b871cc1087ce087f94ea0013c2660506463ae7264dfba0d5d54c09af795526b5

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 00:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_790bf2e042ae531af39cab1ee59b7c1f_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 24.0MB
Sample260805-a264bsvbpf
SHA256 b871cc1087ce087f94ea0013c2660506463ae7264dfba0d5d54c09af795526b5
MD5 790bf2e042ae531af39cab1ee59b7c1f
SHA1 9fe671889aa17b3da62aa5967afe7161ce1cb74f
SHA512 c92af4d5d69de1493d8df1c2236ee7c8a023b8bc6fe409dce77fd7a120a3df958b5b27a41dd441e469c3c7f4b28ff699f9e7bda9b08acee91603ac2e1cd0e6f4
SSDEEP 196608:EAeOryKYWm/tZfmkQapldlRbHjHqEoL3/0rVxT5k5SFxFAoF4:hryKYWm/tZfmkQapTrqE3rPN4kxC
TLSH
T114471821BA5B596CD05BC4B0834B8A724A3174DB1B35B9BF44D492383F6EBF42F38259
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-04_790bf2e042ae531af39cab1ee59b7c1f_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1133651779\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1133651779\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1856	msedgewebview2.exe
1856	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4100	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4688	2026-08-04_790bf2e042ae531af39cab1ee59b7c1f_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 4100	4688	2026-08-04_790bf2e042ae531af39cab1ee59b7c1f_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	89
PID 4100 wrote to memory of 4932	4100	msedgewebview2.exe	90
PID 4100 wrote to memory of 2200	4100	msedgewebview2.exe	91
PID 4100 wrote to memory of 2200	4100	msedgewebview2.exe	91
PID 4100 wrote to memory of 2200	4100	msedgewebview2.exe	91
PID 4100 wrote to memory of 2200	4100	msedgewebview2.exe	91
PID 4100 wrote to memory of 2648	4100	msedgewebview2.exe	92
PID 4100 wrote to memory of 5280	4100	msedgewebview2.exe	93
PID 4100 wrote to memory of 5280	4100	msedgewebview2.exe	93
PID 4100 wrote to memory of 5280	4100	msedgewebview2.exe	93
PID 4100 wrote to memory of 2512	4100	msedgewebview2.exe	94
PID 4100 wrote to memory of 2512	4100	msedgewebview2.exe	94
PID 4100 wrote to memory of 2512	4100	msedgewebview2.exe	94
PID 4100 wrote to memory of 2512	4100	msedgewebview2.exe	94
PID 4100 wrote to memory of 2512	4100	msedgewebview2.exe	94
PID 4100 wrote to memory of 992	4100	msedgewebview2.exe	98
PID 4100 wrote to memory of 992	4100	msedgewebview2.exe	98
PID 4100 wrote to memory of 992	4100	msedgewebview2.exe	98
PID 4100 wrote to memory of 1856	4100	msedgewebview2.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-08-04_790bf2e042ae531af39cab1ee59b7c1f_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_790bf2e042ae531af39cab1ee59b7c1f_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-04_790bf2e042ae531af39cab1ee59b7c1f_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=2.4.2 --user-data-dir="C:\Users\Admin\AppData\Local\com.futabear\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4688.6024.486946422562302288 /pfhostedapp:d05eb3ea8ff1bafc42bea1a68be5f37dca758b9e
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.futabear\EBWebView /prefetch:4 /pfhostedapp:d05eb3ea8ff1bafc42bea1a68be5f37dca758b9e --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.futabear\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x160,0x198,0x7ffd37225fd8,0x7ffd37225fe4,0x7ffd37225ff0
    3⤵
    PID:4932
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.futabear\EBWebView" --webview-exe-name=2026-08-04_790bf2e042ae531af39cab1ee59b7c1f_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=2.4.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1404,i,13170317502255232883,16722565431668517807,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:d05eb3ea8ff1bafc42bea1a68be5f37dca758b9e
    3⤵
    PID:2200
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.futabear\EBWebView" --webview-exe-name=2026-08-04_790bf2e042ae531af39cab1ee59b7c1f_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=2.4.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2104 --field-trial-handle=1404,i,13170317502255232883,16722565431668517807,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:d05eb3ea8ff1bafc42bea1a68be5f37dca758b9e
    3⤵
    PID:2648
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.futabear\EBWebView" --webview-exe-name=2026-08-04_790bf2e042ae531af39cab1ee59b7c1f_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=2.4.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2320 --field-trial-handle=1404,i,13170317502255232883,16722565431668517807,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d05eb3ea8ff1bafc42bea1a68be5f37dca758b9e
    3⤵
    PID:5280
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.futabear\EBWebView" --webview-exe-name=2026-08-04_790bf2e042ae531af39cab1ee59b7c1f_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=2.4.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3476 --field-trial-handle=1404,i,13170317502255232883,16722565431668517807,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:d05eb3ea8ff1bafc42bea1a68be5f37dca758b9e /prefetch:1
    3⤵
    PID:2512
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.futabear\EBWebView" --webview-exe-name=2026-08-04_790bf2e042ae531af39cab1ee59b7c1f_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=2.4.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2208 --field-trial-handle=1404,i,13170317502255232883,16722565431668517807,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d05eb3ea8ff1bafc42bea1a68be5f37dca758b9e
    3⤵
    PID:992
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.futabear\EBWebView" --webview-exe-name=2026-08-04_790bf2e042ae531af39cab1ee59b7c1f_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=2.4.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2288 --field-trial-handle=1404,i,13170317502255232883,16722565431668517807,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d05eb3ea8ff1bafc42bea1a68be5f37dca758b9e
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.futabear\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 563d1ff79388f51636ec031f29f9ca2b9de926baad0ff8d8cf035f00f95e362e
MD5 9bf7467dc8edf9f273e2b726289fab01
SHA1 d1f2c72ea522101a4bc50bbb3fc641d68d875f0e
SHA512 67a5db9f86215534d1dc81f0852b9dabdf8c327aada875cb49799721f0a8dd30729b00667b3666594a3fe0dd5a7bc05f716db8d02aff2ba101b826e05a1ffccb
TLSH
T1E6D0123236410138D0603073200275090800C34B400942C49C3C855D5A580700902446
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.futabear\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9751ced195d3779d0c8cf8f94f21cbc26f58f9327abf68cd2b8a7bc89a683514
MD5 8265116f6af28b4a5a3531dbb77f6731
SHA1 8d08cc21782e51f0d0e9277fb23945c3ca70eff5
SHA512 0463159c0d272c2b1d6eb5e881f610355d91b5e1b26eabc18ea550ca18940e9cb1c2b77b1f9fed6053a595170a3a9a370e51c0bfc7dda5f9a6eafe323ae387de
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.futabear\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

44b061db-8733-4da5-9086-f398e889d84d.tmp

Path C:\Users\Admin\AppData\Local\com.futabear\EBWebView\Default\44b061db-8733-4da5-9086-f398e889d84d.tmp
Size 6KB
SHA256 bb83324af752af9feadca218d6053f280cc7cab8a34e39bc1cd81ea4e7e085e4
MD5 8ad779672f667217ef5a5db5f384df5f
SHA1 e507930993248c0cfaf843244eb7e68cc3d558ef
SHA512 aac5111ad0bb0d2ccdcca2b0cb4449f1f8f1f81aae8792068cff9b79a0f73e2cd6d94ef435d1344f53d13e18120c546718a0e0bcc61677bcd789a27cef0082fb
SSDEEP 96:stn/dwvHGIb9Hk+io5h16ZPys7/x+6MhmuecpH/1eje5K+gUaXA4+28XM1C7K:st/6XOo+ysV+FNH/Qj3S4+G6K
TLSH
T18CD196025E247D7B8CC7E109BA75BA13E3F6607260D11E58E7F8551C08E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.futabear\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 11956555742cdf97155250a73067e8c7901efb1b0ba34382f4bfc5193a9e7b46
MD5 0a94c5a852416339c9c67f20611a87d6
SHA1 a349904070316cc0a320067c7509e7fcac772ada
SHA512 43fba7883977548064538759fb452291accc6e47538e5279560257c1e12e8e54a2aae5fa02ecb37559ef4474c1370a1d964159db6e30bde020754ef37fde620d
TLSH
T102B0026150155703E38063BD53D20CA431702C52C7834ECFD0EE1475D9B2F4D91566C9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c01a.TMP

Path C:\Users\Admin\AppData\Local\com.futabear\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59c01a.TMP
Size 48B
SHA256 5b1683b246b28d587c0d758d36e89ee78915cc12118436cee88f8e0558a4be6d
MD5 d66c1096f69fb2b33288ab17d6d3a3ee
SHA1 8ed36793e2c09fe2b16e1f22af4af5625e3a1932
SHA512 7e6fb6ec51e8c6ecada58fec2d7f204cc9f3076f4f17ca70dbbe0ff2062e2b0b936166b336da5782c8ce5c496da95ee2ede9fa898fc470ce22367cc1eeb5914d
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.futabear\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.futabear\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 d64646dd49a6b7d5b08db3ba00ef02011dabc817f912ff899b98f35abe95cadc
MD5 a70891eab513c97ac9744273503f36f6
SHA1 4e89f81615a34c8536d6e19392f4d24f2c48dc15
SHA512 c3cf36166d446106b45e617af339325af8d23dbefc3730fa7d4a74a216c0a2800678da0a043b2caea63905de3c6aa7318c823875490831c4d9b49f5ccd2d94bd
TLSH
T1BE317CBA87F586ADC96156F92A243C1BCF1D081C46B83D1DC9D5EFDB53D1431E20468E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a2fdb.TMP

Path C:\Users\Admin\AppData\Local\com.futabear\EBWebView\Default\Network\Network Persistent State~RFe5a2fdb.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.futabear\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.futabear\EBWebView\Default\Network\TransportSecurity
Size 523B
SHA256 ebad72a04f108087dc98009e9cd80b43424f9e10fa674b0099b14d00daace383
MD5 2b698b9bed37857c204b0f0b7767badf
SHA1 308139b3efb3faaa806a8770fb03457ed1136ae6
SHA512 27531461d28e182bdc0818e3f95304c1357aaa507b6ba7d321c2e8f29492d2a3fa4871ed6b60d56a4ec04d00e1736b320a3e3ba8ee7f6dbef52b7fbd23591f2b
TLSH
T1AFF059B785BFE1B72068096B6C507C0A5B76FA3611C168F8EF92816CA0812A3070B472
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.futabear\EBWebView\Default\Network\TransportSecurity
Size 523B
SHA256 68e185c843b076cd00017fc4452d96943c7888a5d6e097b50835a608ebb33d68
MD5 64c1641b17fa11a8443f848ad32dc055
SHA1 4c6922b133071a98722262940013bedf64e49a3e
SHA512 ae6026f54a198621872f8536926893f6295c0d70175d3b592e885e3195624eb0a6aabef11e397fb4b5cf2f6c12ff40bdbe9106677efea487bc2a884f692b938f
TLSH
T1A2F050B7C5BFE577206809676950BC0A5B76F53511C1A4E4EF92416CA0411F31707062
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59982f.TMP

Path C:\Users\Admin\AppData\Local\com.futabear\EBWebView\Default\Network\TransportSecurity~RFe59982f.TMP
Size 356B
SHA256 dc992b72ba0207ff386218eef50fe034fe5a1f30e259610919c00dafb32a0565
MD5 9c266a0d346605ba446169471c43f8da
SHA1 822cae5729cfa7a8943f94c7d4ed86c23a214747
SHA512 a52024a6491824a4f9c59aae89b0523534aef6715d7382bb74fe032cf0233a8983b98f17bcf928932e74f0890b409227b8ade4f5f1c5ddb880ff8257579a94f4
TLSH
T163E020F7847BE17711AC4D7F18807C06AB77E535119158E4EA5381ACB0812A74767473
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.futabear\EBWebView\Default\Preferences
Size 6KB
SHA256 b15f2824ecb11f82c03a5527428c79a81ce964c1c5ac1a2c96fdfae3589e8516
MD5 a2bf3f5eaf18e45beec8975f5289669a
SHA1 d1a05fed53edff6bc295ca9ddd810873b088ee57
SHA512 8c2b7b210e8e4a7d761f39c33b40d18749c8ecae78d80a17655d00ecfb5728e93cbda767675e808ac71eef53dddb4980c6ea571f58e294fb95bedfc68bb8807a
SSDEEP 96:stn/dwvAIb9Hk+io5h16ZPys7/x+6MhmuecpH/1eje5K+gU1Al+28XM1C7K:st/6pOo+ysV+FNH/Qj3/l+G6K
TLSH
T183D1A8025E24BD7B8CC7E109BA75BA17E3F6603260D51E58E7F8561C08E75DD630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5998fa.TMP

Path C:\Users\Admin\AppData\Local\com.futabear\EBWebView\Default\Preferences~RFe5998fa.TMP
Size 5KB
SHA256 b7aaad50e05f54647a77cab7406cc8f1d3725f9d4f25d961cce126a9a863dcc5
MD5 2a1a660248c208fc47595317b1532516
SHA1 b3b1bb70fab2aa9fcf25f33722d784d33792c915
SHA512 a71a0a0e72c960ec39f893d8e667e355889efd68c8ec94b4a61b1daaa3042bae7d93a32abe0d025aec690b2feb1c97764f6914b4ff74f4246a0c955fdb1561b8
SSDEEP 96:rn/dwvAIb9Hkcdo616ZPys7/x+6MhmuecpH/1eje5K+gUZl+28XM1C7K:r/6pvo9ysV+FNH/Qj3wl+G6K
TLSH
T19BC175029A287D7B8CC7E108BA35BA16E3FA603165D52D58E7F8562C08EA5DC6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.futabear\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.futabear\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.futabear\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.futabear\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.futabear\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.futabear\EBWebView\Local State
Size 2KB
SHA256 d90263d20b3cfcd2053539f18fc7e55956cd7e7dc59ffa0e7f3512e3042d83fc
MD5 5fd4a61975f4a9caa499ab5e33daf294
SHA1 f993596bd7b1ee4310d56b5a8df530d7c322b098
SHA512 9a38b4c7def1d4097063d3ce2c0c1c5509613d5dd418d8ed0d7bd4a6dbc8cb6d3920e4bc0275a0f23995a466d374b47c03081630a301e703b76e7b4884a4ebf9
TLSH
T160515433BC18AB37E6E34A05759A3A53AE7660719A622FA096DC0B1C41E755D1342C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.futabear\EBWebView\Local State
Size 3KB
SHA256 4f5520e650de612f34ce83d57f83f0e5f263c3fe87986b0a731510c640def121
MD5 63bcd3158264df1d4f1943738b9d5214
SHA1 58806368e21a5a8e65ae1502a46a7418320f64d2
SHA512 c6c75bb97e2c0e2ffc89eb81d446047e25efba64c78c4634a5db5a1f7e95470c5a36962c28687e4c7a530eb9c5c9182820bd79051222b45e61b4f7cd767d09a7
TLSH
T1D4617827AD74AA279EF39A0574C63B16B7A65033E5913FA4D6EC0F1C01D72881352C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.futabear\EBWebView\Local State
Size 3KB
SHA256 2cc3d8065240657424763e18703d879160bf5e4ac9b0f6ec831d4d77d1c41c73
MD5 58deeac47d973fbc5dc9ab36971bfeb9
SHA1 5eeb6b1eeb0851b4bad55dd193ab04a483ffaa28
SHA512 85c5f1176b1f98a29efd7a65945fd5db752b54e9d1dfdc249584a09785505e03ae1f00f8b53b4a49e9d2b9cb1eb938621f1e996ab5f9fc94a65429a1e23e8aa6
TLSH
T189717423A974AA379EF3D905B9863B03BBA5506395917FE4D6EC0F0C02E728D1342827
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe591b00.TMP

Path C:\Users\Admin\AppData\Local\com.futabear\EBWebView\Local State~RFe591b00.TMP
Size 1KB
SHA256 64f7493f472f7f30ebb1df2b933f3a4e31cf4a8f918aa1f91aa1d7924e1a9f9c
MD5 d757f47ba3da9e6797cefb862d657b4c
SHA1 378abda36f9dcb7cdf6ab34f43ea9794be3c0fa3
SHA512 5e61d58ed9f04673623a6975c9fe87c9ae65426a35ec1c90a765bf371fda44dade1bbdad6c9fb17bbcdbe1a3e2fcb6c828c22790a5ac4d6589665f351e202aaa
TLSH
T1372172B3F8681F32FD92161231927A8B3E72607786614E40A2DD0B1D42E314DA627833
MD5 SHA1 SHA512 TLSH

Submit Download

cd8e57a0-bf8d-4479-8b01-94ad98125033.tmp

Path C:\Users\Admin\AppData\Local\com.futabear\EBWebView\cd8e57a0-bf8d-4479-8b01-94ad98125033.tmp
Size 15KB
SHA256 8c34d3105d240a9ff20c181c12d678417df224e699b398c24e0e62fff7bd46b5
MD5 3ac56241a41d5f3c5814f1dda588d62e
SHA1 bf83b9be6e64e367cbe8f9dc3fea889dc601f2d9
SHA512 b7687b78aa40a94a384306071179e50c770dbddff143543c03c337d264de5c6201ac61b207eaab801795d1294c524794beb9c3a4f54b6579dba849417f3507eb
SSDEEP 384:3+aQikB+z/xvxjg/qhEwNBSYqp38sPvih8A9zE:G/UxvxjgC+g8s8YFE
TLSH
T112729E2B98297E23E5F7E50579991B4BDFBD947250C26EB84AFD5F0D06D72980302813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/992-304-0x00007FFD57D40000-0x00007FFD57D41000-memory.dmp

Download

memory/992-305-0x00007FFD58DF0000-0x00007FFD58DF1000-memory.dmp

Download

memory/1856-331-0x000001D31C9C0000-0x000001D31C9C1000-memory.dmp

Download

memory/1856-324-0x000001D31C9C0000-0x000001D31C9C1000-memory.dmp

Download

memory/1856-322-0x000001D31C9C0000-0x000001D31C9C1000-memory.dmp

Download

memory/1856-333-0x000001D31C9C0000-0x000001D31C9C1000-memory.dmp

Download

memory/1856-332-0x000001D31C9C0000-0x000001D31C9C1000-memory.dmp

Download

memory/1856-330-0x000001D31C9C0000-0x000001D31C9C1000-memory.dmp

Download

memory/1856-328-0x000001D31C9C0000-0x000001D31C9C1000-memory.dmp

Download

memory/1856-329-0x000001D31C9C0000-0x000001D31C9C1000-memory.dmp

Download

memory/2200-26-0x00007FFD58870000-0x00007FFD58871000-memory.dmp

Download

memory/2512-101-0x00007FFD58870000-0x00007FFD58871000-memory.dmp

Download