d951fcc18ed8532d067a7c3606a59e3fad4f370ed19c88bf5b6b601a34bf9d09

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/07/2026, 21:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-26_d65d710d9271f7222e38595f7174ae85_akira_coinminer_glassworm_rusty-stealer.exe
Size 8.6MB
Sample260726-1k6pcadr2s
SHA256 d951fcc18ed8532d067a7c3606a59e3fad4f370ed19c88bf5b6b601a34bf9d09
MD5 d65d710d9271f7222e38595f7174ae85
SHA1 46a6f9fb682082175e97e958a3c3beefc790f406
SHA512 bcb9d2ffed5ee65d108d4d107e12fa409f46985caa3b3fb4429c8263ebcbdf29a8fc2d637c18ba200d879c9eac245a6c89b364301fb70d1afbc431a2b10a3a12
SSDEEP 98304:7eCe+b5zY9Ldvhr0/n4VRdh3OL4XQ3yWla6uEBOadK4xCBfZ+ALhb:7elo4rala6uEoadK4gBxXFb
TLSH
T17E966B56F27940E8C86AC179C2566233FB71B85903707ADB5BA44AB52F66FD02F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-26_d65d710d9271f7222e38595f7174ae85_akira_coinminer_glassworm_rusty-stealer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1856_272312546\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1856_272312546\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1856_2024714669\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1856_2024714669\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1856_2024714669\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1856_1346400723\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1856_1346400723\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1856_272312546\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1856_2024714669\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1856_2024714669\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1856_1346400723\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1856_272312546\manifest.json	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5764	msedgewebview2.exe
5764	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1856	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5052	2026-07-26_d65d710d9271f7222e38595f7174ae85_akira_coinminer_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 1856	5052	2026-07-26_d65d710d9271f7222e38595f7174ae85_akira_coinminer_glassworm_rusty-stealer.exe	89
PID 1856 wrote to memory of 252	1856	msedgewebview2.exe	90
PID 1856 wrote to memory of 4140	1856	msedgewebview2.exe	91
PID 1856 wrote to memory of 4140	1856	msedgewebview2.exe	91
PID 1856 wrote to memory of 4140	1856	msedgewebview2.exe	91
PID 1856 wrote to memory of 4140	1856	msedgewebview2.exe	91
PID 1856 wrote to memory of 2860	1856	msedgewebview2.exe	92
PID 1856 wrote to memory of 3584	1856	msedgewebview2.exe	93
PID 1856 wrote to memory of 3584	1856	msedgewebview2.exe	93
PID 1856 wrote to memory of 3584	1856	msedgewebview2.exe	93
PID 1856 wrote to memory of 2972	1856	msedgewebview2.exe	94
PID 1856 wrote to memory of 2972	1856	msedgewebview2.exe	94
PID 1856 wrote to memory of 2972	1856	msedgewebview2.exe	94
PID 1856 wrote to memory of 2972	1856	msedgewebview2.exe	94
PID 1856 wrote to memory of 2972	1856	msedgewebview2.exe	94
PID 1856 wrote to memory of 3400	1856	msedgewebview2.exe	98
PID 1856 wrote to memory of 3400	1856	msedgewebview2.exe	98
PID 1856 wrote to memory of 3400	1856	msedgewebview2.exe	98
PID 1856 wrote to memory of 2392	1856	msedgewebview2.exe	99
PID 1856 wrote to memory of 2392	1856	msedgewebview2.exe	99
PID 1856 wrote to memory of 2392	1856	msedgewebview2.exe	99
PID 1856 wrote to memory of 5764	1856	msedgewebview2.exe	100
PID 1856 wrote to memory of 5372	1856	msedgewebview2.exe	101
PID 1856 wrote to memory of 5372	1856	msedgewebview2.exe	101
PID 1856 wrote to memory of 5372	1856	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-07-26_d65d710d9271f7222e38595f7174ae85_akira_coinminer_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-26_d65d710d9271f7222e38595f7174ae85_akira_coinminer_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-26_d65d710d9271f7222e38595f7174ae85_akira_coinminer_glassworm_rusty-stealer.exe --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz,RemoveRedirectionBitmap --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5052.1416.8266218623921810240 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView /prefetch:4 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffe096e5fd8,0x7ffe096e5fe4,0x7ffe096e5ff0
    3⤵
    PID:252
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-26_d65d710d9271f7222e38595f7174ae85_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1788 --field-trial-handle=1792,i,14613219468070446783,10947696874291024007,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:4140
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-26_d65d710d9271f7222e38595f7174ae85_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2224 --field-trial-handle=1792,i,14613219468070446783,10947696874291024007,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:2860
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-26_d65d710d9271f7222e38595f7174ae85_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2312 --field-trial-handle=1792,i,14613219468070446783,10947696874291024007,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:3584
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-26_d65d710d9271f7222e38595f7174ae85_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3464 --field-trial-handle=1792,i,14613219468070446783,10947696874291024007,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe /prefetch:1
    3⤵
    PID:2972
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-26_d65d710d9271f7222e38595f7174ae85_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4564 --field-trial-handle=1792,i,14613219468070446783,10947696874291024007,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:3400
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-26_d65d710d9271f7222e38595f7174ae85_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4536 --field-trial-handle=1792,i,14613219468070446783,10947696874291024007,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:2392
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-26_d65d710d9271f7222e38595f7174ae85_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4712 --field-trial-handle=1792,i,14613219468070446783,10947696874291024007,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5764
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-26_d65d710d9271f7222e38595f7174ae85_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=1792,i,14613219468070446783,10947696874291024007,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:5372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8e5e254efb6a250a34103513b8c970bdf5d948510e8820efae5fe41d40a0651c
MD5 59430a6cd44b89e938bf50166bcdb375
SHA1 e2f6ded3ea1f58636c0f70b4a918639699eab17a
SHA512 712495bd88c379217cd958a712c545f0b54c9d3cb640787269b43e63193ae23f981ef4e49454b3e9ec49c3c6ddfe2095014289a6b5ea024c77a60904d0575088
TLSH
T1B9D01212B3020634C41025F30102E6084402C50B514980407838CE2D1A040900A02841
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 131b366eb4c5fc34aeec7ac099d915b42677193f991cfe49483183b81e395c5e
MD5 56b39b1f3557051b6564cf9b3db40f0b
SHA1 184574c35b319bf35529d139bfcff1fa09f9f6fa
SHA512 ac00af016fdb2e00852dd66eceaef5cd80a8d4a0683ca8c5015e9108086ccbe960079bb75f13d3632f6598df47fc1a11ff7aed714f342dcc8189dd0e5aef2cff
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 840B
SHA256 67b158ea8029634c21ce365055d1030f1839f6aed3fd8988ce887756f36ab8bd
MD5 fce810013803c6a7cd3cbcae945644f9
SHA1 019e17fa8b7dc811caa16e2cf21c56c19dfbb7f8
SHA512 3e9c7d09819d5f92518d242add34f082d72083afd78ecc9dd6c9bffcb5fd965ea3f160693b3a7ae967d3ea845cd0d3cdfaed354ff5b9d37845d9467566b4b29e
TLSH
T10F01973016F7E00ACB16037220EA09BA34B26960683F0FF304203C78181B39FBA59182
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e054.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59e054.TMP
Size 48B
SHA256 2cb3ed847abcac776870e1bf267f6599e73b8b8911582bb761a181d253e9c019
MD5 9cf62ddc635fa08c7adb55d378ba7144
SHA1 c132144e83194809714624bde60fdab787dcc48d
SHA512 e0e5ba6307083e28fed4bb97b07e9a79a6301c42634596fc56d2bf141f73c008beba8fea3569faa7e3e818b92ec426d84153124abde0210ea6df034f97a12d86
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 0b1303dcd79ef1ff4a4700877dc360969888ec9b86a42d278e88a5cb38a25eeb
MD5 a5c968f29a595432832dbe706c87fc70
SHA1 1e614f8320c2413727c33fd0dbc9087b718d08e7
SHA512 458bee40ad001f82751a32278a312157a29dce5b9b582eb8ccecffe3fd41c1972c72085ec3b9011d7c6071f4636f47d99eb8fcf75b85dfe875948f5a683380c6
TLSH
T14721ABF383B046AD9F5252FC3B2C2E1B4E5D082403AC291ACAD8DB4ED3F1860D244A4A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a9e26.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\Network Persistent State~RFe5a9e26.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 691B
SHA256 bace1d2e2bfd54795f663087df6ea2359c62e823fec11517bae072692618d916
MD5 3850c2c731064d5bde790440fe3e7f66
SHA1 6e680e38983b04489eaabe2da529f890e7c0c93f
SHA512 ac221f18327d24522063a246a5a47e396d9e595438f2a3a2bfff2d07f53a87634059c2db1e73b9a77fb0a3f1c24e82f5585525cc1c0c2dc63d83788f37235065
TLSH
T1A5014E53C2BBB8A750A81D5A1D447C052FB6B431419364F4CB9BC17DE0918F36A028B7
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 691B
SHA256 40262a170793f63b6fcb0d11290bbce969a36d068d784a8397bf1806f0f59fd1
MD5 1a76edd8a8932234bb7249dfc5006969
SHA1 6e403b2839f1f9645d9d5945c240424cb36f22ec
SHA512 1b3d147c8df260401d7aacbd5927ad5422fb564b42be2900b199561516de6a87b3e64c2f8a7836edc66e52a0fee7d19be6daacaceba43c674ede52e49bcb237b
TLSH
T18D014E53C67AB86B50E85D5A0D447C093EB7B431419364F8CAEBC17DE0909F36A02477
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59f40b.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\TransportSecurity~RFe59f40b.TMP
Size 691B
SHA256 8472eaa7f5fca3795e7d4ecdb05189205195c3c90e8ca57195e6d01b5a172411
MD5 d0adff5625b32bca38ec3fec62a7d8dd
SHA1 76114f73e1445be5c0c2e80b55d500ad90b0178f
SHA512 db570a934a4a3dd1c1d6874ae9871c9f4a9579c56f247ec9ddc2032057c0df83c5fb3f00e3021cc0baa7ea72da98794e9cfdf98dff02df3afa7a4cf617114561
TLSH
T1EE014E53C37AB8B750A85F5A4E447C052EBAB470419364F4CE9BC13DE0908F72A46473
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 295b5a5870fd6f58dbc85736ad5ce9c41b19c3533078877e4691f1d443758684
MD5 69f7ffc3a7ae82fb92f6538417fcff5f
SHA1 d48a869581a4be5ceb6545fa62850705ff76a0b2
SHA512 945fd4e1057865b112b36edbd7c86806c9bed2b5169fb93b29e05a85a1313aaf4969ee897543cdf38a78080fd899e5ab63e800fca4376a6f8688b7c52895a515
SSDEEP 96:stRb/dcawcUhAGglb9WukT/o5h16Z/RKs7/x+6MhmuecFRFJ1ehR+REEeYlK+gZR:stB2av2uwoCMsV+FRDJQh8WEqklG6K
TLSH
T171D1B6036A24797F4CC7E119FA29BB17E2F56032A5D62E48E7F84A1C04DA6DC731790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 1dcad7fc36719d3357d7374efe589212215f7007dbedafb0ab0bd41a3d825421
MD5 5a03a2d7c2f33be465f01cf4132a0bac
SHA1 b1bbf2ee28978761399a17a1fb56fe240f3563ef
SHA512 109235ab14e98980ecb52839f618123a4418eb9bc50d60b20381bedb1cc76fa2492e10fa38eee137a8ef2751ef4ba9ea87db5aa28ddb41d2a28888599c14d4b3
TLSH
T1ADA0025561A00115C4A413B8218B15C862116D26C546364386D806C78D553584119254
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59dff6.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59dff6.TMP
Size 48B
SHA256 f737a2a06cf3435272c4cfc584af59adb02191795c8d9e09e520519de6896050
MD5 2f66ac4a8b5f6423bbe174d7047c7020
SHA1 a9235c44ebf7a48ab9eb459c6c2fdb64efa7b710
SHA512 66c77824e913dec23002232024efd8c76179823d21b0770fd080bf072c90ac0aa963eafa9b32bdef1994cb2b52b096b83d399e69d19451bc9779b1ec85ed2a10
MD5 SHA1 SHA512

Submit Download

bdc2282c-3712-43e4-9664-9aedb704ef43.tmp

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\bdc2282c-3712-43e4-9664-9aedb704ef43.tmp
Size 6KB
SHA256 59ec5f0e9e9204a1b7561d02fdc43c34e728ee93e015da4cc30bedcc30e50ebd
MD5 e947dbd7058228b7e98c8d4528bf269e
SHA1 b6b748f76ace50bf6e6dd5d8dc5fc41fb106e3f8
SHA512 8be7c03700ad6a5cf2a8e1fa2f1b5faa557195be1871ce8afc73f7fc8cea2b11319c60a2d68c6ad592fae334b3df079da06ef22cd4c873aeb63bc07b057e89ac
SSDEEP 96:stRb/dcawcUhJglb9WukT/o5h16Z/RKs7/x+6MhmuecFRFJ1ehR+REEeYlK+gZxO:stB2a12uwoCMsV+FRDJQh8WEqXlG6K
TLSH
T113D1C7036A24797F4CC7E109FA29BB07E2F5603265D62E58E7F88A1C04DA6DC731780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Local State
Size 2KB
SHA256 08153ee940b2fd933a149de373036ed83eb9cf6aa29ea1d5c9662ac243f8aa89
MD5 9dee298215cbe44ea305d23e0f818a54
SHA1 b85cbf6675b0e104048ac89363ebc29513cea3fc
SHA512 c43a07ec26911a57b0ad88e93216194eae1ec827c6d19e713f2a538d1ddc377947e8bc4c1b4654670bfc21a100b065243b397ad94f4da62ca321b0aa8d0877cc
TLSH
T1B9519273B8205A3B89E35B48795BBF139E3290A1DA632F149ACC0B0801D765C2756CBB
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Local State
Size 3KB
SHA256 4346f264f2d77d46fa5f27f3c8ce0fef9f41debbb92c5a077b223311a3a96bc2
MD5 c5dc13419d9e18473ed2e8713046170a
SHA1 9c655caf2fb3836ae3b53eb6010aaffc653b450b
SHA512 570a3e36cf9e5a3a4e4496edc035cc4f37c43090403eb06231cda87eb37a437b7dccb3f3faa6db9046b45f3bc6d2ce105bf4f1a2466eac8c508260fbc93ed0a5
TLSH
T1D7618377A870993B8DE39A05B9866F06ABA15026E5973F58DAEC0F0C01D72982351C6B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Local State
Size 15KB
SHA256 6836052b0b458c559ad944198dfcd376f8be85857ecce12ee43043aae40a7b70
MD5 84c86de4fdd91ea98afa42200c73fa53
SHA1 9d7f2bda565842c3d6b3d2343c2c377f2cdc2626
SHA512 9ba03d023634dd0f6cc07ea3c683f54c21bc9c8447b58c6d6175acadcfb0113d25146627a85e6017c7617f93deb6eec569760fbdf9f56d60df1c40890b5a5052
SSDEEP 384:/+aQikB+z/xvxjg/qhEBNBS/oOCqR33IIq9zR:O/UxvxjgC+g2c33IIqFR
TLSH
T16972AE3B91782D3799F3E605794E4B4BCAB588B291C36E684EED5F0D06C72981342C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59894b.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Local State~RFe59894b.TMP
Size 1KB
SHA256 3eb7545c8c8d31cba7117878248ad43b5fb13e7f7b8a5956043b7b30609a872d
MD5 3a1299780e4219285054ba34c130eb7d
SHA1 eba842c5bbcd54d9dfdb5a60b5d256a7d5db0d1b
SHA512 185dbc3089917d611fa275340531572cf5ab67a9a359fd2a1a0e1ebd4e5844ef1e20331def6028d1a4d26c04ef3c9e865f24ac4dc98acc6f323d238f35f88099
TLSH
T17E2140B3E0601A37ACD2638A3117FF1B5E32506682134F0466CD8B1D02D619CA76AD7B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2972-291-0x0000021345760000-0x0000021345812000-memory.dmp

Download

memory/2972-102-0x00007FFE26FF0000-0x00007FFE26FF1000-memory.dmp

Download

memory/3400-384-0x00007FFE28860000-0x00007FFE28861000-memory.dmp

Download

memory/3400-383-0x00007FFE287D0000-0x00007FFE287D1000-memory.dmp

Download

memory/4140-290-0x000001CFD4E90000-0x000001CFD4F42000-memory.dmp

Download

memory/4140-477-0x000001CFD4E90000-0x000001CFD4F42000-memory.dmp

Download

memory/4140-27-0x00007FFE26FF0000-0x00007FFE26FF1000-memory.dmp

Download

memory/5052-0-0x00007FF7EBEE0000-0x00007FF7EC777000-memory.dmp

Download

memory/5764-460-0x000001C165DF0000-0x000001C165DF1000-memory.dmp

Download

memory/5764-456-0x000001C165DF0000-0x000001C165DF1000-memory.dmp

Download

memory/5764-459-0x000001C165DF0000-0x000001C165DF1000-memory.dmp

Download

memory/5764-458-0x000001C165DF0000-0x000001C165DF1000-memory.dmp

Download

memory/5764-455-0x000001C165DF0000-0x000001C165DF1000-memory.dmp

Download

memory/5764-457-0x000001C165DF0000-0x000001C165DF1000-memory.dmp

Download

memory/5764-449-0x000001C165DF0000-0x000001C165DF1000-memory.dmp

Download

memory/5764-451-0x000001C165DF0000-0x000001C165DF1000-memory.dmp

Download