3c953f78e4e4823884e6b22087fba22e59114996c023fae02af7bbf32a0cd76e

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_6b6bfbbc128ce1c999b048207029a5fc_akira_coinminer_glassworm_rusty-stealer.exe
Size 8.6MB
Sample260727-pdfc2a1fpf
SHA256 3c953f78e4e4823884e6b22087fba22e59114996c023fae02af7bbf32a0cd76e
MD5 6b6bfbbc128ce1c999b048207029a5fc
SHA1 e7fa48301bdb7ecd92e051f75e422958d615503f
SHA512 349069f5d4e828dfe2d916179fdaa84fe7dac656e972e793e11da2f5d703e706a7b0b866f985307727047816aab0ffa7c2a771fcae881994707d3a88fc36a7e5
SSDEEP 98304:ROru+NQ4ZN1P6Q0zIQMzkfQHcSwUIV/61q6eEBOKdK4xT3fZ+ALVb:ROKrMuM1q6eEoKdK4t3xXZb
TLSH
T1C8965B56F27940E8C86AC179C2566233FB71B85903707ADB5BA44AB52F66FD02F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-27_6b6bfbbc128ce1c999b048207029a5fc_akira_coinminer_glassworm_rusty-stealer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5332	msedgewebview2.exe
5332	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4536	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2032	2026-07-27_6b6bfbbc128ce1c999b048207029a5fc_akira_coinminer_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 4536	2032	2026-07-27_6b6bfbbc128ce1c999b048207029a5fc_akira_coinminer_glassworm_rusty-stealer.exe	89
PID 4536 wrote to memory of 3264	4536	msedgewebview2.exe	90
PID 4536 wrote to memory of 5496	4536	msedgewebview2.exe	91
PID 4536 wrote to memory of 5496	4536	msedgewebview2.exe	91
PID 4536 wrote to memory of 5496	4536	msedgewebview2.exe	91
PID 4536 wrote to memory of 5496	4536	msedgewebview2.exe	91
PID 4536 wrote to memory of 3472	4536	msedgewebview2.exe	92
PID 4536 wrote to memory of 2072	4536	msedgewebview2.exe	93
PID 4536 wrote to memory of 2072	4536	msedgewebview2.exe	93
PID 4536 wrote to memory of 2072	4536	msedgewebview2.exe	93
PID 4536 wrote to memory of 3320	4536	msedgewebview2.exe	94
PID 4536 wrote to memory of 3320	4536	msedgewebview2.exe	94
PID 4536 wrote to memory of 3320	4536	msedgewebview2.exe	94
PID 4536 wrote to memory of 3320	4536	msedgewebview2.exe	94
PID 4536 wrote to memory of 3320	4536	msedgewebview2.exe	94
PID 4536 wrote to memory of 5332	4536	msedgewebview2.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-07-27_6b6bfbbc128ce1c999b048207029a5fc_akira_coinminer_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_6b6bfbbc128ce1c999b048207029a5fc_akira_coinminer_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-27_6b6bfbbc128ce1c999b048207029a5fc_akira_coinminer_glassworm_rusty-stealer.exe --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz,RemoveRedirectionBitmap --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2032.4112.16993217462922359544 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView /prefetch:4 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x19c,0x1a0,0x1a4,0x178,0x1ac,0x7ffdd5485fd8,0x7ffdd5485fe4,0x7ffdd5485ff0
    3⤵
    PID:3264
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-27_6b6bfbbc128ce1c999b048207029a5fc_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1780 --field-trial-handle=1756,i,2502059529343474485,1257737197334208006,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:5496
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-27_6b6bfbbc128ce1c999b048207029a5fc_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2208 --field-trial-handle=1756,i,2502059529343474485,1257737197334208006,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:3472
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-27_6b6bfbbc128ce1c999b048207029a5fc_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2316 --field-trial-handle=1756,i,2502059529343474485,1257737197334208006,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:2072
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-27_6b6bfbbc128ce1c999b048207029a5fc_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3512 --field-trial-handle=1756,i,2502059529343474485,1257737197334208006,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e /prefetch:1
    3⤵
    PID:3320
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-27_6b6bfbbc128ce1c999b048207029a5fc_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4472 --field-trial-handle=1756,i,2502059529343474485,1257737197334208006,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4940b284fd17655f9a4167ffb11748dfb630b3ea65a81d18393ea8fafb945986
MD5 f59e1e8069af8920b19e7b4d8731c334
SHA1 29c7db6291544a0cc306bb0be06227c906e8769d
SHA512 1cb03006e563185d5adaf681b06ed68e9630f5676be28671a0c4df5e0e4e112005d102300eac6eb560dc7147f4ed9567815d996c8eb3437cc8b63ba164bbe702
TLSH
T108D0121A33010A74C03134330212A70D0640C23F41494400A428951E1B940500A12491
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f0f1ebcc33ad7fe0a2f2c4108b39e828f00ea705705ff1ce95cde5ca0ccca4e1
MD5 b0b60014f1d5755ae1770adfb3979b99
SHA1 f1cc1b9930afdb99c21db79534fdd7b25fbd9405
SHA512 baade56b59a3bf27b7a6d3d8638023c94b5ffecfc9c3c53bfecd59e362ea2a80aa4b91937b6b8bc46457e2860edffcee2fa1ef92957fe73bf7a2a230ef3d8074
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 840B
SHA256 8ae6fec0319a018524034be7187be3b63a11ad33de9111be7f30fa5fd8e371f7
MD5 ffe2849426e6b7d8f235bced1e84fdb6
SHA1 ab903f17cd501505cfb479361268f8a817ee4ff6
SHA512 64f9f366b0ba3deea0a8a56622fafc40677c275b68a2db46eb99b8283222ed14357d5a97acc1bf6c884d6c2f3ecdbed477309ef3330186f0538461f4ea3c4d5a
TLSH
T10201592359A5242DDF0A113212DE2C61B0BB438E95B30ECF10814AB4633FBCAB23AD50
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599a42.TMP

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe599a42.TMP
Size 48B
SHA256 ddaa1e4525256362a2eea8451baf96166d995083b6f936dfa42e608d9b3762ae
MD5 78b1edf7b9e8582a6673db1a11137984
SHA1 14f739223b4d73a65db2f9f64ad86378bf793af4
SHA512 b5c13cd9636b92717366b87ec58a241a914f86dbe94c6ba4cd5e86ca6f55e4ab4991c7542e49ca1b1c9136f73516ba443aefedcab9b46c8b3e904fff68a2af67
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 13ca6cdf150d8ad37f02470910b4c6b7382e4838c91942276722e53fa023460e
MD5 6a4d60d0f2bf93e564e396f06dd343f9
SHA1 3ac8f4653f0683e3d10d2523187956e172f3cfe2
SHA512 4191a07146164891bc621203666f1b35b6e572378e8b8a8a51a7613b4362de7447d32925dd2be3f56844a0ddf1148ba084c201f79adfe051aec4903017229e9c
TLSH
T14A2182B7D2B445AD9F61D2FD7B1C2D278E191914036C2D8BCAC4DF9BA3F1060D24470A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5999f4.TMP

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\Network Persistent State~RFe5999f4.TMP
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 081552d5120aecfcd22655bdc25b1ad7b4069d594e34b6039f3eba21e9001ada
MD5 43b72d4f16f39eca3ab38ed707c27666
SHA1 0f4b81d7a283a766dc594bbbff741cb1161b1fa5
SHA512 62a36563722bbbf933d4ebcccfe22f70a0dceecdd5a664c6bcf02a79a67dcadcba9268e6a1ddfa224719183ee68bc841f09284f64ba5d4c497b74ae5a8290992
TLSH
T131217F9BD17EF4AF5158086E1C84F84535BBA87341C268F4D69A817C7095FF78A06493
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 3ce14ee0c06a75f4d7e9a26b5162c2c78c15633f3f37d3f4d63a2d31f1007f78
MD5 76677cd33739c02ea25257f13254aeef
SHA1 7cf9272cee0b9d70c119d0180b693844bb760cfe
SHA512 6c75c46914bf6d51efab263b1032bb2f01c8d50417b02f00ad6cf19242d71a363ea25ac28c07bd22653a51ede250662eb76f4f9faa81b40e9929459fedbf7d07
TLSH
T15F219EABC17EF4AF5168087E1C88F84535BBA87341C268F4D6AA857C7095FFB8A06453
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 c4425a270775039572a51899049f365fab039e3fee554012a08367d851f3da73
MD5 add9a577dbd4a596906f45b889a79ac8
SHA1 8b632e5412246feedb455417f1c6ba447bf129fa
SHA512 ea6e76d82bac1654a4275958fd651caf28303b74c30769ecb88479298ceab618c3447023242038e3e0ba3de5f995dd23e3f9629a565fdabb91e6495c9c1e642b
TLSH
T1C921919BC17EF4AF6168087E1C44F84535BBA47341C268F4D69B813C7095FFB9A06463
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 fefda9c902b9abda3f408c9151e66a62cd761f439a4946527440df2a95ead0b3
MD5 000663e39fbd7d411ac04f2e229f3dbf
SHA1 b2f484ba8453593a3744ea44a0392a5102cc601b
SHA512 bc5003ae64300061fbfef958b4b39f1b1c98a49fde4fab2e9b5aaa19a7d4349d60b5ee3b19148378b90e02ff48a95bf7e46f05464e60a5b394b0e2ff4ad1c746
TLSH
T1F6217F97C17EF4AF6158087E1C84F84535BBA87341C258F4D69A857C7091FF74A06493
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 ea94c1a6c0f9110b3e2ed3dcfa093731c6ce669c02de49b57722d484f7112cca
MD5 8f7dcb72f95f927593845fdb1901b144
SHA1 9e5b4b8cb3028d37b839ecb359dd71c778793192
SHA512 bfe407c60314de37a4a8ea2be2f42bc9aed31936e8b796a79296a575d34dfa500048757e0e464b5750f46df5b08e3e94ba824e6b021724d506445dfd57fdab66
TLSH
T14521919BC17EF4AF5058086E1C44F84535BBA87341C268F4D6AA813C70D5FFB9A16453
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 e8132a5aa561f895d0a63393bc5beb1758f4d4fb5b80d6e0020214ed080ba215
MD5 5fbe84f70cc899d426985a9387f80c91
SHA1 6163d61628d86cd439f9b35ca181e287ad8bd1c1
SHA512 6269dc2602c2833c3bfe5f9bcb719c8bb5a32a57ea4d41be36e919e437d6ec6c510f9a4d6cea84a855f8d24ce04382711f21e4f7d4027638565a0a6dc75ffbae
TLSH
T16D2191ABC17EF4AF5158186F1C84F84535BBA87341C268F4D69A817C7095FF78B06453
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 6941b89a68f20dd11682fb65d107cbbc34720741fd32ee830091858ceb30fd4e
MD5 5ef805fec915a5ad6d02b85030e34e84
SHA1 3be3687fdeaecf5fac2a5d382d0c6dbc6b1e99ca
SHA512 c02991402e39e24c632958df25a83773e4db99b81e301f29b5dc5014ed1f525a41ed87dbeb5778bb1e37c23110f1975239a50f64d0934f3bdfe942cfc65b4e03
TLSH
T17C21919BC17EF4AF5158086E1C44F84535BBA87341C268F4D69A813C7095FFB9A06453
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 5bd2f8746e4896cc1bdbbdaf61a2be4320bb954ac293522421485720712bb02b
MD5 690f49daf7100d9e216d53f18acb37ba
SHA1 99d68dd4c51290a46c3b0bab13f4b7db6e1abb2d
SHA512 fb98409088c04c46513b20a7f1a97fef37f1b41d3e8c58003d10d84c18047db72b8c2ea722e1fd1bcc284282d6be7f38e0ac8fef8316ce65852a75c49ff344f6
TLSH
T1D721919BC17EF4AF5058086E1C45F84135BBA47341D26CF4D6AA813C7095FFB9B06453
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 2eee015fcbb974c16abac378c56d0df800770bd83b62b9af7885491e39e571b4
MD5 8b25eceebaaed8752c548923b989c820
SHA1 087c004cf08e05f88d405550b16609907b395fcd
SHA512 ce9e33663b74960fa39162da378079984a01e8c1de3ccd1323cf4b97a7c543b39444aa374482108bd703d6e371249b52362efc145ee7c25edc18f9f0eda996ac
TLSH
T132217FABC17EF8AF6168086E1C84F84535BBA87341C258F4D6AA857C7095FF74B06453
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 3d710696b71d960570c273b4fbc4cb116ab19f7cc115e3429b840fa885537523
MD5 aea111fd004e19cd6c53ea7e33ce4833
SHA1 a1f14317dfd0230cf1e911456547e41d4186754d
SHA512 8fd2d0f0a84549638c14e4a30776a97933add403c83340c6ea485aa27c48253ab31a9f5441e417caf6f90ebdaf363aff66ed8eebeb331e2681d5d1f19ba99948
TLSH
T1FF219EABC17EF4AF6168086E1C88F84535BBB87341C268F4D69A813C70D5FFB9A06453
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 63c20c3547219df0c43400ff45ce11ae82c843b949ac7788c6aaf7f11625495a
MD5 16ed5374939977fa37984da2302f112b
SHA1 8d1a118666f47615009354e167eb7f65f1b708a5
SHA512 8a2a71eb4ca88d0b4cd615fe247c08721aee410ffe694a87c30bd760f44123dbcb7ca91216a2f454da127e5556738926b30185ff4bd3a690442d00d747563d3a
TLSH
T19021919BC17EF4AF6058087E1C44F84135FBA47381C268F4D6AA817C7095FF79A06453
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 848f4ac5b21000ac68ba81983704ac3fc1f508119a225828803d0c3598ad6c51
MD5 a3b93a5d496ac67e906089c595f3f9f2
SHA1 92ea77bc1667fdf194ee0b706bd649b7cbace947
SHA512 1d7aef8f69b9e78cac482e330625a31498135d330919b353f303751b17cd8d67009bd47ff6ee8cdfda7d8f22137f03af7647c57f08665e95de51ae7cc5fc25b2
TLSH
T12F21919BC57EF4AF5158086E1C44F84535BBA47341C268F4D69A813C7095FFB9A07453
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 8e6467f8ced45bfcf4c00b29ef1e87c8c241286f08e890523e11b1018c9bcabe
MD5 d5e05a458a1ea7f7fc33cd18f0619c83
SHA1 0ef751a187e0fcfb93c36849feea1ced756ecd92
SHA512 00efbca85e796e9807b7e091aa246b9977ad1a41d928a9873e2db1c34ea5b1ad4d49a8cb23adf86f9f11a38d24655022fc7bfd3ac4e23f028855e5b3f35512cd
TLSH
T154217CABC17EF4AF6168086E1C88F84525BBA87341C268F4D69A813C7095FFB9A06453
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe599a52.TMP

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity~RFe599a52.TMP
Size 1KB
SHA256 9e3c420759d69b22f73765a14b027718dc628147927c6b952ca87677c8ab4d47
MD5 5bb9d86759e8f6bc3d82e6174cdd43f1
SHA1 56ab8162fb57a5e39f443793db6820ac83d76908
SHA512 08fe753aa9eea1f26cae51c0ca50b8a2fe7a545803a9f5b7b2d44c09ce850fd3ec2264ce8b9296435617a5f856013f8ae58a2704a5325b409613ce92262ae62a
TLSH
T155219EABC17EB4AF616C086E1C88F88225BBB873419264F4D7A9417C7091FFB5A06493
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 2556e7d883665d209187659f3cf0e25b6f1cbe239a5b3a17aa8a1da4dd4f9f3d
MD5 152fb60b0c393a8740547a42ab692dd6
SHA1 374f8796d17571495f78a64036a73ad97f76f8d4
SHA512 1651cb87a1ba2a8415bf3012c5b6f41a66825d8d4cd137a0e4c72e1293661c4eb34a0fe520e4b4d677a7577e0a098f75af0e4c619935f01f8e71bf7bdb83d810
SSDEEP 96:stU/dca3hGSb9ykTo5h16ZLglYs7/x+6Mhmuec8qGX1ehSTQeUK+gzGqV28XM1CO:stY2ae8oUglYsV+FQqGXQhWQgFGaG6K
TLSH
T142D1B806DA64697B4CCAE218FA35BA16E2F6703261D11E58E7FC861C14DB6DD7303847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 f623b4a3ec72e5dabaa642c41e7b108a5b063e2876e75092d23b0e615a6ebec4
MD5 0104604c9b01f7d2889a4cbc2afd2861
SHA1 1b1fb6b1a6ce034b9428aa51320bf9a8ac53ae3c
SHA512 158ab6312c63d28e5fd72fe69c3ad47850e223abefefe83ce0c052937df2480e7a22caff4267eee71cf9884ac1e6e603ca852b0426d02eecbbc7b7406cfc8080
TLSH
T18AA0026702404511C01896F4105D0184A2115D2E65531A024BF9F29A8E611A2F521060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59987d.TMP

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59987d.TMP
Size 48B
SHA256 6d6a22e2cb082dc82a7f1ae8280cc3e2a2340ce0b7fe9f0f9d46d699b2aa230f
MD5 75952287846f465b2602d3b171560d3f
SHA1 33a1f1df40bb3f75d732f06edc6a0f73beb45677
SHA512 4ffdc668dd76a233d182d0e1f0d1eda2a77a2b7b5d541a8324380c1213a93d22f84c6c474bfaca238c99a2bf2b3e28830eeed05ddd0999018c50b0c22e63049c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

e47622f9-db29-4d6c-b55b-632a1e3eae2b.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\e47622f9-db29-4d6c-b55b-632a1e3eae2b.tmp
Size 6KB
SHA256 f8cec8887f1e66cd8973a2d3f65782b85e5249069cb81184704eace7545fe004
MD5 73ba76c7d6d2bced81d0056958a4400e
SHA1 e258f1427cd3ba339f0dadcd86d4be24f3cba3f7
SHA512 d7109bb4657248d639fd764b04228109d555dc75a26505f8d71b9134144224c27c6bff427d831c6cd010d16128594193b405c2f242895ee98586c9a1e67a867e
SSDEEP 96:stU/dca36Sb9ykTo5h16ZLglYs7/x+6Mhmuec8qGX1ehSTQeUK+gzG3428XM1C7K:stY2aI8oUglYsV+FQqGXQhWQgFGIG6K
TLSH
T121D1C702EA64697B4CCAE218FA35BA16E2F6703261D11E54EBF8861C18DB6CD7303847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Local State
Size 15KB
SHA256 a2eba21ff910bdabefd0c2071c2db4a7fbce29bcb3665a3f872e7a4745772f45
MD5 3efe1c362d65bcc9adf6a0264deedd0f
SHA1 0cda00afafca6e883bc295bb5af1fd5dfb5b3fc0
SHA512 ae775447f7b46dc1a6d59849827b060f2444066cb42c9cb744f1fbe031380e169da1b0f5ae5015ff3e2b32e3be10aaf24edb23098ea3c850f7a3f6ab1940a380
SSDEEP 384:n+aQikB+z/xvxjg/qhEFNBSy1uQ9GlGWoiOebG29zi:2/UxvxjgC++w8bZFi
TLSH
T10572AE3B94797E2395F7E7047A4A474BDEB9A4A380C22EB489BD5F0D16CB3981302D52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Local State
Size 2KB
SHA256 3ffbe1c884a502241b04620da5f03cc696976a25db394d840d98a23c2df55091
MD5 3d2ee691126db8a1acffb23f99237a47
SHA1 8f31ba89d54ab6730a1a5ea40691370db73e238f
SHA512 aa25df14d968ca466256fb8622e972879278e6ba7398a34369b7778f5df6cb70f0d034211b5cd402570caac20ff283de9818b41c62194ec56e19d31e0ffddece
TLSH
T1FE519437E8259B7789F24B0A7A477F139F76B096DA512F21D6DD0B0C01CB25C2302CA6
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Local State
Size 3KB
SHA256 bc182585602970cf683421841c99b56dbb600e9991a59791580c43c2d1ae8645
MD5 e4b5d58335230600cb0a9089458d8040
SHA1 ce07032f9436078888a5a5cb0ab7862771c11d3d
SHA512 f74b120e42c57d0c745b55d0df007f045f6fb577475770bb47658bfe693cbeeea44e406e661a79075f7c83e789c508c726427504aceb8ac106ddd08ed6f8516e
TLSH
T18C61643BA8759A778DF68B05B9873B02ABA56027E5853FA5D6EC0F0C01DB3881342C56
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59430a.TMP

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Local State~RFe59430a.TMP
Size 1KB
SHA256 695f5d105b79e31cf0e7690bb6df4b75f79e3ce3b53663caaa1d69b88c0334e4
MD5 116df293197ab2aed61dbcb16cd75ca2
SHA1 f3fb4e2c8e1029d81f938d58e4af3954292b691f
SHA512 5cf404f772f37f26889b3f9abeef4e470e351f787e5e15fcae382649e7d5b879f938b4f17e8eddf48b1ef3550af251bf59b48b39c09d337b76d44d90e613a765
TLSH
T1E42142B7E8608F738DD5574B3243BA436F61706B82004F00E2DE8B0C02D728D9726D72
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2032-0-0x00007FF6A8B60000-0x00007FF6A93F7000-memory.dmp

Download

memory/3320-103-0x00007FFDF8240000-0x00007FFDF8241000-memory.dmp

Download

memory/5332-423-0x0000017C221A0000-0x0000017C221A1000-memory.dmp

Download

memory/5332-426-0x0000017C221A0000-0x0000017C221A1000-memory.dmp

Download

memory/5332-425-0x0000017C221A0000-0x0000017C221A1000-memory.dmp

Download

memory/5332-424-0x0000017C221A0000-0x0000017C221A1000-memory.dmp

Download

memory/5332-421-0x0000017C221A0000-0x0000017C221A1000-memory.dmp

Download

memory/5332-422-0x0000017C221A0000-0x0000017C221A1000-memory.dmp

Download

memory/5332-417-0x0000017C221A0000-0x0000017C221A1000-memory.dmp

Download

memory/5332-415-0x0000017C221A0000-0x0000017C221A1000-memory.dmp

Download

memory/5496-27-0x00007FFDF8240000-0x00007FFDF8241000-memory.dmp

Download