e20e2350549f0a17552ef259d835ef90c1e261f7202612f6a876cbd4974d3bea

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 09:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_e13e48157b609a737a8a4d28e2623b39_akira_coinminer_glassworm_rusty-stealer.exe
Size 8.6MB
Sample260728-lpy3qstdmf
SHA256 e20e2350549f0a17552ef259d835ef90c1e261f7202612f6a876cbd4974d3bea
MD5 e13e48157b609a737a8a4d28e2623b39
SHA1 b8d21d588fdbfc16a2856ea6eed8af11f2816afe
SHA512 3551baa146719c527884e6f5b04c1480d8ed74f2fe17c2b97305b9b29b924e1ad60ce1d52f1bc3715abfdcae59eb931d582e0e3637e1e93e3730408f3bcdd114
SSDEEP 98304:dOru+NQ4ZN1P6Q0zIQMzkfQHcSwUIV/61q6eEBOKdK4xT3fZ+ALVb:dOKrMuM1q6eEoKdK4t3xXZb
TLSH
T1A8965B56F27940E8C86AC179C2566233FB71B85903707ADB5BA44AB52F66FD02F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-28_e13e48157b609a737a8a4d28e2623b39_akira_coinminer_glassworm_rusty-stealer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_423790552\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_791849586\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_2081964805\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_2081964805\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_2081964805\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_2081964805\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_423790552\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_791849586\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_2081964805\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_2081964805\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_2081964805\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_423790552\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_2081964805\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_2081964805\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_2081964805\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_791849586\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_2081964805\manifest.json	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1216	msedgewebview2.exe
1216	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4808	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2672	2026-07-28_e13e48157b609a737a8a4d28e2623b39_akira_coinminer_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 4808	2672	2026-07-28_e13e48157b609a737a8a4d28e2623b39_akira_coinminer_glassworm_rusty-stealer.exe	88
PID 4808 wrote to memory of 3380	4808	msedgewebview2.exe	89
PID 4808 wrote to memory of 4160	4808	msedgewebview2.exe	90
PID 4808 wrote to memory of 4160	4808	msedgewebview2.exe	90
PID 4808 wrote to memory of 4160	4808	msedgewebview2.exe	90
PID 4808 wrote to memory of 4160	4808	msedgewebview2.exe	90
PID 4808 wrote to memory of 5348	4808	msedgewebview2.exe	91
PID 4808 wrote to memory of 3464	4808	msedgewebview2.exe	92
PID 4808 wrote to memory of 3464	4808	msedgewebview2.exe	92
PID 4808 wrote to memory of 3464	4808	msedgewebview2.exe	92
PID 4808 wrote to memory of 4668	4808	msedgewebview2.exe	93
PID 4808 wrote to memory of 4668	4808	msedgewebview2.exe	93
PID 4808 wrote to memory of 4668	4808	msedgewebview2.exe	93
PID 4808 wrote to memory of 4668	4808	msedgewebview2.exe	93
PID 4808 wrote to memory of 4668	4808	msedgewebview2.exe	93
PID 4808 wrote to memory of 3424	4808	msedgewebview2.exe	97
PID 4808 wrote to memory of 3424	4808	msedgewebview2.exe	97
PID 4808 wrote to memory of 3424	4808	msedgewebview2.exe	97
PID 4808 wrote to memory of 3716	4808	msedgewebview2.exe	98
PID 4808 wrote to memory of 3716	4808	msedgewebview2.exe	98
PID 4808 wrote to memory of 3716	4808	msedgewebview2.exe	98
PID 4808 wrote to memory of 1216	4808	msedgewebview2.exe	99
PID 4808 wrote to memory of 2380	4808	msedgewebview2.exe	100
PID 4808 wrote to memory of 2380	4808	msedgewebview2.exe	100
PID 4808 wrote to memory of 2380	4808	msedgewebview2.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-07-28_e13e48157b609a737a8a4d28e2623b39_akira_coinminer_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_e13e48157b609a737a8a4d28e2623b39_akira_coinminer_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-28_e13e48157b609a737a8a4d28e2623b39_akira_coinminer_glassworm_rusty-stealer.exe --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz,RemoveRedirectionBitmap --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2672.4644.8919905383633762509 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView /prefetch:4 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x198,0x7ffe342b5fd8,0x7ffe342b5fe4,0x7ffe342b5ff0
    3⤵
    PID:3380
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-28_e13e48157b609a737a8a4d28e2623b39_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1748 --field-trial-handle=1752,i,2902239660831843346,13773269287109250528,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:4160
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-28_e13e48157b609a737a8a4d28e2623b39_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2056 --field-trial-handle=1752,i,2902239660831843346,13773269287109250528,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:5348
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-28_e13e48157b609a737a8a4d28e2623b39_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2412 --field-trial-handle=1752,i,2902239660831843346,13773269287109250528,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:3464
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-28_e13e48157b609a737a8a4d28e2623b39_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3500 --field-trial-handle=1752,i,2902239660831843346,13773269287109250528,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e /prefetch:1
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-28_e13e48157b609a737a8a4d28e2623b39_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2272 --field-trial-handle=1752,i,2902239660831843346,13773269287109250528,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:3424
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-28_e13e48157b609a737a8a4d28e2623b39_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4796 --field-trial-handle=1752,i,2902239660831843346,13773269287109250528,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:3716
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-28_e13e48157b609a737a8a4d28e2623b39_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4688 --field-trial-handle=1752,i,2902239660831843346,13773269287109250528,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1216
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-28_e13e48157b609a737a8a4d28e2623b39_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4792 --field-trial-handle=1752,i,2902239660831843346,13773269287109250528,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:2380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0dfdb588-6bd0-47b0-b87d-ab40a3fc5a6b.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\0dfdb588-6bd0-47b0-b87d-ab40a3fc5a6b.tmp
Size 15KB
SHA256 f0fb1981894cb22ad5931a6a8bca0da457966d4e0ae8cd08fd4db5684de8b405
MD5 62060bacae19558206939e022f940b90
SHA1 d4ab69d02ae6201c9d37611a8d4a91912a35e1e0
SHA512 e3ef1e4a9947987a44a8470a5f861278458657438df952366f992ab264c623c5c285c10067d40f9c9cbe550670dba690b10c0f86a09a843b5b891183ad0bdef2
SSDEEP 384:V+aQikB+z/xvxjg/qhEbNBSN/KoYisd9YH09ze:g/UxvxjgC+ehYisLPFe
TLSH
T120729E3B58783D3795F2EA05794E5B9BDBB988B291C26EB84BED5F0C05873A40342D07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 133a96f46d6daa5cc01404e8904411238347838b0cc8ff6687108232feecdf33
MD5 b69c54600d3a8f8eafaa98d25d3be905
SHA1 835420bd4f2655428e6122666ce35f8a07a9805c
SHA512 5ea4454646295ae55ca7e2378be8ae1eecbed02665b96cbafd20e1bd0cef2cffa8832e24b71899d80292c4d90f1ef680d0fd01ebe55f78551ece8983b0bf99e7
TLSH
T181D0121332110234C12026330153730D1544C70F8006C011D8298A1D1A844500D4E581
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 926641c7cdd2b1da2e6b6bc47722a706aa7f7cd9e315af391ebc6afec195ed2b
MD5 89a1517026fa4a5af8f5f011f3177829
SHA1 33e726c06783c85bef11b2f72c18b1d15d1d5db1
SHA512 c1c10ca78071dccb00100ca67c0987ed8fa192eac7ea28c845b362f0aa72a311aed094504069b93812287631147b1065bcd2e0e63a402a6b33b0d34bdcc2d96f
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

2b6d88a5-73b3-4859-ab83-7c67ff72be54.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\2b6d88a5-73b3-4859-ab83-7c67ff72be54.tmp
Size 6KB
SHA256 800feba7099d3b026acda77b698a4a8fb4d647c1a6a1f86ec320c73944d87b4d
MD5 02538ef9493c826c517f2fc923aed9d0
SHA1 63a4f36fb9ef545f1252c0f9a52f4dec8da3cbb6
SHA512 e16fb7632f43b77a2205ac29bacf314100a9824492ac99b6ec031d49f1e919168a790699bb6941ce468233f4d9150f698cdbae2f78a05cc05c751338da93c123
SSDEEP 96:stm/dcaqg9b9GkAo5h16ZLglCs7/x+6Mhmuec8dPS1ehi54euK+gJs28XM1C7K:ste2aqDoUglCsV+FQd6Qhi54GvsG6K
TLSH
T1F1D1C7025E6869BB4CC6E549BA38BF07E2F95431A5D21E94E7FC4A1C04EA6CC6303D07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 864B
SHA256 cccb5682243311dc71471253e21cd37dc808d9344bacdbcd3df409a03ac98185
MD5 3dec70746b433b8a27164481f75f19a2
SHA1 3cb3f513c84351e33d4551d2485dbc1fd8310a9a
SHA512 c7448d0de37a6bd5b80c7387ef2b9c380b22f17dfcbbfa2ac71083a9e86f6e9da293995762d49fe7b4c6ed9ad6c6d3a02b690507b221161b4d56f50a35373dd9
TLSH
T11D11A4DEBD8B2031DB0827FA52E2780571B240C6068B0EC65C813BBEC126B8B8C05DC6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5aaa0c.TMP

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5aaa0c.TMP
Size 48B
SHA256 92a54916e6641ef947d769b17ea1a937c33c0711263bdeb721df363a59bbcb36
MD5 ba33d32cdc35c717bf5a7e481525958e
SHA1 4e10b0925c32c222c6856778b00e6efa905d1d65
SHA512 2f75120dcafac836a5ce48331e6ad0973d8a9fec8d9c2449fc1123ff066574919c251ef33b9925c4eb0613db53f88a3a4b87e9fb7f2fb52a4979c900c2a47bf1
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 6e825d14e9797cb3f1d699b699e1acb4c5531270bf6932b2ab3a68929c74d585
MD5 957f92a2904e2e4e44dea0edd41fe18d
SHA1 d893c30b9faa143f474a856f6ee20cc6393f6f20
SHA512 e300deacb93556210f1989f07080dd7a554a393732f1c49a866657258da495a3f7ee48d8dea5c3764fcf15615ae8b6eae6c8427d038a7e7bae2cec065f766321
TLSH
T1CA215EB3C2B445ADAF62D2FC7B1C6D279E191924136C2D4BCAC49F8AA3F1460D24460A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5abd46.TMP

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\Network Persistent State~RFe5abd46.TMP
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 e1842e9223e16def0d0524e6eeae38b0e8d80a68a770d9b220f7c1f105e5a09f
MD5 500e2a983100218e76334ad56a1c6dd7
SHA1 de36bf4b629ef22bfca4b73dab0b4e4aa815809e
SHA512 3c7aa80f91719950d80e468a4dbfc7aaa353b4f5b77bea3c10ccb923925032238f389526c6aa5a4bfd7c865522e7d3aea08142513df87c6dead647981044f222
TLSH
T1E1219E9785BAB866B12C487A580B7D057B7EE431C24254F4DB5E412CB0D89F79B1381A
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 e172c8bd36f65093f76b2f542e9481c3a29351b6886ac3f87f025fe642e7cdc8
MD5 366164a7ca3fde372d7ddda5c5b078f8
SHA1 7c5cf13e9b87baca8c25b2af1652232d90aae742
SHA512 e872ce31bd1fe1ce5f3d31e827e2a7f1f552a1f1a102169cd4569c0b7b4c3ebd687dc4e614db5abe8ea70fe634c84ff353598272611788061d96639b894fb56b
TLSH
T19D219E9785BAB866B12C486A280A7D057B7EE431C24354F8DB5F422CB0989F79B1341A
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 39ef37e069d18cefbab6b253eecb000df656dd9ca09c49d40cd4a232cbf72604
MD5 962eee51d5c0032f72b51336c9cf1faf
SHA1 2b6f1f85db6016bc8dfcf6d7763aabfa95f7089b
SHA512 0347b38e47803a1618042b0593a42e834dfb1ec91704998a017ee937d11a5f101a3a075d7493685401fbcc62a0b011c77708eda78f40bd29463d2d5a4c2010b4
TLSH
T1E8219E9785BAB866B12C486A1C4A7D057B7AE431C242A4F4DB5E412CB0989F79B1341A
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5abd85.TMP

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity~RFe5abd85.TMP
Size 1KB
SHA256 daae17a6426378f2c7dbdb3b7fe7183395a0453dc49c7d83e138e344ddf9b32b
MD5 284f58101e83e7cae80e9520d3c2edcc
SHA1 2d60b6a119799e8e00fb2bc1124be4aaf7adf1d0
SHA512 cd5b5c56daca3bbd4fb973b3657400cfe1e1fa0dbfc0b1e740c684616ff3eac049bf91631cd57621971a7d4c533ef9449be5cb5a47b470479b6cf641585e1a6a
TLSH
T13621919785BAACB6B12C486B18067D05BF7AF435C24254F4DB5E412CB0989F75B0382A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 9f7ca311394041e03530de281d1d3284dfefb4b3b4e3a5abe98be3feac5d1858
MD5 5ecc5c3f91ee9ac6d2fa4e20ce3015bb
SHA1 0f7eca43a9ac949757074255b10bfacc651ab6a5
SHA512 3f7ed650575a5942de7a8e824c8d21f315ed62ae614fc6ddf2d0833a5b423a72fbf8f289da9f29756a8e185d840d728c333a27e660d8a2198b26abe83a64765c
SSDEEP 96:stm/dcaqnG9b9GkAo5h16ZLglCs7/x+6Mhmuec8dPS1ehi54euK+gJN28XM1C7K:ste2aYDoUglCsV+FQd6Qhi54GvNG6K
TLSH
T1EAD1C8025AA869BB4CC6E519FA29BF13E2F95431A1D11E98E7FC4A1C04EB6DC6303907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 cda4240145859a47c801531ecc80e403fa64a351268eb2c65505994af92f0d11
MD5 bd042e7b2039da07ab0e1a1a4229e00e
SHA1 f06e01a398905d091955cfe6b0fcab1a2987148d
SHA512 b747c06e601bef306bb62506d7a725fbc8fb8d5b7dcbd0c2701035400e6f9c71265849d79ee14c8874bd26382515737f1f0992a4247bca75a2a651b404d57769
TLSH
T101A0025B33801311C11C22F1144E468463109939570316164AA1E386CC61155F512041
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5aa970.TMP

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5aa970.TMP
Size 48B
SHA256 cfb70478c3cf656dc0afb009ba1eb8216b7ef881ead9cc294586b3b04cf57754
MD5 5ffaf236bb45212ba9a0f8337ed26c40
SHA1 0c5a5be783628548a683404fee2dc16f467e4097
SHA512 57ad9f44502b7cf1153ef55b5f7f55937edeaf0a47f41c1900db9e17277979d054249e11117d728db23ca185cefb71bcefb7c2c6ba1d879ae32026d413a02f89
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Local State
Size 2KB
SHA256 2c8e9e50a8bd82f61b3db4f0376c9af538956726319e3c16cc445672a57ab1a4
MD5 0ca29c143f3fad6f2c6e478945e79033
SHA1 c26390da68fdee8a4ef7b2fe4dbc5513bf74bfab
SHA512 f84b7b29c93c0d0c93d85ab766c7b3c9411a42c08155defe2ac5019bdf031a979f4eb2b277ba89efba5bce322d873b0e5e29ba5497d1be39893cfa728b860458
TLSH
T1BA516373B8686A3799B28B46784B3F539E365062EA921F61D7DC0F0C00CA75C1342C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Local State
Size 3KB
SHA256 4bfd529bba4d048a603bb884a2af7f93a403cd76834c144987dcb517d7f39b23
MD5 8b88607a8474aef056fefeb1cdf18aea
SHA1 e27cde1284b0bea2b239882eacd52afa0ca0385d
SHA512 c233551510300da9aa2d13c00be74889671b76cf017ad605a822226a2d0efc8cf96c5b7c873f2346015eed201d355782313931348449813c482b35cd9e271d00
TLSH
T13F61437769B4A93B9DF2DB0678863F13AAA55023E5852FA5D6EC0F0C01D73981342D17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5a50b1.TMP

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Local State~RFe5a50b1.TMP
Size 1KB
SHA256 aeb07b9b4ad6d70a5045576cb9a3175b27968396927731d1223918f42e9134c9
MD5 95cac05392f002fa3d95c6f7222b2b0f
SHA1 20b873cbc946808eea99af075c59d83944590ba7
SHA512 dbfb8ea429d677aef01f3713c7913181f192e8d97aa1914bbedddbd6f43ace8f92f39e79b86b563a752c171380d0df5934434289968c1fd82538452ee7a76033
TLSH
T14F2110F3E9B85A33ACA597473147BF835E221063C2514F5493DC4F6C02DA38D8666933
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1216-413-0x000001D143FF0000-0x000001D143FF1000-memory.dmp

Download

memory/1216-423-0x000001D143FF0000-0x000001D143FF1000-memory.dmp

Download

memory/1216-421-0x000001D143FF0000-0x000001D143FF1000-memory.dmp

Download

memory/1216-422-0x000001D143FF0000-0x000001D143FF1000-memory.dmp

Download

memory/1216-424-0x000001D143FF0000-0x000001D143FF1000-memory.dmp

Download

memory/1216-419-0x000001D143FF0000-0x000001D143FF1000-memory.dmp

Download

memory/1216-415-0x000001D143FF0000-0x000001D143FF1000-memory.dmp

Download

memory/1216-420-0x000001D143FF0000-0x000001D143FF1000-memory.dmp

Download

memory/2672-0-0x00007FF65B7C0000-0x00007FF65C057000-memory.dmp

Download

memory/3424-351-0x00007FFE55280000-0x00007FFE55281000-memory.dmp

Download

memory/3424-352-0x00007FFE56870000-0x00007FFE56871000-memory.dmp

Download

memory/4160-269-0x0000018D00DF0000-0x0000018D00E1F000-memory.dmp

Download

memory/4160-20-0x00007FFE564E0000-0x00007FFE564E1000-memory.dmp

Download

memory/4668-113-0x00007FFE564E0000-0x00007FFE564E1000-memory.dmp

Download