d81af51ec8246875f0c205926fea880cc634b7cf44ab8fba1c559294f0e934c3

Analysis

max time kernel
150s
max time network
158s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 12.5MB
Sample260925-xefzystgnc
SHA256 d81af51ec8246875f0c205926fea880cc634b7cf44ab8fba1c559294f0e934c3
MD5 dc2803cce7f2739445ebf96b84e2f9be
SHA1 14a4c9b74be97e302e23d3c1da1bc16f442f8e4a
SHA512 6858f1e58415f5fbf5c073b8674089a3ee2913ad5303f6851cc132a50e44d0c4d573400b8af56f09a41a6452d8f03eb32e1dc72328f655cfc935e071b290dacb
SSDEEP 196608:4JjojYIYNj3XJy2KfMQzVRzqz5+yWKY4YVcYxP:4J8jYIYNj3XJy2KfMQuzLW+YVzP
TLSH
T1F6D63A157B5B95A8C0ABC07482878A675D7030CB0B35AAFF5584963D2F7ABF46F38318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Executes dropped EXE 47 IoCs

pid	Process
6096	webmanager.exe
3032	webmanager.exe
6016	webmanager.exe
1240	webmanager.exe
1036	webmanager.exe
5292	webmanager.exe
2084	webmanager.exe
1016	webmanager.exe
1388	webmanager.exe
5584	webmanager.exe
2944	webmanager.exe
1352	webmanager.exe
1324	webmanager.exe
5896	webmanager.exe
4684	webmanager.exe
4356	webmanager.exe
1240	webmanager.exe
916	webmanager.exe
2328	webmanager.exe
3156	webmanager.exe
688	webmanager.exe
3868	webmanager.exe
4844	webmanager.exe
2124	webmanager.exe
1884	webmanager.exe
6016	webmanager.exe
2280	webmanager.exe
1656	webmanager.exe
3680	webmanager.exe
2480	webmanager.exe
2792	webmanager.exe
1712	webmanager.exe
4832	webmanager.exe
3868	webmanager.exe
2424	webmanager.exe
5212	webmanager.exe
3244	webmanager.exe
5064	webmanager.exe
2484	webmanager.exe
2024	webmanager.exe
5576	webmanager.exe
2668	webmanager.exe
1856	webmanager.exe
2260	webmanager.exe
2724	webmanager.exe
4464	webmanager.exe
1780	webmanager.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 47 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2760	tasklist.exe
3092	tasklist.exe
2232	tasklist.exe
2560	tasklist.exe
1780	tasklist.exe
5272	tasklist.exe
1448	tasklist.exe
5064	tasklist.exe
4352	tasklist.exe
2756	tasklist.exe
1056	tasklist.exe
2440	tasklist.exe
3372	tasklist.exe
2448	tasklist.exe
1348	tasklist.exe
2512	tasklist.exe
672	tasklist.exe
1400	tasklist.exe
3428	tasklist.exe
1436	tasklist.exe
2116	tasklist.exe
4400	tasklist.exe
3064	tasklist.exe
4636	tasklist.exe
4428	tasklist.exe
1436	tasklist.exe
5740	tasklist.exe
1544	tasklist.exe
3788	tasklist.exe
900	tasklist.exe
1200	tasklist.exe
1184	tasklist.exe
1740	tasklist.exe
4848	tasklist.exe
2892	tasklist.exe
4868	tasklist.exe
5384	tasklist.exe
916	tasklist.exe
2660	tasklist.exe
1308	tasklist.exe
4468	tasklist.exe
2024	tasklist.exe
4308	tasklist.exe
6020	tasklist.exe
5220	tasklist.exe
4532	tasklist.exe
3156	tasklist.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WebManager\webmanager.exe	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4932_1132173466\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4932_810275953\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4932_810275953\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4932_634366767\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4932_634366767\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4932_1202516718\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4932_1202516718\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4932_1132173466\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4932_1132173466\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4932_810275953\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4932_634366767\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5316	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3424	msedgewebview2.exe
3424	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4932	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	4636	tasklist.exe
Token: SeDebugPrivilege	4428	tasklist.exe
Token: SeDebugPrivilege	4468	tasklist.exe
Token: SeDebugPrivilege	2560	tasklist.exe
Token: SeDebugPrivilege	1436	tasklist.exe
Token: SeDebugPrivilege	2024	tasklist.exe
Token: SeDebugPrivilege	3372	tasklist.exe
Token: SeDebugPrivilege	1200	tasklist.exe
Token: SeDebugPrivilege	1780	tasklist.exe
Token: SeDebugPrivilege	1308	tasklist.exe
Token: SeDebugPrivilege	1184	tasklist.exe
Token: SeDebugPrivilege	2440	tasklist.exe
Token: SeDebugPrivilege	3092	tasklist.exe
Token: SeDebugPrivilege	2232	tasklist.exe
Token: SeDebugPrivilege	5064	tasklist.exe
Token: SeDebugPrivilege	2448	tasklist.exe
Token: SeDebugPrivilege	1740	tasklist.exe
Token: SeDebugPrivilege	4352	tasklist.exe
Token: SeDebugPrivilege	5272	tasklist.exe
Token: SeDebugPrivilege	4308	tasklist.exe
Token: SeDebugPrivilege	4848	tasklist.exe
Token: SeDebugPrivilege	5740	tasklist.exe
Token: SeDebugPrivilege	1544	tasklist.exe
Token: SeDebugPrivilege	2892	tasklist.exe
Token: SeDebugPrivilege	2760	tasklist.exe
Token: SeDebugPrivilege	1400	tasklist.exe
Token: SeDebugPrivilege	3064	tasklist.exe
Token: SeDebugPrivilege	2660	tasklist.exe
Token: SeDebugPrivilege	1348	tasklist.exe
Token: SeDebugPrivilege	2756	tasklist.exe
Token: SeDebugPrivilege	3428	tasklist.exe
Token: SeDebugPrivilege	2512	tasklist.exe
Token: SeDebugPrivilege	672	tasklist.exe
Token: SeDebugPrivilege	1056	tasklist.exe
Token: SeDebugPrivilege	4868	tasklist.exe
Token: SeDebugPrivilege	3788	tasklist.exe
Token: SeDebugPrivilege	5384	tasklist.exe
Token: SeDebugPrivilege	6020	tasklist.exe
Token: SeDebugPrivilege	1436	tasklist.exe
Token: SeDebugPrivilege	916	tasklist.exe
Token: SeDebugPrivilege	5220	tasklist.exe
Token: SeDebugPrivilege	2116	tasklist.exe
Token: SeDebugPrivilege	4400	tasklist.exe
Token: SeDebugPrivilege	1448	tasklist.exe
Token: SeDebugPrivilege	4532	tasklist.exe
Token: SeDebugPrivilege	3156	tasklist.exe
Token: SeDebugPrivilege	900	tasklist.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 4932	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	89
PID 4932 wrote to memory of 5080	4932	msedgewebview2.exe	90
PID 4932 wrote to memory of 4200	4932	msedgewebview2.exe	91
PID 4932 wrote to memory of 4200	4932	msedgewebview2.exe	91
PID 4932 wrote to memory of 4200	4932	msedgewebview2.exe	91
PID 4932 wrote to memory of 4200	4932	msedgewebview2.exe	91
PID 4932 wrote to memory of 4976	4932	msedgewebview2.exe	92
PID 4932 wrote to memory of 3436	4932	msedgewebview2.exe	93
PID 4932 wrote to memory of 3436	4932	msedgewebview2.exe	93
PID 4932 wrote to memory of 3436	4932	msedgewebview2.exe	93
PID 4932 wrote to memory of 4632	4932	msedgewebview2.exe	94
PID 4932 wrote to memory of 4632	4932	msedgewebview2.exe	94
PID 4932 wrote to memory of 4632	4932	msedgewebview2.exe	94
PID 4932 wrote to memory of 4632	4932	msedgewebview2.exe	94
PID 4932 wrote to memory of 4632	4932	msedgewebview2.exe	94
PID 4108 wrote to memory of 5316	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	95
PID 4108 wrote to memory of 4636	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	97
PID 4108 wrote to memory of 6096	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	101
PID 4108 wrote to memory of 4428	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	103
PID 4108 wrote to memory of 6016	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	105
PID 4108 wrote to memory of 4468	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	106
PID 4108 wrote to memory of 1240	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	108
PID 4108 wrote to memory of 2560	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	109
PID 4108 wrote to memory of 1036	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	111
PID 4108 wrote to memory of 1436	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	112
PID 4108 wrote to memory of 5292	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	114
PID 4108 wrote to memory of 2024	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	115
PID 4108 wrote to memory of 2084	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	117
PID 4108 wrote to memory of 3372	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	118
PID 4108 wrote to memory of 1016	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	120
PID 4108 wrote to memory of 1200	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	121
PID 4108 wrote to memory of 1388	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	123
PID 4108 wrote to memory of 1780	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	125
PID 4108 wrote to memory of 5584	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	127
PID 4108 wrote to memory of 1308	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	128
PID 4108 wrote to memory of 2944	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	130
PID 4108 wrote to memory of 1184	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	131
PID 4108 wrote to memory of 1352	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	133
PID 4108 wrote to memory of 2440	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	134
PID 4108 wrote to memory of 1324	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	136
PID 4108 wrote to memory of 3092	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	137
PID 4108 wrote to memory of 5896	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	139
PID 4108 wrote to memory of 2232	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	140
PID 4108 wrote to memory of 4684	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	142
PID 4108 wrote to memory of 5064	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	143
PID 4108 wrote to memory of 4356	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	145
PID 4108 wrote to memory of 2448	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	146
PID 4108 wrote to memory of 1240	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	148
PID 4108 wrote to memory of 1740	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	149
PID 4108 wrote to memory of 916	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	151
PID 4108 wrote to memory of 4352	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	152
PID 4108 wrote to memory of 2328	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	154
PID 4108 wrote to memory of 5272	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	155
PID 4108 wrote to memory of 3156	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	157
PID 4108 wrote to memory of 4308	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	160
PID 4108 wrote to memory of 688	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	162
PID 4108 wrote to memory of 4848	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	163
PID 4108 wrote to memory of 3868	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	165
PID 4108 wrote to memory of 5740	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	166
PID 4108 wrote to memory of 4844	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	168
PID 4108 wrote to memory of 1544	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	169
PID 4108 wrote to memory of 2124	4108	2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	171
PID 4932 wrote to memory of 2376	4932	msedgewebview2.exe	172
PID 4932 wrote to memory of 2376	4932	msedgewebview2.exe	172

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe --webview-exe-version=0.5.295 --user-data-dir="C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4108.3344.16390855313767602352 /pfhostedapp:f1ed5419d81c4f7b377d7ff67294de5e93355f37
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView /prefetch:4 /pfhostedapp:f1ed5419d81c4f7b377d7ff67294de5e93355f37 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x16c,0x194,0x7ff9fcce5fd8,0x7ff9fcce5fe4,0x7ff9fcce5ff0
    3⤵
    PID:5080
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView" --webview-exe-name=2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe --webview-exe-version=0.5.295 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1748 --field-trial-handle=1756,i,7509768831945762191,12125677746053661190,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:f1ed5419d81c4f7b377d7ff67294de5e93355f37
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView" --webview-exe-name=2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe --webview-exe-version=0.5.295 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2040 --field-trial-handle=1756,i,7509768831945762191,12125677746053661190,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:f1ed5419d81c4f7b377d7ff67294de5e93355f37
    3⤵
    PID:4976
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView" --webview-exe-name=2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe --webview-exe-version=0.5.295 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2312 --field-trial-handle=1756,i,7509768831945762191,12125677746053661190,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f1ed5419d81c4f7b377d7ff67294de5e93355f37
    3⤵
    PID:3436
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView" --webview-exe-name=2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe --webview-exe-version=0.5.295 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3352 --field-trial-handle=1756,i,7509768831945762191,12125677746053661190,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:f1ed5419d81c4f7b377d7ff67294de5e93355f37 /prefetch:1
    3⤵
    PID:4632
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView" --webview-exe-name=2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe --webview-exe-version=0.5.295 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4380 --field-trial-handle=1756,i,7509768831945762191,12125677746053661190,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f1ed5419d81c4f7b377d7ff67294de5e93355f37
    3⤵
    PID:2376
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView" --webview-exe-name=2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe --webview-exe-version=0.5.295 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4532 --field-trial-handle=1756,i,7509768831945762191,12125677746053661190,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f1ed5419d81c4f7b377d7ff67294de5e93355f37
    3⤵
    PID:1728
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView" --webview-exe-name=2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe --webview-exe-version=0.5.295 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4516 --field-trial-handle=1756,i,7509768831945762191,12125677746053661190,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f1ed5419d81c4f7b377d7ff67294de5e93355f37
    3⤵
    PID:2468
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView" --webview-exe-name=2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe --webview-exe-version=0.5.295 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4552 --field-trial-handle=1756,i,7509768831945762191,12125677746053661190,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f1ed5419d81c4f7b377d7ff67294de5e93355f37
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3424
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView" --webview-exe-name=2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe --webview-exe-version=0.5.295 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4008 --field-trial-handle=1756,i,7509768831945762191,12125677746053661190,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f1ed5419d81c4f7b377d7ff67294de5e93355f37
    3⤵
    PID:3216
- C:\Windows\system32\schtasks.exe
  "schtasks" /Create /TN "Web Manager" /TR "\"C:\Program Files\WebManager\webmanager.exe\"" /SC ONLOGON /RL HIGHEST /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5316
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4636
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:6096
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4428
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:6016
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4468
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2560
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1436
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:5292
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2024
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3372
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1200
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1780
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:5584
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1308
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1184
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2440
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3092
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:5896
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2232
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5064
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2448
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1740
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4352
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5272
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4308
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4848
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5740
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1544
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2892
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2760
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:6016
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1400
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3064
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2660
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1348
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2756
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3428
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2512
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:672
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1056
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4868
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:5212
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3788
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5384
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:6020
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1436
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:916
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:5576
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5220
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2116
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4400
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1448
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4532
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3156
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq webmanager.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:900
- C:\Program Files\WebManager\webmanager.exe
  "C:\Program Files\WebManager\webmanager.exe"
  2⤵
  PID:5820

C:\Program Files\WebManager\webmanager.exe
"C:\Program Files\WebManager\webmanager.exe"
1⤵
- Executes dropped EXE
PID:3032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

webmanager.exe

Path C:\Program Files\WebManager\webmanager.exe
Size 2.9MB
SHA256 3242a9a62ce22e7f21db07e1186546d5a60886d1b800725a8027857d282fb905
MD5 29bcc7238989b0168e935a08b4d24f0e
SHA1 acf5cc5181432f0ac550f5a13b8f8d522affbe76
SHA512 01585c84bd52caeac3b62874996ed73f4e4cda4363721f9b5feff9dd88d121ccc0f1b364dfcf03cbe2a807dd9a4be9c9f0d9e8e0b5e9625fa580b4e93e7f47c9
SSDEEP 49152:wiOoBVF8bPqFkNh7/9L2MRGDRThQfebFH:7jV+yFq7cMM
TLSH
T12EE5294EAAA941E1C0BAD07CC683652BFC7134A68331A7D767959B171F23BE4E93D700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d3e55827c04591901425e9f2ac0014fd2f91333d6bbb664f25317fd74708f0a4
MD5 5b7981b427d1356ff8b5589959c9fe10
SHA1 3fe56f41a62f6d09438cffce064ef807f9ce1ffe
SHA512 af5260dfda8caea5d5e02f8bf3364352b7423a1a8311841782016e32ff561976ef804b386f1053e12e2082319369dd01713c30c1df872822db460e2e70a26b8a
TLSH
T171D0121232410174C810203B060271491500C10BC1868140A43D85EE9A044A01DA6C41
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4ff794d41229d86e2a46febc3f7e4285d6d21c7ab36a9d43a65920267dbd395d
MD5 0185e36ecb78e4e03b8487e82f4024f4
SHA1 ff555a1052689d4c0bc4dad5d938fd9cea466a8c
SHA512 2b1f041bcb9752a63d559a7185deee7da71efe25c3632bdf295c10d7d6910ce3ecc9cb71b52d6d5075777e38ad278171e077032ae6630414c81acbd7a6723923
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

68f01599-3140-4599-ad56-f435a961b69b.tmp

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Default\68f01599-3140-4599-ad56-f435a961b69b.tmp
Size 6KB
SHA256 1bb79755f15acfe1c15d139ed64671bb40298ad14f665ce976616a356413fa23
MD5 e39d315cb02f9ca40aa888a8c6958461
SHA1 49ab2dac68982e37710c4f94274018af54fed56a
SHA512 587e029b7e6b4fe54fc06a0e5519e0e1cedf8c47348bd47a219b4dbefc37d309512d67ff81b53ce87fdf2fa409d30e4a5ae4b8458b87cb8f1412dde401525d60
SSDEEP 96:stO/dVUt5b9Ekyo5h16Z0Js7/x+6MhmuecJNr1ejeFK+gJ28XM1C7K:stW/nxonJsV+FdNrQjzXG6K
TLSH
T1FCD1A6095E24B97B8CCBE109BA29BA57E2F9507274D11F58E7F8462C04DB6CD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 5a58d5532e6d96a0333667cb591328748e0583c32ff4c3ddf8c35f4f6cf5a978
MD5 b076df3ac463e7b08eacf5398c0b1d87
SHA1 6726536a27cda7a704b87bd360eaaafdfbcbb27e
SHA512 b6fab56a78a2abc734df4b5f1745b431c3e532b6b7da7c70d4262d0bb40bae04f66cf735db945e0e492dec0b9f262d782453ff96bc883dc32c498de5aa7c1cf6
TLSH
T144A0022895440416C160577161D321907730B878065B1A21D4D101B98DE1BB94591154
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ad0f.TMP

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59ad0f.TMP
Size 48B
SHA256 c4fb744b073a8c3035fad53d3ba63c9666cf63cd98ae0ab4c6e6838a1bdd831c
MD5 292d03adb2dda13231d125ff66bdf91c
SHA1 e355a5e236f7fb9626b9518861a7ed3e07fdb8e3
SHA512 dfe1c160e3e8c46e1e6f3455fc76dbafb9b991310840e252ad9d15c62348b18f02060ad6523fcf50147714c914bcb224235cf1f053c6b667ac803d8b682ec464
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a7f63.TMP

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Default\Network\Network Persistent State~RFe5a7f63.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Default\Preferences
Size 6KB
SHA256 73017fb1b93d7ad87363d8ed82f1c19c3bb36b0520ea8525270d426de8bcb679
MD5 955d593dcf3737d3228ef735e50bada2
SHA1 bbb0c2fc3f6625c6f675913c43b983dea244f6e9
SHA512 1548b4f68199ea284fc92cfdbb8cccc25853bcae7b3c68b5da55aa4872f74355ff8f8c51fce3735589319b29add944bb4641416588399ec8f26b5fd344133af2
SSDEEP 96:stO/dVUEG5b9Ekyo5h16Z0Js7/x+6MhmuecJNr1ejeFK+gm28XM1C7K:stW/FxonJsV+FdNrQjzIG6K
TLSH
T1CCD1A70A5E24B97B8CCBE109BA29BB57E2F9507261D11F58E7F8462C04DB6DD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Local State
Size 2KB
SHA256 debd863d45772ffb63b67ec5018ec85b430d101c96270c1dccef53bd7c07de72
MD5 7389464768baf36c91f1c8b858bb3ce4
SHA1 ac6b22987a60a0020ee9d125fc6df7847152093c
SHA512 a41ac8bafbe1c81d623a5acbb04e4f9700f6960a40fe8f131c177bfbaed39018efa24b1d7731d61161a837067d23cb2da4c34ad10b255b6890b99a370feed6f1
TLSH
T1A451967B6D50AA338AE78605788A3F62DE754077AA931F50AACD0B0801DB55D2307C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Local State
Size 16KB
SHA256 9b470c8f9ca75914e399c675eb07005fe5966786901321e8521eb39348845dc8
MD5 e606b2b58ae3122b5b4395563cb475bd
SHA1 6db8c21b7844a99e9de1235099222aebdb3821c7
SHA512 4a60b21961a314fa535e05819975434f2939e74e8d9c8119733bf20ade714757b0eb69d197266df3cd265bed005e64b2904576d8b2273ffa710e79770487299b
SSDEEP 384:u+aQikB+z/xvxjg/qhEwNBSugPFq7mZn/Fr9zZ:5/UxvxjgC+BFFZlFZ
TLSH
T1F6729D2F59687D3399F7E50539491B8BDBB994B394C26EB88AAD1F0907C72E80342C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Local State
Size 3KB
SHA256 f34fe3f9654e8d35efb2fb27c4c5259ffa330bd1b1e17a16a0b7b2d7907f4a07
MD5 6fc564cc9cf802eaf13565f5dfc19816
SHA1 b90d66642a39cb39c068d6ace779de5a499caa3f
SHA512 87a2c5d5f39e040f725ab64ef5c84470c2b25a97a4642216f47c53f95e28e4a594b6a8e3b0b4f7bf3a06899958349ce5b1ac856c6f93a3f784a277a648238077
TLSH
T1C871847E6DA0A9374EE78A0578863F52B7A54037A5D67F94E5EC0F0C01D72881312C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5958e4.TMP

Path C:\Users\Admin\AppData\Local\com.eseanet.anticheat\EBWebView\Local State~RFe5958e4.TMP
Size 1KB
SHA256 122f50f8f3e55198edbbf2f1045d097ac0e937fcde6a8967dbc5ab530bd3218b
MD5 27fc347e87e7f5a01efda0d136f11980
SHA1 7394d90131dbe5aab421c993ec39ba711fb9c7ad
SHA512 1a5e0ea24d565326683fe3522480289c68ca916d0e360295162d3bb5e57e98851a2620f6862b72488ae92fb08b7143dfa89f43afbb38fbe5fb5fda986c799c6c
TLSH
T1E03176BE99A069329DDB85463486BEE3AF60107F91914F44B5CE4B0D02DB14DA22FC37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2376-269-0x00007FFA1E010000-0x00007FFA1E011000-memory.dmp

Download

memory/2376-270-0x00007FFA1F1C0000-0x00007FFA1F1C1000-memory.dmp

Download

memory/3424-353-0x000001F782BA0000-0x000001F782BA1000-memory.dmp

Download

memory/3424-346-0x000001F782BA0000-0x000001F782BA1000-memory.dmp

Download

memory/3424-348-0x000001F782BA0000-0x000001F782BA1000-memory.dmp

Download

memory/3424-357-0x000001F782BA0000-0x000001F782BA1000-memory.dmp

Download

memory/3424-356-0x000001F782BA0000-0x000001F782BA1000-memory.dmp

Download

memory/3424-355-0x000001F782BA0000-0x000001F782BA1000-memory.dmp

Download

memory/3424-354-0x000001F782BA0000-0x000001F782BA1000-memory.dmp

Download

memory/3424-352-0x000001F782BA0000-0x000001F782BA1000-memory.dmp

Download

memory/4200-24-0x00007FFA1E260000-0x00007FFA1E261000-memory.dmp

Download

memory/4200-203-0x000001CB6A6B0000-0x000001CB6A849000-memory.dmp

Download

memory/4632-63-0x00007FFA1E260000-0x00007FFA1E261000-memory.dmp

Download