darksiderat | f9535b10e72de9b6149e69c2c7815d2b2773c6510786c6714344811719c9cea6

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_6d8d1db437c7b0090336165947df7689_akira_glassworm_rusty-stealer.exe
Size 18.4MB
Sample260705-c8tspagx5x
SHA256 f9535b10e72de9b6149e69c2c7815d2b2773c6510786c6714344811719c9cea6
MD5 6d8d1db437c7b0090336165947df7689
SHA1 0721b491463aeb6602a6b7de4245b54cc92c4222
SHA512 c5a309162d19e40fecd23129314285dc51ca0c1e8cc05d85f9bd0be2338eef5f5ae1a214fa2954296936d87c44b2a6d21e149b93464c9aea870275fe924a983a
SSDEEP 98304:bAn5GsOIJdKWDLhkmiIIN0DJhIOtXNdi8hKJ3VGXkNEc3baVwT4xiPqy+4tYbZSU:boPPQXY98ENA4ARGYnq0J6
TLSH
T1A91708117B5B99ACC19AC8B0834A47774E2130DB0A36B9BF45D456393F6EBF42F28319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 1 IoCs

resource	yara_rule
behavioral2/files/0x000b00000001c815-564.dat	family_darksiderat

Detects executables containing URLs to raw contents of a Github gist 2 IoCs

resource	yara_rule
behavioral2/memory/5516-3-0x0000000140000000-0x000000014125E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/5516-492-0x0000000140000000-0x000000014125E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Executes dropped EXE 1 IoCs

pid	Process
6732	ox_1783219528828.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-05_6d8d1db437c7b0090336165947df7689_akira_glassworm_rusty-stealer.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com
10	discord.com
11	discord.com
13	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_292536761\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_1648434177\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_984407650\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_984407650\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_984407650\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_292536761\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_292536761\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_1648434177\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_1648434177\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_984407650\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_984407650\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_984407650\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5848_292536761\manifest.json	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1749168396-1890032557-311772428-1000\{9412B3E5-3715-49E3-AC35-A90265ED67F6}	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
760	msedgewebview2.exe
760	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5848	msedgewebview2.exe
5848	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5516	2026-07-05_6d8d1db437c7b0090336165947df7689_akira_glassworm_rusty-stealer.exe
5516	2026-07-05_6d8d1db437c7b0090336165947df7689_akira_glassworm_rusty-stealer.exe
5516	2026-07-05_6d8d1db437c7b0090336165947df7689_akira_glassworm_rusty-stealer.exe
5516	2026-07-05_6d8d1db437c7b0090336165947df7689_akira_glassworm_rusty-stealer.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5516	2026-07-05_6d8d1db437c7b0090336165947df7689_akira_glassworm_rusty-stealer.exe
5516	2026-07-05_6d8d1db437c7b0090336165947df7689_akira_glassworm_rusty-stealer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5516	2026-07-05_6d8d1db437c7b0090336165947df7689_akira_glassworm_rusty-stealer.exe
5516	2026-07-05_6d8d1db437c7b0090336165947df7689_akira_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5516 wrote to memory of 5848	5516	2026-07-05_6d8d1db437c7b0090336165947df7689_akira_glassworm_rusty-stealer.exe	89
PID 5848 wrote to memory of 5988	5848	msedgewebview2.exe	90
PID 5848 wrote to memory of 2688	5848	msedgewebview2.exe	91
PID 5848 wrote to memory of 2688	5848	msedgewebview2.exe	91
PID 5848 wrote to memory of 2688	5848	msedgewebview2.exe	91
PID 5848 wrote to memory of 2688	5848	msedgewebview2.exe	91
PID 5848 wrote to memory of 6728	5848	msedgewebview2.exe	92
PID 5848 wrote to memory of 5612	5848	msedgewebview2.exe	93
PID 5848 wrote to memory of 5612	5848	msedgewebview2.exe	93
PID 5848 wrote to memory of 5612	5848	msedgewebview2.exe	93
PID 5848 wrote to memory of 4864	5848	msedgewebview2.exe	94
PID 5848 wrote to memory of 4864	5848	msedgewebview2.exe	94
PID 5848 wrote to memory of 4864	5848	msedgewebview2.exe	94
PID 5848 wrote to memory of 4864	5848	msedgewebview2.exe	94
PID 5848 wrote to memory of 4864	5848	msedgewebview2.exe	94
PID 5848 wrote to memory of 4116	5848	msedgewebview2.exe	95
PID 5848 wrote to memory of 4116	5848	msedgewebview2.exe	95
PID 5848 wrote to memory of 4116	5848	msedgewebview2.exe	95
PID 5848 wrote to memory of 4116	5848	msedgewebview2.exe	95
PID 5848 wrote to memory of 4116	5848	msedgewebview2.exe	95
PID 5848 wrote to memory of 3796	5848	msedgewebview2.exe	96
PID 5848 wrote to memory of 3796	5848	msedgewebview2.exe	96
PID 5848 wrote to memory of 3796	5848	msedgewebview2.exe	96
PID 5848 wrote to memory of 3624	5848	msedgewebview2.exe	97
PID 5516 wrote to memory of 3144	5516	2026-07-05_6d8d1db437c7b0090336165947df7689_akira_glassworm_rusty-stealer.exe	99
PID 3144 wrote to memory of 6732	3144	cmd.exe	101
PID 5848 wrote to memory of 2440	5848	msedgewebview2.exe	107
PID 5848 wrote to memory of 2440	5848	msedgewebview2.exe	107
PID 5848 wrote to memory of 2440	5848	msedgewebview2.exe	107
PID 5848 wrote to memory of 2356	5848	msedgewebview2.exe	108
PID 5848 wrote to memory of 2356	5848	msedgewebview2.exe	108
PID 5848 wrote to memory of 2356	5848	msedgewebview2.exe	108
PID 5848 wrote to memory of 760	5848	msedgewebview2.exe	109
PID 5848 wrote to memory of 5996	5848	msedgewebview2.exe	110
PID 5848 wrote to memory of 5996	5848	msedgewebview2.exe	110
PID 5848 wrote to memory of 5996	5848	msedgewebview2.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-07-05_6d8d1db437c7b0090336165947df7689_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_6d8d1db437c7b0090336165947df7689_akira_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5516
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-05_6d8d1db437c7b0090336165947df7689_akira_glassworm_rusty-stealer.exe --webview-exe-version=6.12.2 --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --embedded-browser-webview-enable-extension --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5516.6328.10262959245927813342 /pfhostedapp:db8f6a65259db1e3ed0d8233c63f15b111ace224
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5848
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView /prefetch:4 /pfhostedapp:db8f6a65259db1e3ed0d8233c63f15b111ace224 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x19c,0x1a0,0x1a4,0x178,0xa0,0x7ff8ebfb5fd8,0x7ff8ebfb5fe4,0x7ff8ebfb5ff0
    3⤵
    PID:5988
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --webview-exe-name=2026-07-05_6d8d1db437c7b0090336165947df7689_akira_glassworm_rusty-stealer.exe --webview-exe-version=6.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1740 --field-trial-handle=1744,i,8901498996516495252,17712824160377675959,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:db8f6a65259db1e3ed0d8233c63f15b111ace224
    3⤵
    PID:2688
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --webview-exe-name=2026-07-05_6d8d1db437c7b0090336165947df7689_akira_glassworm_rusty-stealer.exe --webview-exe-version=6.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2156 --field-trial-handle=1744,i,8901498996516495252,17712824160377675959,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:db8f6a65259db1e3ed0d8233c63f15b111ace224
    3⤵
    PID:6728
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --webview-exe-name=2026-07-05_6d8d1db437c7b0090336165947df7689_akira_glassworm_rusty-stealer.exe --webview-exe-version=6.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2448 --field-trial-handle=1744,i,8901498996516495252,17712824160377675959,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:db8f6a65259db1e3ed0d8233c63f15b111ace224
    3⤵
    PID:5612
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --webview-exe-name=2026-07-05_6d8d1db437c7b0090336165947df7689_akira_glassworm_rusty-stealer.exe --webview-exe-version=6.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3436 --field-trial-handle=1744,i,8901498996516495252,17712824160377675959,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:db8f6a65259db1e3ed0d8233c63f15b111ace224 /prefetch:1
    3⤵
    PID:4864
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --webview-exe-name=2026-07-05_6d8d1db437c7b0090336165947df7689_akira_glassworm_rusty-stealer.exe --webview-exe-version=6.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4024 --field-trial-handle=1744,i,8901498996516495252,17712824160377675959,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:db8f6a65259db1e3ed0d8233c63f15b111ace224 /prefetch:1
    3⤵
    PID:4116
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --webview-exe-name=2026-07-05_6d8d1db437c7b0090336165947df7689_akira_glassworm_rusty-stealer.exe --webview-exe-version=6.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3560 --field-trial-handle=1744,i,8901498996516495252,17712824160377675959,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:db8f6a65259db1e3ed0d8233c63f15b111ace224
    3⤵
    PID:3796
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --webview-exe-name=2026-07-05_6d8d1db437c7b0090336165947df7689_akira_glassworm_rusty-stealer.exe --webview-exe-version=6.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4280 --field-trial-handle=1744,i,8901498996516495252,17712824160377675959,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:db8f6a65259db1e3ed0d8233c63f15b111ace224
    3⤵
    - Modifies registry class
    PID:3624
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --webview-exe-name=2026-07-05_6d8d1db437c7b0090336165947df7689_akira_glassworm_rusty-stealer.exe --webview-exe-version=6.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2276 --field-trial-handle=1744,i,8901498996516495252,17712824160377675959,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:db8f6a65259db1e3ed0d8233c63f15b111ace224
    3⤵
    PID:2440
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --webview-exe-name=2026-07-05_6d8d1db437c7b0090336165947df7689_akira_glassworm_rusty-stealer.exe --webview-exe-version=6.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2096 --field-trial-handle=1744,i,8901498996516495252,17712824160377675959,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:db8f6a65259db1e3ed0d8233c63f15b111ace224
    3⤵
    PID:2356
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --webview-exe-name=2026-07-05_6d8d1db437c7b0090336165947df7689_akira_glassworm_rusty-stealer.exe --webview-exe-version=6.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=5040 --field-trial-handle=1744,i,8901498996516495252,17712824160377675959,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:db8f6a65259db1e3ed0d8233c63f15b111ace224
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:760
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --webview-exe-name=2026-07-05_6d8d1db437c7b0090336165947df7689_akira_glassworm_rusty-stealer.exe --webview-exe-version=6.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5008 --field-trial-handle=1744,i,8901498996516495252,17712824160377675959,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:db8f6a65259db1e3ed0d8233c63f15b111ace224
    3⤵
    PID:5996
- C:\Windows\system32\cmd.exe
  /c start C:\Users\Admin\AppData\Local\Temp\ox_1783219528828.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3144
- - C:\Users\Admin\AppData\Local\Temp\ox_1783219528828.exe
    C:\Users\Admin\AppData\Local\Temp\ox_1783219528828.exe
    3⤵
    - Executes dropped EXE
    PID:6732

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x0000000000000500 0x00000000000004F8
1⤵
PID:6232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ox_1783219528828.exe

Path C:\Users\Admin\AppData\Local\Temp\ox_1783219528828.exe
Size 67KB
SHA256 245c4870dbf4b2f0102835addb1780d845bd1c31d5ac2a8ac7a5dfe993d6365f
MD5 32b268f7114cd6816d3b1c0558e88f95
SHA1 1d0caf4582173eb45e0be05134ed432a21f5af55
SHA512 9b453ea4ac1ec6f216629ca16654e78f02fb61af8158eb3153e3fbecaae8e78b50c53242c4e76a93d59f3f3150392805a18892b103cd689d6814c7984b5e866b
SSDEEP 768:d8w6iBGb+IyfJoTOBPca/CCNNl1uHBNdXIBMEB44w7Fv6NDzSkzNT2L:PIyfiTOpZNiMMuw7Z6NDzPNTI
TLSH
T18363E735C9A9B13FD3199C78DE060D84DF62BC8A4784BF97A7D11CE60F92A902F1D681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\dorion\config.json
Size 967B
SHA256 4c1450fd767606da6d5157ac81b3304ea99298d6b708f18ab06f9821b85c21cd
MD5 c238940462f171b89f7c49aa15fe0ae7
SHA1 a08a9c05fdb14428cd046d04f40ba59d6fe4faa0
SHA512 3fdbd349028535a43eaf4005b5ac070d2b11ab8b9ee56d68f17c478ff842cf40fd342ca0ab7b75bb551c6d18f3315a7a6e2b0af25b521494d58375ed580af97f
TLSH
T12311E712C93855BE16F4A13C9DAE91834B358D55438D3C18926785182A1E73371F7EDA
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\dorion\config.json
Size 802B
SHA256 ff9f909802531f8860811783977850841cf07b03a317a9d16a45d14fc628e245
MD5 11becec3fd46452a5373c6a667e781ae
SHA1 d51adfa4f0f7563f25d4b013269cbe2cd8267b39
SHA512 4b416b2f2f072202c1183bec049458e5e384ad2e6bb493866fb1a5d1dcb5c6216d17006485f08f398c4d7eef009e72a1ca0c9b6faeb7706a0e97f7f5f5303f58
TLSH
T13101890E4A24657EDDA19209E67A6B828F3C047336953DA8E2B885383DE71C301A320B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f2d8e95b0698915420c19c17ce5118102fde948c081da433a7d827cf671fc2ff
MD5 d0eb12919fe5880a2419c905eb9d312e
SHA1 b7c7e637c0b8a91733971d0a9f69d95b08611848
SHA512 d8f0e2accb46943ad2b43d701784662ce81e6fb7909c65e7b545aaa4bf516d075eee3a37374c05f3245532bfcb13cbc5bb316da1ef8aedc0ce806252100a2538
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0e549615a8ab11e3d6888458ae1c15577096aabc35ce515987e7c1c7d385f0ed
MD5 3be88f9cfddeda1121661630fca70c30
SHA1 ade7f46ee680bf3332ff3c9cb983261ec7e1b38f
SHA512 7899c5e6b64eae66ff606869ee54de699519f971f534d09612b7663fc0274db3b4497a1fe5dd1c0dfb0928c36b342e5c622dca0e98638ba7fb77a7d5a99c0de6
TLSH
T1F1D0122273824538C03020330042674A2941C51F404940405438C51E3A0C0940A16441
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

49f6d74c-07fb-4130-818f-855322180f7c.tmp

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\49f6d74c-07fb-4130-818f-855322180f7c.tmp
Size 6KB
SHA256 ee25f1fc7fe0e03612072f2ef8aaa623af4efba3c115780d2cfd33d0cafdf9e8
MD5 33015e094d8ac3e97d771f711a57db64
SHA1 9286fa9dd3f8d219cacc38fa1d67fa3c22aad6b0
SHA512 fd5b612f648ed91b82da281366b0b1f73190c9c9069318d2340e65a6a9e1d0b3aebef4455f58d11ea39d9f2332d292545d48c0bdadeeddc34023366c643d82a6
SSDEEP 96:st3/dxCGddb9Gkffo5h16ZEQs7/x+6MhHimuec6bD1eje/K+ggq28XM1C7K:stP/CXIfo5QsV+FhHbbDQjB3G6K
TLSH
T127D1A5036A2469FB4CC7F119BA257A07E2F5602275D55E58EBF8461C29DB6DC6203C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5a0f9ac513af754fc33a7cac4572ba67fe4054246295f11391dc76a5ad4d6172
MD5 79464cd2aa0f05dde672338595c32398
SHA1 b5e672f3de260e187b724f23753ffd7b07ad42c6
SHA512 99c427fb05f8120a7b56f227ea0df17776d65e775a181c0ed9ed9a0043ec917e185000a8c9c99cbe4a3b02d959cb4b70ddddeb8d7a395460b6a8aa68c9f352d8
TLSH
T12B81E555377104D4D3C19E37FAD8A425FBFA9F51F6879C40854D80BAF81BB94918D0B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589304.TMP

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe589304.TMP
Size 48B
SHA256 3b51d4422a4b78e2eb521feea2424b6dc82ade1cfa01e34d32719466ee9a2510
MD5 3442ef701e024b53a88eaabd59805c4a
SHA1 b0394eb7a9a7442357939bd0a5c62fa32c59bf29
SHA512 c91d52e326b6a8e294cf42e7113e925677e8cf7b930a9254efdc4d474ebe590e9a21b2b89dffa8c32b6ff2cdcdcb4dc4a408b55acf7aa6907c291a8a03d4148f
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Extension Rules\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\IndexedDB\https_discord.com_0.indexeddb.blob\1\00\27
Size 67KB
SHA256 3d4ff4e0a74bbacafa1e3f6b2eaa64f0cac0e1b14e408c3e87dc0bd1f22d03b1
MD5 34272bf2efa6d4e0605a30e3f7cd56f5
SHA1 070c29057866030f5e78e4b9ce814c2198056779
SHA512 7b04d6b830a50a5f6ce1380300b269623b7e61a22f08927213e8b43ed57d864d113747bfbce4e54e3e82f27e220d84393ba744d532f68bdd451d03c4012cf9ae
SSDEEP 384:45LC/w9ptjb1RGjZA3Q9mDEpiFeooiq2AmBZmFx2268+vO9YNRjbEKyEJIVwlTfH:ebpRE0pvDcQWpIhI1coxUQC
TLSH
T10863054AA3F96548F5F77B016BBA58E08F37BE913934C88D528A5C4D08B5B60E970733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\IndexedDB\https_discord.com_0.indexeddb.blob\1\00\7
Size 144KB
SHA256 c1d4d86ba38d2da51f4c81e97c1fdaec7f2d23c0bc7d700b06e3f32444fb647b
MD5 eb8d26958c6ee8889969c69ab3cefcbc
SHA1 e96342b1fc66f94a5b5e60447c18bc2341890b19
SHA512 103fa5d343919c2fe297566aca1e6d7767f4cd536313634c0ec54b648506d6a7c01efc99acc90b51f32911422950b57eb11c8a6999b58ffe1de3a13574f1f043
SSDEEP 1536:U2VqtJsl3Eo53CJ5OnpYgJaTOc5S7kFrGIRpEkpbNQQ08ni0rgM:ItJa5cGSBvRf/08ni2gM
TLSH
T128E3E8C1FB4E506A43A474985D2C04EAE2FE9532AD48DCEFFC38B0E81DC555D81EB9A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Network\Network Persistent State
Size 982B
SHA256 2a7a0f840f17e60bb29c4022cac669af9f50004f86c5519a4eb2cdd26afd1365
MD5 b527e53118ac689000dff38398a9d818
SHA1 82f00c2aa5e994579ad5edfec5f383f4a4338116
SHA512 7fc3ebc67bf79e1bc90b4525030996d10e9dc6775942e292459c496291ed85ac904fff71b8482bd5cf3655839ad0c44ef5c45a105edb6628dec88903d76c1e19
TLSH
T15B115BB3C6E8832CCA6513F41F28391BCA2E1D5443183D2DC5D5AF8A97D1676F284A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 c594bb393dc28ff94a50a074799f42673684841e2f84dcbe95a0d5af2f74ed07
MD5 d2ea0bb69d1ee5d9ec7bdb1195a9fe7f
SHA1 1867372e3e04f0af86c387c19a293d6f7d79d068
SHA512 273e18739a36420c2ec13e7ec6a19cd871fc13e9742be612681842dbe10e174b3ca477c41d617a0fa9e29d148c25f364fcf7096c9cf32e7c817ef2d06f0bd22a
TLSH
T1872127A2C6E8832CD96513F41E28392BCA2D1D5443183D3DC9D6EF8B97D1676F28464E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5944b0.TMP

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Network\Network Persistent State~RFe5944b0.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Network\TransportSecurity
Size 689B
SHA256 8bf964eb6d1775fedb99ac39736c7faa7fc6c907558edb34742f30fe391565fd
MD5 71962ea3f33b656e4cad8483ff65e92a
SHA1 32abe8c05abe71c630dc427540b79d844bf68cb7
SHA512 bbde11fcdb31cc2974e7e77b0077e3b4607c12e1e447fcdc7bb64e92e5133ee22df620af5d27adbbdac2319186b1ef3fe51348ed0df8022e71bc1bc152591285
TLSH
T194012053D1BFE83B603C0D7F0D48B8066A77B435414294F5C992876CA5E75A71B16473
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe594617.TMP

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Network\TransportSecurity~RFe594617.TMP
Size 689B
SHA256 778a36a7aa3c8a87b74a27d72e2fc7c6de5788355bca47914a05da0e97387b17
MD5 a9c5da5e19f46f9f328a57ad16a91258
SHA1 fd5e8c2e73b9ae04613b5304974dec54980a40e2
SHA512 589cbc10d0763421027c0348361def70338972666d5fde6f65ea516fae889cd71f192847d74b7455fe616d246b01609a1e9ff0b89e69a061c1cd436b5bc2e56e
TLSH
T1AC012B63917FD83B90384E7F0D88B81269BAB0370241A4F5CA52C7AC64F94BB6B16463
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Preferences
Size 6KB
SHA256 ae803f26f69c13b6d70a733ab36563e67071767b94d641763247ced7e88574a4
MD5 c1b7192581a505531ed90425951821ef
SHA1 2fb01c32a8865a4a0c27cbceb8734bbbdf081e82
SHA512 a3e43fd3d57e07132895d50f3986bb7e56a55eb58abba4f8cddbbd7adc95fd779eaf2312a1af209edd29ec506b7e21f6828efd1a44b0a720328e18515e6193d7
SSDEEP 96:st3/dxCGUGdb9Gkffo5h16ZEQs7/x+6MhHimuec6bD1eje/K+ggH28XM1C7K:stP/CpIfo5QsV+FhHbbDQjBiG6K
TLSH
T110D1B7035A2469FB4CCBE119BA257B47E2F5603271E15E58EBFC461C29DB6DC6203C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe588b34.TMP

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Preferences~RFe588b34.TMP
Size 6KB
SHA256 690897e389acfc8e6f2556dedeea77dc0d59792ba61ff7c2bacc78233ba324f2
MD5 838083f9abd76d78d5f2f00aefc3627c
SHA1 083409db7bb788ca9cec184cba18473922ed34dc
SHA512 1576b794e56000ddd755d0d38a57404d5d92e52e10179bbb9ba5346371db20f9a8ca1e6ddb960eff487d49705cf6e600f7550b096f5fc86b3bc7a7a06767deea
SSDEEP 96:st3/d4CGddb9Gkffo5h16ZEQs7/x+6MhHimuec6bD1eje/K+ggq28XM1C7K:stPyCXIfo5QsV+FhHbbDQjB3G6K
TLSH
T1ABD1A5036A2469FB4CC7F119BA257A07E2F5602275D55E58EBF8461C29DB6DC6203C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\d9f288c0-4dbe-4f0d-b608-8c2d422ff5cf\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 177B
SHA256 bc0b5df70d5351dbb1c0d12fa0f594a9f4b92869978865417cd5238d0a50e62e
MD5 3f277f2e4dfba28a3a232bd4a583b444
SHA1 f2a3e397257aec756fa239954028ce014c36ec7b
SHA512 8bbe0193eb6fa7d50cf766ccf84f1037c12b3aac320878621fa212d73b4f5f9bda9524182422bc8de151c9b25b6f56dafce15d27318f6362e63920dc7f971a20
TLSH
T12EC0805FC0244DA03B2A078D5A12987D42552DCC885D94D5D6C7B08DB475F27F623A96
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 170B
SHA256 1c6844086834e8796a7ba9bd8a5ca07aaf9f0a80d190840b6c195e83ca13c82d
MD5 72994c3141e6fd0af6b5b019cb12b6c8
SHA1 b89828b65112b5d66c788149cebe9afedf2bad19
SHA512 5dd9189e839f94289de3b6971df6f039512ae9ae927a10f084264e079cde3ecd76cbe8c52c05cc6452e389ee3dccefc99474aeb39d28beb95e6d30e37ea614cb
TLSH
T1DDC0805FC4188DE05B26078D1A02987D525921CCC44D94D5D6C2914DA445F367123956
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe583dcf.TMP

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe583dcf.TMP
Size 114B
SHA256 3351016e237ec0841249ee46f952235295c28232dd0e2b60758ac1608aa774e9
MD5 c74ec667b48ef70d71f7c0da023c3116
SHA1 962de16e1befc1f66acb440b550b98d904c29137
SHA512 d13410c1ceba7dab936b9d10ddb40af18a148c9a40a02a7d6b6962b50fa3bc2dcace8ad0ba683d0e5e61876563ea94014cb10488b4cde1bbdafc953527305626
TLSH
T1E4B0926B81180CA06F2603964A02E46D93120CCC884AA88AA687308A2035A377243EE2
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Local State
Size 15KB
SHA256 3fdae94899e1dba8a7d6b0277cd392164b6927b2d6df557b2796c85541082550
MD5 731a27851c2360ab47cdb6e210e0704e
SHA1 41ddc686ec791263a799d4f1f413963537a085d3
SHA512 2e36dc19bb84970b477987d791574aa1b3ec4971f4845b51bae04ad6ce7e41c195e522c576bf72ba4ee4870423aabc422b627cce630f6e69e45fe756f9e0f020
SSDEEP 384:lsrv+89zHqlDNP9oidl3NBSWXXc1O38EN8:yrv+4UNbdlV+O38EN8
TLSH
T13272AE33E578AA778DB3C50AB84A6E077FB8609761C24FA0E9985B4C52CB4C93307D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Local State
Size 2KB
SHA256 3103c88c135d867f03c3646391c36e3da8d933e2cccddf7e39a3041bff52f621
MD5 50343e5a04d743232cfffddd5ebfc09a
SHA1 8a9b40e717e0cb391d0e16396c26e94650ecd2e7
SHA512 829bc1012a9f9992e0db8d51420e69fec771f8ad87f55bbe486cebbdefbded8dcb1ecef2aaa0dc2b9444ad047e5e935050e33909a587c7424ff1ade95e5d00df
TLSH
T10A51A6736C105AB7C9A3864A7D167FA3DE7550A5AB921F10B6DC1B0C12D744C2347C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Local State
Size 3KB
SHA256 8973f4ca0f9cb7b2033c66af8b34397ead25b52fa071571ebc4ce06e7d86d40f
MD5 c6e0471002d241419788f90eaf5c0783
SHA1 228e25ad684260f42d2fd4b3b0131dceb2d97a27
SHA512 0fe98ff5ca5b8db22a1ba1b0a872d954ad4acdfe62b9133dccc009a4f6b2fa36585ce0cea41442e9e96c87afc92308bfeeaa2c70fdac4bcadff8fdbb18e2434d
TLSH
T12271937B696099778DA3CA06BD852B56ABA55037AA817F64E6EC0F0C12C72881343C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5830a0.TMP

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Local State~RFe5830a0.TMP
Size 1KB
SHA256 2ac700e9fb5010d7bbf7764185b7f73a3fc6da6b6e7afb760d7024d9dd56b70c
MD5 6ee5e4bf8c69ee95943a5237d1509e84
SHA1 d1c7c45c17fd5d6d5d0c99a3857fb4de219a3118
SHA512 8b6b3189078684d724d1efd5c25e1eaba4b67d38183100786125bfcab7050bbc7310f483a1b075ded0e2b85126f0ae8784836f720c2a918ae7fce9e4dd22f097
TLSH
T1C23196B2D8500B72DC9296477A11BEE76F7050B566818F0072DC070C23D744C666FC35
MD5 SHA1 SHA512 TLSH

Submit Download

plugins.json

Path C:\Users\Admin\dorion\plugins\plugins.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

memory/760-703-0x00000256BF9B0000-0x00000256BF9B1000-memory.dmp

Download

memory/760-702-0x00000256BF9B0000-0x00000256BF9B1000-memory.dmp

Download

memory/760-701-0x00000256BF9B0000-0x00000256BF9B1000-memory.dmp

Download

memory/760-705-0x00000256BF9B0000-0x00000256BF9B1000-memory.dmp

Download

memory/760-706-0x00000256BF9B0000-0x00000256BF9B1000-memory.dmp

Download

memory/760-695-0x00000256BF9B0000-0x00000256BF9B1000-memory.dmp

Download

memory/760-697-0x00000256BF9B0000-0x00000256BF9B1000-memory.dmp

Download

memory/760-704-0x00000256BF9B0000-0x00000256BF9B1000-memory.dmp

Download

memory/2440-639-0x00007FF90D450000-0x00007FF90D451000-memory.dmp

Download

memory/2440-638-0x00007FF90CDF0000-0x00007FF90CDF1000-memory.dmp

Download

memory/2688-521-0x00000295ED270000-0x00000295ED318000-memory.dmp

Download

memory/2688-43-0x00007FF90C570000-0x00007FF90C571000-memory.dmp

Download

memory/4864-131-0x00007FF90C570000-0x00007FF90C571000-memory.dmp

Download

memory/5516-3-0x0000000140000000-0x000000014125E000-memory.dmp

Download

memory/5516-492-0x0000000140000000-0x000000014125E000-memory.dmp

Download