fc38f267c223a3f86aabc9a05acc01609d4caa7d800206d39615d5ecb33358c4

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 08:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_c1681580040e069cfa5d154acdb36e30_icedid_njrat_ryuk.exe
Size 11.6MB
Sample260813-j6byesdn9v
SHA256 fc38f267c223a3f86aabc9a05acc01609d4caa7d800206d39615d5ecb33358c4
MD5 c1681580040e069cfa5d154acdb36e30
SHA1 9b2ad5f4c1b97a11443bef272556b36d0b322887
SHA512 5b6016dae757d72147ff12593cb448cb5af82392a716b62385e62f128341ffeabf2fc3deb476cd6882cc99fd2f67ed98fdded9bc754cc344b98ba541360d1965
SSDEEP 49152:HRiWs6UiT29lNfx8Co4CG3AeF/JKPj9rHXNrDq3u+E72oTgm52ZEIklB3S6r4UYL:fCBQtuA/jdvbS0cnQH//KhjP
TLSH
T104C66D03F2A651ECD0BAD574972A5332BA72BC454B30B5EF079076251E75BE0AB3CB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{908AAF3D-6DAA-4F36-A9B0-538D90BEC8C1}\ = "Ace"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{908AAF3D-6DAA-4F36-A9B0-538D90BEC8C1}\StubPath = "\"C:\\Program Files\\Ace\\Ace\\Application\\150.0.7874.0\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{908AAF3D-6DAA-4F36-A9B0-538D90BEC8C1}\Localized Name = "Ace"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{908AAF3D-6DAA-4F36-A9B0-538D90BEC8C1}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{908AAF3D-6DAA-4F36-A9B0-538D90BEC8C1}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{908AAF3D-6DAA-4F36-A9B0-538D90BEC8C1}	setup.exe

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	ace.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	ace.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	ace.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	ace.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	ace.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	ace.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	ace.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	ace.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	ace.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	ace.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	ace.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 38 IoCs

pid	Process
116	updater.exe
628	updater.exe
2848	updater.exe
4676	updater.exe
5008	updater.exe
3372	updater.exe
4356	mini_installer.exe
1812	setup.exe
2920	setup.exe
5788	elevation_service.exe
5836	setup.exe
5856	setup.exe
5268	ace.exe
5312	ace.exe
5520	ace.exe
932	ace.exe
5552	elevation_service.exe
5644	ace.exe
4148	ace.exe
3196	ace.exe
696	ace.exe
5184	ace.exe
5904	ace.exe
5232	ace.exe
4300	ace.exe
3972	chrmstp.exe
3716	ace.exe
740	chrmstp.exe
5924	ace.exe
3908	ace.exe
3772	chrmstp.exe
3340	ace.exe
5656	chrmstp.exe
1100	ace.exe
2188	ace.exe
5200	ace.exe
4948	updater.exe
220	updater.exe

Loads dropped DLL 40 IoCs

pid	Process
5268	ace.exe
5312	ace.exe
5268	ace.exe
5520	ace.exe
5520	ace.exe
932	ace.exe
932	ace.exe
5520	ace.exe
5520	ace.exe
5520	ace.exe
5520	ace.exe
5520	ace.exe
5644	ace.exe
5644	ace.exe
4148	ace.exe
4148	ace.exe
3196	ace.exe
3196	ace.exe
696	ace.exe
696	ace.exe
5184	ace.exe
5184	ace.exe
5904	ace.exe
5904	ace.exe
5232	ace.exe
5232	ace.exe
4300	ace.exe
3716	ace.exe
4300	ace.exe
5924	ace.exe
3908	ace.exe
3908	ace.exe
3340	ace.exe
3340	ace.exe
1100	ace.exe
1100	ace.exe
2188	ace.exe
2188	ace.exe
5200	ace.exe
5200	ace.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AceAutoLaunch = "\"C:\\Program Files\\Ace\\Ace\\Application\\ace.exe\""	ace.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Ace.lnk	setup.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\libEGL.dll	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\pt-BR_MASCULINE.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\sr.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\resources\ace_adblock\index.css	setup.exe
File opened for modification	C:\Program Files\Ace\Ace\Application\SetupMetrics\1812_13431082678400571.pma	setup.exe
File opened for modification	C:\Program Files (x86)\Ace\AceUpdater\143.0.7513.0\Crashpad\metadata	updater.exe
File opened for modification	C:\Program Files (x86)\Ace\AceUpdater\143.0.7513.0\uninstall.cmd	updater.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\cs_NEUTER.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\mr_MASCULINE.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\ms_MASCULINE.pak	setup.exe
File opened for modification	C:\Program Files\chromium_installer.log	setup.exe
File created	C:\Program Files (x86)\Ace\AceUpdater\crx_cache\metadata.json~RFe592b2d.TMP	updater.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\ml_MASCULINE.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\ms_NEUTER.pak	setup.exe
File created	C:\Program Files (x86)\Ace\AceUpdater\e2b4d3f3-ee30-44f4-839e-a7c94c45c764.tmp	updater.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\chrome_200_percent.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\hu.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\pt-BR.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\vi_FEMININE.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\resources\ace_adblock\assets\popup-darkmode-disable.svg	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\am_NEUTER.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\en-US_NEUTER.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\he.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\ja_MASCULINE.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\lt.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\resources\ace_adblock\acePagesBridge.ts-loader.js	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\fil_NEUTER.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\sw_NEUTER.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\resources\ace_adblock\assets\proteced_light.png	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\cs_FEMININE.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\te_FEMININE.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\MEIPreload\preloaded_data.pb	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\resources\ace_adblock\utils.js	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\icudtl.dat	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\et_FEMININE.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\fil_MASCULINE.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\uk.pak	setup.exe
File created	C:\Program Files\Ace412_1935240235\updater.7z	2026-08-13_c1681580040e069cfa5d154acdb36e30_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Ace\AceUpdater\143.0.7513.0\Crashpad\metadata	updater.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\es.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\it_FEMININE.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\ja.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\kn_MASCULINE.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\sk_NEUTER.pak	setup.exe
File created	C:\Program Files (x86)\Ace\AceUpdater\29051954-56aa-4b9a-a03a-f4313a40f87c.tmp	updater.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\bg_NEUTER.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\fi.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\fi_FEMININE.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\sr_NEUTER.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\resources\ace_adblock\assets\shield16.png	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\resources\ace_adblock\consts.js	setup.exe
File created	C:\Program Files (x86)\Ace\AceUpdater\prefs.json~RFe58e356.TMP	updater.exe
File created	C:\Program Files\updater_chrome_Unpacker_BeginUnzipping5008_1844473823\CR_DDD2F.tmp\SETUP.EX_	mini_installer.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\elevated_tracing_service.exe	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\af.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\fi_MASCULINE.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\lt_NEUTER.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\sr_MASCULINE.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\ta_MASCULINE.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\en-US_MASCULINE.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\fr_FEMININE.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\he_NEUTER.pak	setup.exe
File created	C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\resources\ace_adblock\assets\popup-lightmode-protected.svg	setup.exe
File created	C:\Program Files (x86)\Ace\AceUpdater\prefs.json~RFe5a68fc.TMP	updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1812	setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
932	ace.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	ace.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ace.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ace.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	ace.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	ace.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	ace.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Ace\Ace	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ace	setup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Ace\Ace\InstallerPinned = "0"	setup.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	ace.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310827226508742"	ace.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{D734C877-21F4-496E-B857-3E5B2E72E4CC}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D734C877-21F4-496E-B857-3E5B2E72E4CC}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9D31EA63-2E06-4D41-98C7-CB1F307DB597}\1.0\0\win32\ = "C:\\Program Files (x86)\\Ace\\AceUpdater\\143.0.7513.0\\updater.exe\\6"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{C7A3F475-A701-5C8E-BB21-271707FF9079}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{47C8886A-A4B5-4F6C-865A-41A207074DFA}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AceHTM\Application\ApplicationDescription = "Access the Internet"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.xht	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{D45CFCE3-5297-4D0B-925E-1924A32A7452}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{8CA0CD21-6864-4BD8-BF0F-2D69AF3A0FE8}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CFF9AE0F-C5C5-4D53-8394-7602758A52BA}\1.0\0\win64\ = "C:\\Program Files (x86)\\Ace\\AceUpdater\\143.0.7513.0\\updater.exe\\6"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{BAEE6326-C925-4FA4-AFE9-5FA69902B021}\1.0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D734C877-21F4-496E-B857-3E5B2E72E4CC}\TypeLib\ = "{D734C877-21F4-496E-B857-3E5B2E72E4CC}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BE5D3E90-A66C-4A0A-9B7B-1A6B9BF3971E}\1.0\0\win64\ = "C:\\Program Files (x86)\\Ace\\AceUpdater\\143.0.7513.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{47C8886A-A4B5-4F6C-865A-41A207074DFA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{7D908375-C9D0-44C5-BB98-206F3C24A74C}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{9D31EA63-2E06-4D41-98C7-CB1F307DB597}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\{B52C8B56-9541-4B78-9B2F-665366B78A9C}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{BAEE6326-C925-4FA4-AFE9-5FA69902B021}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E1C53EEF-2BAB-4420-BDD7-256B91C49D0C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{87DBF75E-F590-4802-93FD-F8D07800E2E9}\1.0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{027234BD-61BB-4F5C-9386-7FE804171C8C}\TypeLib\ = "{027234BD-61BB-4F5C-9386-7FE804171C8C}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7D908375-C9D0-44C5-BB98-206F3C24A74C}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{C7A3F475-A701-5C8E-BB21-271707FF9079}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{4AF986BF-DD14-45C2-8228-2541622699CD}\1.0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E0425C1F-4263-4BA5-9328-423470344FC0}\1.0\ = "AceUpdater TypeLib for ICurrentStateSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{D45CFCE3-5297-4D0B-925E-1924A32A7452}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BAEE6326-C925-4FA4-AFE9-5FA69902B021}\1.0\0\win32\ = "C:\\Program Files (x86)\\Ace\\AceUpdater\\143.0.7513.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D734C877-21F4-496E-B857-3E5B2E72E4CC}\TypeLib\ = "{D734C877-21F4-496E-B857-3E5B2E72E4CC}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B89F6621-36AF-554C-9C1E-A5B7AEA875A5}\1.0\0\win32\ = "C:\\Program Files (x86)\\Ace\\AceUpdater\\143.0.7513.0\\updater.exe\\4"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FDC4145B-1E06-5E9C-A5C5-99CA25A3B10B}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FDC4145B-1E06-5E9C-A5C5-99CA25A3B10B}\1.0\0\win64\ = "C:\\Program Files (x86)\\Ace\\AceUpdater\\143.0.7513.0\\updater.exe\\4"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{87DBF75E-F590-4802-93FD-F8D07800E2E9}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{FDC4145B-1E06-5E9C-A5C5-99CA25A3B10B}\1.0\0\win64	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{04588E40-E38A-5A61-A4F3-B6274FB4C996}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B7DA4837-09FF-4355-BFE1-30598E40F41A}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{3057E1F8-2498-4C19-99B5-F7F207DA4DC7}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9F76CA-FCFB-4F8E-B65E-F7C0703AAFBD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D734C877-21F4-496E-B857-3E5B2E72E4CC}\ = "IAppBundleWeb"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BE5D3E90-A66C-4A0A-9B7B-1A6B9BF3971E}\1.0\0\win32\ = "C:\\Program Files (x86)\\Ace\\AceUpdater\\143.0.7513.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{027234BD-61BB-4F5C-9386-7FE804171C8C}\ = "IGoogleUpdate3Web"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6F7996CA-5531-4299-BD7F-3C7090520090}\1.0\0\win32\ = "C:\\Program Files (x86)\\Ace\\AceUpdater\\143.0.7513.0\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E1C53EEF-2BAB-4420-BDD7-256B91C49D0C}\TypeLib\ = "{E1C53EEF-2BAB-4420-BDD7-256B91C49D0C}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{D1A6B952-89EF-5716-BF5C-193134EE0E16}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{D1A6B952-89EF-5716-BF5C-193134EE0E16}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{B7DA4837-09FF-4355-BFE1-30598E40F41A}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{DD9F76CA-FCFB-4F8E-B65E-F7C0703AAFBD}\1.0\0\win64	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{9D31EA63-2E06-4D41-98C7-CB1F307DB597}\1.0\0\win32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1B26166D-48F0-4CBB-BF20-BF6516BC22A0}\1.0\ = "TypeLib for Interface {1B26166D-48F0-4CBB-BF20-BF6516BC22A0}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{78A85A33-F541-4A52-A1F2-0BCBA1F1A4F0}\TypeLib\ = "{78A85A33-F541-4A52-A1F2-0BCBA1F1A4F0}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{DD9F76CA-FCFB-4F8E-B65E-F7C0703AAFBD}\1.0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BAEE6326-C925-4FA4-AFE9-5FA69902B021}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE5D3E90-A66C-4A0A-9B7B-1A6B9BF3971E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B7DA4837-09FF-4355-BFE1-30598E40F41A}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B7DA4837-09FF-4355-BFE1-30598E40F41A}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8CA0CD21-6864-4BD8-BF0F-2D69AF3A0FE8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F8197F77-DE9C-4BB0-9F63-459A001154C6}\1.0\ = "AceUpdater TypeLib for IPolicyStatusSystem"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.webp\OpenWithProgids\AceHTM	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{A6562E6F-E434-5CD6-9DED-A2A786A9E630}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.shtml	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{FDC4145B-1E06-5E9C-A5C5-99CA25A3B10B}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{FDC4145B-1E06-5E9C-A5C5-99CA25A3B10B}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{DD9F76CA-FCFB-4F8E-B65E-F7C0703AAFBD}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{EED70106-3604-4385-866E-6D540E99CA1A}\ProxyStubClsid32	updater.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
116	updater.exe
116	updater.exe
116	updater.exe
116	updater.exe
116	updater.exe
116	updater.exe
2848	updater.exe
2848	updater.exe
2848	updater.exe
2848	updater.exe
2848	updater.exe
2848	updater.exe
5008	updater.exe
5008	updater.exe
5008	updater.exe
5008	updater.exe
5008	updater.exe
5008	updater.exe
116	updater.exe
116	updater.exe
5268	ace.exe
5268	ace.exe
4948	updater.exe
4948	updater.exe
4948	updater.exe
4948	updater.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	412	2026-08-13_c1681580040e069cfa5d154acdb36e30_icedid_njrat_ryuk.exe
Token: SeIncBasePriorityPrivilege	412	2026-08-13_c1681580040e069cfa5d154acdb36e30_icedid_njrat_ryuk.exe
Token: 33	4356	mini_installer.exe
Token: SeIncBasePriorityPrivilege	4356	mini_installer.exe
Token: SeShutdownPrivilege	5268	ace.exe
Token: SeCreatePagefilePrivilege	5268	ace.exe
Token: SeShutdownPrivilege	5268	ace.exe
Token: SeCreatePagefilePrivilege	5268	ace.exe
Token: SeShutdownPrivilege	5268	ace.exe
Token: SeCreatePagefilePrivilege	5268	ace.exe
Token: SeShutdownPrivilege	5268	ace.exe
Token: SeCreatePagefilePrivilege	5268	ace.exe
Token: SeShutdownPrivilege	5268	ace.exe
Token: SeCreatePagefilePrivilege	5268	ace.exe
Token: SeShutdownPrivilege	5268	ace.exe
Token: SeCreatePagefilePrivilege	5268	ace.exe
Token: SeShutdownPrivilege	5268	ace.exe
Token: SeCreatePagefilePrivilege	5268	ace.exe
Token: SeShutdownPrivilege	5268	ace.exe
Token: SeCreatePagefilePrivilege	5268	ace.exe
Token: SeShutdownPrivilege	5268	ace.exe
Token: SeCreatePagefilePrivilege	5268	ace.exe
Token: SeShutdownPrivilege	5268	ace.exe
Token: SeCreatePagefilePrivilege	5268	ace.exe
Token: SeShutdownPrivilege	5268	ace.exe
Token: SeCreatePagefilePrivilege	5268	ace.exe
Token: SeShutdownPrivilege	5268	ace.exe
Token: SeCreatePagefilePrivilege	5268	ace.exe
Token: SeShutdownPrivilege	5268	ace.exe
Token: SeCreatePagefilePrivilege	5268	ace.exe
Token: SeShutdownPrivilege	5268	ace.exe
Token: SeCreatePagefilePrivilege	5268	ace.exe
Token: SeShutdownPrivilege	5268	ace.exe
Token: SeCreatePagefilePrivilege	5268	ace.exe
Token: SeShutdownPrivilege	5268	ace.exe
Token: SeCreatePagefilePrivilege	5268	ace.exe
Token: SeShutdownPrivilege	5268	ace.exe
Token: SeCreatePagefilePrivilege	5268	ace.exe
Token: SeShutdownPrivilege	5268	ace.exe
Token: SeCreatePagefilePrivilege	5268	ace.exe
Token: SeShutdownPrivilege	5268	ace.exe
Token: SeCreatePagefilePrivilege	5268	ace.exe
Token: SeShutdownPrivilege	5268	ace.exe
Token: SeCreatePagefilePrivilege	5268	ace.exe
Token: SeShutdownPrivilege	5268	ace.exe
Token: SeCreatePagefilePrivilege	5268	ace.exe
Token: SeShutdownPrivilege	5268	ace.exe
Token: SeCreatePagefilePrivilege	5268	ace.exe
Token: SeShutdownPrivilege	5268	ace.exe
Token: SeCreatePagefilePrivilege	5268	ace.exe
Token: SeShutdownPrivilege	5268	ace.exe
Token: SeCreatePagefilePrivilege	5268	ace.exe
Token: SeShutdownPrivilege	5268	ace.exe
Token: SeCreatePagefilePrivilege	5268	ace.exe
Token: SeShutdownPrivilege	5268	ace.exe
Token: SeCreatePagefilePrivilege	5268	ace.exe
Token: SeShutdownPrivilege	5268	ace.exe
Token: SeCreatePagefilePrivilege	5268	ace.exe
Token: SeShutdownPrivilege	5268	ace.exe
Token: SeCreatePagefilePrivilege	5268	ace.exe
Token: SeShutdownPrivilege	5268	ace.exe
Token: SeCreatePagefilePrivilege	5268	ace.exe
Token: SeShutdownPrivilege	5268	ace.exe
Token: SeCreatePagefilePrivilege	5268	ace.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
5268	ace.exe
5268	ace.exe
5268	ace.exe
5268	ace.exe
5268	ace.exe
5268	ace.exe
5268	ace.exe
5268	ace.exe
3772	chrmstp.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 116	412	2026-08-13_c1681580040e069cfa5d154acdb36e30_icedid_njrat_ryuk.exe	91
PID 116 wrote to memory of 628	116	updater.exe	92
PID 2848 wrote to memory of 4676	2848	updater.exe	94
PID 5008 wrote to memory of 3372	5008	updater.exe	97
PID 5008 wrote to memory of 4356	5008	updater.exe	100
PID 4356 wrote to memory of 1812	4356	mini_installer.exe	101
PID 1812 wrote to memory of 2920	1812	setup.exe	102
PID 1812 wrote to memory of 5836	1812	setup.exe	115
PID 5836 wrote to memory of 5856	5836	setup.exe	116
PID 116 wrote to memory of 5268	116	updater.exe	121
PID 5268 wrote to memory of 5312	5268	ace.exe	122
PID 5268 wrote to memory of 5520	5268	ace.exe	123
PID 5268 wrote to memory of 932	5268	ace.exe	124
PID 5268 wrote to memory of 5644	5268	ace.exe	126
PID 5268 wrote to memory of 4148	5268	ace.exe	128
PID 5268 wrote to memory of 3196	5268	ace.exe	129
PID 5268 wrote to memory of 696	5268	ace.exe	130
PID 5268 wrote to memory of 5184	5268	ace.exe	131
PID 5268 wrote to memory of 5904	5268	ace.exe	133
PID 5268 wrote to memory of 5232	5268	ace.exe	135
PID 5268 wrote to memory of 4300	5268	ace.exe	137
PID 5268 wrote to memory of 3972	5268	ace.exe	138
PID 3972 wrote to memory of 740	3972	chrmstp.exe	139
PID 3716 wrote to memory of 5924	3716	ace.exe	140
PID 5268 wrote to memory of 3908	5268	ace.exe	141
PID 5268 wrote to memory of 3340	5268	ace.exe	142
PID 3972 wrote to memory of 3772	3972	chrmstp.exe	143
PID 5268 wrote to memory of 1100	5268	ace.exe	144
PID 3772 wrote to memory of 5656	3772	chrmstp.exe	145
PID 5268 wrote to memory of 2188	5268	ace.exe	146
PID 5268 wrote to memory of 5200	5268	ace.exe	147
PID 4948 wrote to memory of 220	4948	updater.exe	150

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-13_c1681580040e069cfa5d154acdb36e30_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_c1681580040e069cfa5d154acdb36e30_icedid_njrat_ryuk.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:412
- C:\Program Files\Ace412_1935240235\bin\updater.exe
  "C:\Program Files\Ace412_1935240235\bin\updater.exe" --install="appguid={908AAF3D-6DAA-4F36-A9B0-538D90BEC8C1}&appname=Chromium&needsadmin=prefers&iid=a9d132b8-2955-11f1-9ad6-cec9a7209edd@0876d7a6-fd86-11f0-b237-da8b59dcce9e@gs_23692028536_197155777160_801868231567@discoverAce " --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/enterprise_companion/*=2,*/chrome/updater/*=2
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:116
- - C:\Program Files\Ace412_1935240235\bin\updater.exe
    "C:\Program Files\Ace412_1935240235\bin\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Ace\AceUpdater\143.0.7513.0\Crashpad" --url=https://clients2.google.com/cr/staging_report --annotation=prod=AceUpdater --annotation=ver=143.0.7513.0 "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater.log" --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ff6f14882ac,0x7ff6f14882b8,0x7ff6f14882c8
    3⤵
    - Executes dropped EXE
    PID:628
- - C:\Program Files\Ace\Ace\Application\ace.exe
    "C:\Program Files\Ace\Ace\Application\ace.exe" --from-installer --iid=a9d132b8-2955-11f1-9ad6-cec9a7209edd@0876d7a6-fd86-11f0-b237-da8b59dcce9e@gs_23692028536_197155777160_801868231567@discoverAce
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5268
  - - C:\Program Files\Ace\Ace\Application\ace.exe
      "C:\Program Files\Ace\Ace\Application\ace.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Ace\Ace\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Ace\Ace\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Ace --annotation=ver=150.0.7874.0 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ffd221a7d70,0x7ffd221a7d7c,0x7ffd221a7d88
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5312
  - - C:\Program Files\Ace\Ace\Application\ace.exe
      "C:\Program Files\Ace\Ace\Application\ace.exe" --type=gpu-process --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1856,i,1430005123175791692,11150138623656100199,262144 --field-trial-handle=1872,i,7258785162673325107,17295788989605934535,262144 --variations-seed-version --pseudonymization-salt-handle=1904,i,7524529769713436991,7859677789291898221,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1868 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5520
  - - C:\Program Files\Ace\Ace\Application\ace.exe
      "C:\Program Files\Ace\Ace\Application\ace.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --start-stack-profiler --metrics-shmem-handle=2224,i,8862294494747573470,14110096592558841153,524288 --field-trial-handle=1872,i,7258785162673325107,17295788989605934535,262144 --variations-seed-version --pseudonymization-salt-handle=1904,i,7524529769713436991,7859677789291898221,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2228 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Time Discovery
      PID:932
  - - C:\Program Files\Ace\Ace\Application\ace.exe
      "C:\Program Files\Ace\Ace\Application\ace.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2472,i,10939440234607951012,16607195157550284398,524288 --field-trial-handle=1872,i,7258785162673325107,17295788989605934535,262144 --variations-seed-version --pseudonymization-salt-handle=1904,i,7524529769713436991,7859677789291898221,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2492 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5644
  - - C:\Program Files\Ace\Ace\Application\ace.exe
      "C:\Program Files\Ace\Ace\Application\ace.exe" --type=renderer --force-high-res-timeticks=disabled --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,7000488890982365629,15685678753192951063,2097152 --field-trial-handle=1872,i,7258785162673325107,17295788989605934535,262144 --variations-seed-version --pseudonymization-salt-handle=1904,i,7524529769713436991,7859677789291898221,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3272 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:4148
  - - C:\Program Files\Ace\Ace\Application\ace.exe
      "C:\Program Files\Ace\Ace\Application\ace.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3312,i,9403289658594851396,12303219548245567731,2097152 --field-trial-handle=1872,i,7258785162673325107,17295788989605934535,262144 --variations-seed-version --pseudonymization-salt-handle=1904,i,7524529769713436991,7859677789291898221,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3328 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:3196
  - - C:\Program Files\Ace\Ace\Application\ace.exe
      "C:\Program Files\Ace\Ace\Application\ace.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4656,i,14023525364364031623,12346956166401952159,2097152 --field-trial-handle=1872,i,7258785162673325107,17295788989605934535,262144 --variations-seed-version --pseudonymization-salt-handle=1904,i,7524529769713436991,7859677789291898221,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4664 /prefetch:2
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:696
  - - C:\Program Files\Ace\Ace\Application\ace.exe
      "C:\Program Files\Ace\Ace\Application\ace.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,18179378956633852574,2240812793087756779,2097152 --field-trial-handle=1872,i,7258785162673325107,17295788989605934535,262144 --variations-seed-version --pseudonymization-salt-handle=1904,i,7524529769713436991,7859677789291898221,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4832 /prefetch:2
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:5184
  - - C:\Program Files\Ace\Ace\Application\ace.exe
      "C:\Program Files\Ace\Ace\Application\ace.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4972,i,14759042082968909137,1107129950171798002,2097152 --field-trial-handle=1872,i,7258785162673325107,17295788989605934535,262144 --variations-seed-version --pseudonymization-salt-handle=1904,i,7524529769713436991,7859677789291898221,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5232 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:5904
  - - C:\Program Files\Ace\Ace\Application\ace.exe
      "C:\Program Files\Ace\Ace\Application\ace.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5864,i,15049015698177458170,14805497110059615139,524288 --field-trial-handle=1872,i,7258785162673325107,17295788989605934535,262144 --variations-seed-version --pseudonymization-salt-handle=1904,i,7524529769713436991,7859677789291898221,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5876 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5232
  - - C:\Program Files\Ace\Ace\Application\ace.exe
      "C:\Program Files\Ace\Ace\Application\ace.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6076,i,11636373197006302817,13997306955323200218,524288 --field-trial-handle=1872,i,7258785162673325107,17295788989605934535,262144 --variations-seed-version --pseudonymization-salt-handle=1904,i,7524529769713436991,7859677789291898221,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=6080 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4300
  - - C:\Program Files\Ace\Ace\Application\150.0.7874.0\Installer\chrmstp.exe
      "C:\Program Files\Ace\Ace\Application\150.0.7874.0\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3972
    - - C:\Program Files\Ace\Ace\Application\150.0.7874.0\Installer\chrmstp.exe
        
        "C:\Program Files\Ace\Ace\Application\150.0.7874.0\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --annotation=plat=Win64 --annotation=prod=Ace --annotation=ver=150.0.7874.0 "--attachment=C:\Program Files\chromium_installer.log" "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater.log" "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater_history.jsonl" --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ff6d4e95380,0x7ff6d4e9538c,0x7ff6d4e95398
        5⤵
        Executes dropped EXE
        
        PID:740
    - - C:\Program Files\Ace\Ace\Application\150.0.7874.0\Installer\chrmstp.exe
        
        "C:\Program Files\Ace\Ace\Application\150.0.7874.0\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Ace\Ace\Application\master_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3772
      - C:\Program Files\Ace\Ace\Application\150.0.7874.0\Installer\chrmstp.exe
        
        "C:\Program Files\Ace\Ace\Application\150.0.7874.0\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --annotation=plat=Win64 --annotation=prod=Ace --annotation=ver=150.0.7874.0 "--attachment=C:\Program Files\chromium_installer.log" "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater.log" "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater_history.jsonl" --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ff6d4e95380,0x7ff6d4e9538c,0x7ff6d4e95398
        6⤵
        Executes dropped EXE
        
        PID:5656
  - - C:\Program Files\Ace\Ace\Application\ace.exe
      "C:\Program Files\Ace\Ace\Application\ace.exe" --type=renderer --instant-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6220,i,13254116878380492496,17409955139391577738,2097152 --field-trial-handle=1872,i,7258785162673325107,17295788989605934535,262144 --variations-seed-version --pseudonymization-salt-handle=1904,i,7524529769713436991,7859677789291898221,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=6248 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:3908
  - - C:\Program Files\Ace\Ace\Application\ace.exe
      "C:\Program Files\Ace\Ace\Application\ace.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6472,i,15318394568136183679,10225896156677558399,2097152 --field-trial-handle=1872,i,7258785162673325107,17295788989605934535,262144 --variations-seed-version --pseudonymization-salt-handle=1904,i,7524529769713436991,7859677789291898221,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5324 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:3340
  - - C:\Program Files\Ace\Ace\Application\ace.exe
      "C:\Program Files\Ace\Ace\Application\ace.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6788,i,8135526170693509472,15294836882923832454,2097152 --field-trial-handle=1872,i,7258785162673325107,17295788989605934535,262144 --variations-seed-version --pseudonymization-salt-handle=1904,i,7524529769713436991,7859677789291898221,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=6816 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:1100
  - - C:\Program Files\Ace\Ace\Application\ace.exe
      "C:\Program Files\Ace\Ace\Application\ace.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6572,i,13017135064244491045,1218813012754032701,2097152 --field-trial-handle=1872,i,7258785162673325107,17295788989605934535,262144 --variations-seed-version --pseudonymization-salt-handle=1904,i,7524529769713436991,7859677789291898221,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=6748 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:2188
  - - C:\Program Files\Ace\Ace\Application\ace.exe
      "C:\Program Files\Ace\Ace\Application\ace.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=7392,i,4716909114866791184,16316289855877804828,2097152 --field-trial-handle=1872,i,7258785162673325107,17295788989605934535,262144 --variations-seed-version --pseudonymization-salt-handle=1904,i,7524529769713436991,7859677789291898221,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=7540 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:5200

C:\Program Files (x86)\Ace\AceUpdater\143.0.7513.0\updater.exe
"C:\Program Files (x86)\Ace\AceUpdater\143.0.7513.0\updater.exe" --system --windows-service --service=update-internal
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Program Files (x86)\Ace\AceUpdater\143.0.7513.0\updater.exe
  "C:\Program Files (x86)\Ace\AceUpdater\143.0.7513.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Ace\AceUpdater\143.0.7513.0\Crashpad" --url=https://clients2.google.com/cr/staging_report --annotation=prod=AceUpdater --annotation=ver=143.0.7513.0 "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater.log" --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff6795982ac,0x7ff6795982b8,0x7ff6795982c8
  2⤵
  - Executes dropped EXE
  PID:4676

C:\Program Files (x86)\Ace\AceUpdater\143.0.7513.0\updater.exe
"C:\Program Files (x86)\Ace\AceUpdater\143.0.7513.0\updater.exe" --system --windows-service --service=update
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Program Files (x86)\Ace\AceUpdater\143.0.7513.0\updater.exe
  "C:\Program Files (x86)\Ace\AceUpdater\143.0.7513.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Ace\AceUpdater\143.0.7513.0\Crashpad" --url=https://clients2.google.com/cr/staging_report --annotation=prod=AceUpdater --annotation=ver=143.0.7513.0 "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater.log" --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ff6795982ac,0x7ff6795982b8,0x7ff6795982c8
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Program Files\updater_chrome_Unpacker_BeginUnzipping5008_1844473823\mini_installer.exe
  "C:\Program Files\updater_chrome_Unpacker_BeginUnzipping5008_1844473823\mini_installer.exe" --do-not-launch-chrome
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Program Files\updater_chrome_Unpacker_BeginUnzipping5008_1844473823\CR_DDD2F.tmp\setup.exe
    "C:\Program Files\updater_chrome_Unpacker_BeginUnzipping5008_1844473823\CR_DDD2F.tmp\setup.exe" --install-archive="C:\Program Files\updater_chrome_Unpacker_BeginUnzipping5008_1844473823\CR_DDD2F.tmp\CHROME.PACKED.7Z" --do-not-launch-chrome
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Network Configuration Discovery: Internet Connection Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Program Files\updater_chrome_Unpacker_BeginUnzipping5008_1844473823\CR_DDD2F.tmp\setup.exe
      "C:\Program Files\updater_chrome_Unpacker_BeginUnzipping5008_1844473823\CR_DDD2F.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --annotation=plat=Win64 --annotation=prod=Ace --annotation=ver=150.0.7874.0 "--attachment=C:\Program Files\chromium_installer.log" "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater.log" "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater_history.jsonl" --initial-client-data=0x258,0x25c,0x260,0x234,0x264,0x7ff627b25380,0x7ff627b2538c,0x7ff627b25398
      4⤵
      Executes dropped EXE
      PID:2920
  - - C:\Program Files\updater_chrome_Unpacker_BeginUnzipping5008_1844473823\CR_DDD2F.tmp\setup.exe
      "C:\Program Files\updater_chrome_Unpacker_BeginUnzipping5008_1844473823\CR_DDD2F.tmp\setup.exe" --system-level --verbose-logging --create-shortcuts=0 --install-level=1
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Program Files directory
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:5836
    - - C:\Program Files\updater_chrome_Unpacker_BeginUnzipping5008_1844473823\CR_DDD2F.tmp\setup.exe
        
        "C:\Program Files\updater_chrome_Unpacker_BeginUnzipping5008_1844473823\CR_DDD2F.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --annotation=plat=Win64 --annotation=prod=Ace --annotation=ver=150.0.7874.0 "--attachment=C:\Program Files\chromium_installer.log" "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater.log" "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater_history.jsonl" --initial-client-data=0x258,0x25c,0x260,0x234,0x264,0x7ff627b25380,0x7ff627b2538c,0x7ff627b25398
        5⤵
        Executes dropped EXE
        
        PID:5856

C:\Program Files\Ace\Ace\Application\150.0.7874.0\elevation_service.exe
"C:\Program Files\Ace\Ace\Application\150.0.7874.0\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5788

C:\Program Files\Ace\Ace\Application\150.0.7874.0\elevation_service.exe
"C:\Program Files\Ace\Ace\Application\150.0.7874.0\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5908

C:\Program Files\Ace\Ace\Application\ace.exe
"C:\Program Files\Ace\Ace\Application\ace.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Program Files\Ace\Ace\Application\ace.exe
  "C:\Program Files\Ace\Ace\Application\ace.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Ace\Ace\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Ace\Ace\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Ace --annotation=ver=150.0.7874.0 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd221a7d70,0x7ffd221a7d7c,0x7ffd221a7d88
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5924

C:\Program Files (x86)\Ace\AceUpdater\143.0.7513.0\updater.exe
"C:\Program Files (x86)\Ace\AceUpdater\143.0.7513.0\updater.exe" --system --windows-service --service=update
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Program Files (x86)\Ace\AceUpdater\143.0.7513.0\updater.exe
  "C:\Program Files (x86)\Ace\AceUpdater\143.0.7513.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Ace\AceUpdater\143.0.7513.0\Crashpad" --url=https://clients2.google.com/cr/staging_report --annotation=prod=AceUpdater --annotation=ver=143.0.7513.0 "--attachment=C:\Program Files (x86)\Ace\AceUpdater\updater.log" --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff6795982ac,0x7ff6795982b8,0x7ff6795982c8
  2⤵
  - Executes dropped EXE
  PID:220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

metadata.json

Path C:\Program Files (x86)\Ace\AceUpdater\crx_cache\metadata.json
Size 130B
SHA256 343c1b16af9865fced8950e4a4f334f798e69924909c70f729c155cf3a37b5e3
MD5 c764744b6a8192e4a1a1a3ac91e8a6e7
SHA1 ee857d46d9fa81511b24e4664f933b5355d08fb5
SHA512 b060b54cfece6002991dbc4dd6f3c96eaccdec4f05babfa734ccf76c531b741fa525f6b0508b2fcf3378b12f6a24c8e05b9c7da493f380acaa810d3e94c8008b
TLSH
T10DC02BD5F20C17CC0CA40FE9F732651DC2220A00407C305D4C038CC42C33D5D4041137
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json~RFe592b2d.TMP

Path C:\Program Files (x86)\Ace\AceUpdater\crx_cache\metadata.json~RFe592b2d.TMP
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

prefs.json

Path C:\Program Files (x86)\Ace\AceUpdater\prefs.json
Size 658B
SHA256 9017250221c21acaf77bc80747838254afe39cea37cc31f5b4166bc71a8f3bb5
MD5 c604a2d010acb80cd53f1db886e8e0c2
SHA1 5725959f8eae17e9730a6f7345d1d62c1ed852cd
SHA512 923df9a7cf74097529e1a5b5f41330651b107dd418b439e5cb7de3d1928f4aa52facc51c237f14889b7fdccaf952d1b97e43d162332175eb9baf9512d3fad694
TLSH
T10501D31CAA33A923BC600BAB8019A55483F05951512D38985CC81C0E0C8EC8AFE0F41A
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Program Files (x86)\Ace\AceUpdater\prefs.json
Size 49B
SHA256 52c211532e9cd53cf6a8f8cd74681e9d7960ee13ec667a804aa0fc79f1c49b00
MD5 962ba6ade27a529188527e8cb2617d4e
SHA1 ebe07ca56a467cd640bc9699ecdea84b6c251cfa
SHA512 aaee1c85ba8ed12c3ba15db716543b491275b9823d5f2bb0bf21ef37df8a8d9dee3e691bf0d66b88a990c07eff435a5145319855943b2438a07f9d8e8489b418
MD5 SHA1 SHA512

Submit Download

prefs.json

Path C:\Program Files (x86)\Ace\AceUpdater\prefs.json
Size 626B
SHA256 2232233e9ad6b8b7f384c64a7b3f99e3013b3f077de977bb0b962ea15f3b0ccb
MD5 d59b70ef1971d24d83a1502c29e95465
SHA1 cc301c533829e43cdf63a4f15d208fd05dcb92dc
SHA512 cd0fd50638f907134d2c6668dce5cf84d717ec4193344649c3e8c8ca24fa5be0b0121b7fe31cf01abca54821129c538dd6b56a56d70f1955840497c5be2fe615
TLSH
T1DFF0A21CBA32B623BD70079BC019A54483F15D52922D39985CD81D4E0C8AC8AFE4F42A
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Program Files (x86)\Ace\AceUpdater\prefs.json
Size 83B
SHA256 b9d95c0cbbdfd46cda82f48ada2882276a71c4166395d5ef56068d3e9dfb903b
MD5 b40f3ed4e62880f1b7953b6567a75319
SHA1 e05410a303ff90abd9bf0168b500f218726667a8
SHA512 a97eeab7425ff64f26f29b1856f19678dc9cbebb18452d162c918ef845934f1035c7db696e31692cc413d9e1722b17a52f091cda89d588ce4b0e34f92cebb4f2
TLSH
T1D6A011208032C832F8028A8F00282A88CBE802C3222802E2308C000B0AA2C8AA08220E
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Program Files (x86)\Ace\AceUpdater\prefs.json
Size 658B
SHA256 4302ea6308146ddd9c101e19ae7312bf71cad1df74685877fc863cb42023c6c9
MD5 f889d35259170dd28e1b788a5452abdd
SHA1 4a2f65e6a58079877395a7f3aff5082548b7439b
SHA512 691c25f603278c82cd8a3c421468bf0e055ef15717ef4bbc7e3a257c3a79766c53dfcdd35a9637fe3c8bef02a4d5cc86cd99168f0c3ab13e8610a5ceae10ec65
TLSH
T16A01D31CAA33B923BC200BAB8029A55483F05951516D38985CC81C0E0D8EC4AFE0F41A
MD5 SHA1 SHA512 TLSH

Submit Download

updater.log

Path C:\Program Files (x86)\Ace\AceUpdater\updater.log
Size 1KB
SHA256 2b4f1e3e2bc08c36ba5649cf1d89534b2fb245257c15d7a848b498623403c77a
MD5 72f2a7ca331709048f8a25c58d01aabc
SHA1 b42fb0b93d197fd596642c9be7590d0cae309942
SHA512 3097cf606f7785c81ad21be92f88ee90d8a281298aed49d1701ffc5eb94b8759b554d14b3b1d940b18f1a09db966ea331fd4916f18f17fa534576603d6aebddd
TLSH
T1EB311F617222483F79042F1BB634D44BA5B00491FE56B0747ACF6A2437C7C5B3C6DEA2
MD5 SHA1 SHA512 TLSH

Submit Download

updater.log

Path C:\Program Files (x86)\Ace\AceUpdater\updater.log
Size 2KB
SHA256 9d9f32d875bb231fdf320be53e855a6bf04011bbeb507198bd3fa57e44d0c4e9
MD5 db84f3c5c936e67c60942d85bfb3b32a
SHA1 25ce195b00f0b9fac1f563d7d5833265c7822d59
SHA512 1a6e9b1d7c185c0b87b8448f27d4e163a4033354baa5d61cbad77c22cc6a64dc3b61059d4214d44b8ee76055a48fc0af801b92bf8e4731f41234689785ad9c12
TLSH
T1D9413F917202843B75015E17BA30E55B93B40185FA56B0783ACF9A1977C7D2B3C9CE96
MD5 SHA1 SHA512 TLSH

Submit Download

updater.log

Path C:\Program Files (x86)\Ace\AceUpdater\updater.log
Size 6KB
SHA256 4d1806770cefcf45b8f857ad75554b5bb32f9a63e3b51159bb2833e7883a882f
MD5 bc66fb8b8fbbe624cd1ccb7f2188da87
SHA1 04338fa8c2ddf3b1085a1649e17aaf3a6a5197c7
SHA512 9ed02ae03819b8d7f3a4bbee2f4e9d0629c8c98a77c97858eb6096d38da4f5911bb41f2bf1dc2adc8a7d54f1170f239ddb3797178d5c6a4e60a43b4bc742f481
SSDEEP 96:5tRydi9BIRyHoctBE1rCdne+tuBlWmerLIpc6Ta9pVBQRFyjBxQIgcWf:bv9WAdtIrCde+tuBUmerLIypVXjQ57f
TLSH
T125D178A1BA03C43F71119C677E30694B16BC4184A79E60A5B7CF4709F6D7E372C9C94A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.log

Path C:\Program Files (x86)\Ace\AceUpdater\updater.log
Size 5KB
SHA256 831a13defdd70093e6e13db96d399b4a4da19ae00cf2347df00a561c4a203ca5
MD5 5b0551ace651334f006af76a5aaab9f1
SHA1 6983820886669e7f90aad0a2d9e513d41a85dd0d
SHA512 bf2ffeca227872a29fb34963d4d247f36107dace04fc22a2b210db71b22508a4e6b399fda1a4ba3ebed9205b1c23a6d60d7cc34fbb3d13ef63946a698ac392b3
SSDEEP 96:5tRydi9BIRyHoctBE1rCdne+tuBlWmerLIpc6Ta9pVBQRFyjBxb:bv9WAdtIrCde+tuBUmerLIypVXjb
TLSH
T1CEC176A1BA03C43FB1165C577E30A94A277C4180AB9E60A5B7CE4609F7D7E372CDC94A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.log

Path C:\Program Files (x86)\Ace\AceUpdater\updater.log
Size 11KB
SHA256 b68ec6050662b0bec293b717a88a8ecc636b28c13a5f65fd1f4423acca176e6d
MD5 9f128f2a61ad520eac3a1900c0d787ab
SHA1 b4f530f62f5c435e9fac75683b4729da22d70bea
SHA512 315448c6e2dd4e149350feff26edf80e170063c6404c843b8c6713727e18922060a2c8d8642b73d247f0ad95bd880f03f1ca680bd4a786371384c6840e856278
SSDEEP 192:bv9WAdtIrCde+tuBUmerLIypVXjQ57dCq0z8mBANVPMq5AhD7f:R7Itsz8x048I5sr
TLSH
T174426564AE43C43F70119C6B7E30594A2ABC4191A7DE509977CE4709F5D7F332C9CA4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.log

Path C:\Program Files (x86)\Ace\AceUpdater\updater.log
Size 13KB
SHA256 84e48640614d38e2e4641f1781a104e24b294fe90933b9bb7be3536a5b7a68f8
MD5 e0ed7afeb46b4c148004962aa132727d
SHA1 ca8e70f3b5f012bb8c45fd04167f6480bf2e4c18
SHA512 97aeb498b9624f247673df06971c05bdb201bfef2e13a532ed5e408820b3d22bcea5cfc4ea1935064607e0948b4d23f4930c10c55ebc4bf438f5183bb0f1b5f8
SSDEEP 192:bv9WAdtIrCde+tuBUmerLIypVXjQ57dCq0z8mBANVPMq5AhD7iwoB+c:R7Itsz8x048I5sTE+c
TLSH
T1CD526424AE43C43F70219C6B7E30594A2ABC8191A7DD50A977CE4709F5D7F732C9CA8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.cmd

Path C:\Program Files\Ace412_1935240235\bin\uninstall.cmd
Size 618B
SHA256 4c7fb6edc3bdc0f12b11b3669f27dc7274ee0642ee0e00fe5b1a04d96a009dbd
MD5 37b06e59cf1ab59705a9b621a76e0bf1
SHA1 b96c1775d0485c5795d2688f4ca51a43fa930b71
SHA512 d108d97790df1bc6cf38739976677945a385507f472b07b4efc40789e1a57b84ef6944942f524a366cf3c2086a797afadb8e55c54cdb410ea1fd4d23508748a5
TLSH
T198F0DD2A76D4227189E30351FA49D1961641C1FF222DB96211D6076D2CAB4E21AE9399
MD5 SHA1 SHA512 TLSH

Submit Download

updater.exe

Path C:\Program Files\Ace412_1935240235\bin\updater.exe
Size 6.6MB
SHA256 81c1d53e84f2db298deb16091d8d1cda2323b44e503866a436e8c179240a52b1
MD5 17a4fa33b90580b237452bdcc42b2b87
SHA1 080d11d149b4481ac2026b9aa4a4808a4f94d73c
SHA512 a7ad513ed03cc06a5386266189896690190ec158dfe051f1c09be53ab33a1f0e9c0bb8082cfbc4853b6c1fa7d40ec761c1b7b2c92c1b9a848f0a3c8715dd7a14
SSDEEP 49152:hEIklB3S6r4UYYP6ghhYwYkFTvqkSdfMe5XDCyQup4e3NbJRElzHkcM+XbsKgs8l:4jdvbS0cnQH//Kh1
TLSH
T126666D13F2A651EDD0AAD574872A5332B9727C894B30B5EF079076251E71FE0AB3CB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\Ace\Ace\Application\150.0.7874.0\MEIPreload\manifest.json
Size 238B
SHA256 44844cf3dde6e80087ae0e6bf0d9326d7ef7d23326d24ac83af0850be26923d2
MD5 442699c95b20a60470421c6a4d29960f
SHA1 c7317f2d2414c991c21205ba3c68a187b997e3c1
SHA512 c89cf089f7feeb80c6ded11f1fce84287abe8216a6e05723d1a7faf567c501c043cd1246ff8dbee1240d2d79c41b698ef4cc3459589e68e5bfc5bed7fc3a150b
TLSH
T127D0A7633841CD770198AA993D31AC0A73BB3F0B58429C1722B3100D80D5BB6206575F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\Ace\Ace\Application\150.0.7874.0\PrivacySandboxAttestationsPreloaded\manifest.json
Size 122B
SHA256 51c311a4ba03140bcd1c827f8d93dba50cadda736925903b26e95609275dbffd
MD5 31c3d9d18dce3f1e88374c0f1b052692
SHA1 8c9bf4993e317a9051db7fe4da8c8465e9cb3856
SHA512 e29fc312fa85c3ce6778d60d6964ddc49147664f313cfcdb0372989de353e173813d03d018bef98e728fe4ee812c12cae4f05c86fc12eecac8bf834a70fa68a3
TLSH
T1BFB092B56D05A2B628C403650A7683D79BB25D927823BD34A7071441216963A6277A1D
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_100_percent.pak

Path C:\Program Files\Ace\Ace\Application\150.0.7874.0\chrome_100_percent.pak
Size 679KB
SHA256 0a289d37473cbca548ea1dd0b70bccbb784059ba924fa2b7158eb71e427473ea
MD5 eebdc1050bf83d9fd518f22b30d6e687
SHA1 36028986f4509211bf716c32941a49c1c9057743
SHA512 69fe3b87cec121cf2dd2219f9c94533c854345f5a204da3161f2a765343d80c6a101fe15604d659aa4bc107e0f138df80f3208794ea7cc01f75ea4bd4e74669a
SSDEEP 12288:eI3H1fJw3Ozgsz5B0GDJQrnKs8SNP+QSs8ilSTe+gnoYu4oYJblIrkjKQCrC:J3VB++zEEmPL8bTe+gnoYu4LbQkGQt
TLSH
T1C7E412E77370AC7DEE9B1677826211B0FC7716280A52060A1B9FF8796917B4898DD3C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Program Files\Ace\Ace\Application\150.0.7874.0\chrome_200_percent.pak
Size 1.1MB
SHA256 01757ad39a5542dc425fc3cdfdfda97fdbe65ef447f7f2a0ee828f6d01be9a7d
MD5 510dc2aa65d1947e724a11e92fe202c1
SHA1 e68de56b92d2b77e1f29464c9e0093ade6a1d23d
SHA512 56d5d9c0936038c3baf01097bb29943602cdb2feec4817e3164e89037ef45e8a2eedd5c17865954c3aa765afe2d82d727ff6fec7707bd5b80526ca0daf600e21
SSDEEP 24576:Y3zB09pP8mmibkFR8+mZi5r8BWhQumeeRB3w/ppIQwuSXA4baUGQ74:Y3yP8mNbkFRJmQ58khQRtGp8uSXAUGQU
TLSH
T1344522D79370DC7DDD530B7792AB00F0FD7A146B0AB2140E0666AD7D3925A889ACA7C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Program Files\Ace\Ace\Application\150.0.7874.0\chrome_elf.dll
Size 2.5MB
SHA256 0c4f20d301b31417efbf0b884baecbb32b9fb33c16f990685a680670c5fc595b
MD5 a48c045dc131296099550c435ede0d1b
SHA1 46e2bcbda1b073ca1b62d154f7b3bb964f8b4762
SHA512 959b92f6ee57e4d2a851c0bca047d5a2540047c7befb4aca9cdf0102a59d0e7ded7720276abefdab160852e416c62d341c809e99bc1cb4c3f9a816c34858605a
SSDEEP 49152:KN9xZhY65q6FTJyBSCPABD96qt2CmR25MkeY930oK:wZCGyBi/9rK
TLSH
T12EC55B43F2A651EDC069C1788B1B9632FA61BC454B30BAEF0A90B7251E76FE0673D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Program Files\Ace\Ace\Application\150.0.7874.0\d3dcompiler_47.dll
Size 4.5MB
SHA256 54cf78298bfa1c4099db9e51c9aa7db9e2e36670bcec1aca40f7ac2e4886a428
MD5 90aaad43c12e9f0965baece1cf973e42
SHA1 8e884063a4252dc210e4917b7f01272d8a220f6f
SHA512 20e084cdef13235029d0562e915ca103f9cca37dbcc6930a93ef375ec5a8c9951fdd8fec43cdfb2767f068b09574aa54df8e8af6c613e0173624b30d077245ae
SSDEEP 49152:J6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/3:JUdeqt737jFm5wf
TLSH
T190268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Program Files\Ace\Ace\Application\150.0.7874.0\dxcompiler.dll
Size 23.1MB
SHA256 06cf862d073fb6c3e43b6665b788e588f4a2da3cc1ae5fc54477b5ebc87e0250
MD5 9090a680e9df4a48dfc10f86930082f5
SHA1 64cfb638d3a5a51c06dafc9ca62b769ed1c954f0
SHA512 81890719bc73f45b638ba5162f920185cba3c36c93a001a8ce7c45f0d4a23d898d613863f2ecfa44fc72d789caf3ad8c4f97e7cb0319a454c7919322f4be8a17
SSDEEP 393216:bTj7qV7StJH6Qn7nKKKKKKKKOKKKCtOiR:bTCMwbOi
TLSH
T1C1373A122646D09DC059C879C3278B269A2C34E72F67B9EFC4F491252F79EF85B39234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Program Files\Ace\Ace\Application\150.0.7874.0\dxil.dll
Size 1.4MB
SHA256 425638195d5f2af6b57b5d7a0ba0260a9069f0a532feab4454e5a37aeb8541f8
MD5 a59fba31ba47ba72de1906f0197edc09
SHA1 3ba499d3a4cdcc6d111041b6249e68ccccf0c046
SHA512 031f95270a04b89a5589b6efec8b8428f1422da7008da919a9347f730fe354f0e27f3d134ca45be55685c573c8624579001d1ca4c5e909573ebd067cd7c45e13
SSDEEP 24576:lcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/D:lsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bu
TLSH
T101656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Ace\Ace\Application\150.0.7874.0\elevation_service.exe
Size 3.8MB
SHA256 b873875096199c56e115cf523f4dd410bd39b291f95ba09056088fd91be328be
MD5 37f84338036713e688f567d927a89b05
SHA1 425674e42655bd5a3a1156d39b2957654b9d68ef
SHA512 f157a4b9024e6527156ac8effbf1298fc159a7f44ca9c3f8f8eebbcb29c0bc7692eb8c101b7cedd38f81d9e435dac1165fa33c3da90b07514ce1ee3021cccc58
SSDEEP 49152:Fgy2EEpAZE66e7MpKDn1CRu6AQtXpAvH5pcz/p6WOTyuuMpy5Lyd1i98VM+45:aEE3rAmW06nU5
TLSH
T1DE067C03F29651FCC05AD1B8874A9532BA21BC494B35AAEF07D0B7211A72FE06F3DB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Program Files\Ace\Ace\Application\150.0.7874.0\icudtl.dat
Size 10.4MB
SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
MD5 0a7cbe8e902379fc03c5c6c7c08c7d3b
SHA1 18ff020331534d21f24d922d4da3c253668e44d8
SHA512 88b94c5d350c2022aa27481e3a5c6bc74dd13ed1f2157dec4219d9b847469f7191f6fdc7305f3d27533c69f146324da8fdefbd8acbd2081965e74e8926d1e9c9
SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89o:1/cBhORok2HiXUxO/RJk3IWhlYntjdOo
TLSH
T180B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Program Files\Ace\Ace\Application\150.0.7874.0\libEGL.dll
Size 510KB
SHA256 ea4fc2ca825e125819944cb48cab600d77ab2eedf4b15c626a091bcdcf6e892a
MD5 20a4c159f5660441c9ac9ed3b33258d9
SHA1 ce17323a991edbcd393410518bd84d11438d642a
SHA512 96ca1968f0d2f005a763673b5f6034113fa1b75a28c757a5fc1364c33ddb456070671854e6145c56599043fb3c0f78a8ace10fe4e0d974bdae65e4e3111de7ae
SSDEEP 6144:ylbtylxx9WuGMQCCaPXN7P3k4Clx8DIlSBRt3JeNOQKlXFPVUcl0t0jdFCVs:xtLPXN7M4Clx8BBR/eyXFPVUcl0i+Vs
TLSH
T17DB48D15B3999669D077D1788A134A42FB71B8420B217AEF02E0E27D3F777E45A3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Program Files\Ace\Ace\Application\150.0.7874.0\libGLESv2.dll
Size 8.2MB
SHA256 18e12d0d013056012b5ea53474959998955448c111245b93c6cbdc8b4a686434
MD5 a12928d496aa9fecae3675cc0c2bbac0
SHA1 fcd84f077c2f27b430b7618a876277b7e396e6ab
SHA512 ca84e882d7fd5d011e30e1dce6d05b7a4f3587cd8ef4f9bd508fd8bed4c312da0bcdeb274591ff0d909dad14874f1f272b8f1e40f7d3989288bd261394bf1a1f
SSDEEP 98304:UbJ/XvcJoNZye0F0Rjw/dW5YLFOuAVgRS:ArbMnRJAt
TLSH
T1FE865A03F29291ADC05DD2789357A223F6307C4907387ADF1A9497262F76FE0AB7A714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Program Files\Ace\Ace\Application\150.0.7874.0\locales\en-US.pak
Size 497KB
SHA256 5bc4f4df73e56488bf430b80807c42ca3a901bba0e7000e3dcdb63955600271f
MD5 ae0bf27501e0024b9353b59751a94c83
SHA1 56caa68611c98bff92d200784c3f3c9566cea364
SHA512 474b991abcf75bfd054068b7b04f88506fb38d8779532db21abbc63cb3907ba61e50a8889aa43c384ccf4c6486830b6de762d3992d27a4328f70cb12c7b6f790
SSDEEP 6144:Yldp0uSu6DJqR5jogUZOOFXB6++Mf9CWvqtfaYY4mF+N/6Zw/:YHKG6V4JogUMMMWvqOw/
TLSH
T1BFB43B1FF7841236069312A27F0996B2FB36D06DA35152563CBC812C3377B76827B6E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Program Files\Ace\Ace\Application\150.0.7874.0\resources.pak
Size 15.1MB
SHA256 32f74164fab8b058195b6d44790ae42f6c7e1c637ae7a2e7c083434c251e31fe
MD5 8e432283616f0c11b4349ba971b9496a
SHA1 dcefcf6304149fc0ae057ab67891d93f47e8d1a1
SHA512 d8d8cd19372a60dfd2c21186d4f40aa30c281d73a60a26a87df0b0275061f47f2792ceead83b4d36f96cae61b2a1b11a890a5071ef89a8867eb4beacfad59e41
SSDEEP 393216:n6mtNcAhyBFrdN/N9tnfR8Wdyx2nMkrg0uR3GlCqSFJ2H1fNY:n6msBpTftnfR8ETMkg0uR2MqS61VY
TLSH
T115F633D032A2AD3FCD5683B4152CC231A59D890A36E57052094CB3EDDD79AA86FDD83F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Program Files\Ace\Ace\Application\150.0.7874.0\snapshot_blob.bin
Size 356KB
SHA256 312bad4fc48153ff9bbb8fb4800eb7b58e51721dbe8fb4775d94269ebab304c0
MD5 380d406024fbe7d94d0d4cd4a0661b95
SHA1 1ad1a8a818e9679faae933b2da92e3ddab17eaa6
SHA512 135d48ea7281a958fead30af6c021451d1170fdb9ecbb07a6b7309d05aa0e006a4f5ca916760fa80dc66d7832bbb2e03c7f43c18f42dda61083aa25af3f335b5
SSDEEP 3072:MiOt+xbRt2NaRDUUBxRcREwcWjBF3fNWit4l+yIdZ5b7HE6noZ6ulRVjJJ:At+HLDkrJ4lNibrQZ6u7z
TLSH
T18874CD12F709CE26C8B2267C8DF5CB942E34B18D9E99AA5B314443FDB4797640E2B34D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ace.exe

Path C:\Program Files\Ace\Ace\Application\ace.exe
Size 3.8MB
SHA256 059e9f84d929a6fbf7741f488fbf7c3ccf3081095088a9020b9fdd34c5882a1f
MD5 f8ce5593e50e89d1d72ed10607d3b4a7
SHA1 a76db4c6d3c2a2f57d3c89387cd32edcf6191fc6
SHA512 3b76872ac6ccd20653a302f885fa9d1813b4086b15de16b82d178a73af6fff209da78e181d0b267a1cb3396518e0c7877dd37ee9e28e4cc08bcccfc4b0235aca
SSDEEP 49152:BEqX2kBQJaMOonbz1GHDsPOjyDTG50ldA6Gz9XBy4B11kxkXNI/RdbWYLzXM+e95:R20MpbTP406r6IXOx7gbS1il
TLSH
T145066C43F19650EEC05EC178871A9632FA617C4947317AEF0AD0BB222E76FE06A3D715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am_MASCULINE.pak

Path C:\Program Files\Ace\Ace\Temp\source1812_978737396\Chrome-bin\150.0.7874.0\Locales\am_MASCULINE.pak
Size 18B
SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
MD5 65f69bd2d8b6458d3ecf77d84d70dc1c
SHA1 679bdfb03cbaa594ace5af4340a061ddc514309d
SHA512 39f2728a1898bc9406516fa737c58c349e3bd7f779276a2f6679b3e3f0db43f956e03ad25e5d9bf4b07b19909febcc6c0560f71ab4f4fa6b5dd1f021ef742c60
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 403187490d7747a3db01cb8b45c2fd89cf2d7074fba81f91c1416ad7134a0bf6
MD5 d54b5002d56259f1698e2b82ad8c3c35
SHA1 250775a688d476aa680e6acd2126aa191c4b6e2f
SHA512 663880556b8e7de7b0d6427ce8b5553104841d5b7bcf924f7cc0dd157467df2891c7d6eb9c0c78093a697c5bb64ab3592a5cda7c354ce31ebee1f823186bec22
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\Program Files\updater_chrome_Unpacker_BeginUnzipping5008_1844473823\CR_DDD2F.tmp\setup.exe
Size 5.9MB
SHA256 cd2cf52fe21faf644e60695186e2e8d6039109a9cc96bc20383a27e361384e48
MD5 6258a4187e35ae0f801bc2f419a82143
SHA1 96fab7e462e04deba5c63210f7e48d4eb34bce5f
SHA512 e783bbfcd52a94411a4216b1b4dee6df5efe7cf81d352310cb2560c1eef09ef2af206866131c62351900dc31afa9a79213ae03dc3c530042437d447f0137e7e0
SSDEEP 49152:bSX17nc6CMaFkgOIRv36kQSble6JibI1F5Dm7wwA4gVypuFDlogffqbb20UL7jb7:IvaFkEw6Dqlrbb45Llkqc1/g
TLSH
T1B9564B43F3A211F8D46ED974CF2E5122AA247C4A47B1A6EF16D476E11A31ED47B3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ace.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ace.lnk
Size 2KB
SHA256 5c8feaf8874ff5ef8d4f52238b46ec31de6865c6a49e9fc5c07005ff61a8d453
MD5 a3d15a258eece569e13bdd533c98ca43
SHA1 6ab31221414cd09ba13d147752864d325b3a36b4
SHA512 8b2fe8eaf58e13efe0652b7c41058322db19675ef6b38780068759fef459df3f5c16ea672022d0a1baa9ffaba758594a1a212604715ad934e13adef7bce92cd5
TLSH
T1FE4102167AE11795E3F352326A3336315F3ABC459527579E008443CC1893E908DACFA7
MD5 SHA1 SHA512 TLSH

Submit Download

1c1d0465-2ae2-45f4-b5f3-6bfa505cf247.tmp

Path C:\Users\Admin\AppData\Local\Ace\Ace\User Data\1c1d0465-2ae2-45f4-b5f3-6bfa505cf247.tmp
Size 1KB
SHA256 e960af5beebbf245370b26e8c738329f9d5683087a37c6a19fb5bc414bb7ad0f
MD5 9a9a56c930ae12fb9db7dabd328625b7
SHA1 7d3addd0f71ba05e786109ac98aaa6556ab40e6f
SHA512 6fe41fb5f869f8f2f645186852159e99acf0d06fe0764930f129d3c7f884c2a767ea22b61588994ab975f22ad4d18e273e60f7dfc44df783c624ff27e79acd01
TLSH
T1AB116572B09D6D735C5224C2B5972D631F75A27B42310A44AFDE012C13FB65D2317433
MD5 SHA1 SHA512 TLSH

Submit Download

32aeed12-0a92-4e43-9f8f-18959ae47e19.tmp

Path C:\Users\Admin\AppData\Local\Ace\Ace\User Data\Default\32aeed12-0a92-4e43-9f8f-18959ae47e19.tmp
Size 9KB
SHA256 1986a9cc47e5b99253ae003eaaae0c7866e2d4780a8404f297a4c046c3de4f96
MD5 02fbbc4441d68bbc0e4539955fc959ef
SHA1 e89e20530b6f4775c779f805b85ab24c2b5b9c6b
SHA512 a90b95a4709332705d3e6df870e9f61a0d9f37d2e8fdf776e02c6ee12c4aa603de455923c549cbd955009985c2e90bfa82d045ed52121c1a97ca08446cc0e9f4
SSDEEP 192:zRWu1Gv7rkRv9qFHcb+WNO0v/yIsn2agAI:zRWuI4vAFgbAI
TLSH
T1B712872EA954747B6DC7F25AE9253B42E7F2106234942E84DBFC893C25E7ACC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Ace\Ace\User Data\Default\Cache\Cache_Data\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Ace\Ace\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Ace\Ace\User Data\Default\Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Ace\Ace\User Data\Default\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Ace\Ace\User Data\Default\Cache\Cache_Data\f_000003
Size 1024KB
SHA256 6058ebcfba86a17fcaf6330b3ad2af64a0c9b3af0aa032253d832584be5a3a6e
MD5 3a6df5b8b549c6b169279f6d8cedb5ba
SHA1 903c907094fab271af863e56e49ffa305b562be2
SHA512 c2eeeeea390aaf744aaaa6b001342870247f4354a37d0e702f517737882e9cff983e26a8a122dfa4054fbddbf26324a1f483ceb739b64222fcee21c1cde5acd5
SSDEEP 12288:+pZD1KeDNY0+f4YMPsow08KtY25qUCO5Lm1FBFNnoifuw97p5yMDiP2wciYJxGsU:+Ld+cwzBLf1X7B97p5PGP2XZfuNoOf
TLSH
T1202523135F3689DB72DC068AAD356721FB22AAD54351F8AB90E03446F078878DBD9C4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af48f96e-5a36-4e9a-8128-7ffdfab15b40.tmp

Path C:\Users\Admin\AppData\Local\Ace\Ace\User Data\Default\Code Cache\js\index-dir\af48f96e-5a36-4e9a-8128-7ffdfab15b40.tmp
Size 48B
SHA256 855ea483f43ebcdd4108a353850e2ebb9de37d52077937f470d0f08c1f66f046
MD5 b9c3f7d404f3510f37a16ab884cbd00b
SHA1 4d722b8aa15c59d4725a448bf46ce34882dedb63
SHA512 57392ff4f29f60d83a02bf8bd742d07dfafa89a3858b220daf56f66318b7afcf0898057dae1b9e58821ecc57917fd4e46d1524817ce5ade049a5f9083162defe
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Ace\Ace\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 720B
SHA256 b06a14464735354273919065c2e11af529fb32c5b6c0f8eef9ff08b835e51a2f
MD5 9e4e1997e7f529accbf4040b1a29f5df
SHA1 0e568e8199223b93434332a1fb8ec06fc305f590
SHA512 6c1d66a1a83a701a4d0d720ef048e264ce6fa4c26c046e15432645f901bc61080b75d5a6335ce652041278ef1bda38006f3e83c5c452d69b3f2062b56cad32b6
TLSH
T1DC012DBC32AA020BFF90D5BA45D33C2575383002C19BAE829F108DF0AD0338411EF11B
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Ace\Ace\User Data\Default\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Ace\Ace\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Ace\Ace\User Data\Default\Preferences
Size 10KB
SHA256 a042eec2a58d0f1d4e01e20a59c0936ea43c240b907d570feac65d1610d6d49e
MD5 01f975d2a3790ba96e52d7ce0ec1e215
SHA1 a3fa5cb59354cd9979f9d1f0ed39d96899136b9b
SHA512 5815ad24ce5ded0bce7efb8055871f5efc4598fe4f0bbe0074ff36774617362e7ce4ea1b30d14ac505715a7ead26a1da06f7f4403ce03feaf465266e65b90918
SSDEEP 192:zR1u1Gv7tNRet9qFHcb+WNOsiX4R7/yIsn2agAC:zR1uIxsAFg44XAC
TLSH
T1DB22B72EA954757B5DC6F25BF9253B52EBF2006134902E84EBFC893C15E7ACC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab2b7f41-73ac-40ec-aaab-92d6ba05f498.tmp

Path C:\Users\Admin\AppData\Local\Ace\Ace\User Data\Default\Service Worker\ScriptCache\index-dir\ab2b7f41-73ac-40ec-aaab-92d6ba05f498.tmp
Size 72B
SHA256 821a96476b6825d13ab9446114458ca17c8735fffaf119c24e6427259f26e668
MD5 ebfa80b4b78cb7b3b3ec48224346f8d2
SHA1 0b5395c60d2687e1dc95e7388466a5dcdb8bc316
SHA512 e8e9e36d31dd5ee9bdbc9329507c859106b61133e50ec7afc8dfb792e0f4f7846b220e8803648033a353918b0912cb5d1422123c4ab7a699bf1d1942f68b5f66
TLSH
T16BA002222640C210C14002F42803939B1750F925D01142977BD5438E8C600D05E12184
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Ace\Ace\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 384B
SHA256 50d14360ee3dc71978b4a560f5cd495b3f12d1bc8670a67533612686387c1e73
MD5 6e7096e7c39e2eb5e607189fb58401b3
SHA1 a39afc4603d18f74a4d24b8efebf445b0e332d0f
SHA512 d752ddd076a3cebf8e3cb44cd1371d412c88e6721af7c7bd87e4ae48081b68375529b6c68a5b1abb917eaa886c6b598836b010e978b12bdc29dd8efc7daf3d7e
TLSH
T1E2E09703EADA650ACE204AB0108B00CDB335DAF2C24A93838260B3BD2CB32515A32386
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Ace\Ace\User Data\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

e7db53da-e327-4cba-8f49-7755d4bc5055.tmp

Path C:\Users\Admin\AppData\Local\Ace\Ace\User Data\Default\e7db53da-e327-4cba-8f49-7755d4bc5055.tmp
Size 182KB
SHA256 de849030d2b606c22e3e2b43de9cba5b484071999531566e99faf5a17fdadab8
MD5 8aca4a2cca77fc3f36276d73b4a38d39
SHA1 eff54f69661c94eec8d86abe36403d144f714013
SHA512 91ff3fdd6d01e0db88096cd66166b191beb100780cae9a4e68667586aeca504a0fb81a79f2cad32a2b701a610f2191e50faaec0e09729d0146139afefb241b8c
SSDEEP 3072:CS62L4kuF09G3N3qEDVDWrqizdq2pIRiHV/lG0a96h44tW8zcn:CSIG9o4Sr4tW3n
TLSH
T1A8047CB38E94085DCD9B173583ABDD2B39EB5E749C72BA5BD95A709C9B3B1C101B3002
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Ace\Ace\User Data\Local State
Size 3KB
SHA256 14c2cd57d9928e3a10be1d7504ead9c16cae72659f526b7c73647bf09d26efed
MD5 cf3d880576154e677a8230e10b8ae1ad
SHA1 be7b5df4e07bc54e174b0183d32916ee44ee55d3
SHA512 de02ef46ed5eaa8145b2c4cd15bb1c9f3b2ec57c25394a25f0d11ad8b9c5378c901d23b74934548faf3185adf8c755b4a2a25f8ff735be7aa68624b5eaa02466
TLSH
T14881D735B8AD9DB61D73A182F5033E53DFA621BBA5617F949AED471C12E72C82313003
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Ace\Ace\User Data\Local State
Size 3KB
SHA256 ebeb6dce9753ecc52e042e57a31724dfe8052f3ef5a985cc997be118569916bd
MD5 6c940c3bc0defdde02fca30023b00c74
SHA1 91ca9e3d80e1f03a019df341374e190dedac676d
SHA512 7de559babf446a8606cf094b62c6d9c767defcf534d4bf1f107e9479107d40f6529506bdfd4d47e9a955ab43b8a6e70af0e9f1cd3fd71f6448fb2a3bca3b4c1a
TLSH
T19471D635B4A99DB61E73A182F5033D53DFA622BB65717F94AADC460C12E32982356103
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5520-1125-0x00000245043D0000-0x0000024505AFD000-memory.dmp

Download

memory/5520-984-0x00000245043D0000-0x0000024505AFD000-memory.dmp

Download

memory/5644-761-0x00007FFD3ED30000-0x00007FFD3ED31000-memory.dmp

Download

memory/5644-760-0x00007FFD3EFB0000-0x00007FFD3EFB1000-memory.dmp

Download