87a8574288014c615648b2ad238d9d75a632bd90adbe94edb45b8c28e21b7f5d

Resubmissions

06/08/2026, 13:21

260806-qlyd9awxfs8

06/08/2026, 12:13

260806-pd4evshf238

Analysis

user interaction
yes
max time kernel
95s
max time network
100s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
06/08/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Essential_0.0.4_x64-setup.exe
Size 11.8MB
Sample260806-pd4evshf23
SHA256 87a8574288014c615648b2ad238d9d75a632bd90adbe94edb45b8c28e21b7f5d
MD5 031790b667865c3627227b4900ff5081
SHA1 e258f57f3caf9c028159bda2cfc67ac69424e126
SHA512 ba954e6999e7ad685f1bc8dd2b98bf2c9ff34025f9197b54cef8af88e7369ad9effae9d69dea19a03bf56a4324686c3c99e355054acb30b1d8a8bbf47cb28ace
SSDEEP 196608:95oZBQABLohOBQsQZ2MdxHRwZCbep0rPPV/uQiL+Ve2cEmH6kvolfdbYs30xxWds:95oXQuKe1yJ3rPd/uQiL+VpvoKVE00TH
TLSH
T1D8C633FA214D6D7EDB419E70C23605E6EA0D8D92B8F10A894EB57D628304A83D5C7DF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
74	3224	Essential.exe

Executes dropped EXE 2 IoCs

pid	Process
3224	Essential.exe
1936	lsp.exe

Loads dropped DLL 7 IoCs

pid	Process
2864	Essential_0.0.4_x64-setup.exe
2864	Essential_0.0.4_x64-setup.exe
2864	Essential_0.0.4_x64-setup.exe
2864	Essential_0.0.4_x64-setup.exe
2864	Essential_0.0.4_x64-setup.exe
2864	Essential_0.0.4_x64-setup.exe
2864	Essential_0.0.4_x64-setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Essential.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
21	raw.githubusercontent.com
64	raw.githubusercontent.com
74	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 15 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3604	tasklist.exe
884	tasklist.exe
4552	tasklist.exe
4816	tasklist.exe
3092	tasklist.exe
1984	tasklist.exe
3064	tasklist.exe
1788	tasklist.exe
4256	tasklist.exe
392	tasklist.exe
4092	tasklist.exe
1964	tasklist.exe
1068	tasklist.exe
1084	tasklist.exe
1880	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4828	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Essential_0.0.4_x64-setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5128	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304920975528431"	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2864	Essential_0.0.4_x64-setup.exe
2864	Essential_0.0.4_x64-setup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1360	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeImpersonatePrivilege	2864	Essential_0.0.4_x64-setup.exe
Token: SeImpersonatePrivilege	2864	Essential_0.0.4_x64-setup.exe
Token: 35	3224	Essential.exe
Token: 35	3224	Essential.exe
Token: SeDebugPrivilege	3092	tasklist.exe
Token: SeDebugPrivilege	4256	tasklist.exe
Token: SeDebugPrivilege	3604	tasklist.exe
Token: SeDebugPrivilege	392	tasklist.exe
Token: SeDebugPrivilege	4092	tasklist.exe
Token: SeDebugPrivilege	1964	tasklist.exe
Token: SeDebugPrivilege	1084	tasklist.exe
Token: SeDebugPrivilege	1984	tasklist.exe
Token: SeDebugPrivilege	3064	tasklist.exe
Token: SeDebugPrivilege	1880	tasklist.exe
Token: SeDebugPrivilege	884	tasklist.exe
Token: SeDebugPrivilege	4552	tasklist.exe
Token: SeDebugPrivilege	1788	tasklist.exe
Token: SeDebugPrivilege	1068	tasklist.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3224	Essential.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 1360	3224	Essential.exe	91
PID 1360 wrote to memory of 3696	1360	msedgewebview2.exe	92
PID 1360 wrote to memory of 3656	1360	msedgewebview2.exe	94
PID 1360 wrote to memory of 3656	1360	msedgewebview2.exe	94
PID 1360 wrote to memory of 3656	1360	msedgewebview2.exe	94
PID 1360 wrote to memory of 752	1360	msedgewebview2.exe	95
PID 1360 wrote to memory of 4136	1360	msedgewebview2.exe	96
PID 1360 wrote to memory of 4136	1360	msedgewebview2.exe	96
PID 1360 wrote to memory of 1380	1360	msedgewebview2.exe	97
PID 1360 wrote to memory of 1380	1360	msedgewebview2.exe	97
PID 1360 wrote to memory of 1380	1360	msedgewebview2.exe	97
PID 3224 wrote to memory of 2500	3224	Essential.exe	98
PID 3224 wrote to memory of 3092	3224	Essential.exe	102
PID 3224 wrote to memory of 4256	3224	Essential.exe	104
PID 3224 wrote to memory of 3604	3224	Essential.exe	106
PID 3224 wrote to memory of 392	3224	Essential.exe	108
PID 3224 wrote to memory of 4092	3224	Essential.exe	110
PID 3224 wrote to memory of 1964	3224	Essential.exe	112
PID 3224 wrote to memory of 1084	3224	Essential.exe	114
PID 3224 wrote to memory of 1984	3224	Essential.exe	116
PID 3224 wrote to memory of 3064	3224	Essential.exe	118
PID 3224 wrote to memory of 1876	3224	Essential.exe	120
PID 3224 wrote to memory of 1880	3224	Essential.exe	122
PID 3224 wrote to memory of 1936	3224	Essential.exe	124
PID 3224 wrote to memory of 884	3224	Essential.exe	126
PID 3224 wrote to memory of 4552	3224	Essential.exe	128
PID 3224 wrote to memory of 1788	3224	Essential.exe	133
PID 3224 wrote to memory of 1068	3224	Essential.exe	136
PID 3224 wrote to memory of 4828	3224	Essential.exe	139

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2500	attrib.exe
1876	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Essential_0.0.4_x64-setup.exe
"C:\Users\Admin\AppData\Local\Temp\Essential_0.0.4_x64-setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2864
- C:\Users\Admin\AppData\Local\Essential\Essential.exe
  "C:\Users\Admin\AppData\Local\Essential\Essential.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Essential.exe --webview-exe-version=0.0.4 --user-data-dir="C:\Users\Admin\AppData\Local\essential.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3224.3220.18108028638026614523
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:1360
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\essential.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffbe5f4b078,0x7ffbe5f4b084,0x7ffbe5f4b090
      4⤵
      PID:3696
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\essential.exe\EBWebView" --webview-exe-name=Essential.exe --webview-exe-version=0.0.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1812,i,6656846081369828584,4911770836055731156,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:2
      4⤵
      PID:3656
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\essential.exe\EBWebView" --webview-exe-name=Essential.exe --webview-exe-version=0.0.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2076,i,6656846081369828584,4911770836055731156,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:3
      4⤵
      PID:752
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\essential.exe\EBWebView" --webview-exe-name=Essential.exe --webview-exe-version=0.0.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2120,i,6656846081369828584,4911770836055731156,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:8
      4⤵
      PID:4136
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\essential.exe\EBWebView" --webview-exe-name=Essential.exe --webview-exe-version=0.0.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3508,i,6656846081369828584,4911770836055731156,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      PID:1380
- - C:\Windows\system32\attrib.exe
    "attrib" +h C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Essential\lsp
    3⤵
    - Views/modifies file attributes
    PID:2500
- - C:\Windows\system32\tasklist.exe
    "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3092
- - C:\Windows\system32\tasklist.exe
    "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4256
- - C:\Windows\system32\tasklist.exe
    "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3604
- - C:\Windows\system32\tasklist.exe
    "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:392
- - C:\Windows\system32\tasklist.exe
    "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4092
- - C:\Windows\system32\tasklist.exe
    "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1964
- - C:\Windows\system32\tasklist.exe
    "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1084
- - C:\Windows\system32\tasklist.exe
    "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1984
- - C:\Windows\system32\tasklist.exe
    "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3064
- - C:\Windows\system32\attrib.exe
    "attrib" +h C:\Users\Admin\AppData\Roaming\essential.exe\v
    3⤵
    - Views/modifies file attributes
    PID:1876
- - C:\Windows\system32\tasklist.exe
    "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1880
- - C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Essential\lsp\lsp.exe
    "C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Essential\lsp\lsp.exe" lsp --definitions=C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Essential\lsp\globalTypes.d.luau --definitions=C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Essential\lsp\executor.d.luau --documentation=C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Essential\lsp\en-us.json --documentation=C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Essential\lsp\luau-en-us.json
    3⤵
    - Executes dropped EXE
    PID:1936
- - C:\Windows\system32\tasklist.exe
    "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:884
- - C:\Windows\system32\tasklist.exe
    "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4552
- - C:\Windows\system32\tasklist.exe
    "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1788
- - C:\Windows\system32\tasklist.exe
    "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1068
- - C:\Windows\system32\cmd.exe
    "cmd" /c start "" "https://discord.com/oauth2/authorize?client_id=1530904904997011546&response_type=code&scope=identify&redirect_uri=http%3A%2F%2Flocalhost%3A17835%2Fcallback&state=a0d5536bc0fd01cee8081241e33c577c"
    3⤵
    - Executes a command shell one-liner
    PID:4828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/oauth2/authorize?client_id=1530904904997011546&response_type=code&scope=identify&redirect_uri=http%3A%2F%2Flocalhost%3A17835%2Fcallback&state=a0d5536bc0fd01cee8081241e33c577c
      4⤵
      PID:1524
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://discord.com/oauth2/authorize?client_id=1530904904997011546&response_type=code&scope=identify&redirect_uri=http%3A%2F%2Flocalhost%3A17835%2Fcallback&state=a0d5536bc0fd01cee8081241e33c577c
        5⤵
        
        PID:4736
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x304,0x7ffbe36cc188,0x7ffbe36cc194,0x7ffbe36cc1a0
        6⤵
        
        PID:2208
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,7203387757763638631,17924583174348552980,524288 --field-trial-handle=2636,i,6037251417756715650,15364930371961768233,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:5128
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,16544304725580383365,7355975506003086959,262144 --field-trial-handle=2636,i,6037251417756715650,15364930371961768233,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:2
        6⤵
        
        PID:5148
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,337440241928860926,7185835455329709177,524288 --field-trial-handle=2636,i,6037251417756715650,15364930371961768233,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:8
        6⤵
        
        PID:5156
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,17509008541679065707,6400113871769248870,2097152 --field-trial-handle=2636,i,6037251417756715650,15364930371961768233,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
        6⤵
        
        PID:5216
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,15382518797920561669,7913016510727058876,2097152 --field-trial-handle=2636,i,6037251417756715650,15364930371961768233,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
        6⤵
        
        PID:5224
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4132,i,1133076976801747648,2680745570065237751,2097152 --field-trial-handle=2636,i,6037251417756715650,15364930371961768233,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:1
        6⤵
        
        PID:5376
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4144,i,1761845325869109360,15399798379278589286,2097152 --field-trial-handle=2636,i,6037251417756715650,15364930371961768233,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:2
        6⤵
        
        PID:5384
- - C:\Windows\system32\tasklist.exe
    "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:4816

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Essential.exe

Path C:\Users\Admin\AppData\Local\Essential\Essential.exe
Size 23.8MB
SHA256 37032a994b082431bf8fe0c165a2ecfb9c0e194242b8a3618c358cda0cf5d729
MD5 196609e9c5739fe63be4471f8a4f3ffd
SHA1 dc5fb521f830b9eda30c20bf3509388773fdc8bd
SHA512 c45499b292c52de74156a31816293b9ef6dc183be138bc72db7116bf44943cc2afa4fb0f11ed0ce3f875fdae1a6190dd4a0ede2b263599aefc2f3fc5325b73a1
SSDEEP 393216:XjcNN8OTdOSUbu3ZFzeO9BUNfnAvqUnfjbGJs9uKLH:XjcNN8OTdOSUbu3ZFzeO9lvbnbR
TLSH
T141476B207A5A996CD09BC47483478A721A7130EB1B35BAFF44D496382F7DBF46F38219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

beta.log

Path C:\Users\Admin\AppData\Local\Essential\Essential\beta.log
Size 2KB
SHA256 35c20fc8b4a7023ada9afc0f5c02cbdae19a25150e559198a139a2a7546c47ce
MD5 88f9de1df1082f3fb23fc0f34147044f
SHA1 bb066590a311c317b73e3f622396587982ae0146
SHA512 d12a4f4c1a8234cf15bd28d1a44b962732833db303f14d30c1fd2999759e44f1a8e4c00b4278878ca0fb26a47429ca706c12c4f893d47751695aa77878207e01
TLSH
T133510D4F84A7806F987B2549F62E9DB07E467BC105CB822AF90F98DC34D12472F25E82
MD5 SHA1 SHA512 TLSH

Submit Download

beta.log

Path C:\Users\Admin\AppData\Local\Essential\Essential\beta.log
Size 4KB
SHA256 dcbd01d01660c52bc68fe7c507b1137f98cd59f606ef1cb7668c9bb53350d908
MD5 3d34fb8c281dd16c66e210c5592bbfce
SHA1 24fa9005976896450c48707841a649b80628d12c
SHA512 4433804178c8cd35802e0f46134f583502ae397343af64842af45073b4377c5649db100254b610eb2007401dfddeca931d9d297c9f8d6dda8d6562c1660af54d
SSDEEP 96:rvgBvvrJKPQ/ywZ5KQGMw4BImy9LzalOhhNaNWgyz:LCT9q7
TLSH
T1EB91F85F85AB805F987B2649F61DADE07E477BC1028B812BF94A68CC30D12473F2DD96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 eb6e4c3c1ff9ed97bb67aeb0d434ffe02961fef2204006156de0c8016e804f8c
MD5 ad47d0f507ef049d8589a010a5742cb0
SHA1 b6cd0d47a5138ac8c4b9f43cfb419391ca142fa6
SHA512 8347fe69939685ced24d8db2ac65a696d817ae5d3cc9eaadabcc077032027d0ae50a34c8744211ec16388506f4257888fbaa081dbfc2aa366d9e0e40c78e2b89
TLSH
T1ABD08033368D6402DBA573B3D447CF45175E557415529702F124D54CC6F50C49397686
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0382957c99791bbf37f0a292a68a688ba898893f53c7be2d420d0abfa3205949
MD5 80e81afd519a94b0e3f1e843218d3393
SHA1 093d55b2a0251e8969cd893db151c2617d83ebb1
SHA512 192644826f1731a384b4a8a62d6df749510036d4f447f976a99b3b16ab73b188a9f8602e8e5e57f53a4ecc919d28bd8b5b97a0d5dd2b3cfaa58fdd196e2db9a1
TLSH
T148D08033364D6002D7A573B3D447CF45175E557415525601F124D54CD6F50C49397686
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cdf1c08f392d5160e2e72ffb80c9f7e6443926572054760c411aebb1da6afc7d
MD5 deaa9486681e06285ca5ac08551ce717
SHA1 a40afc5c2dad4f3e0d491e09a4f0706456656132
SHA512 e99e6585a3ecad80e7716e0e1d53f036b71deb9833f0000127d9cf35e464aa36bef8f23718fba50dc4aceded7f8845a210531cd1451c3fb9a36dbf8bf1d7d2bc
SSDEEP 192:mONl6rvoQmiUySKGDrKhD4XqMB/1jiOBJMFFExhV/U6:mONl6cT+6Xq6kOLJ7U6
TLSH
T10502E835786C6C779EE6AE49F4873B135FE4202BDA856F84DAE81A1C01DB25C1307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e03d3126a6390fc24ad35be53d3b488e43c08b18127348fa8cfc96deaa468b5f
MD5 cd8db184099785ff58bc0dc5d530339a
SHA1 6e4a88edeabff559d4ac635ac533e2a015bff690
SHA512 51230ab3b0d4f59faa335efe86e6eb4d542d2ce567cc447c5afff8144dae6056495c27239f64ad591bfbb275d18b456d8920a9f526e582e1f129658325476f76
SSDEEP 192:dJON8V6rvoQmiUyTGDshD4XqMB/1jiOBJMFQkICxqzKU6:3ONK68bs6Xq6kOL1CbU6
TLSH
T1DA120A32787CAC375EE6B545F08736135EA46127DA857FC0D6EC2A2C01DF66C130AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf3853.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsf3853.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf3853.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf3853.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7f86ebaf-907d-4536-b5f4-9568d223a0b7.tmp

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\7f86ebaf-907d-4536-b5f4-9568d223a0b7.tmp
Size 2KB
SHA256 153dd6762ccfe09cfcb378a1d34e5655f26946fd63143ea5ba7655df70c07db7
MD5 92fb5a555a131ddd234fa1989e85fce6
SHA1 e515a6a31b3f528be6189976c0f4e9f904ea0b51
SHA512 a30d1ce3b141dfb00a119530225aeb550dad128bd699ff8ad1562b1bc6dcceb7b92b00b7d0ca2ce092bf032dab3f8011eb1fde98fb8974f31df1432fb3c8ea04
TLSH
T18E51B773B858BA7749D3C604BA463F23DE3552A6D6622F6099FD1B2C01CB19C3396C27
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9ff6e8acf789718a6048c0a39387be850b626107294db982546afaf83d16cfd6
MD5 7d4b322dba7d1cf586d08ce2303330a3
SHA1 b034ecbbdd444131e9fc6b3fbdbc8277edc02a99
SHA512 2c302131efa107f8de30ea089f6249012608d059cffa47bbb12c1d8e10604e5db279a0e72af191de7b932e049736a44ab8e63d3a06df0bf92d35288c4a5b9dc7
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5f7c159e0e17fd8bd2eb179a636aa7f7ab9d8b097b679b15589f41926f9739dd
MD5 ab3100a8e9aa330d64a45d6d4427e531
SHA1 36a28d133889cf9c62e317da3eb82954a0ba4ef1
SHA512 757594137d6dbd5d0ff1701560a9db76b4806c9ffe09d35b809ad33affb14b35a5937cfc3bdd8d23d7a637e7157e9eb78de22f58d456609924ff7a340b1310fe
TLSH
T189D0121373458139C0103033240362085440C61B810780005828DA5F6A344900902546
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 b228e38490b844193372ae1ef9bbd558daf7abeecc2f8d5a1b8eed488b412e16
MD5 e71ed7c1a84d9ae72a47a7aae8d42bbc
SHA1 6f921994fa3c0ff0d7f0af83538ea78d84665eda
SHA512 3c34c9f183fdf835338ae0dcc494c12a6f05629f380aff078ddcac13dc47cfeb925ff1af9f1f1eaba351b5b1c08bf5cb850c3aa04925c1982f100c10a764ed46
TLSH
T115D01258A4025109DBD1557611D95BFC76380D64D333CFF5451901398650799EA8598A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594a9c.TMP

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe594a9c.TMP
Size 48B
SHA256 fc899b7708d3ae44aa6a1dd195af8227b3a57437bd723b62e15905ce02fc1f19
MD5 8dea27310633872cc69d70b6966ad71d
SHA1 eb08cf9f7bf1eedf6d898210deed1b76e286fd1b
SHA512 9a200466e3e9410edf7b80b85245dd50d773f2d51b818de523b6fb2abca551b9af58e496b2092f383cd71beaf8efe2ce0bb2773bddb708b1cf94629c8e35dc3b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 50791ea920782712150b91673e49fc65e4d90ae618d3413556ace833d6d7a768
MD5 efd692834fa37e034bd14e8a09f3da95
SHA1 11e879ba697ff20c0f1a7ece9efcf34f71f4f705
SHA512 289d20abf05860c33d4a67bdc10f18fe7e53f8bba47fd199510205ccd90ab5bd9bf9596eadb12ccb1936f568291c359ec1dadc070ff39569e919189a4eebe13e
SSDEEP 3:LstlNllkll/lqKt:LsX3lEtqKt
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Network\TransportSecurity
Size 523B
SHA256 9ae9a0c3935749483de396ffca7c66c7da0b345c51892e50e09490de2dd15596
MD5 739788368c61e5ba3def623207f18b67
SHA1 2e31e07eb9012d7a343f471da210d347ed5934f4
SHA512 c7913296d46bf8269973cf216a6ac1787fbbd7632d7aa60f2ea786c1fed4c55ce0b9e8a1c22ae0d34521f0866033c7724db389dd592bbbbdcb8d75cc2c9266ad
TLSH
T101F050A3503FE427C5BC056F9A45BC055ABAE437510154F4C792C06DE0D05A75B27116
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59a53f.TMP

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Network\TransportSecurity~RFe59a53f.TMP
Size 355B
SHA256 f6d895eae425b0933c08e7e2c9f250a90441cf166433aec59a051432e6cdd18b
MD5 6b3af8fe725ef36d3f9a1b56cf585086
SHA1 ff730c929d2eb04f73e5d58cacb7137509ad733b
SHA512 44e86d82359c9f43fb2a62ab9654ae18b1637521e509a67cb613438c532c96247ae815c3715712bc7ed3fc8c031cd257dfef1ec8dc8a99ee61b45aa662dd7a32
TLSH
T12EE020B2903FE4B6506C05271B85FD049FBEF475105194F8DB9681BCD1D057B571311A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 9fc705eac77bb4e177507c1f725ddef4e3ba8d1591b16bfc19e7e045dfcdf647
MD5 ac68acb6056b48cfd431bf10343a42c8
SHA1 85b2510974b83b4341670d9c192b05c457c7edc3
SHA512 f31ddf2838a633ef4466a1ec2c8491eadc1d4afe7a44a2ebb5f0e9ef35d23412d66d1c3c69bff22f7e87e1fcb2e43aada01a6db3525a81d6fd6eff2ccbcfa2aa
SSDEEP 96:stZ05nYjEb9qMffLZ8i0vhE+ktom/7qx+WVHMSm+uecJSHu41idQjQ+gTXt+MOB:stZ0RrfTZ8palB/S+WiTgHwdBdt+MC
TLSH
T1FBD1B7066E287D778CC7F6197B36BB12E2F6116261D40E58EBFC962C05D66CC630B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe598c87.TMP

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Preferences~RFe598c87.TMP
Size 6KB
SHA256 2d1f12f70cfba84f8d8f940c4de97e8ef68330d1df03e175cd348b7c577ae28c
MD5 61c51f484e7ee1e4f9dc01c261ae195d
SHA1 2d36396242be6d83788f7f41fea1bbf1069a1c9c
SHA512 e5ab0fa5c4984108e08baa604b29bf648bdcbd42f4e5f39e82d7c26d063e3cd3055c5a18ec5ba1cfdbb32f18af59bbfb687f441c20c13f0d91b372a463867dd9
SSDEEP 96:stZ05nYjEb9JMffLZ8i0vhE+ktom/7qx+WVHMSm+uecJSHu41idQjQ+gTut+MEB:stZ0R6fTZ8palB/S+WiTgHwdBgt+M8
TLSH
T1F1D1B8065F28B9778CC7E6197F36BB02E2F6116261D41E58EBFC952C08D66CC630B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

en-us.json

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Essential\lsp\en-us.json
Size 6.7MB
SHA256 bfb1ffb3119b4a081882237ddcd1e29f33ce0557a6e54ba7c1049392fb228bcb
MD5 12236bdb8a86788be295891516db9175
SHA1 ef0137add69bed3a10b1a1f8ca93b80e2fa60179
SHA512 ce47f4102511042707ae9622451f56b98b164ba15a38af936c467d0dd97f09386729d6db63c2579813eb4af8d57e5c24167565ec6730fdafacb1589252e43ddd
SSDEEP 49152:Acv8mlo/8ZrJGYbihxzWwvkeUvJVwG9he/a:p
TLSH
T18966CD72C9A01D932686165DF8B9425AF83840DB285D3D88BA9C732C6F88D7F51763CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsp.exe

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Essential\lsp\lsp.exe
Size 16.1MB
SHA256 9e85ce9370f208c97f1dfc1b8fcf7185fe64386f23130a65fc834f5323a0d653
MD5 0e14d186ed05911115868aec341ca13c
SHA1 525708cd63fbcaa2bd68225aa2411b0f46c3e9fb
SHA512 e3acd3aad750e35cf9993384fc274db9ffdfd18099d4fd90a39ad0c039410d4e451baa6a2e1a5b1fd2658281bed8d33a2a3d2403675ef3976f10322ec5d5d029
SSDEEP 393216:E4BgLVggOglggqgTgXi17gCFggqgggocgQgejM9gggggdvFBggggjCggggoggggg:KBggOglggqgTgXi17gCFggqgggocgQgP
TLSH
T188077B3A21AC10DCF1BBD0BD8BCB9E47D6B2340903319ADF0591569A1E1BDED4A7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

luau-en-us.json

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Essential\lsp\luau-en-us.json
Size 150KB
SHA256 df16b4bce28e169bc54442f030ae7cfbe03ea5588421be290b323a13a9cf4d1b
MD5 d53854e092e78a22e4b269464b18bbb7
SHA1 4dada46917d5fdd7aea42a47fef7c83f6c840ed8
SHA512 5ba2aec5526cc31eb2fb197295a928e4e408a2e77f506a9c58d369e968229b2795307f6061656dd20afb1237b561a27ee98159107431b64aa9667a295da686a8
SSDEEP 3072:6UBaQcZlXmr0yokdWR0MUBNpYybDwPO9he/jq3:6UBaQcZlXmr0yokdWR0MUBNpYybDwG9/
TLSH
T179E38A6CC6B11C231AC6212D997EA21AB43C40A7799F7C1079BC764C1F2C97DA37D29E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Local State
Size 1KB
SHA256 1818194986edff6321ad8cf9b75c084b6a02672a95ac97de8f7201a16771b5d8
MD5 be8d4c879b58d216451139589249c242
SHA1 f12fe7bf40539a686e69fe75cc2b664aef026f2b
SHA512 8c4d24bc8d8f4e626de21927e2fce4bd09bd59150ba3bba50ae00188e7c5e545f8007493cdc000b4d3bf849d19b8368f9efe766f85d2375e3dfd06bdd91d5733
TLSH
T13F3140B2E4E47F7758C29242B3432F5B9E205266D2515F04A5FD5B2802D61DCB2AEC22
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Local State
Size 16KB
SHA256 0ed9d8b60fae6a3b6fccdee215aad6aa4c0d566a72a34f932555ecdcaf0edf5a
MD5 fbcde6d65cba6abc939df9652de9bf6c
SHA1 55d2a6ff8fc6a5be5834955e84235849ee783cf0
SHA512 28fa390beab1b13f31184c684b2522229b8fd2adbcf735a0437eb46a837554c05d2608dd38f424e57211cb9782fc0f015aca2d9d5887cf793f6a051758dc9cb8
SSDEEP 384:zX+aQikB+z/xvxjg/qhEwNbhRRfd/3M2UY9zz:C/UxvxjgC+UdPM2UYFz
TLSH
T193729E3B94697E3355F3E9057A590B5FDAB545B290816FB84DFD2F0C02DB2D82346C06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Local State
Size 3KB
SHA256 049247c81e7bbce40688bd66988771b0672de580f752f95b558c9f3f765be67e
MD5 6dbb6136a764891b66238594bc93a6d8
SHA1 43c8af9a563f10e0ddd58c3edf8b0b7f338841e0
SHA512 1d7007a0b3db892d5abd4556c991aa4c090c2d18d6e17eef9d0dfa870f2060ee49b23c83d7dd0c6a59142a69cfcb70a2cfde725165bd2c58d3527ed036ae9255
TLSH
T17671A676A8A4F9374DE3DA01B9863F16AA615237D5913FA5D9FC1F1C01CB2D82392C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58ef1e.TMP

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Local State~RFe58ef1e.TMP
Size 1KB
SHA256 6062d8b0f62739cff25c6825dd747cefb1add45f34bfcb3629197c869076f8c2
MD5 13e39bf943badb12edd45bf466c4e840
SHA1 9782b72b8cec3f1864d8b7039ddee277895cedaf
SHA512 497f40c4f7432a87fc9a84475732254516c1acdccff1167b98fd26f1c43d9040d6ecbdfd4c4b7b333dc3f3172bea2690093c60b098da05cb8bf1bda28ee728b0
TLSH
T1382110B2D4A87EB758C68641F2437F4B9E109276D2115F08E5ED562812CB1DCA3BAC33
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\essential.exe\v
Size 8B
SHA256 e3121abb19d064148aa27a37c91ba2eee99940accea3eb1adea272c5a555df70
MD5 07c487b441fc294e19d48094b23ca80f
SHA1 e43cc175c7a56c5d600924ff63763bd78bbb2aac
SHA512 fb33f7b3d9dd2a2e79bfd1f5b5aa2bee3fd9d3ae467344dcc0e2079d084b8ed4ffd6aa33367b5f49562ea82230770800fe8acb813fba58e6d904623cb87c07bf
MD5 SHA1 SHA512

Submit Download

memory/1380-164-0x00007FFC02F30000-0x00007FFC02F31000-memory.dmp

Download

memory/3656-76-0x00007FFC02F30000-0x00007FFC02F31000-memory.dmp

Download

memory/4136-137-0x00007FFC032B0000-0x00007FFC032B1000-memory.dmp

Download

memory/4136-138-0x00007FFC03740000-0x00007FFC03741000-memory.dmp

Download