b7fedad13497b4a5c65c802581d5c311bfe1f9235925e5c1d4228671af0e498f

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 03:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 12.5MB
Sample260924-dl8trscf47
SHA256 b7fedad13497b4a5c65c802581d5c311bfe1f9235925e5c1d4228671af0e498f
MD5 b3f7ff78266465e12f903fbf569c2667
SHA1 c72548f31e4aaa66a4221c63d0fba754af72708a
SHA512 c91ef4b696dff0ca7a94809ab7286e8a609e195296b811fb75058ca07c837a2b678f089c003e43b09d926e5fe7979e06bdd440a91b2c1cb23f4457de3e24b355
SSDEEP 196608:pJjojYIYNj3XJy2KfMQHVRzq05OyagY4YVcKxP:pJ8jYIYNj3XJy2KfMQK0zaQYVpP
TLSH
T138D63A157B5B95A8C0ABC07482878A675D7030DB0B35AAFF5484963D2F7ABF46F38318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Executes dropped EXE 47 IoCs

pid	Process
4420	webmanager.exe
2748	webmanager.exe
2672	webmanager.exe
1924	webmanager.exe
2112	webmanager.exe
5128	webmanager.exe
4132	webmanager.exe
3448	webmanager.exe
3984	webmanager.exe
4644	webmanager.exe
2976	webmanager.exe
3260	webmanager.exe
1176	webmanager.exe
5508	webmanager.exe
5920	webmanager.exe
2792	webmanager.exe
2292	webmanager.exe
3564	webmanager.exe
3220	webmanager.exe
1352	webmanager.exe
5276	webmanager.exe
3952	webmanager.exe
4420	webmanager.exe
3052	webmanager.exe
2744	webmanager.exe
1376	webmanager.exe
4840	webmanager.exe
5964	webmanager.exe
5880	webmanager.exe
708	webmanager.exe
6072	webmanager.exe
1948	webmanager.exe
5496	webmanager.exe
2476	webmanager.exe
2056	webmanager.exe
1424	webmanager.exe
2672	webmanager.exe
1904	webmanager.exe
4796	webmanager.exe
6068	webmanager.exe
4712	webmanager.exe
2432	webmanager.exe
4124	webmanager.exe
4224	webmanager.exe
1304	webmanager.exe
2476	webmanager.exe
5492	webmanager.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 47 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4640	tasklist.exe
2160	tasklist.exe
3196	tasklist.exe
2608	tasklist.exe
2056	tasklist.exe
3920	tasklist.exe
5748	tasklist.exe
5328	tasklist.exe
3892	tasklist.exe
3476	tasklist.exe
4380	tasklist.exe
4388	tasklist.exe
3020	tasklist.exe
1224	tasklist.exe
5344	tasklist.exe
5588	tasklist.exe
3052	tasklist.exe
1472	tasklist.exe
3976	tasklist.exe
5396	tasklist.exe
3220	tasklist.exe
5148	tasklist.exe
3104	tasklist.exe
1440	tasklist.exe
4948	tasklist.exe
1304	tasklist.exe
5964	tasklist.exe
1220	tasklist.exe
5004	tasklist.exe
1088	tasklist.exe
2976	tasklist.exe
4684	tasklist.exe
1624	tasklist.exe
5308	tasklist.exe
3752	tasklist.exe
5188	tasklist.exe
2608	tasklist.exe
1896	tasklist.exe
3480	tasklist.exe
1452	tasklist.exe
4916	tasklist.exe
4612	tasklist.exe
5404	tasklist.exe
5832	tasklist.exe
4704	tasklist.exe
2032	tasklist.exe
1244	tasklist.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WebManager\webmanager.exe	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_1706593672\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_1706593672\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_1706593672\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_1706593672\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_1675489445\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_124714404\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_1706593672\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_1706593672\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_1706593672\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_1675489445\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_124714404\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_1706593672\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_1706593672\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_1706593672\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_1706593672\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_1706593672\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_1675489445\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_1706593672\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_1706593672\Filtering Rules-CA	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3876	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1040	msedgewebview2.exe
1040	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1736	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	2608	tasklist.exe
Token: SeDebugPrivilege	3104	tasklist.exe
Token: SeDebugPrivilege	3052	tasklist.exe
Token: SeDebugPrivilege	5404	tasklist.exe
Token: SeDebugPrivilege	1896	tasklist.exe
Token: SeDebugPrivilege	5832	tasklist.exe
Token: SeDebugPrivilege	5004	tasklist.exe
Token: SeDebugPrivilege	1440	tasklist.exe
Token: SeDebugPrivilege	1472	tasklist.exe
Token: SeDebugPrivilege	3976	tasklist.exe
Token: SeDebugPrivilege	2608	tasklist.exe
Token: SeDebugPrivilege	4948	tasklist.exe
Token: SeDebugPrivilege	2056	tasklist.exe
Token: SeDebugPrivilege	3196	tasklist.exe
Token: SeDebugPrivilege	3476	tasklist.exe
Token: SeDebugPrivilege	5396	tasklist.exe
Token: SeDebugPrivilege	4380	tasklist.exe
Token: SeDebugPrivilege	4388	tasklist.exe
Token: SeDebugPrivilege	4704	tasklist.exe
Token: SeDebugPrivilege	2032	tasklist.exe
Token: SeDebugPrivilege	1088	tasklist.exe
Token: SeDebugPrivilege	3920	tasklist.exe
Token: SeDebugPrivilege	2976	tasklist.exe
Token: SeDebugPrivilege	5748	tasklist.exe
Token: SeDebugPrivilege	1244	tasklist.exe
Token: SeDebugPrivilege	2160	tasklist.exe
Token: SeDebugPrivilege	3752	tasklist.exe
Token: SeDebugPrivilege	3480	tasklist.exe
Token: SeDebugPrivilege	3220	tasklist.exe
Token: SeDebugPrivilege	5328	tasklist.exe
Token: SeDebugPrivilege	3892	tasklist.exe
Token: SeDebugPrivilege	1452	tasklist.exe
Token: SeDebugPrivilege	5188	tasklist.exe
Token: SeDebugPrivilege	1304	tasklist.exe
Token: SeDebugPrivilege	4916	tasklist.exe
Token: SeDebugPrivilege	3020	tasklist.exe
Token: SeDebugPrivilege	4640	tasklist.exe
Token: SeDebugPrivilege	5148	tasklist.exe
Token: SeDebugPrivilege	4684	tasklist.exe
Token: SeDebugPrivilege	5964	tasklist.exe
Token: SeDebugPrivilege	1624	tasklist.exe
Token: SeDebugPrivilege	1224	tasklist.exe
Token: SeDebugPrivilege	5344	tasklist.exe
Token: SeDebugPrivilege	1220	tasklist.exe
Token: SeDebugPrivilege	5588	tasklist.exe
Token: SeDebugPrivilege	5308	tasklist.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 1736	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	88
PID 1736 wrote to memory of 2280	1736	msedgewebview2.exe	89
PID 1736 wrote to memory of 2752	1736	msedgewebview2.exe	90
PID 1736 wrote to memory of 2752	1736	msedgewebview2.exe	90
PID 1736 wrote to memory of 2752	1736	msedgewebview2.exe	90
PID 1736 wrote to memory of 2752	1736	msedgewebview2.exe	90
PID 1736 wrote to memory of 384	1736	msedgewebview2.exe	91
PID 1736 wrote to memory of 1332	1736	msedgewebview2.exe	92
PID 1736 wrote to memory of 1332	1736	msedgewebview2.exe	92
PID 1736 wrote to memory of 1332	1736	msedgewebview2.exe	92
PID 1736 wrote to memory of 2760	1736	msedgewebview2.exe	93
PID 1736 wrote to memory of 2760	1736	msedgewebview2.exe	93
PID 1736 wrote to memory of 2760	1736	msedgewebview2.exe	93
PID 1736 wrote to memory of 2760	1736	msedgewebview2.exe	93
PID 1736 wrote to memory of 2760	1736	msedgewebview2.exe	93
PID 3416 wrote to memory of 3876	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	94
PID 3416 wrote to memory of 2608	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	96
PID 3416 wrote to memory of 4420	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	100
PID 3416 wrote to memory of 3104	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	101
PID 3416 wrote to memory of 2748	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	103
PID 3416 wrote to memory of 3052	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	104
PID 3416 wrote to memory of 2672	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	106
PID 3416 wrote to memory of 5404	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	108
PID 3416 wrote to memory of 1924	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	110
PID 3416 wrote to memory of 1896	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	111
PID 3416 wrote to memory of 2112	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	113
PID 3416 wrote to memory of 5832	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	114
PID 3416 wrote to memory of 5128	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	116
PID 3416 wrote to memory of 5004	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	117
PID 3416 wrote to memory of 4132	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	119
PID 3416 wrote to memory of 1440	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	120
PID 3416 wrote to memory of 3448	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	122
PID 3416 wrote to memory of 1472	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	123
PID 3416 wrote to memory of 3984	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	125
PID 3416 wrote to memory of 3976	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	127
PID 3416 wrote to memory of 4644	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	129
PID 3416 wrote to memory of 2608	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	130
PID 3416 wrote to memory of 2976	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	132
PID 3416 wrote to memory of 4948	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	133
PID 3416 wrote to memory of 3260	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	135
PID 3416 wrote to memory of 2056	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	136
PID 3416 wrote to memory of 1176	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	138
PID 3416 wrote to memory of 3196	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	139
PID 3416 wrote to memory of 5508	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	141
PID 3416 wrote to memory of 3476	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	142
PID 3416 wrote to memory of 5920	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	144
PID 3416 wrote to memory of 5396	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	145
PID 3416 wrote to memory of 2792	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	147
PID 3416 wrote to memory of 4380	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	148
PID 3416 wrote to memory of 2292	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	150
PID 3416 wrote to memory of 4388	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	151
PID 3416 wrote to memory of 3564	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	153
PID 3416 wrote to memory of 4704	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	154
PID 3416 wrote to memory of 3220	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	156
PID 3416 wrote to memory of 2032	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	158
PID 3416 wrote to memory of 1352	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	161
PID 3416 wrote to memory of 1088	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	162
PID 3416 wrote to memory of 5276	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	164
PID 3416 wrote to memory of 3920	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	165
PID 3416 wrote to memory of 3952	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	167
PID 3416 wrote to memory of 2976	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	168
PID 3416 wrote to memory of 4420	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	170
PID 3416 wrote to memory of 5748	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	171
PID 3416 wrote to memory of 3052	3416	2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	173

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe --webview-exe-version=0.5.273 --user-data-dir="C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3416.2240.15669487806964355274 /pfhostedapp:f1ed5419d81c4f7b377d7ff67294de5e93355f37
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView /prefetch:4 /pfhostedapp:f1ed5419d81c4f7b377d7ff67294de5e93355f37 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffc3d085fd8,0x7ffc3d085fe4,0x7ffc3d085ff0
    3⤵
    PID:2280
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView" --webview-exe-name=2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe --webview-exe-version=0.5.273 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1780,i,4123064722518822575,2175308840163904628,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:f1ed5419d81c4f7b377d7ff67294de5e93355f37
    3⤵
    PID:2752
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView" --webview-exe-name=2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe --webview-exe-version=0.5.273 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2188 --field-trial-handle=1780,i,4123064722518822575,2175308840163904628,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:f1ed5419d81c4f7b377d7ff67294de5e93355f37
    3⤵
    PID:384
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView" --webview-exe-name=2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe --webview-exe-version=0.5.273 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2300 --field-trial-handle=1780,i,4123064722518822575,2175308840163904628,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f1ed5419d81c4f7b377d7ff67294de5e93355f37
    3⤵
    PID:1332
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView" --webview-exe-name=2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe --webview-exe-version=0.5.273 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3412 --field-trial-handle=1780,i,4123064722518822575,2175308840163904628,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:f1ed5419d81c4f7b377d7ff67294de5e93355f37 /prefetch:1
    3⤵
    PID:2760
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView" --webview-exe-name=2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe --webview-exe-version=0.5.273 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2084 --field-trial-handle=1780,i,4123064722518822575,2175308840163904628,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f1ed5419d81c4f7b377d7ff67294de5e93355f37
    3⤵
    PID:968
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView" --webview-exe-name=2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe --webview-exe-version=0.5.273 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4524 --field-trial-handle=1780,i,4123064722518822575,2175308840163904628,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f1ed5419d81c4f7b377d7ff67294de5e93355f37
    3⤵
    PID:6004
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView" --webview-exe-name=2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe --webview-exe-version=0.5.273 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4392 --field-trial-handle=1780,i,4123064722518822575,2175308840163904628,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f1ed5419d81c4f7b377d7ff67294de5e93355f37
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1040
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView" --webview-exe-name=2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe --webview-exe-version=0.5.273 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4412 --field-trial-handle=1780,i,4123064722518822575,2175308840163904628,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f1ed5419d81c4f7b377d7ff67294de5e93355f37
    3⤵
    PID:4468
- C:\Windows\system32\schtasks.exe
  "schtasks" /Create /TN "Web Manager" /TR "\"C:\Program Files\WebManager\webmanager.exe\"" /SC ONLOGON /RL HIGHEST /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3876
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2608
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3104
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3052
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5404
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1896
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5832
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:5128
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5004
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1440
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1472
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3976
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2608
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4948
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2056
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3196
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:5508
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3476
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:5920
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5396
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4380
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4388
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4704
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2032
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1088
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:5276
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3920
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2976
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5748
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1244
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2160
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3752
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3480
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:5964
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3220
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:5880
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5328
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3892
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:6072
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1452
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5188
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:5496
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1304
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4916
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3020
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  PID:4612
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4640
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5148
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4684
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:6068
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5964
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1624
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1224
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5344
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1220
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5588
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5308
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:5492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

webmanager.exe

Path C:\Program Files\WebManager\webmanager.exe
Size 2.9MB
SHA256 f060957dd369a3043664aed1ab558e64a359384c7e2ce6fff55d4ec1ba178492
MD5 78f91e86303cf158e28e00df1c1f8466
SHA1 0daa6665769384e1447acb56be0157292e61f103
SHA512 2b0f4a1fcff7a244dc34dd1fd6c8c65b4bbd83f1a0c79d11c2dbdf15e2d703f7cdcef7a0af20d2a1a8a489153e5b85541bcf29387895b9e699b5cdd4ae9439d7
SSDEEP 49152:piOoBV18bPqFoNLN/9L2MsGDRThQfebyH:8jVOyFENcM9
TLSH
T17CE5294EAAA941E1C0BAD07CC683652BFC7134A68331A7D767959B171F23BE4E93D700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 116f82908589571c8358218f009eb50a0c16d283fc15beba7cd6662132a8a5d1
MD5 06d06cd8b4a7228b9bf0d747b58d714a
SHA1 f83232dc4eeaffeee752ac85eb30203f7ec2252b
SHA512 192515157ba0985fdbb49e67f55d62f9fd09c019d19f7a207e437aafc666317a85937503e361c5ccfc4be425f37e20014936668527c493387f5980210ec88ee0
TLSH
T1A7D012123A020E34C01021331842610D1408C50B40C941406429891D1B040680917493
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9922970fb0e8e9d92d7990bb661f20cb0208869292254f6564947ad5385dfdc0
MD5 ac19a400981ffadfa43cd3a62a52052a
SHA1 1004ab54f3cd9f5de1a69bb7f740576344b0cec4
SHA512 f43b93e4e8c140104a39f705d839aca811cfb9cdddc7e9d6b3cab0830fa00b2e7d59c9ddb28f153f9e0d5c04363c0c6466b5584867b8c92517b09e04ea021236
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 68009b513a17ec21ab4f7bec19424e5bb73a05f55891daf9b3ab0146994845bf
MD5 436948b5287a20cf1e692e211c1e263d
SHA1 5ba8646152c5e0469c3a2b17b4f9fbb237529e9e
SHA512 24ba02d779bd0cbf208063f78b2df3254513d1d7ac2b96e3bee219f39b50c4aaa84ee1bec23317320b6c8e24a34f3c93f2816140fefe08108f05767eee42b258
TLSH
T148A0027545408956E58433B1A0DA968433304E982E172B0DC8F106F6AC50750C681020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a2b76.TMP

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a2b76.TMP
Size 48B
SHA256 31467c63c8792c5f3fde54d87b7c0ee8165fc57d0e7555b62719f2163c9b35f3
MD5 fb33b57bdb2094ad36bbdcf99b732bc1
SHA1 4e2f9cec8c8b2fb7b65474c44dc9da4c0a143fb1
SHA512 2d62fbe40a833694c828c6dd499648d7ad795857781058f6932709c6c74373ecacb62af92697b794c5551e65e73978de47e07b9dcf6e7d61057d5d42672080b0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Default\Preferences
Size 6KB
SHA256 df5f0299ad485762252c9665f814672ba3a429d8d706f8519d1fb79627989eb0
MD5 f739b3cd3996cfad832c32c9b9965779
SHA1 1b4b48d0ccde1c1d73280be72960f7513df8bf8b
SHA512 ca8395e7ecf3d85bf9347d2d50f3a456697ff69e2b349adc20379825865ba96a866262fbd17baf89c1eb37353f12bf9dc68f761ac3042e881985fa644c32eed3
SSDEEP 96:stv/dVqPGlDib9OkEo5h16Z03s7/x+6MhmuecJ3Wzp1ejeFK+gaZj28XM1C7K:st3/DxDon3sV+Fdm1QjvshG6K
TLSH
T1C4D1A5065E28787B8CC6E549BB29BF13E2F5607261D11E5CE7F85A2C14DAACC2317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd5446ba-a599-462e-88b3-fd882873304e.tmp

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Default\bd5446ba-a599-462e-88b3-fd882873304e.tmp
Size 6KB
SHA256 3e3c6fc59997262d4e581aa4b6264752b2d71025bde2cd3350769d073aa5d744
MD5 0c4ef6de332bd285202eeb8dfbd335a8
SHA1 8244a60ac8bee59987c622b0a74993f3d3bf6508
SHA512 8bdb0b91217a22e6d279ea5e7579ee0baf1357128a3160b8220fafebf008d45ef0188077840a4a77115cc5de76919807884f27a17ccb2b4934d53a36a86b03c0
SSDEEP 96:stv/dVq4lDib9OkEo5h16Z03s7/x+6MhmuecJ3Wzp1ejeFK+gaZV28XM1C7K:st3/RxDon3sV+Fdm1QjvsrG6K
TLSH
T18AD1A4065E28797B4CC6E549BB29BE13E2F5603261D11E5CE7F89A2C14DA6CC2317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Local State
Size 16KB
SHA256 fdad2f95f658c2eb436a77663d91814d7d64c660a49310a8153adf3dc42493e5
MD5 0a68b845d2424ddd52059834aab89e98
SHA1 ae0295ec33140a17891839fc07e725fda327a60a
SHA512 52702aab135674e6d173bc700fe4e4eed0e9820c4f05ed522de112e44611902cf7d9a69fdb5acd947f0584778b37da08099aebae5a99eac4a4d941b9a35bfe6d
SSDEEP 384:S+aQikB+z/xvxjg/qhEdNBSslSXdPN7mAQ9zC:9/UxvxjgC+NlSN1hQFC
TLSH
T171729E2E99B9BD3396F3E9053D595F4BCBB894B250816EB849E96F0D02C77C80347816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Local State
Size 2KB
SHA256 edc50e621d070426f125879dac0e274dccf7af6f3ebbfe2e1f403a6854f15ca4
MD5 b4f2bcab568b85ab60b5dfbcbfefb921
SHA1 917a4d8b3dd73959e40f16c4c145384a8efa9f2e
SHA512 1dd9b418310f4055d70d54e016132b8df96675b48fb140fefd8a49bcbc9bd3502fdf8a827dfc0f1fe7196a8b3a68e985297344bffa8f2ab3a5859d8b84fea60f
TLSH
T18F51B6336C60AA374AF29A457A46BF53CF3590629A421F9095CD6F0C10D7A8C1347C32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Local State
Size 3KB
SHA256 6f9683fa04d29a630742234d724873423f5144d62517b642ecb870ef950ceac4
MD5 2ab13b4f0a56f9d48af236c03ecc7588
SHA1 8199d72cfa091b5a62b271a633594e7f2b775082
SHA512 994ce163e465ddde47f878098cb757df9a33a78028cd8d4965df39cb0e5c3afe4f99a4e25eed08afc1fb269a0ba64db887410c945f5d0fe9a302fc4d15e7ab72
TLSH
T13171943A6CA0E9374EF29A45B9866F57ABA55023E9813F94D5EC1F0C11D77CC1393C12
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59d9cc.TMP

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Local State~RFe59d9cc.TMP
Size 1KB
SHA256 77e88c8a158851e7228bbd6cbb2bb0d770d542e01e64cc7ad808b8a082a7066c
MD5 46aa649a3be855ff7e2f1878b535123f
SHA1 80ba3ac681682222793880ee8b69a5f4b3ac2ac4
SHA512 2b97eb3026450b163613dbb4b2c857e67f0986bdae3838cc0f1d8988ea32d358111c380dfef5e016fb2fbeea67b693438e6542fbce88278673f2be275b14ffb7
TLSH
T136319976D8E06A725DE265872692FEC79F20507783014F4464CD9B0C21D75CC557FC32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/968-263-0x00007FFC5CEC0000-0x00007FFC5CEC1000-memory.dmp

Download

memory/968-262-0x00007FFC5C4D0000-0x00007FFC5C4D1000-memory.dmp

Download

memory/1040-348-0x0000023EC9160000-0x0000023EC9161000-memory.dmp

Download

memory/1040-346-0x0000023EC9160000-0x0000023EC9161000-memory.dmp

Download

memory/1040-354-0x0000023EC9160000-0x0000023EC9161000-memory.dmp

Download

memory/1040-357-0x0000023EC9160000-0x0000023EC9161000-memory.dmp

Download

memory/1040-353-0x0000023EC9160000-0x0000023EC9161000-memory.dmp

Download

memory/1040-356-0x0000023EC9160000-0x0000023EC9161000-memory.dmp

Download

memory/1040-352-0x0000023EC9160000-0x0000023EC9161000-memory.dmp

Download

memory/1040-355-0x0000023EC9160000-0x0000023EC9161000-memory.dmp

Download

memory/2752-182-0x0000026366F70000-0x0000026367018000-memory.dmp

Download

memory/2752-26-0x00007FFC5C7F0000-0x00007FFC5C7F1000-memory.dmp

Download

memory/2760-102-0x00007FFC5C7F0000-0x00007FFC5C7F1000-memory.dmp

Download