b7573244bfb90324eba8b4297fa28899daf6946eb8b51c107874500937bde531

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 04:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_0d7e4e9f53b6057974cebd23b148d244_akira_coinminer_glassworm_rusty-stealer.exe
Size 8.6MB
Sample260706-eldjashv81
SHA256 b7573244bfb90324eba8b4297fa28899daf6946eb8b51c107874500937bde531
MD5 0d7e4e9f53b6057974cebd23b148d244
SHA1 9b01e23071f03d453624732573c5e196bb7021dc
SHA512 982e0cdf3caaa811b2251b1d69fcb1834fca1c2c6bc096b2566f837a74e3c1fc9ca1664b68632521bbfb64a00ef812c4c5a353dba87e18b365226a9e12558ef7
SSDEEP 98304:TeCe+b5zY9Ldvhr0/n4VRdh3OL4XQ3yWla6uEBOadK4xCBfZ+ALhb:Telo4rala6uEoadK4gBxXFb
TLSH
T1F7966B56F27940E8C86AC179C2566233FB71B85903707ADB5BA44AB52F66FD02F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-06_0d7e4e9f53b6057974cebd23b148d244_akira_coinminer_glassworm_rusty-stealer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 63 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-da.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_815101827\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_528056569\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-la.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-te.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-it.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_815101827\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-be.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1018101027\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_528056569\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_815101827\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-af.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-el.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-as.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-et.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_528056569\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1018101027\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-es.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-or.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-sv.hyb	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277840973350965"	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4908	msedgewebview2.exe
4908	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4768	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1568	2026-07-06_0d7e4e9f53b6057974cebd23b148d244_akira_coinminer_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 4768	1568	2026-07-06_0d7e4e9f53b6057974cebd23b148d244_akira_coinminer_glassworm_rusty-stealer.exe	87
PID 4768 wrote to memory of 1388	4768	msedgewebview2.exe	88
PID 4768 wrote to memory of 4500	4768	msedgewebview2.exe	89
PID 4768 wrote to memory of 4500	4768	msedgewebview2.exe	89
PID 4768 wrote to memory of 4500	4768	msedgewebview2.exe	89
PID 4768 wrote to memory of 2480	4768	msedgewebview2.exe	90
PID 4768 wrote to memory of 1068	4768	msedgewebview2.exe	91
PID 4768 wrote to memory of 1068	4768	msedgewebview2.exe	91
PID 4768 wrote to memory of 3180	4768	msedgewebview2.exe	93
PID 4768 wrote to memory of 3180	4768	msedgewebview2.exe	93
PID 4768 wrote to memory of 3180	4768	msedgewebview2.exe	93
PID 4768 wrote to memory of 4892	4768	msedgewebview2.exe	111
PID 4768 wrote to memory of 4892	4768	msedgewebview2.exe	111
PID 4768 wrote to memory of 4336	4768	msedgewebview2.exe	112
PID 4768 wrote to memory of 4336	4768	msedgewebview2.exe	112
PID 4768 wrote to memory of 680	4768	msedgewebview2.exe	113
PID 4768 wrote to memory of 680	4768	msedgewebview2.exe	113
PID 4768 wrote to memory of 4908	4768	msedgewebview2.exe	114
PID 4768 wrote to memory of 3304	4768	msedgewebview2.exe	115
PID 4768 wrote to memory of 3304	4768	msedgewebview2.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-07-06_0d7e4e9f53b6057974cebd23b148d244_akira_coinminer_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_0d7e4e9f53b6057974cebd23b148d244_akira_coinminer_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-06_0d7e4e9f53b6057974cebd23b148d244_akira_coinminer_glassworm_rusty-stealer.exe --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=RemoveRedirectionBitmap --lang=en-US --mojo-named-platform-channel-pipe=1568.2984.15628426898551010262
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x118,0x16c,0x7fff5918b078,0x7fff5918b084,0x7fff5918b090
    3⤵
    PID:1388
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-06_0d7e4e9f53b6057974cebd23b148d244_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1732,i,17866695470460314651,7497687134209558079,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:2
    3⤵
    PID:4500
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-06_0d7e4e9f53b6057974cebd23b148d244_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2052,i,17866695470460314651,7497687134209558079,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:3
    3⤵
    PID:2480
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-06_0d7e4e9f53b6057974cebd23b148d244_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1744,i,17866695470460314651,7497687134209558079,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:8
    3⤵
    PID:1068
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-06_0d7e4e9f53b6057974cebd23b148d244_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3600,i,17866695470460314651,7497687134209558079,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:3180
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-06_0d7e4e9f53b6057974cebd23b148d244_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2112,i,17866695470460314651,7497687134209558079,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
    3⤵
    PID:4892
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-06_0d7e4e9f53b6057974cebd23b148d244_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4564,i,17866695470460314651,7497687134209558079,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
    3⤵
    PID:4336
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-06_0d7e4e9f53b6057974cebd23b148d244_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=756,i,17866695470460314651,7497687134209558079,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:8
    3⤵
    PID:680
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-06_0d7e4e9f53b6057974cebd23b148d244_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2220,i,17866695470460314651,7497687134209558079,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4908
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-06_0d7e4e9f53b6057974cebd23b148d244_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4816,i,17866695470460314651,7497687134209558079,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:8
    3⤵
    PID:3304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1018101027\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4768_1313856641\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4768_528056569\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4768_815101827\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
TLSH
T169A022F3F000F02030022F8A80203C00C8A23BA80C8020808000BEE0200322A3A0C820
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4768_815101827\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6c9080e3e8ac02cc6365a7b0df93e88b709586b03e3719775309a51d12039f4e
MD5 73e3ba0abe8307c9f11fadf944af67a9
SHA1 605f7129ceb0cfa7f0c3c8547e2bdf15a1a7b15f
SHA512 2c0dd8e409a371c5f67bbbcfde74b5ede80d843d65fd16007f58ff8a588e1f9db078144801cdd2bbddedb69bc15df477a65e649e3e52e6dab8980b29d6b02fa9
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f222d5d5c59d00b43f3e5857bd6076951c62fd51337a22b3df6fd8734560244b
MD5 1a349771cbd26e8bdbcea8701c52cd23
SHA1 49f4bdbbd2d45b12663d2ae6a00329b52aecfa7d
SHA512 8097777711d979a51ea6cb18816391d61dbf460a624ac1a76f96342c5ccd4ca8d1f1977ba65ee7abff0ee652c47c11608ae21f502c69be47bf2277e8c5baeeaa
TLSH
T163D0121332820AB4C0113473040371480510C52B400D8100542D862D1E5409119434C3
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 10a207bb11a9e1bc1cf2392ad99c4c74283b94da7f9987d96accddc3f3c28e32
MD5 1878934dd9a64bb9bf21239b1e4289ec
SHA1 610069c42eb6e6a0713e592e516658f85effecb4
SHA512 65bfb529d25d144674722736360f26b0a3fe6201853c6fad5b42fbe32cbb3ae1a87471234a47bcc90bd7be96444eb3ba0ece1298a844e09985bc0a719f3152b2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 864B
SHA256 804385ea2ad8979978ac1622eab89c399641fb5cc75f26f89d1b6c5f21df2864
MD5 6bba913825d065fb7e157c14c62ffc54
SHA1 7b7f6b8225b00585fba7d85c756a79fa4d599ce1
SHA512 c04ae95fbc58bfd5bf5e5ed45d10f589f6ff20e0bc0e001dca76d5bebaa9f5f374408405132af437d3b7cc76b531df7ed1a560269ca13604488981100938cdf4
TLSH
T13F11C90009D7E06ACF058270C4397DED665F30C8986607638E1D2CAC2D233DFABCB0A6
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 ecba0918631b3397001d6f551842e43a8d92a6332afd8eeff3fc8b7874886eb2
MD5 db1e847ccbc766ee193df108f46a3d24
SHA1 89f17d1780b504394d3fdeaf7177a084d8b54bc9
SHA512 005e42af934a58ae3ddc980e4bbd7f551b587fbcb4d25a9fb664bc98f45f71d32be5c22f2e46a7fb4de01933775709e43870e99cd25e241282d89508186b8b5d
TLSH
T1D621A2B7C3B445ADAF5152FD3B2C292B8E1D452503AC295BCED8DB4FD3F1860D14464A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe595fd9.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\Network Persistent State~RFe595fd9.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 683B
SHA256 a9212e3251ddf82433c9d5e6e2127c8b1fd3db6faf67071d6f7cbac0d9584b61
MD5 804dd334322f0cad0e2ecd0d3f925570
SHA1 8b221139c31fae54f56c1d3d27769ef1a805a2b6
SHA512 4961177bf6a930fab22dc3e9437d49867ceb6f413ad8f240a072897f42c6b65105c39cdf82b63355c1c08bbd84375ffafc3cf8defaa17c3cda2241a9694111bb
TLSH
T1B0019E9385FAF4AB10280A6E1D447C511E77B5704142A4F4C796832EB0554F74B17412
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 683B
SHA256 c1f3cc6074621033970f3c91040c399b1282f4597c03e99cfbdda411a570b2af
MD5 45ab765631ec6cfd6d4b15fc8911354c
SHA1 d85e109016b76c082ad19c41313815524e6f763b
SHA512 89ded2a7aa2b9c2f83c3f950834ac6dbe590a7377df069b052b23d4170a52da0245c63c26ccb5a9774627f98a0a873493fb20a1df31f62cf2480699e52088edf
TLSH
T13D01999385FBB8AF10281A6E1C447C621FB7B5714282A4F4C796832EB0464F74B0B012
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe58b958.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\TransportSecurity~RFe58b958.TMP
Size 683B
SHA256 db7ca15c4292de53a8065d1ff1f5d696b16dc7e4985e0c3e77ef7c2594937529
MD5 b7a3867b57c84002eb105077b69f91da
SHA1 429ddd73a585145a4a81411b18fcaa9b87f87fa1
SHA512 c260afb0e67a6a39ca0202e056eaef5244afb268af2b2e276fa2a9b8851f20195c56713652de08a9a46599d46c31b949018356ad551f23a720e6f6e1d819c03a
TLSH
T1FD019E5795FAF4AF1068096E1C407C011E76B4B1554294F4CB9A832FB0954F74B07512
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 86c6f0d7cecb73c821d297e972a839485d89b26730fa782524f2724af9d5cb86
MD5 32acc2afcc378ff37e2c7a39b1b17762
SHA1 efc6f238ac02cda68ee17c89c1d972e86c643273
SHA512 65ad3b984d52b1b2a6d09a904be72e757b3604aba757ee021500a6e0cea99c39103fa607c7dce2613bd5800a70f8a7de83ae58ed66544cf14f203d119fdefc3e
SSDEEP 192:stNM0Uaq6ItfnMZ8paCV7/S+WiDfMwUTQDv42Y6TvMC:st/Uastrl/V4wNUC
TLSH
T10CE1B743AE2869778CC7F619B935BB27E2F6102156C10E98EBFD860C05D6ACD620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58e7da.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Preferences~RFe58e7da.TMP
Size 6KB
SHA256 df48f92b6bec02aa55f49df44420e8781379d8be5714d12feb763f1008568703
MD5 a1fa00ec7ff481d958a5f64bd496cb18
SHA1 c270299bd10f4fac4a9d7a7eceb95095bec06b6d
SHA512 9571154e0a8c80527415cc919723f23fa8ba15de1931ce6eca3bcb90b413055bcdbcb99fc89d4ba8251385687c573229b674ea550db6cf3303fc034a4df310f6
SSDEEP 192:stNM0Uaq6ILfnMZ8paCV7/S+WiDfMwUTQDv4l6TvM8:st/UasLrl/V4wA8
TLSH
T126E1C703AE3C69778CC7E619BE35BB17D2F6102166D00E99EBFD860C09D66CD620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 e5db274075cbace14a9b3974faac0b47f202e3282943174e5c41fc4c44a61cf4
MD5 527396bba25801bd633b4a24e56f753e
SHA1 42e58c25e900b04ea8b7afbcc9a915c7283496cc
SHA512 e09a64d7c303399e4d4445f6e566a2c2f2ef7fc1807cc72aa45d645baa7797a079f193b80f6946fafbf7545c516b3ff6bba81fc4aad68d604efecbcabd7981c7
TLSH
T190A0025151C44223C0C102B5145B11C86251592AC545174766D812858C96369911A754
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a2a4.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a2a4.TMP
Size 48B
SHA256 6294fbd45ca634605a091f5ed70945440bf0f6ec5c52386fbca50c0e4bf1c408
MD5 3826b47ed9984a067f3c11fabd5f667f
SHA1 2b950289d9ae76ab12e12dc9419a2af742760153
SHA512 5090bac2e5cdcb1abece2c5fdc084f32972f69091908549f691a2845f416b18f226c3df6c0cc16428e54dd2eea6782abc89b8562ac86ed0c3593ded57ba90113
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Local State
Size 1KB
SHA256 99507b9b224798ebf45e6ad41cc2952412cb59a98933e87b71790e9a3002255c
MD5 8f917b3ad77892ec2b9f2c12d881601c
SHA1 5953904edb3f71c438f222696f21b84f5aa931e9
SHA512 edda23df48a8ee368fbc8147ebc57defae7d67649efbe34e7638cf135f88b04c915afbc2da6407f87f719831d2b37baa2902a7edafcd1437b121b14d230a0c2e
TLSH
T1B1319573E4E42A32EC81D842F5453B675E612422C3510F0896EF4B0C12E7ADC6717D22
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Local State
Size 2KB
SHA256 ee5711b1c6c95614f11df13bf32dc2d9ee2493cdf4df1dd1267d09f4f7a799a9
MD5 7342b0ed8b3eaab036c8457da4cb63ab
SHA1 5b628518d22c401112ec68584c853f34011147c7
SHA512 52c81c261d0f36d937d5e16838c9de116ea0b17ad75b1ef60db87cb524ac93800e2001a6c076d2541c8a133a0abfa8a3e1dac283267624b827127aee7bb22435
TLSH
T13B518673B8586A36C8D2D944FD493F23DE76512183521F549AEE0B0C02E76AC3303C26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Local State
Size 3KB
SHA256 f6277e45747f4a299523c45ab032ae49c7a9916029a4948c8311271666c4dd80
MD5 37a1ee6cae9b82f2978f74cab5dacbf6
SHA1 2cd62c047e192a65454561c26ee708d4026f5356
SHA512 b445fb71bcf5d46e2255feecc73c99f9add5dc9a03120054fe6ecd49f7c8df11a3a60b7a1c909c3579ffd7ca4490114ea22c1250bcbfdbd56f6949f8f2161e98
TLSH
T1B4715533A8A4A9378DE2DD45F8853B27AAA55123D2912F99DAED0F0D02D77D82343C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Local State
Size 16KB
SHA256 133b9885f2d00a8dbfe28727a08bfb12a21d659cc965f16a1c4497b3c46187ae
MD5 4a9574355ee8b8edc4a486741bbd9c78
SHA1 6079aac761cd24d8e76e1b596c62d43603865090
SHA512 d1cdfbcee1fa63d46848c9852fd55b4244a21a437c777e8bcfffad53a9a9c928d966aa24fcfd42f47581dee66539545412da23200e72bc96e4d321a80552a891
SSDEEP 384:z3srv+89zHqlDNP9oidjNbpJAXZJplqbsNu:4rv+4UNbdzmXXplq4Nu
TLSH
T123728E33A47CA7379DF29845F8896A177FB850A642C10BA8D9DA0F8E429F4D93317D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5848fb.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Local State~RFe5848fb.TMP
Size 1KB
SHA256 00328f66f47c614f53a2dd2de1c4575728d7327006387c3d553e2d41c89c0e21
MD5 4371becab8c84cc6270618f354f40d07
SHA1 6f3174146e2466d77da84dc6687f3c8dfed6d997
SHA512 37bd895068de48f960fd4ba3bd5c2a935bd37d4c39e923e38c996ece4894cf92b99c2e7d542b2b7e5d168b560982e4b22f89281b7f813c35fae2d3094ffb97f6
TLSH
T182214273E4A82A36EC809842F5457B5B1E90642683514F0CD6EF471D26A7AEDA727C22
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1068-56-0x00007FFF73A90000-0x00007FFF73A91000-memory.dmp

Download

memory/1068-55-0x00007FFF755D0000-0x00007FFF755D1000-memory.dmp

Download

memory/1568-0-0x00007FF6A0260000-0x00007FF6A0AF7000-memory.dmp

Download

memory/3180-128-0x00007FFF73E00000-0x00007FFF73E01000-memory.dmp

Download

memory/3180-384-0x000001FC14540000-0x000001FC145EC000-memory.dmp

Download

memory/4500-26-0x00007FFF73E00000-0x00007FFF73E01000-memory.dmp

Download

memory/4500-367-0x00000270A0C50000-0x00000270A0CFC000-memory.dmp

Download

memory/4500-783-0x00000270A0C50000-0x00000270A0CFC000-memory.dmp

Download

memory/4908-754-0x00000282C1260000-0x00000282C1261000-memory.dmp

Download

memory/4908-763-0x00000282C1260000-0x00000282C1261000-memory.dmp

Download

memory/4908-766-0x00000282C1260000-0x00000282C1261000-memory.dmp

Download

memory/4908-765-0x00000282C1260000-0x00000282C1261000-memory.dmp

Download

memory/4908-764-0x00000282C1260000-0x00000282C1261000-memory.dmp

Download

memory/4908-762-0x00000282C1260000-0x00000282C1261000-memory.dmp

Download

memory/4908-761-0x00000282C1260000-0x00000282C1261000-memory.dmp

Download

memory/4908-760-0x00000282C1260000-0x00000282C1261000-memory.dmp

Download

memory/4908-755-0x00000282C1260000-0x00000282C1261000-memory.dmp

Download

memory/4908-756-0x00000282C1260000-0x00000282C1261000-memory.dmp

Download