Overview

overview

6

Static

static

3

2026-08-09...ar.exe

windows10-2004-x64

6

2026-08-09...ar.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 07:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_66fabb9ee913950bdde2452eb55a2719_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe
  • Size 11.0MB
  • Sample260809-jnvmtabp3w
  • SHA256 0306f4ee5039bddae624578c917ab44123365a64edbf760177ae6d62712dcbae
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoverytrojan

Malware Config

Signatures

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_66fabb9ee913950bdde2452eb55a2719_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_66fabb9ee913950bdde2452eb55a2719_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe"
    1⤵
    • Checks whether UAC is enabled
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4612
    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-09_66fabb9ee913950bdde2452eb55a2719_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe --webview-exe-version=1.1.2 --user-data-dir="C:\Users\Admin\AppData\Local\Owlin\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4612.1860.5839361836185177145
      2⤵
      • Drops file in Program Files directory
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of WriteProcessMemory
      PID:2032
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Owlin\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Owlin\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffaa07eb078,0x7ffaa07eb084,0x7ffaa07eb090
        3⤵
          PID:5284
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Owlin\EBWebView" --webview-exe-name=2026-08-09_66fabb9ee913950bdde2452eb55a2719_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe --webview-exe-version=1.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1728,i,160321373254812065,9874121862977822528,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1696 /prefetch:2
          3⤵
            PID:748
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Owlin\EBWebView" --webview-exe-name=2026-08-09_66fabb9ee913950bdde2452eb55a2719_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe --webview-exe-version=1.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2028,i,160321373254812065,9874121862977822528,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3
            3⤵
              PID:4408
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Owlin\EBWebView" --webview-exe-name=2026-08-09_66fabb9ee913950bdde2452eb55a2719_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe --webview-exe-version=1.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2368,i,160321373254812065,9874121862977822528,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:8
              3⤵
                PID:960
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Owlin\EBWebView" --webview-exe-name=2026-08-09_66fabb9ee913950bdde2452eb55a2719_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe --webview-exe-version=1.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3604,i,160321373254812065,9874121862977822528,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
                3⤵
                  PID:1168
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Owlin\EBWebView" --webview-exe-name=2026-08-09_66fabb9ee913950bdde2452eb55a2719_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe --webview-exe-version=1.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-databases --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3916,i,160321373254812065,9874121862977822528,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:1
                  3⤵
                    PID:1388
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Owlin\EBWebView" --webview-exe-name=2026-08-09_66fabb9ee913950bdde2452eb55a2719_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe --webview-exe-version=1.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4080,i,160321373254812065,9874121862977822528,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:8
                    3⤵
                      PID:5544
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Owlin\EBWebView" --webview-exe-name=2026-08-09_66fabb9ee913950bdde2452eb55a2719_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe --webview-exe-version=1.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1048,i,160321373254812065,9874121862977822528,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1236 /prefetch:8
                      3⤵
                        PID:3668
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Owlin\EBWebView" --webview-exe-name=2026-08-09_66fabb9ee913950bdde2452eb55a2719_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe --webview-exe-version=1.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4792,i,160321373254812065,9874121862977822528,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:8
                        3⤵
                          PID:3904
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Owlin\EBWebView" --webview-exe-name=2026-08-09_66fabb9ee913950bdde2452eb55a2719_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe --webview-exe-version=1.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4740,i,160321373254812065,9874121862977822528,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:8
                          3⤵
                            PID:5012
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Owlin\EBWebView" --webview-exe-name=2026-08-09_66fabb9ee913950bdde2452eb55a2719_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe --webview-exe-version=1.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4872,i,160321373254812065,9874121862977822528,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:8
                            3⤵
                              PID:1720
                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Owlin\EBWebView" --webview-exe-name=2026-08-09_66fabb9ee913950bdde2452eb55a2719_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe --webview-exe-version=1.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4132,i,160321373254812065,9874121862977822528,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
                              3⤵
                                PID:6016

                          Network

                                MITRE ATT&CK Enterprise v16

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                manifest.fingerprint
                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2032_1190685216\manifest.fingerprint
                                • Size 66B
                                • SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                manifest.json
                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2032_1190685216\manifest.json
                                • Size 135B
                                • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                manifest.json
                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2032_1445262407\manifest.json
                                • Size 76B
                                • SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                manifest.json
                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2032_1447707272\manifest.json
                                • Size 113B
                                • SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                hyph-as.hyb
                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2032_209506210\hyph-as.hyb
                                • Size 703B
                                • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                hyph-hi.hyb
                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2032_209506210\hyph-hi.hyb
                                • Size 687B
                                • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                hyph-nb.hyb
                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2032_209506210\hyph-nb.hyb
                                • Size 141KB
                                • SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                manifest.json
                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2032_209506210\manifest.json
                                • Size 82B
                                • SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                protocols.json
                                • Path C:\Users\Admin\AppData\Local\Owlin\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
                                • Size 3KB
                                • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                crl-set
                                • Path C:\Users\Admin\AppData\Local\Owlin\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
                                • Size 22KB
                                • SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                settings.dat
                                • Path C:\Users\Admin\AppData\Local\Owlin\EBWebView\Crashpad\settings.dat
                                • Size 280B
                                • SHA256 06336b6bd16ee557c4e443a97ecf68d96cbc1d3c9352b27c2d49e99cb7b1a796
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                settings.dat
                                • Path C:\Users\Admin\AppData\Local\Owlin\EBWebView\Crashpad\settings.dat
                                • Size 280B
                                • SHA256 ed25684d21f85704a94cd7142388bb9f9f6a240818dd9d129cb0e6959ed360d9
                                • MD5 SHA1 SHA512
                                Submit Download

                                throttle_store.dat
                                • Path C:\Users\Admin\AppData\Local\Owlin\EBWebView\Crashpad\throttle_store.dat
                                • Size 20B
                                • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                                • MD5 SHA1 SHA512
                                Submit Download

                                177d66c0-0e35-4325-af5d-db9327610608.tmp
                                • Path C:\Users\Admin\AppData\Local\Owlin\EBWebView\Default\177d66c0-0e35-4325-af5d-db9327610608.tmp
                                • Size 5KB
                                • SHA256 559b787b3eab0de1b06773abb65fee59cac4f3f8083827ef8f05d36edd039eaa
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                MANIFEST-000001
                                • Path C:\Users\Admin\AppData\Local\Owlin\EBWebView\Default\Extension Rules\MANIFEST-000001
                                • Size 41B
                                • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                • MD5 SHA1 SHA512
                                Submit Download

                                Network Persistent State
                                • Path C:\Users\Admin\AppData\Local\Owlin\EBWebView\Default\Network\Network Persistent State
                                • Size 111B
                                • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Network Persistent State~RFe598497.TMP
                                • Path C:\Users\Admin\AppData\Local\Owlin\EBWebView\Default\Network\Network Persistent State~RFe598497.TMP
                                • Size 59B
                                • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                SCT Auditing Pending Reports
                                • Path C:\Users\Admin\AppData\Local\Owlin\EBWebView\Default\Network\SCT Auditing Pending Reports
                                • Size 2B
                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                • MD5 SHA1 SHA512
                                Submit Download

                                Preferences~RFe58fd47.TMP
                                • Path C:\Users\Admin\AppData\Local\Owlin\EBWebView\Default\Preferences~RFe58fd47.TMP
                                • Size 5KB
                                • SHA256 2ed56faa88fb3777855a5cad4d38ae933c0b1d6cf296aed326c79bfc06c6e220
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                CURRENT
                                • Path C:\Users\Admin\AppData\Local\Owlin\EBWebView\Default\Site Characteristics Database\CURRENT
                                • Size 16B
                                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                • MD5 SHA1 SHA512
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Owlin\EBWebView\Local State
                                • Size 1KB
                                • SHA256 63855986dd5d52a0ad62bdeb442256c3d8da97c5d711fa2cb0ca0909beae3387
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Owlin\EBWebView\Local State
                                • Size 2KB
                                • SHA256 f3862d19d8d27308a7835aa0be9abd9f975ffeb267047ef1e8ded7980aa937d4
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Owlin\EBWebView\Local State
                                • Size 3KB
                                • SHA256 ba06da1a69da36689bd9217178ca3d6dabdb66635498a4c2d0ee97aa1b3a2d3c
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Owlin\EBWebView\Local State
                                • Size 16KB
                                • SHA256 49784c9c55889e4bd119d96636458df927d2b8473177f5198181613079092dbb
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Local State~RFe585d7d.TMP
                                • Path C:\Users\Admin\AppData\Local\Owlin\EBWebView\Local State~RFe585d7d.TMP
                                • Size 1KB
                                • SHA256 3f3f4b1945526b820737517d3d8a69e2a295b4d136236fe2e84ee46253957790
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                memory/748-25-0x00007FFABC570000-0x00007FFABC571000-memory.dmp
                                Download

                                memory/748-172-0x0000028612C00000-0x0000028612D2A000-memory.dmp
                                Download

                                memory/748-186-0x0000028612C00000-0x0000028612D2A000-memory.dmp
                                Download

                                memory/748-577-0x0000028612C00000-0x0000028612D2A000-memory.dmp
                                Download

                                memory/960-51-0x00007FFABBA50000-0x00007FFABBA51000-memory.dmp
                                Download

                                memory/960-50-0x00007FFABAEB0000-0x00007FFABAEB1000-memory.dmp
                                Download

                                memory/1168-131-0x00007FFABC570000-0x00007FFABC571000-memory.dmp
                                Download

                                memory/1168-177-0x00000196394D0000-0x00000196395FA000-memory.dmp
                                Download

                                memory/1388-178-0x00000207664D0000-0x00000207665FA000-memory.dmp
                                Download

                                memory/1720-549-0x00000289825D0000-0x00000289825D1000-memory.dmp
                                Download

                                memory/1720-548-0x00000289825D0000-0x00000289825D1000-memory.dmp
                                Download

                                memory/1720-556-0x00000289825D0000-0x00000289825D1000-memory.dmp
                                Download

                                memory/1720-557-0x00000289825D0000-0x00000289825D1000-memory.dmp
                                Download

                                memory/1720-555-0x00000289825D0000-0x00000289825D1000-memory.dmp
                                Download

                                memory/1720-554-0x00000289825D0000-0x00000289825D1000-memory.dmp
                                Download

                                memory/1720-558-0x00000289825D0000-0x00000289825D1000-memory.dmp
                                Download

                                memory/1720-560-0x00000289825D0000-0x00000289825D1000-memory.dmp
                                Download

                                memory/1720-559-0x00000289825D0000-0x00000289825D1000-memory.dmp
                                Download

                                memory/1720-550-0x00000289825D0000-0x00000289825D1000-memory.dmp
                                Download

                                memory/2032-159-0x000002962DD10000-0x000002962ED10000-memory.dmp
                                Download