207074DFA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{568CF642-62DB-5864-9891-F6A0D73637FB}\1.0\0\win32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{470F6208-3435-5D40-A9C8-8B3AA8A5169C}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{470F6208-3435-5D40-A9C8-8B3AA8A5169C}\1.0\0\win64	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{E0425C1F-4263-4BA5-9328-423470344FC0}\1.0\0\win32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6F7996CA-5531-4299-BD7F-3C7090520090}\ = "IPolicyStatus3System"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{027234BD-61BB-4F5C-9386-7FE804171C8C}\ = "IGoogleUpdate3Web"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{DD7A1388-6638-5F72-A321-F01568133381}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B7DA4837-09FF-4355-BFE1-30598E40F41A}\TypeLib\ = "{B7DA4837-09FF-4355-BFE1-30598E40F41A}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CFF9AE0F-C5C5-4D53-8394-7602758A52BA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EED70106-3604-4385-866E-6D540E99CA1A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{568CF642-62DB-5864-9891-F6A0D73637FB}\1.0\0\win32\ = "C:\\Program Files (x86)\\Ace\\AceUpdater\\148.0.7786.0\\updater.exe\\5"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{EED70106-3604-4385-866E-6D540E99CA1A}\1.0\0\win32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithProgIds\AceHTM	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DF735BF0-0265-4D65-BABA-E244D428EFC5}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BE5D3E90-A66C-4A0A-9B7B-1A6B9BF3971E}\TypeLib\ = "{BE5D3E90-A66C-4A0A-9B7B-1A6B9BF3971E}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcePDF\Application\ApplicationIcon = "C:\\Program Files\\Ace\\Ace\\Application\\ace.exe,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\{83FE19AC-72A6-4A72-B136-724444121586}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{390D26B7-DA37-5842-B307-DD94806BBF08}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{04588E40-E38A-5A61-A4F3-B6274FB4C996}\1.0\0\win32\ = "C:\\Program Files (x86)\\Ace\\AceUpdater\\148.0.7786.0\\updater.exe\\4"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{470F6208-3435-5D40-A9C8-8B3AA8A5169C}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{6F7996CA-5531-4299-BD7F-3C7090520090}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9F76CA-FCFB-4F8E-B65E-F7C0703AAFBD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{3057E1F8-2498-4C19-99B5-F7F207DA4DC7}\1.0\0\win32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7D908375-C9D0-44C5-BB98-206F3C24A74C}\1.0\0\win64\ = "C:\\Program Files (x86)\\Ace\\AceUpdater\\148.0.7786.0\\updater.exe\\6"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{773FE669-69ED-4029-AED1-BD57595C8358}	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\{773FE669-69ED-4029-AED1-BD57595C8358}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DD7A1388-6638-5F72-A321-F01568133381}\1.0\ = "AceUpdater TypeLib for IUpdaterInternalCallbackSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B89F6621-36AF-554C-9C1E-A5B7AEA875A5}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcePDF\Application\ApplicationDescription = "Access the Internet"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{390D26B7-DA37-5842-B307-DD94806BBF08}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{390D26B7-DA37-5842-B307-DD94806BBF08}\1.0\0\win32\ = "C:\\Program Files (x86)\\Ace\\AceUpdater\\148.0.7786.0\\updater.exe\\4"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{4AF986BF-DD14-45C2-8228-2541622699CD}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{BE5D3E90-A66C-4A0A-9B7B-1A6B9BF3971E}\1.0\0\win64	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DD9F76CA-FCFB-4F8E-B65E-F7C0703AAFBD}\1.0\0\win64\ = "C:\\Program Files (x86)\\Ace\\AceUpdater\\148.0.7786.0\\updater.exe\\6"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{3057E1F8-2498-4C19-99B5-F7F207DA4DC7}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{3057E1F8-2498-4C19-99B5-F7F207DA4DC7}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{027234BD-61BB-4F5C-9386-7FE804171C8C}\1.0\0\win32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{568CF642-62DB-5864-9891-F6A0D73637FB}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\{283209B7-C761-41CA-BE8D-B5321CD78FD6}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{78A85A33-F541-4A52-A1F2-0BCBA1F1A4F0}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{027234BD-61BB-4F5C-9386-7FE804171C8C}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{D1A6B952-89EF-5716-BF5C-193134EE0E16}\1.0\0\win64	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{568CF642-62DB-5864-9891-F6A0D73637FB}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{7D908375-C9D0-44C5-BB98-206F3C24A74C}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F8197F77-DE9C-4BB0-9F63-459A001154C6}\1.0\0\win64	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{87DBF75E-F590-4802-93FD-F8D07800E2E9}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7D908375-C9D0-44C5-BB98-206F3C24A74C}\ = "IPolicyStatus"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{47C8886A-A4B5-4F6C-865A-41A207074DFA}\1.0\0\win32\ = "C:\\Program Files (x86)\\Ace\\AceUpdater\\148.0.7786.0\\updater.exe\\6"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{DF735BF0-0265-4D65-BABA-E244D428EFC5}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{78A85A33-F541-4A52-A1F2-0BCBA1F1A4F0}\1.0\0\win32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{437174A3-B9A5-4835-B896-7DE8C1FE2638}\1.0\0\win32\ = "C:\\Program Files (x86)\\Ace\\AceUpdater\\148.0.7786.0\\updater.exe\\6"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{3057E1F8-2498-4C19-99B5-F7F207DA4DC7}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{DD7A1388-6638-5F72-A321-F01568133381}\1.0\0\win64	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E1C53EEF-2BAB-4420-BDD7-256B91C49D0C}\1.0\ = "AceUpdater TypeLib for IProcessLauncher2System"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{D734C877-21F4-496E-B857-3E5B2E72E4CC}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AcePDF	setup.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
4404	updater.exe
4404	updater.exe
4404	updater.exe
4404	updater.exe
4404	updater.exe
4404	updater.exe
3708	updater.exe
3708	updater.exe
3708	updater.exe
3708	updater.exe
3708	updater.exe
3708	updater.exe
3376	updater.exe
3376	updater.exe
3376	updater.exe
3376	updater.exe
3376	updater.exe
3376	updater.exe
4404	updater.exe
4404	updater.exe
4340	ace.exe
4340	ace.exe
956	updater.exe
956	updater.exe
956	updater.exe
956	updater.exe
4544	updater.exe
4544	updater.exe
4544	updater.exe
4544	updater.exe
5624	updater.exe
5624	updater.exe
5624	updater.exe
5624	updater.exe
3372	updater.exe
3372	updater.exe
3372	updater.exe
3372	updater.exe
984	updater.exe
984	updater.exe
984	updater.exe
984	updater.exe
984	updater.exe
984	updater.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1756	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	904	2026-07-19_06267b47e40fbbca24837dabf221cc3e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeIncBasePriorityPrivilege	904	2026-07-19_06267b47e40fbbca24837dabf221cc3e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: 33	4976	mini_installer.exe
Token: SeIncBasePriorityPrivilege	4976	mini_installer.exe
Token: SeShutdownPrivilege	4340	ace.exe
Token: SeCreatePagefilePrivilege	4340	ace.exe
Token: SeShutdownPrivilege	4340	ace.exe
Token: SeCreatePagefilePrivilege	4340	ace.exe
Token: SeShutdownPrivilege	4340	ace.exe
Token: SeCreatePagefilePrivilege	4340	ace.exe
Token: SeShutdownPrivilege	4340	ace.exe
Token: SeCreatePagefilePrivilege	4340	ace.exe
Token: SeShutdownPrivilege	4340	ace.exe
Token: SeCreatePagefilePrivilege	4340	ace.exe
Token: SeShutdownPrivilege	4340	ace.exe
Token: SeCreatePagefilePrivilege	4340	ace.exe
Token: SeShutdownPrivilege	4340	ace.exe
Token: SeCreatePagefilePrivilege	4340	ace.exe
Token: SeShutdownPrivilege	4340	ace.exe
Token: SeCreatePagefilePrivilege	4340	ace.exe
Token: SeShutdownPrivilege	4340	ace.exe
Token: SeCreatePagefilePrivilege	4340	ace.exe
Token: SeShutdownPrivilege	4340	ace.exe
Token: SeCreatePagefilePrivilege	4340	ace.exe
Token: SeShutdownPrivilege	4340	ace.exe
Token: SeCreatePagefilePrivilege	4340	ace.exe
Token: SeShutdownPrivilege	4340	ace.exe
Token: SeCreatePagefilePrivilege	4340	ace.exe
Token: SeShutdownPrivilege	4340	ace.exe
Token: SeCreatePagefilePrivilege	4340	ace.exe
Token: SeShutdownPrivilege	4340	ace.exe
Token: SeCreatePagefilePrivilege	4340	ace.exe
Token: SeShutdownPrivilege	4340	ace.exe
Token: SeCreatePagefilePrivilege	4340	ace.exe
Token: SeShutdownPrivilege	4340	ace.exe
Token: SeCreatePagefilePrivilege	4340	ace.exe
Token: SeShutdownPrivilege	4340	ace.exe
Token: SeCreatePagefilePrivilege	4340	ace.exe
Token: SeShutdownPrivilege	4340	ace.exe
Token: SeCreatePagefilePrivilege	4340	ace.exe
Token: SeShutdownPrivilege	4340	ace.exe
Token: SeCreatePagefilePrivilege	4340	ace.exe
Token: SeShutdownPrivilege	4340	ace.exe
Token: SeCreatePagefilePrivilege	4340	ace.exe
Token: SeShutdownPrivilege	4340	ace.exe
Token: SeCreatePagefilePrivilege	4340	ace.exe
Token: SeShutdownPrivilege	4340	ace.exe
Token: SeCreatePagefilePrivilege	4340	ace.exe
Token: SeShutdownPrivilege	4340	ace.exe
Token: SeCreatePagefilePrivilege	4340	ace.exe
Token: SeShutdownPrivilege	4340	ace.exe
Token: SeCreatePagefilePrivilege	4340	ace.exe
Token: SeShutdownPrivilege	4340	ace.exe
Token: SeCreatePagefilePrivilege	4340	ace.exe
Token: SeShutdownPrivilege	4340	ace.exe
Token: SeCreatePagefilePrivilege	4340	ace.exe
Token: SeShutdownPrivilege	4340	ace.exe
Token: SeCreatePagefilePrivilege	4340	ace.exe
Token: SeShutdownPrivilege	4340	ace.exe
Token: SeCreatePagefilePrivilege	4340	ace.exe
Token: SeShutdownPrivilege	4340	ace.exe
Token: SeCreatePagefilePrivilege	4340	ace.exe
Token: SeShutdownPrivilege	4340	ace.exe
Token: SeCreatePagefilePrivilege	4340	ace.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
4340	ace.exe
4340	ace.exe
4340	ace.exe
4340	ace.exe
4340	ace.exe
4340	ace.exe
4340	ace.exe
4340	ace.exe
4552	chrmstp.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 1756	2720	2026-07-19_06267b47e40fbbca24837dabf221cc3e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	86
PID 1756 wrote to memory of 2504	1756	msedgewebview2.exe	87
PID 1756 wrote to memory of 4928	1756	msedgewebview2.exe	88
PID 1756 wrote to memory of 4928	1756	msedgewebview2.exe	88
PID 1756 wrote to memory of 4928	1756	msedgewebview2.exe	88
PID 1756 wrote to memory of 4040	1756	msedgewebview2.exe	89
PID 1756 wrote to memory of 3108	1756	msedgewebview2.exe	90
PID 1756 wrote to memory of 3108	1756	msedgewebview2.exe	90
PID 1756 wrote to memory of 2556	1756	msedgewebview2.exe	91
PID 1756 wrote to memory of 2556	1756	msedgewebview2.exe	91
PID 1756 wrote to memory of 2556	1756	msedgewebview2.exe	91
PID 1756 wrote to memory of 3500	1756	msedgewebview2.exe	92
PID 1756 wrote to memory of 3500	1756	msedgewebview2.exe	92
PID 2720 wrote to memory of 904	2720	2026-07-19_06267b47e40fbbca24837dabf221cc3e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	93
PID 904 wrote to memory of 4404	904	2026-07-19_06267b47e40fbbca24837dabf221cc3e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	94
PID 4404 wrote to memory of 4316	4404	updater.exe	95
PID 3708 wrote to memory of 4480	3708	updater.exe	98
PID 3376 wrote to memory of 2228	3376	updater.exe	102
PID 3376 wrote to memory of 4976	3376	updater.exe	107
PID 4976 wrote to memory of 2520	4976	mini_installer.exe	108
PID 2520 wrote to memory of 1600	2520	setup.exe	109
PID 2520 wrote to memory of 5952	2520	setup.exe	116
PID 5952 wrote to memory of 5980	5952	setup.exe	117
PID 1756 wrote to memory of 5540	1756	msedgewebview2.exe	122
PID 1756 wrote to memory of 5540	1756	msedgewebview2.exe	122
PID 1756 wrote to memory of 5892	1756	msedgewebview2.exe	123
PID 1756 wrote to memory of 5892	1756	msedgewebview2.exe	123
PID 4404 wrote to memory of 4340	4404	updater.exe	124
PID 4340 wrote to memory of 6100	4340	ace.exe	125
PID 4340 wrote to memory of 5260	4340	ace.exe	126
PID 4340 wrote to memory of 5308	4340	ace.exe	127
PID 4340 wrote to memory of 5900	4340	ace.exe	129
PID 4340 wrote to memory of 2500	4340	ace.exe	131
PID 4340 wrote to memory of 2508	4340	ace.exe	132
PID 4340 wrote to memory of 3916	4340	ace.exe	134
PID 4340 wrote to memory of 4812	4340	ace.exe	133
PID 4340 wrote to memory of 1964	4340	ace.exe	136
PID 4340 wrote to memory of 5468	4340	ace.exe	137
PID 1868 wrote to memory of 6024	1868	ace.exe	140
PID 4340 wrote to memory of 1404	4340	ace.exe	141
PID 4340 wrote to memory of 2000	4340	ace.exe	142
PID 4340 wrote to memory of 4952	4340	ace.exe	143
PID 4340 wrote to memory of 6040	4340	ace.exe	144
PID 4340 wrote to memory of 5656	4340	ace.exe	145
PID 5656 wrote to memory of 5364	5656	chrmstp.exe	146
PID 5656 wrote to memory of 4552	5656	chrmstp.exe	147
PID 4552 wrote to memory of 1764	4552	chrmstp.exe	148
PID 4340 wrote to memory of 4948	4340	ace.exe	149
PID 956 wrote to memory of 1648	956	updater.exe	151
PID 4340 wrote to memory of 4544	4340	ace.exe	152
PID 4544 wrote to memory of 4040	4544	updater.exe	153
PID 4544 wrote to memory of 5624	4544	updater.exe	154
PID 5624 wrote to memory of 1160	5624	updater.exe	155
PID 3372 wrote to memory of 1084	3372	updater.exe	157
PID 984 wrote to memory of 3044	984	updater.exe	159

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-19_06267b47e40fbbca24837dabf221cc3e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_06267b47e40fbbca24837dabf221cc3e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-19_06267b47e40fbbca24837dabf221cc3e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe --webview-exe-version=148.0.7786.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=2720.4440.11230193235173092802
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffb60c5b078,0x7ffb60c5b084,0x7ffb60c5b090
    3⤵
    PID:2504
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView" --webview-exe-name=2026-07-19_06267b47e40fbbca24837dabf221cc3e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe --webview-exe-version=148.0.7786.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1720,i,5079241781044735287,5283212427501784645,262144 --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
    3⤵
    PID:4928
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView" --webview-exe-name=2026-07-19_06267b47e40fbbca24837dabf221cc3e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe --webview-exe-version=148.0.7786.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2024,i,5079241781044735287,5283212427501784645,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:3
    3⤵
    PID:4040
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView" --webview-exe-name=2026-07-19_06267b47e40fbbca24837dabf221cc3e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe --webview-exe-version=148.0.7786.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2380,i,5079241781044735287,5283212427501784645,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:8
    3⤵
    PID:3108
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView" --webview-exe-name=2026-07-19_06267b47e40fbbca24837dabf221cc3e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe --webview-exe-version=148.0.7786.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3660,i,5079241781044735287,5283212427501784645,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
    3⤵
    PID:2556
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView" --webview-exe-name=2026-07-19_06267b47e40fbbca24837dabf221cc3e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe --webview-exe-version=148.0.7786.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3972,i,5079241781044735287,5283212427501784645,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:8
    3⤵
    PID:3500
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView" --webview-exe-name=2026-07-19_06267b47e40fbbca24837dabf221cc3e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe --webview-exe-version=148.0.7786.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4632,i,5079241781044735287,5283212427501784645,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:8
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView" --webview-exe-name=2026-07-19_06267b47e40fbbca24837dabf221cc3e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe --webview-exe-version=148.0.7786.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=756,i,5079241781044735287,5283212427501784645,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:8
    3⤵
    PID:5892
- C:\Users\Admin\AppData\Local\Temp\2026-07-19_06267b47e40fbbca24837dabf221cc3e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-19_06267b47e40fbbca24837dabf221cc3e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe" --install=appguid={908AAF3D-6DAA-4F36-A9B0-538D90BEC8C1}&appname=Chromium&needsadmin=prefers&iid=b9fe2a40-8212-11f1-a0ce-868513eab8d3@b9fe1d48-8212-11f1-a0ce-868513eab8d3@@ --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/enterprise_companion/*=2,*/chrome/updater/*=2 --expect-elevated --silent --alwayslaunchcmd
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Program Files\Ace904_442078170\bin\updater.exe
    "C:\Program Files\Ace904_442078170\bin\updater.exe" --install=appguid={908AAF3D-6DAA-4F36-A9B0-538D90BEC8C1}&appname=Chromium&needsadmin=prefers&iid=b9fe2a40-8212-11f1-a0ce-868513eab8d3@b9fe1d48-8212-11f1-a0ce-868513eab8d3@@ --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/enterprise_companion/*=2,*/chrome/updater/*=2 --expect-elevated --silent --alwayslaunchcmd
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4404
  - - C:\Program Files\Ace904_442078170\bin\updater.exe
      "C:\Program Files\Ace904_442078170\bin\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\Crashpad" --url=https://clients2.google.com/cr/staging_report --annotation=prod=AceUpdater --annotation=ver=148.0.7786.0 "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater.log" "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater_history.jsonl" --initial-client-data=0x2b0,0x1d8,0x484,0x204,0x488,0x7ff63b58950c,0x7ff63b589518,0x7ff63b589528
      4⤵
      Executes dropped EXE
      PID:4316
  - - C:\Program Files\Ace\Ace\Application\ace.exe
      "C:\Program Files\Ace\Ace\Application\ace.exe" --from-installer --iid=b9fe2a40-8212-11f1-a0ce-868513eab8d3@b9fe1d48-8212-11f1-a0ce-868513eab8d3@@
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4340
    - - C:\Program Files\Ace\Ace\Application\ace.exe
        
        "C:\Program Files\Ace\Ace\Application\ace.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Ace\Ace\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Ace\Ace\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Ace --annotation=ver=148.0.7786.0 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ffb5d3e5d60,0x7ffb5d3e5d6c,0x7ffb5d3e5d78
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6100
    - - C:\Program Files\Ace\Ace\Application\ace.exe
        
        "C:\Program Files\Ace\Ace\Application\ace.exe" --type=gpu-process --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1888,i,5991255760798525106,11626696686931326823,262144 --field-trial-handle=1908,i,10804525739856355968,7551828937908500523,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,16480153294429377960,12701758958100432240,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1904 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5260
    - - C:\Program Files\Ace\Ace\Application\ace.exe
        
        "C:\Program Files\Ace\Ace\Application\ace.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --start-stack-profiler --metrics-shmem-handle=2220,i,11659995493003507684,17617831765323689593,524288 --field-trial-handle=1908,i,10804525739856355968,7551828937908500523,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,16480153294429377960,12701758958100432240,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2224 /prefetch:3
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Time Discovery
        
        PID:5308
    - - C:\Program Files\Ace\Ace\Application\ace.exe
        
        "C:\Program Files\Ace\Ace\Application\ace.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,4517564416563244901,2193188908536408650,524288 --field-trial-handle=1908,i,10804525739856355968,7551828937908500523,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,16480153294429377960,12701758958100432240,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2424 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5900
    - - C:\Program Files\Ace\Ace\Application\ace.exe
        
        "C:\Program Files\Ace\Ace\Application\ace.exe" --type=renderer --force-high-res-timeticks=disabled --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,2414296380298411576,7886604272867896121,2097152 --field-trial-handle=1908,i,10804525739856355968,7551828937908500523,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,16480153294429377960,12701758958100432240,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3272 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2500
    - - C:\Program Files\Ace\Ace\Application\ace.exe
        
        "C:\Program Files\Ace\Ace\Application\ace.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3296,i,4077483284068887766,7985403628959718799,2097152 --field-trial-handle=1908,i,10804525739856355968,7551828937908500523,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,16480153294429377960,12701758958100432240,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3312 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2508
    - - C:\Program Files\Ace\Ace\Application\ace.exe
        
        "C:\Program Files\Ace\Ace\Application\ace.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4716,i,14300165899389169365,16294422861380410194,2097152 --field-trial-handle=1908,i,10804525739856355968,7551828937908500523,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,16480153294429377960,12701758958100432240,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4732 /prefetch:2
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4812
    - - C:\Program Files\Ace\Ace\Application\ace.exe
        
        "C:\Program Files\Ace\Ace\Application\ace.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4784,i,11103263214437347259,13234556105522964078,2097152 --field-trial-handle=1908,i,10804525739856355968,7551828937908500523,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,16480153294429377960,12701758958100432240,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4672 /prefetch:2
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3916
    - - C:\Program Files\Ace\Ace\Application\ace.exe
        
        "C:\Program Files\Ace\Ace\Application\ace.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5288,i,15226956213311993820,17728895007340840347,2097152 --field-trial-handle=1908,i,10804525739856355968,7551828937908500523,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,16480153294429377960,12701758958100432240,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5240 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1964
    - - C:\Program Files\Ace\Ace\Application\ace.exe
        
        "C:\Program Files\Ace\Ace\Application\ace.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,9657809259729121900,15106459311859344897,524288 --field-trial-handle=1908,i,10804525739856355968,7551828937908500523,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,16480153294429377960,12701758958100432240,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5560 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5468
    - - C:\Program Files\Ace\Ace\Application\ace.exe
        
        "C:\Program Files\Ace\Ace\Application\ace.exe" --type=renderer --instant-process --force-high-res-timeticks=disabled --start-stack-profiler --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5728,i,16988515677878181509,12129698293758566138,2097152 --field-trial-handle=1908,i,10804525739856355968,7551828937908500523,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,16480153294429377960,12701758958100432240,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5756 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1404
    - - C:\Program Files\Ace\Ace\Application\ace.exe
        
        "C:\Program Files\Ace\Ace\Application\ace.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5964,i,17303387985126621757,2091523514112253525,2097152 --field-trial-handle=1908,i,10804525739856355968,7551828937908500523,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,16480153294429377960,12701758958100432240,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5996 /prefetch:1
        5⤵
        Executes dropped EXE
        
        PID:2000
    - - C:\Program Files\Ace\Ace\Application\ace.exe
        
        "C:\Program Files\Ace\Ace\Application\ace.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6512,i,5015075724694405547,13737538663895139917,2097152 --field-trial-handle=1908,i,10804525739856355968,7551828937908500523,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,16480153294429377960,12701758958100432240,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=6532 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4952
    - - C:\Program Files\Ace\Ace\Application\ace.exe
        
        "C:\Program Files\Ace\Ace\Application\ace.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6884,i,5072730153227402630,5297587693771248208,524288 --field-trial-handle=1908,i,10804525739856355968,7551828937908500523,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,16480153294429377960,12701758958100432240,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=6888 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6040
    - - C:\Program Files\Ace\Ace\Application\148.0.7786.0\Installer\chrmstp.exe
        
        "C:\Program Files\Ace\Ace\Application\148.0.7786.0\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5656
      - C:\Program Files\Ace\Ace\Application\148.0.7786.0\Installer\chrmstp.exe
        
        "C:\Program Files\Ace\Ace\Application\148.0.7786.0\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --annotation=plat=Win64 --annotation=prod=Ace --annotation=ver=148.0.7786.0 "--attachment=C:\Program Files\chromium_installer.log" "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater.log" "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater_history.jsonl" --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ff6ba7892c0,0x7ff6ba7892cc,0x7ff6ba7892d8
        6⤵
        Executes dropped EXE
        
        PID:5364
      - C:\Program Files\Ace\Ace\Application\148.0.7786.0\Installer\chrmstp.exe
        
        "C:\Program Files\Ace\Ace\Application\148.0.7786.0\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Ace\Ace\Application\master_preferences" --create-shortcuts=1 --install-level=0
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Program Files\Ace\Ace\Application\148.0.7786.0\Installer\chrmstp.exe
        
        "C:\Program Files\Ace\Ace\Application\148.0.7786.0\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --annotation=plat=Win64 --annotation=prod=Ace --annotation=ver=148.0.7786.0 "--attachment=C:\Program Files\chromium_installer.log" "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater.log" "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater_history.jsonl" --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ff6ba7892c0,0x7ff6ba7892cc,0x7ff6ba7892d8
        7⤵
        Executes dropped EXE
        
        PID:1764
    - - C:\Program Files\Ace\Ace\Application\ace.exe
        
        "C:\Program Files\Ace\Ace\Application\ace.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=7492,i,11604939228058874494,6214139935818973546,2097152 --field-trial-handle=1908,i,10804525739856355968,7551828937908500523,262144 --variations-seed-version --pseudonymization-salt-handle=1912,i,16480153294429377960,12701758958100432240,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=7512 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4948
    - - C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\updater.exe
        
        "C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\updater.exe" --wake-all --system
        5⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4544
      - C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\updater.exe
        
        "C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\Crashpad" --url=https://clients2.google.com/cr/staging_report --annotation=prod=AceUpdater --annotation=ver=148.0.7786.0 "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater.log" "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater_history.jsonl" --initial-client-data=0x24c,0x250,0x254,0x248,0x258,0x7ff679ee950c,0x7ff679ee9518,0x7ff679ee9528
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:4040
      - C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\updater.exe
        
        "C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\updater.exe" --wake --system
        6⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5624
        
        C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\updater.exe
        
        "C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\Crashpad" --url=https://clients2.google.com/cr/staging_report --annotation=prod=AceUpdater --annotation=ver=148.0.7786.0 "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater.log" "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater_history.jsonl" --initial-client-data=0x244,0x248,0x24c,0x240,0x250,0x7ff679ee950c,0x7ff679ee9518,0x7ff679ee9528
        7⤵
        Executes dropped EXE
        
        PID:1160

C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\updater.exe
"C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\updater.exe" --system --windows-service --service=update-internal
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\updater.exe
  "C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\Crashpad" --url=https://clients2.google.com/cr/staging_report --annotation=prod=AceUpdater --annotation=ver=148.0.7786.0 "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater.log" "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater_history.jsonl" --initial-client-data=0x240,0x244,0x248,0x23c,0x24c,0x7ff679ee950c,0x7ff679ee9518,0x7ff679ee9528
  2⤵
  - Executes dropped EXE
  PID:4480

C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\updater.exe
"C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\updater.exe" --system --windows-service --service=update
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\updater.exe
  "C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\Crashpad" --url=https://clients2.google.com/cr/staging_report --annotation=prod=AceUpdater --annotation=ver=148.0.7786.0 "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater.log" "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater_history.jsonl" --initial-client-data=0x240,0x244,0x248,0x23c,0x24c,0x7ff679ee950c,0x7ff679ee9518,0x7ff679ee9528
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Program Files\AceUpdater_chrome_Unpacker_BeginUnzipping3376_264889127\mini_installer.exe
  "C:\Program Files\AceUpdater_chrome_Unpacker_BeginUnzipping3376_264889127\mini_installer.exe" --do-not-launch-chrome
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Program Files\AceUpdater_chrome_Unpacker_BeginUnzipping3376_264889127\CR_61688.tmp\setup.exe
    "C:\Program Files\AceUpdater_chrome_Unpacker_BeginUnzipping3376_264889127\CR_61688.tmp\setup.exe" --install-archive="C:\Program Files\AceUpdater_chrome_Unpacker_BeginUnzipping3376_264889127\CR_61688.tmp\CHROME.PACKED.7Z" --do-not-launch-chrome
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Network Configuration Discovery: Internet Connection Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2520
  - - C:\Program Files\AceUpdater_chrome_Unpacker_BeginUnzipping3376_264889127\CR_61688.tmp\setup.exe
      "C:\Program Files\AceUpdater_chrome_Unpacker_BeginUnzipping3376_264889127\CR_61688.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --annotation=plat=Win64 --annotation=prod=Ace --annotation=ver=148.0.7786.0 "--attachment=C:\Program Files\chromium_installer.log" "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater.log" "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater_history.jsonl" --initial-client-data=0x25c,0x260,0x264,0x234,0x268,0x7ff64f7992c0,0x7ff64f7992cc,0x7ff64f7992d8
      4⤵
      Executes dropped EXE
      PID:1600
  - - C:\Program Files\AceUpdater_chrome_Unpacker_BeginUnzipping3376_264889127\CR_61688.tmp\setup.exe
      "C:\Program Files\AceUpdater_chrome_Unpacker_BeginUnzipping3376_264889127\CR_61688.tmp\setup.exe" --system-level --verbose-logging --create-shortcuts=0 --install-level=1
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Program Files directory
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:5952
    - - C:\Program Files\AceUpdater_chrome_Unpacker_BeginUnzipping3376_264889127\CR_61688.tmp\setup.exe
        
        "C:\Program Files\AceUpdater_chrome_Unpacker_BeginUnzipping3376_264889127\CR_61688.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --annotation=plat=Win64 --annotation=prod=Ace --annotation=ver=148.0.7786.0 "--attachment=C:\Program Files\chromium_installer.log" "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater.log" "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater_history.jsonl" --initial-client-data=0x25c,0x260,0x264,0x238,0x268,0x7ff64f7992c0,0x7ff64f7992cc,0x7ff64f7992d8
        5⤵
        Executes dropped EXE
        
        PID:5980

C:\Program Files\Ace\Ace\Application\148.0.7786.0\elevation_service.exe
"C:\Program Files\Ace\Ace\Application\148.0.7786.0\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2044

C:\Program Files\Ace\Ace\Application\148.0.7786.0\elevation_service.exe
"C:\Program Files\Ace\Ace\Application\148.0.7786.0\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5640

C:\Program Files\Ace\Ace\Application\ace.exe
"C:\Program Files\Ace\Ace\Application\ace.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Program Files\Ace\Ace\Application\ace.exe
  "C:\Program Files\Ace\Ace\Application\ace.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Ace\Ace\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Ace\Ace\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Ace --annotation=ver=148.0.7786.0 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb5d3e5d60,0x7ffb5d3e5d6c,0x7ffb5d3e5d78
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6024

C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\updater.exe
"C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\updater.exe" --system --windows-service --service=update
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:956
- C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\updater.exe
  "C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\Crashpad" --url=https://clients2.google.com/cr/staging_report --annotation=prod=AceUpdater --annotation=ver=148.0.7786.0 "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater.log" "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater_history.jsonl" --initial-client-data=0x244,0x248,0x24c,0x240,0x250,0x7ff679ee950c,0x7ff679ee9518,0x7ff679ee9528
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1648

C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\updater.exe
"C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\updater.exe" --system --windows-service --service=update-internal
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\updater.exe
  "C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\Crashpad" --url=https://clients2.google.com/cr/staging_report --annotation=prod=AceUpdater --annotation=ver=148.0.7786.0 "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater.log" "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater_history.jsonl" --initial-client-data=0x240,0x244,0x248,0x23c,0x24c,0x7ff679ee950c,0x7ff679ee9518,0x7ff679ee9528
  2⤵
  - Executes dropped EXE
  PID:1084

C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\updater.exe
"C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\updater.exe" --system --windows-service --service=update
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:984
- C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\updater.exe
  "C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Ace\AceUpdater\148.0.7786.0\Crashpad" --url=https://clients2.google.com/cr/staging_report --annotation=prod=AceUpdater --annotation=ver=148.0.7786.0 "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater.log" "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater_history.jsonl" --initial-client-data=0x240,0x244,0x248,0x23c,0x24c,0x7ff679ee950c,0x7ff679ee9518,0x7ff679ee9528
  2⤵
  - Executes dropped EXE
  PID:3044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

263e9b0e-5f27-4462-9165-af921798f5b4.tmp

Path C:\Program Files (x86)\Ace\AceUpdater\crx_cache\263e9b0e-5f27-4462-9165-af921798f5b4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Program Files (x86)\Ace\AceUpdater\crx_cache\metadata.json
Size 130B
SHA256 68a81d8743c56b43d20cd06881fbb954d9b27d89489d5cd6abde580c6f52ba35
MD5 4042bdca7eb810b8ff51a8e0a26df205
SHA1 3a09296a202aaebfa287697f2dbc478e32c6f353
SHA512 3cd693b36651a68a3da200a4ccf78329f2dd20cc99060427abdf91566793ac8f42e735743c6d12c842693731b97355f0470c01951aa0b6cf69436ebe261b3767
TLSH
T1BFC02B8FEA0C22488E66089E25D13C0AC3638740147A28CFC4078C4C041914D48CD8A5
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Program Files (x86)\Ace\AceUpdater\prefs.json
Size 607B
SHA256 79ba4149888eef8eb31828693e371889bf8968a150fb1aea3ab97c7bedcb4f30
MD5 96c3107ee46ede0e519c4c4a03e9774a
SHA1 c96ef90fc185cdec50a8f1f8274c965f3921c0de
SHA512 c0880d08a991ec128ccccd98854e43585d48c73aaeecdc84090270ddb0319d041ea17caf83ef5ec1e5140cc7131605312ea8ad8a98f5fbb148ed6d2833efdcaf
TLSH
T102F0AC685A25A633BD7006BEC80D5E0442F12651442D29488CE86C4E1C5B8CDDE4F41F
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Program Files (x86)\Ace\AceUpdater\prefs.json
Size 575B
SHA256 3959039cbb29a77be7fc10e1a4ba51141de1b7daca368151c22d1f20b2a4b7fd
MD5 43d69f1913fecc8ef11ea793daef13c3
SHA1 e210b1032f4e1b7d69dc15c45e8eaa22b6b98bc7
SHA512 6b90da093a2968f28acc73f3855d0270d2934ee186ade994a8c8d924e7ca049275198a7c805f0de5ae6d00a21c98bb1aaded08ee391b69b16acd8ff1fef8925b
TLSH
T150F08B6C5A39A773BD7007AAC50E6E4482F12A51453D29084CE86D8E1C5B8CDDE4F82F
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Program Files (x86)\Ace\AceUpdater\prefs.json
Size 49B
SHA256 c0dde518198082469c384d94d8c40a0fbf659e42654ebfea83df1e919396592e
MD5 3cf1c4f2168c26e171691f4c6280b1a9
SHA1 b85dce86fd17c8d43a65d7af4001f60e75e4cfc0
SHA512 fe3c231e8175880c51b7d5ff7c8c6b57eedee156f9d2435938d998f4639237de10fd157ab7dd5ab7c2ab6e77d2b8da2743b001874d00c77d696e59ac235556b8
MD5 SHA1 SHA512

Submit Download

prefs.json

Path C:\Program Files (x86)\Ace\AceUpdater\prefs.json
Size 642B
SHA256 ee0682948fd18783ab56c381c13629b60a236854ff1e791b8d6e415a56ee966d
MD5 a32b302672974838e2442450312fc405
SHA1 4ba7049921aa00440c03c041bcbb730d38d47884
SHA512 1149c216a363f2af1f01b230b8afaa8e955a1e7dcb68b13aad1b345235d5f4e3ae2d287c96d706335e56bcab161dbb0b9d28bec7c6be4ca00d39bac19cd69e70
TLSH
T184F07D585A25A633BD7406BBC90D5E4442E12661852D29488CD86D4E1C5F4CDDE4F41B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Program Files (x86)\Ace\AceUpdater\prefs.json
Size 607B
SHA256 7b74e740e214d0bfe5200023e9bc6e07ba59bdd5115c998e9971143a3c5857df
MD5 8492d164b3104bca0e069b6c3813fe44
SHA1 a401e2e7b1389aeb49725f4c67d13a257dceedc9
SHA512 0d76172ab8393692a82abe17650240dc412b381c2915b571afd220f8a2f4749208145589794a0d294d1821e59a761313fda4a35b3c3c8afb9cfc0898179cec49
TLSH
T151F0AC685E25A633BD3006BEC80D5E0442F12651442D29488CE86C4E1C5B8CDDE4F41F
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Program Files (x86)\Ace\AceUpdater\prefs.json
Size 1KB
SHA256 b9c192719e65429d85e5acc3fda42a3d70e5f407c5e032d6757a36b83d8da30d
MD5 9830f151a76d2cbb4ef87a7db8eda34f
SHA1 f9081462fcbd8d22b10dd5e1eed7763d5fe75de1
SHA512 1f0a1abb467cd2ba593f1d5e6aabb2e0ad3877a7c24acc504ff8456a2f01bc7b11334b69ee3fea2641bee45419e09c21bb8f01cbff97aee3619cc0244e02d3bd
TLSH
T19A11CB3D1A25AA33B97407BAC80D9E448EE12523862D2D884CD82E4E1C9E5CDDD4F81B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Program Files (x86)\Ace\AceUpdater\prefs.json
Size 83B
SHA256 122e1bfaf5aa6a9f5565ab7fafceab921af38fa2c1fa3c98ac93a4e205c362d9
MD5 ffce2c78389a341283a0dc941622ba73
SHA1 0473e9f7948726d21f89373b80fb4474a430c4a2
SHA512 d3019ed5bced92962ac809ab52227438dd146273c1b91b45164e879b0aae3d785d102170ceeac0ca5bca0bd097dc4ab0482982b3d1cf45614d4ae5d3bd4fbb0c
TLSH
T125A022220030C833F8038BAF080C0A80CFF802E3200802C220CC280B2BE3CCEE0A220F
MD5 SHA1 SHA512 TLSH

Submit Download

updater.log

Path C:\Program Files (x86)\Ace\AceUpdater\updater.log
Size 1KB
SHA256 0565461020fea72fa55622845042c4455a803582e95241ed68fc4950053f355f
MD5 52dfefc2cfc58914f3d50aba896246e7
SHA1 9d4292de0aa686a67a84d78cede3e72bdf2b7c0b
SHA512 fac46e59c12327befb0fde8ff9b1903b62b7acb3d6149e89caae72e4161978f712384baae7b91116821fc16ad8437326744d6afd9c346bab3b6a58ff0ad89b79
TLSH
T185216630560A8936631C4D29BB39AE4FC8F416485D2631352FEFAD6C269348E1D9C6DF
MD5 SHA1 SHA512 TLSH

Submit Download

updater.log

Path C:\Program Files (x86)\Ace\AceUpdater\updater.log
Size 5KB
SHA256 048dffd4d8ad3b65c23ecd47c7acd1eb41f22608b6757d460dd3a93b9c4e92bd
MD5 321d299cf057a62ea58d0e9fc61ad70b
SHA1 629cfd6b5dbbff39182064fba4378e6653b49841
SHA512 bfae27562712174520dcd83a69a64c4c8c2a7d79863c5bc5d651038ce3a5191ead953499e19468b87a62eb323c4de4034f1d6b2477cbd25a0022b056a5365b7c
SSDEEP 96:XnzhRqtThbeuRqtrXzhRqthvekpRqtKENJC/W6hkkCh:9ItThbvItRIthvHItKENs+6hkkCh
TLSH
T134B17320664BC87A63181C6A3F35294F98E40B484FA5713673DE2918FEC3C5E5DAC29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.log

Path C:\Program Files (x86)\Ace\AceUpdater\updater.log
Size 9KB
SHA256 56b2aaddeac5a0ff74284c4dd0ce65313f822859a03af2efec0b434944dcc09d
MD5 c6bffc8ee43fed90f7987994f6ab80d1
SHA1 896d69e791f8e40a7e4c781b118c48c09249f8a7
SHA512 eb411600488ec0c84024160214f8b962ebec157c4c679e2cd3c6df749c181dab98c5c929f9f5647cad20d6a83e37f197dfde7eaba4ec0904bdd72892b173c8fc
SSDEEP 192:9ItThbvItRIthvHItKENs+6hkkCrDgtWipKY5+FX:mF/wIG
TLSH
T111224720654BD4BB73141C7A3F34294FA8E8078487D5613673EE290DF9C7D6A4DAC19B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.log

Path C:\Program Files (x86)\Ace\AceUpdater\updater.log
Size 20KB
SHA256 b8f6956c9a747e0577883c1c7465e0c150c90eb00ba050bde596a1800fcfc5bc
MD5 f37189a368bc337d05dfefca2460cda5
SHA1 0604b35d931064c460207cabe407156962586302
SHA512 de604b034838bc4d003da3fa2a12a56950c8ae9594c3bf6f6033009388d192a99e132dbe4c4e902b65929a0879987b57aeaf489596abf07571489dc817c564fa
SSDEEP 192:9ItThbvItRIthvHItKENs+6hkkCrDgtWipKY5+F/xpBltH1c/VipK7jeKxX7L/LP:mF/wI4rZKdI6xXa+No+zdWeN1MHwbaQ
TLSH
T1C7922120A987D4FF73141D7A6A34254F98D80785C7D9A12273DE380CF9C7D5A4DAC2AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater_history.jsonl

Path C:\Program Files (x86)\Ace\AceUpdater\updater_history.jsonl
Size 1KB
SHA256 cbce2247835e16d4521aad9e39734a95a680409f550d54f18166b826ab1daf5e
MD5 a9a3b9b75402f761fc8247333117e28f
SHA1 6764803951a1c3819eb01ead1a518fa11b18f086
SHA512 36475bb883177ce5aa325398f746881f328018316c6b8bb06595d073155c53442d1966a157835d768a67522e8ea96da655d98fe78bace90c0d1f91f235c03b2c
TLSH
T1403162413128C421BE27919072AC2EAFC1E16D08C9D6D08D3BC9AF5CA7C784D5DED5AB
MD5 SHA1 SHA512 TLSH

Submit Download

updater_history.jsonl

Path C:\Program Files (x86)\Ace\AceUpdater\updater_history.jsonl
Size 3KB
SHA256 ab6c3ec19d1f90cb6f143281ce97d9c34c780abc0c8b838516d0850b3a750917
MD5 d5f4e121d9a014c2fd0539025c4ad38b
SHA1 0472582a0a19455cd96cd36634074bb2638a9881
SHA512 6c9e7a15e19e8b3510ce7e2152911b5980dad8326c9e535e93844f4545f5b0eadde92092f2e1fb66037c56c123034589f9ce96618b24f2f303d885ba9792bead
TLSH
T12D717543312DC821FE2791A072E82D6BC1B13A04D6D581882AD9BF1CA7C794D6DFE06B
MD5 SHA1 SHA512 TLSH

Submit Download

updater_history.jsonl

Path C:\Program Files (x86)\Ace\AceUpdater\updater_history.jsonl
Size 6KB
SHA256 6c92b952db78e628c026a6a4a80d5fadfceb52f48ed00bccc26811c29a14c552
MD5 d7f7d5e33f37977d0242ea7dd6bc9490
SHA1 586c6558041f013288f176474e747a06ae142292
SHA512 4dc290e68f462ad5a02e099ac44faf5bf2499fc21369d3b9ec33131184b78b8d8b016ef505d74d4024d48ab153583093e5cbd3ca4c83727d5899bb8a362c3317
SSDEEP 96:8Rqt0pMRYy0pKWPbKCa2pK3LA4MeZPU5areMyAX:8ItaTy0pK4bKCa2pK3dMQUdK
TLSH
T14EE18483712EC839FE33615035E43A1BD2B17948D1E082C92AD9BE5C52CB95E29EE51F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.cmd

Path C:\Program Files\Ace904_442078170\bin\uninstall.cmd
Size 618B
SHA256 3538d6952841615a24078799c4fa920ad209b906a80b0705df45abd378965446
MD5 cf3596ee84e67c4459672a3504ac0292
SHA1 3d05980f64d214619f2d409f4aa2782b03650845
SHA512 e4d5475ddea5f3200bf9a02ea1d5697e228b4f0785b9e2ac189dbc2a0e161dc678e152a8618d460350bbb0731d11a52a333cc6ab73a0526b8b1d2a7b8823cdeb
TLSH
T1E4F0DD2E77D4327149E30351BA49D1961A41C1FF222CB92211D7076928AB4E21AE5399
MD5 SHA1 SHA512 TLSH

Submit Download

updater.exe

Path C:\Program Files\Ace904_442078170\bin\updater.exe
Size 8.4MB
SHA256 899ed15049b3cb50b3a65884728e1d056f0e2c2cf4cea381b4b7064c92dcee09
MD5 3e5fb14ba51d0ca5ea9fc2e204a5303b
SHA1 03d4e8b29d5d8df7122d372281b23daf6b741e4e
SHA512 ecfbcc751426e027edaf9d0992bfc94ff716f86e6bc03dade74918c367aba94cc79d4174cd26066d9728621a944b125ae6770b6d70b5e04c53e49fb7e4cae85a
SSDEEP 98304:lJCW5IavZRqUogilouP95h7DOeoJd6Xg:zCpav2KpeoJog
TLSH
T119966D13F29651ECE06ED178872A5232B972BC494B30B5EF0790BA251E71FE06B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\AceUpdater_chrome_Unpacker_BeginUnzipping3376_264889127\CR_61688.tmp\setup.exe
Size 5.9MB
SHA256 92eec06b8f5dfc7e6a9c1681077a938c88c74d590741ddc1e0c7584c94a3af0e
MD5 628435765e3a2a51d0f10b31234e3959
SHA1 695d4160f856d3d41b3f747b4a24b20999bc505a
SHA512 ac19f7d51a579afcf8b334c509908d9b6e2975aa8c196f5c63e6a7b2c4f94891e59e3f5194b3f550803456cc60a07b7f6e183f824e9e69df0a4a1dcf46693459
SSDEEP 49152:yTn2jgkQM5gsMRM5TYWHn1fep2bDK5ddiz61r9fq1WQGYBsZLYggPf5ndPkmW+uU:usMRiHxaotAe5lncVoqME6
TLSH
T1A7565B43F2A211FCD46ED974CF2D9122AA247C4A47B1A7EF16D476E11A31ED47B38B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Program Files\Ace\Ace\Application\148.0.7786.0\chrome_100_percent.pak
Size 706KB
SHA256 a0930ae3bceeb560843191d9fdb32a74719b75029cff44a8e34abc7be6c224e8
MD5 8ad65c0085be375e71c3aa42821c6f69
SHA1 4b23a90854d2378a37a94d8633c5c582d58a59b9
SHA512 37bb57ff6e13be2de04226f7feec80c360f67599e6fc964eaef30c9d6c40171f0e2518e036d3d6382ae47774c678b60b3517c99eb6c2f77ffee8d05dcf603bb5
SSDEEP 12288:ZI3H1fJw0Ozgsz5B0GDJQrnKs8SNP+QSs8ilSTe+gnoYu4ydWYJblIrkjKQCrC:+3VB7+zEEmPL8bTe+gnoYu4ydJbQkGQt
TLSH
T172F412E77774AC7DEE9B1677826611B0FC77056C0A82020A1B9FF8796917B0898C93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Program Files\Ace\Ace\Application\148.0.7786.0\chrome_200_percent.pak
Size 1.2MB
SHA256 17773e6b4947ee6d0ff3e99b5462fc8f9d54490cdfc13e91386f3ab1200f1eb9
MD5 289cb721672b89d8425805181d689f42
SHA1 0ab6ab7c34d5c2e229d6cd515883ac277e2c0824
SHA512 7f4964a5771b50cd42be610110f6e3f1c18650965ccede2f80436c66f988ada09ac98048ccffa2c057b91fdb94c582d08ff2274b4d2bb36fa9f244b8a3a4e0d4
SSDEEP 24576:H3zB09pCmmibkFR8+mZi5r8BWhQumeeRB3w/+YdFIQwuSXA4baUGQ74:H3yCmNbkFRJmQ58khQRtz6F8uSXAUGQU
TLSH
T1B94522D7A374DC7DDD530B7792AB00F4FD7A106B0AA2100E0666BD7D3925A889AC67C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Program Files\Ace\Ace\Application\148.0.7786.0\chrome_elf.dll
Size 2.5MB
SHA256 0eac6f3aee3e59d074b8c9808f9a64ea556c6d2bb477d43e137f8895a766efad
MD5 fd8bdc7be222124eb26dd4b10108508f
SHA1 58e99a7112a81c16c40efcdb6dfd4396d5a8f678
SHA512 93adbc3ad0ebae98c9d3cbd9f5e143b702ac24acc1ca7be5f462806ee665b16c31e13bcb67592fd62013407471ef92f617663931e95350be824044af7d9a8b6c
SSDEEP 49152:MiU420iBJ9dw1B//GtnCNe5SgRNh5FJ5Y+QNA:MiU420/OiQRFV
TLSH
T177C55B53F2A651EDC06AC178871B9232FA61BC454B30BAEF0A90B7251E76FE0673D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Program Files\Ace\Ace\Application\148.0.7786.0\d3dcompiler_47.dll
Size 4.5MB
SHA256 9f11a04927304d9bfadbb137d0cec3affa69f3eff7ab213d66fc817213cf7164
MD5 3f14e9e3f2717a0404ab441cda57c254
SHA1 53306b4e4d6c146f052252857cbcea1048c1f629
SHA512 dd9935e42d6b6cb3d6ad35fe47e1fe4b36c03311960579779bbbcec2fec9677569a16a5b1b482d3918fa041d5572b9c0a9aeeb999cb657ca6f028cb77d93f969
SSDEEP 49152:x6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/Av:xUdeqt737jFm5wI
TLSH
T142268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Ace\Ace\Application\148.0.7786.0\elevation_service.exe
Size 3.7MB
SHA256 a768f909cd2fe78d8073d33d16ca9e7de01d187e39d3cedfff4804a6503c374b
MD5 8871c9cb4dc7d5406e20989657301ca0
SHA1 8aa3ef95b4abb3f496b062ba4b703a146d72bb23
SHA512 f2d66f040c4bcb743949d89577089b6c811438ed7be22f281921d2ece22b233519f256998da26498f7c6c4290f2863271a337cb07f46111a8a5b0bbe6190b14a
SSDEEP 49152:IWKDThK7ZUdGYyWoKDni5R1RJ/XLqvpbMdlseECv9mFndJvzo4FYSWfNN:sdK7SORJ+k2vroH
TLSH
T184067C03F59651ECC05AD178870A9632FA61BC494B25AAEF07D0F7212A72FE06F3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Program Files\Ace\Ace\Application\148.0.7786.0\icudtl.dat
Size 10.4MB
SHA256 c5da2fc389d1bb0ecb13fe22a8e069b7abc491f8aa5d16eb65d4ff32c85a46b6
MD5 5b29b82022f9697b3010b05b2a71535f
SHA1 eed88ddce48046b1a5c5fcdd19cd9c5a81d8c4bd
SHA512 bffa945bcb95b13e69a438afdcbd6d5a490db902896ed4380c7d7c61a4e53b35d73d44d75eaa7debae65e308b01b287411f168ea4377360045afe8a6b9cfa09c
SSDEEP 98304:D/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndP389o:D/cBhORok2HiXUxO/RJk3IWhlYntjdqo
TLSH
T179B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Program Files\Ace\Ace\Application\148.0.7786.0\libglesv2.dll
Size 8.2MB
SHA256 d0cc800a4cc0848f62ada458a2f80adc38f6f29bec2900fe17935d59ea7342fe
MD5 2bee8bacf6f069e65b633813b636a10d
SHA1 ce933ef57fede2a3563092dabca1a70896cea4ab
SHA512 678636954d71f366b72577c3f8dee4bbb21503330dbcc36d9b9177d4558a68db106864ff1eb5f156bd9fde5f1104a90f40c071e8ba3e3787166e80803d989de6
SSDEEP 98304:oVeoAEb7V9qMmrssSwonOllxXMqFLlFy9L7w7Ja:CNpOHnlkpua
TLSH
T151865A03F29290ADC45DD2784757A223F6307C4907387ADF1A94A7262F76FE0AB7A714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Program Files\Ace\Ace\Application\148.0.7786.0\locales\en-US.pak
Size 489KB
SHA256 6c7da7b5dd92e635b15baa32e8dfc33b8d693979510b34070fbcfd947142bc92
MD5 881ab5977d72baa2d9e9355a32d34d4f
SHA1 035c274e437706ba0f0bd69f6766e0a9c38acb04
SHA512 1b9f5eb064e755e93d76a4b782813d0c2fe01a3729246ce6d319e2e8a60f086a0945196e7019b7de505673e69d5175a09ca6e9b92ef6098466b414a728d13d22
SSDEEP 6144:Ch3t/6n60Fcog6SOe+oSsoMf9q14cWfaYypESbZ/JIw/:CD/d0mog6zM814cWw/
TLSH
T1EAB43C1FF744127606A312A27F0996A2FB36D06DA35152563CBC802C3373B76937B6E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Program Files\Ace\Ace\Application\148.0.7786.0\resources.pak
Size 14.4MB
SHA256 2b42ebb1d4154e78aecefc161834aba9bf749987451c710c8b294bc1686edfc4
MD5 ee6c96928eb429edac7700cda40122cb
SHA1 0033e403eaada64810ea96d4cb390589f6284b05
SHA512 829ab1803ca6924142624e47eb497a25d6488585b344dc7cdfbdea3df0343b79bb55fb1211a50952024d25fe5ab5e9006bde2c19794586c90a510a85e8a1bbcd
SSDEEP 196608:dZ9BMnaAgP0JFExcmEY32MCMjrQj2f08I3LYskrLbZcW+5oJeBLtgcJFgv3mSdnj:dZ9uXcxaI2MCMvi25skrhm2UgcJFge+
TLSH
T12FE633E57AA1A97FC9A603B5D588E3301A6C9D0E329530A304CD529CFE5979D1BC0B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Program Files\Ace\Ace\Application\148.0.7786.0\snapshot_blob.bin
Size 338KB
SHA256 48339f9db8d5885801012ef73c20589d8b006771e8f3d1e09a073aebdb9f3624
MD5 a60750566d95c8425d17307a844916b8
SHA1 666235a7fe96ae61956b388b7f62b7a6c06f1bf7
SHA512 4cf7e299adcd373976af6d9cde0b1d5c50e740f208e358e94c1bb87a8d4074dbd9f10c781b0ffaf83d43634591ade40f07814a9d80ba0b9717de79e7f630bc7e
SSDEEP 3072:7BuOiXK9Ot+xbRt2FyR3Ajs5FyN/YgIaGBipVVPoht/J5/P0cA/9:7Bu5Xzt+H7Sjs5Fe/RIaS6PonrP0Pl
TLSH
T12C74DC12F709CA26C8B635745EF98B942E24B2CD9DC9AF477060437DB4797640E2F28E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ace.exe

Path C:\Program Files\Ace\Ace\Application\ace.exe
Size 4.0MB
SHA256 d6a992fa8a73b3d6aa1aae00e9d5d146844197e7a50406b00b199ea0b3dc6d56
MD5 93233be03ae8eb0982c926a4ae088b77
SHA1 f76783b7ec23df14f80fd082bd2a05c73edd062f
SHA512 9a9764bc377ca53e4ba97f89a124b8d44f86b0adc839b0b3e9d3308a23dfc93f54fed7fead8efcb3e1587b22cebaf15de789bd0b28edbd0235c9b87be43ef5ba
SSDEEP 49152:0a6vgPzBZempzVPM0jgmKLf0v6tRqHLTcxTGNGIeoNbZAbzz3KULa5ZbJoyItFsI:z6obz0fXRq8jdJs1O
TLSH
T14D166C43F59650ECC019C078871A9632FA61BC495735BAEF0AD0BB212F76FE06A3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am_MASCULINE.pak

Path C:\Program Files\Ace\Ace\Temp\source2520_564722412\Chrome-bin\148.0.7786.0\Locales\am_MASCULINE.pak
Size 18B
SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
MD5 65f69bd2d8b6458d3ecf77d84d70dc1c
SHA1 679bdfb03cbaa594ace5af4340a061ddc514309d
SHA512 39f2728a1898bc9406516fa737c58c349e3bd7f779276a2f6679b3e3f0db43f956e03ad25e5d9bf4b07b19909febcc6c0560f71ab4f4fa6b5dd1f021ef742c60
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 e2fbd63c02b5359c151edbd45b5dbdb2570dae63d3e383f72e5370d493ca4059
MD5 707288ea22fe5427c640129deb8effce
SHA1 9098d4ea544e5e33feb3a5d6eda201db7091dcf5
SHA512 23c7a7f635b642b4f2e8db1444812e6b8016b0d5b968b9cf03f912cdefa6812f690a3b0251fd73bb57ef1d7d43bee87181a3bbd0cac85f38fe2f9d859bfeaa55
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1756_291276329\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1756_535183584\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
TLSH
T169A022F3F000F02030022F8A80203C00C8A23BA80C8020808000BEE0200322A3A0C820
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1756_535183584\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

407297cf-7bba-4b88-9a40-d8fea66cec6e.tmp

Path C:\Users\Admin\AppData\Local\Ace\Ace\User Data\407297cf-7bba-4b88-9a40-d8fea66cec6e.tmp
Size 1KB
SHA256 21296459448a4e4fd3ec7811b737bee3f21f8c21d5d696e315492a943bdc8e9b
MD5 83f6407b04a3c8dd96558cc241b78108
SHA1 11b118e80f4693d32ba6b6f17102dfbddd67afca
SHA512 9c51ed48a4ebe169182c0585c059e76b1530b35bbfba4d6ea62d7f5851d4cc27ea81e28ade4a9d7c7a5a695820dfb5037ec96a1af269d6843e45148aa4b013aa
TLSH
T16D1165B394242A77FC536585B9E16A935F352332D2600D0557CD010807FBAEE0627D33
MD5 SHA1 SHA512 TLSH

Submit Download

921e6dfd-09eb-4946-a3c8-b6b6996287cd.tmp

Path C:\Users\Admin\AppData\Local\Ace\Ace\User Data\Default\921e6dfd-09eb-4946-a3c8-b6b6996287cd.tmp
Size 182KB
SHA256 de849030d2b606c22e3e2b43de9cba5b484071999531566e99faf5a17fdadab8
MD5 8aca4a2cca77fc3f36276d73b4a38d39
SHA1 eff54f69661c94eec8d86abe36403d144f714013
SHA512 91ff3fdd6d01e0db88096cd66166b191beb100780cae9a4e68667586aeca504a0fb81a79f2cad32a2b701a610f2191e50faaec0e09729d0146139afefb241b8c
SSDEEP 3072:CS62L4kuF09G3N3qEDVDWrqizdq2pIRiHV/lG0a96h44tW8zcn:CSIG9o4Sr4tW3n
TLSH
T1A8047CB38E94085DCD9B173583ABDD2B39EB5E749C72BA5BD95A709C9B3B1C101B3002
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Ace\Ace\User Data\Default\Cache\Cache_Data\f_000004
Size 32KB
SHA256 3b6fb01a8367e774e9742ef4b5d08f9c8605c98f8a1c2a199328c5fc0c2a4ec3
MD5 45ca12a3fcd65a51421b43fc9ab6d190
SHA1 f9480af7a77770d5f2ccca5ad3bad538147a90af
SHA512 940b00431996818249a9ce51c824e089640fbaecab794a829483c36be93b415f663cafb7c1efc42f981c0f7e430d61803ed3aa3caad58ac3292538f098429650
SSDEEP 768:+mRMqFv91QsndEvO0yJEy+JHVk3l6PIFgR:+wHx91/cGJEZJ1+oAgR
TLSH
T1F8E29C9627F11D87E459073F5AEBC70A73B4CC12236B97134FC136A1BD64BEAA6180D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Ace\Ace\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 624B
SHA256 18f3b199a359c167d557bf5dd4bdcbda7f6dad33c9f11b33174a8725d8702da8
MD5 4006f78fc0eac53003c545f8f0b22bcc
SHA1 f87c6f29735ac61e7b5bee488dcd122b85b77795
SHA512 f0c3a3e832b72ebcbfa9dfa17f67e905cd1f0f2f63f992db93dc7e32687242b6496a8dc86161d4a85b451fab429efd57ae674be028059bbd42ea3b6b76d9d190
TLSH
T1ECF027A981B14237DF254EB041D03A1D75395730050F5F81528285F75E7A3C7236580C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Ace\Ace\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 2e3603399efbe4ad3e9ffaae6f1c2051e64e481c4b63bbf513bf662c06ff6a04
MD5 4d67f50ebcf2e67a00820ba327507d62
SHA1 4132939b501705d2a1f249b9400bd7e554eb4016
SHA512 8a1d233e3f1587358ad8a753ee963e382c420ca6453c0be19719f9d575c280cc00952b0530b0b3eb160fb83c46bfa7c231388e4ae36c162b50d856780ac0e516
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Ace\Ace\User Data\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

5d5dc802-08e2-4f2a-86d4-55a6d3f1b276.tmp

Path C:\Users\Admin\AppData\Local\Ace\Ace\User Data\Default\Service Worker\ScriptCache\index-dir\5d5dc802-08e2-4f2a-86d4-55a6d3f1b276.tmp
Size 72B
SHA256 9aaab66edab1e4f9476a144f69917213bc46099825752c1d10ea145ffd2d7dd3
MD5 20a40e87bbd3693e14b9068c71adba9c
SHA1 300f94582b9fa03d74396f9d541e57c0311a7a98
SHA512 5ab16b991f988c32070d8af032c5c63b286c20460392c99630c64fb089ce003c261d4e7b7644e4f218b0c8fb67e1dffd4f7e105f116769f58314c3f8b21654ee
TLSH
T100A002190654E330C90812B4280683882300BB2AA4440253B6D0038ADDF40518B15194
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Ace\Ace\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 360B
SHA256 883e0f929d32c65e1bdb12232c1da4f177d0bdc112a40588b7f142c2e5443976
MD5 f40440697d18891fa0295678e8e87593
SHA1 730a410dabb43762fe360c080559ad38b40084a2
SHA512 567a33f1f894027c9c63138c64c52c82b29aecbce78cf20d0a826a5513730c331b88159512fe6793ecb10beb25d364e963ce7dd2601268f30ff49f8a2ce23ab4
TLSH
T1E1E0A713D9C66618CA900B701196048F7335DAE2C74D93474164B3BA1CA65913A35381
MD5 SHA1 SHA512 TLSH

Submit Download

c90b5e9c-d3b0-4056-8e48-49e7ccb5b744.tmp

Path C:\Users\Admin\AppData\Local\Ace\Ace\User Data\Default\c90b5e9c-d3b0-4056-8e48-49e7ccb5b744.tmp
Size 10KB
SHA256 82adffdd1199477f79e9f0edb99511acb5f8fd248cbf218412db9b8750c97fbe
MD5 3d1de7baf8e7ae1947babf525e851531
SHA1 e7f82157d8792eb20f06f08f20387666351e4f75
SHA512 49685a6cc8ca477c67447c00a7997b4c8e1f435eff8f41145c2bb242acbcafd277ccb3464fb7284351e84d2856b7f069ed0337f9b4330e528377035527758d78
SSDEEP 192:zRhqLRHf+vv7yQNG09ZHcb+WNOsV6yXAoyIsn21gA4:zRhqLRHf+ek/gOpA4
TLSH
T18322D86FA910543B6CD7D21AFE257782E7F6002131D42D44E7FC8A2C1AEBACD6217917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Ace\Ace\User Data\Local State
Size 3KB
SHA256 0ad9f6969d22645fad4910824746fd1c80df29d1ad5557663527a1990b155975
MD5 bfcd4e5644be0fc44a1b4651cc4459b2
SHA1 f7029a506d8278d91b0fa399356aa8be9a7eacc2
SHA512 4f95cc6187454270a2de5fd5d65d9c712da4656b00759911ab5d2b49cfcb5469e689b0e9df50f90ca66ed88f2aab2960d31ddfd3dcccb07a40df4ff6508149bb
TLSH
T13681D735A0658D3B69B39945B9523D43CF7A113BA6606984AAEC4F0C03EB9ED1316A07
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b20c54282d93bde52182342a27f9121966cad7a2ff8b74e4e974996b7cf21fdc
MD5 9beb8fb59252379bd82e04c0e215e400
SHA1 7def8c5146440934f167e2093b52aac9f5a920e1
SHA512 2d623680b5df1d21f357fd8a02b1b6c6f75ff693211b66a3877d4e5c905f21ffe4086a57a58e3bcfb7a8764705a1d9a22f40103da38b486ee24a554af9ea98ed
TLSH
T1F6D0121332420274C81024331013762D0900C1AB510D4200A42889AF1A080B009024D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 bc71a2d404b9b54186aa4a59abddfeadad6b0b80877f0b7c498a8a74d89bd185
MD5 a13182017f76bc11919e607ff199052f
SHA1 bcb99d4155ecffb7ca3a86b913d04992c71e89cf
SHA512 92f85f01ac4c98eb5c9431f2a939de5b77f771a4b10ddeeedd927babc9de4cd3e8f531461532b7dc7048b3f0b8f457e13b758f1d0cd2bd7c163c465068d931bb
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Default\Cache\Cache_Data\f_000002
Size 1024KB
SHA256 6058ebcfba86a17fcaf6330b3ad2af64a0c9b3af0aa032253d832584be5a3a6e
MD5 3a6df5b8b549c6b169279f6d8cedb5ba
SHA1 903c907094fab271af863e56e49ffa305b562be2
SHA512 c2eeeeea390aaf744aaaa6b001342870247f4354a37d0e702f517737882e9cff983e26a8a122dfa4054fbddbf26324a1f483ceb739b64222fcee21c1cde5acd5
SSDEEP 12288:+pZD1KeDNY0+f4YMPsow08KtY25qUCO5Lm1FBFNnoifuw97p5yMDiP2wciYJxGsU:+Ld+cwzBLf1X7B97p5PGP2XZfuNoOf
TLSH
T1202523135F3689DB72DC068AAD356721FB22AAD54351F8AB90E03446F078878DBD9C4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 f6933c4d7c39aec082b03038d7424feb02e04aa0a9c6c4c49df0f715db333fa3
MD5 be05aad4960de93882128b743ccae1fa
SHA1 0cc7c33990d2eea71d362a4316e12d19c9f20b87
SHA512 927085b43cb9aa4ebb9c5f25b3305d68ea3ab80a4932f03d599c225603e1fc7ffa22c482c4e1ecbb865b86539024602fda5818db939af5dc918ba792831d8350
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 107e0a1e6f597825114e926baa3897e0089467c94b22586e40c277f5513f2844
MD5 468193730b77887b4d2b43c3bec184d0
SHA1 fc8592cc7e6690415d5cb7a18b8323c7230a326f
SHA512 b7070333473f601790e4b227cede4188cff0777e95e821c4bdce4cca1461d52d1d947def07741254d58a6cbe2eb8e804cafd5bf4cc4b56bb876392981ebf9fcb
TLSH
T17FA0022906901602C925077052DA87617E344E7602430B43C1D485E5DF513846211557
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Default\Network\Network Persistent State
Size 699B
SHA256 982b6985326dffa2050acdc30d7b2f8837be8e3c8b75d5c63bf1ef980820fb30
MD5 f46345d8582c887139816e64f097007a
SHA1 cc83c3df8d6a18e566916aecd5ca60613b689eef
SHA512 07c3aab2fab2823d16338387355893997ebd7eb92cc6b5066b2e14457b1016a6282b83c723b572c23d9f5be591aa9b8aae9a4d13562b8218860268bffa4b67fb
TLSH
T102014CB7837419BFCB1292B86E156D178E680553137C291B82E06796E3E1960E5A0B4B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Default\Network\Network Persistent State
Size 583B
SHA256 14f61553b3cea05f90b9f81e277a9f2e8c6d06dbf132f5ffaf862ec14c1f7cac
MD5 6c0321deb5e9cc13a02b88448f4140e5
SHA1 9e7776d942f5576ed3796bea69ca126f0b6d63bf
SHA512 c1f42d4f89cb4be9bdacc1236f1580b3c8aa864f4fa4dabf3779f2681916fca8d9becf53d367294a579e88285469bf6b02233f19e3518944f9f9ae4fddb8b93b
TLSH
T121F0ACB7837409BFCB0283F86E156D178F680553033C291B82E0679BD3E1960E5A0A4B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59712f.TMP

Path C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Default\Network\Network Persistent State~RFe59712f.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Default\Network\TransportSecurity
Size 188B
SHA256 d907065752db032e96c336ceee9f2134392da80b131c7a4c7bad5a237d8d40a2
MD5 016f5697645240e4ce9ca5e51b43740b
SHA1 ac6a99260c061019e8c582a21fd2e9d3c4b676ab
SHA512 bafbb5340c7a3bdc8231ec426d4e36701a3d27878b57e154f81d9d52c4defc7a2353bd1322267412b4711045b86112ac7667bd702a36e76d6b1fd850f5f575f1
TLSH
T1C5C022A2003EA43A183805292EC07D085F37B2310040A4F8A6A28EA890002AE4103443
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe58cd7c.TMP

Path C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Default\Network\TransportSecurity~RFe58cd7c.TMP
Size 188B
SHA256 d5baa7fa402fb841da29ab1d2d65ce54f442b609fc366b10ee548ce596e4112c
MD5 582365408c3da2773a384944a3e06ef0
SHA1 099a36db597578ee2877d5a0ad446f71e5f22e0b
SHA512 9424bacadcf330760d0b33e73b3b108bec582e000b46185684f004e7c47376f94c34ba06e92bc1e3ab85b2124da2256a0b7bf5a49f6bdecfac13cb1ffd3e7e7a
TLSH
T19AC022A200BEA93730380B2529C07D056F37A0300040A4EEA6964A2890000664A0B443
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Default\Preferences
Size 7KB
SHA256 8f51ded3677f5dc618100389c80d6dd33a0a189f9747d7aea8651dbe35e17dd0
MD5 204e0e45c7f2756e4da026199c87881b
SHA1 eab33b2c309b26a485f6d09556b320af59da3bf8
SHA512 071163a2da1c56da757d70f1225e584dd5f457dfd8ac87f318746d586a9a84530873d4098d8d634080bd17370721ef11c87163da088c167d7338b5dae3db2c7d
SSDEEP 96:stXY05Elcq3b9k+ffqeZ8i0vhEWDkTGzm/7qx+WVHMSm+uecsA586FdQjp+gNDKC:stXY0+ZfzZ8patGC/S+WiaA582dofDKC
TLSH
T10BE1C8435E2859775CC7E6197A25BB52E2F6202266C01E58EBFC860C09EA6DC5307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Default\Preferences
Size 6KB
SHA256 638b2b92b2cdea406ee3df1d1c8a5c8eaf0adf46977b764b248b282dbac94250
MD5 4d8c7fb87043af59c1aed91849657736
SHA1 d540435e512f8b872ba78b81fcf48a93c8321fe4
SHA512 bff7f903e25ce61b337508ad08fc82db2207f38cbdd819a54ca2ec75807603741268a7924e14db84517bbd9bfaae10bd7031dd8f50f097f708cadd83dcb3e83c
SSDEEP 96:stXY05Elcq3b9k+ffIZ8i0vhEWDkTGzm/7qx+WVHMSm+uecsA586FdQjp+gFiMOB:stXY0+ZfAZ8patGC/S+WiaA582do/iMC
TLSH
T1ABE1C8435E2869775CC7F6197A35BB52E2FA602266D00E58EBFDC60C09EA6CC5307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58ff2b.TMP

Path C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Default\Preferences~RFe58ff2b.TMP
Size 6KB
SHA256 79c5adff701b667d7943f399eb28e6a2bd1f390afaf441c63b0db7eb48ff0b90
MD5 728ecc1467172e7eeae6f7538298fcde
SHA1 2bf08f776272678950a99857479da3dc9458f8c2
SHA512 cef1236e7c55e3e52fb0254c8c9f0c024d4c6cfd0998e4a821272f5070f56a14277ab973cb51525ee841d594a2b0306b931f339ec43baa16b519ad6cea8c1bc4
SSDEEP 96:stXY05Elcq3b9kmffIZ8i0vhEWDkTGzm/7qx+WVHMSm+uecs+E1idQjp+geiMEB:stXY0+9fAZ8patGC/S+Wia+EwdosiM8
TLSH
T1DED1B8435F2869774CCBE61A7A35FB52E2F9202166D40E58EBFD860C09EA6DC5307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Local State
Size 1KB
SHA256 5b47c9c5ccb50373a54bd975ae44a76f0d8443b3541ed923f6af558a53cf380a
MD5 623dee4ac29ae8d91c5dd2934e5e037d
SHA1 0b5df992bf97bc3f3b3430b7d2f6ccd46c9644f7
SHA512 3ccbfd79d7b99550bd7f2d45996968e7aee4ff34d9c1130fed96549ecc00fc6a655ad723af55de6c8e3a7032960ffc18143628d0c3486a34b80474f33ceae269
TLSH
T1443187B3A4E05B711C93A556B3576B9B6E31607281504F8892EE4B0C07F769CA636C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Local State
Size 2KB
SHA256 cfa38cd576350e99db15f29463e82f2f769f3efcf3fd89b17fc9a97161bc7b6d
MD5 4f182ee363896f8ca17c27abe5594ac0
SHA1 92d8b04fdc36729a960f36202b9fce51a56c04a5
SHA512 9863bdaec166305a8b48e65a4c629bc3be411dbbcb24291ad6cd470c18a9ac383be4a3066a8240ff11a90edc2afd95100a833cb6607ed9887cfdc2c940a31eb4
TLSH
T16F51C7B378549A7748E39944BA4A3F53EE35506196A12F9496EE0B0C02EF65C3312C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Local State
Size 3KB
SHA256 e4b7bbaa05de160fd0331d788acb86985ccbf6854127546a6891415b2617b278
MD5 4fb31b5bf0f2fbde915f9929fcef3a6a
SHA1 0be0b6d6beb21f15110954e977d0007dec43dbdc
SHA512 b6fdf9883b0112ff2f69e5999e083d025e923d3f63832b52c4768a68fcf3bea54603d23adf3b28fcbc3c1e69468443146636b9e4f6d5bdc4f54e99150aed3787
TLSH
T19071A46368A4E9274DF3AD05B9862B16BA615133D5D53F98DAED0F0C02EB3982312C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Local State
Size 15KB
SHA256 6fa8ad4e67e2a4ae36196418a7dd11a475ac4a953c6c2fd9b9c009acc090fa0a
MD5 0f341da559585a8e7ef65e39c69335c1
SHA1 74540fb9a8661b7502238cd6836b2198c3391651
SHA512 8d34af2c0cadbbaee94b78b1f6a32b7fe3ee3cd697b737af2ab393b3714bfd9f425ab23a1405f602dc965754fbdfcaca84b76cd7a4c0fe66ff5ddcf1a45637cf
SSDEEP 384:zSsrv+89zHqlDNP9oid6NbiSWSCGjgjACNC:prv+4UNbdiGigjACNC
TLSH
T1BE72AE73A57CA7335CF3E804B44A2A0B7F7850A691C10BA4DADA0F8D42DE1D92316D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe585bc7.TMP

Path C:\Users\Admin\AppData\Local\Temp\AceInstallerWizardData\EBWebView\Local State~RFe585bc7.TMP
Size 1KB
SHA256 13cd2719307a944d0fcc5f5f8de3848fd2d8412c14ce1ee255349e63779025ad
MD5 b61c0b7266c88f620c3a1297e9737c08
SHA1 40b8ca71de740f9ffd9124e8f6d5fece84fd775e
SHA512 0ea04858f79a6f1df8b28bb4af1de5c480ad1eabdb1d8280ef9014b16d857af670ff752ee8b8fd586be2abe271f3b2aa972d4ba1bf96582d5f5a1552dd25cdf8
TLSH
T1CE216573E4E46AB12C925855B713AB8A6E20A07282548F4CD2DE570D07EB69C9736C33
MD5 SHA1 SHA512 TLSH

Submit Download

Ace.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Ace.lnk
Size 2KB
SHA256 e9e1dae0117e15f32eb437ec9dcfd3d8ec9b00102e6ffc9d5aa6a40f83ef209d
MD5 e0c09797f29a6019c693205a2f9d5826
SHA1 d9ce73dd3f0387db522911f1448118b44137514e
SHA512 5f981b1c8e19fda73c0176dcc2d9c148a29de5be2d3ef27d528639b78a86398d825c91102c9807a11d64a234a1118e02d543b860e1c05bc0a3edeba4f32781e9
TLSH
T1B941C00626E613E4E3F39232563737306F3BBC0595169B1E9089828D54E3D949DD8F7B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2556-132-0x00007FFB7C2D0000-0x00007FFB7C2D1000-memory.dmp

Download

memory/3108-101-0x00007FFB7C2D0000-0x00007FFB7C2D1000-memory.dmp

Download

memory/3108-102-0x00007FFB7CB10000-0x00007FFB7CB11000-memory.dmp

Download

memory/4340-1472-0x00000271C0EB0000-0x00000271C15D9000-memory.dmp

Download

memory/4928-25-0x00007FFB7C2D0000-0x00007FFB7C2D1000-memory.dmp

Download

memory/5260-1543-0x0000027246600000-0x0000027246A8D000-memory.dmp

Download

memory/5260-1575-0x0000027246600000-0x0000027246A8D000-memory.dmp

Download

memory/5900-1107-0x00007FFB7CB10000-0x00007FFB7CB11000-memory.dmp

Download

memory/5900-1106-0x00007FFB7C2D0000-0x00007FFB7C2D1000-memory.dmp

Download