5763e5f7d0a65033efbf4ef22c9c522aca5ad5c649464c1ec14f432fe5135513

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_f1669dcdf0f5c4542432e85ae1ae7c17_akira_coinminer_glassworm_rusty-stealer.exe
Size 8.6MB
Sample260729-ctsbbadf45
SHA256 5763e5f7d0a65033efbf4ef22c9c522aca5ad5c649464c1ec14f432fe5135513
MD5 f1669dcdf0f5c4542432e85ae1ae7c17
SHA1 0b70119a2905da2843775f3f3cb428f57e76cd92
SHA512 cec5539bc15157ef2150861b78b4f0f239c9d984b516a84beb111d76eb6fd0f74320d0d54c1f16f5946b7631d0bf62eddc87b5d8f2bcbcf298f4e320ff0ef438
SSDEEP 98304:MeCe+b5zY9Ldvhr0/n4VRdh3OL4XQ3yWla6uEBOadK4xCBfZ+ALhb:Melo4rala6uEoadK4gBxXFb
TLSH
T13B966B56F27940E8C86AC179C2566233FB71B85903707ADB5BA44AB52F66FD02F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-29_f1669dcdf0f5c4542432e85ae1ae7c17_akira_coinminer_glassworm_rusty-stealer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5340_698336614\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5340_698336614\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5340_1839983885\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5340_941304709\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5340_698336614\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5340_1839983885\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5340_1839983885\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5340_573309831\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5340_573309831\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5340_941304709\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5340_941304709\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5340_698336614\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5340_698336614\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5340_573309831\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5340_941304709\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5340_941304709\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4108	msedgewebview2.exe
4108	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5340	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4772	2026-07-29_f1669dcdf0f5c4542432e85ae1ae7c17_akira_coinminer_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 5340	4772	2026-07-29_f1669dcdf0f5c4542432e85ae1ae7c17_akira_coinminer_glassworm_rusty-stealer.exe	89
PID 5340 wrote to memory of 5864	5340	msedgewebview2.exe	90
PID 5340 wrote to memory of 4248	5340	msedgewebview2.exe	91
PID 5340 wrote to memory of 4248	5340	msedgewebview2.exe	91
PID 5340 wrote to memory of 4248	5340	msedgewebview2.exe	91
PID 5340 wrote to memory of 4248	5340	msedgewebview2.exe	91
PID 5340 wrote to memory of 3620	5340	msedgewebview2.exe	92
PID 5340 wrote to memory of 4428	5340	msedgewebview2.exe	93
PID 5340 wrote to memory of 4428	5340	msedgewebview2.exe	93
PID 5340 wrote to memory of 4428	5340	msedgewebview2.exe	93
PID 5340 wrote to memory of 5148	5340	msedgewebview2.exe	94
PID 5340 wrote to memory of 5148	5340	msedgewebview2.exe	94
PID 5340 wrote to memory of 5148	5340	msedgewebview2.exe	94
PID 5340 wrote to memory of 5148	5340	msedgewebview2.exe	94
PID 5340 wrote to memory of 5148	5340	msedgewebview2.exe	94
PID 5340 wrote to memory of 5540	5340	msedgewebview2.exe	98
PID 5340 wrote to memory of 5540	5340	msedgewebview2.exe	98
PID 5340 wrote to memory of 5540	5340	msedgewebview2.exe	98
PID 5340 wrote to memory of 1748	5340	msedgewebview2.exe	99
PID 5340 wrote to memory of 1748	5340	msedgewebview2.exe	99
PID 5340 wrote to memory of 1748	5340	msedgewebview2.exe	99
PID 5340 wrote to memory of 1976	5340	msedgewebview2.exe	100
PID 5340 wrote to memory of 1976	5340	msedgewebview2.exe	100
PID 5340 wrote to memory of 1976	5340	msedgewebview2.exe	100
PID 5340 wrote to memory of 4108	5340	msedgewebview2.exe	101
PID 5340 wrote to memory of 5020	5340	msedgewebview2.exe	102
PID 5340 wrote to memory of 5020	5340	msedgewebview2.exe	102
PID 5340 wrote to memory of 5020	5340	msedgewebview2.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-07-29_f1669dcdf0f5c4542432e85ae1ae7c17_akira_coinminer_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_f1669dcdf0f5c4542432e85ae1ae7c17_akira_coinminer_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-29_f1669dcdf0f5c4542432e85ae1ae7c17_akira_coinminer_glassworm_rusty-stealer.exe --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz,RemoveRedirectionBitmap --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4772.3592.3556756030254155498 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5340
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView /prefetch:4 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x174,0x194,0x7ffcedff5fd8,0x7ffcedff5fe4,0x7ffcedff5ff0
    3⤵
    PID:5864
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-29_f1669dcdf0f5c4542432e85ae1ae7c17_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1384 --field-trial-handle=1736,i,14982028662162331270,323765552632042350,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:4248
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-29_f1669dcdf0f5c4542432e85ae1ae7c17_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2220 --field-trial-handle=1736,i,14982028662162331270,323765552632042350,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:3620
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-29_f1669dcdf0f5c4542432e85ae1ae7c17_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2292 --field-trial-handle=1736,i,14982028662162331270,323765552632042350,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:4428
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-29_f1669dcdf0f5c4542432e85ae1ae7c17_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3504 --field-trial-handle=1736,i,14982028662162331270,323765552632042350,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe /prefetch:1
    3⤵
    PID:5148
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-29_f1669dcdf0f5c4542432e85ae1ae7c17_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4668 --field-trial-handle=1736,i,14982028662162331270,323765552632042350,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-29_f1669dcdf0f5c4542432e85ae1ae7c17_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4808 --field-trial-handle=1736,i,14982028662162331270,323765552632042350,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:1748
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-29_f1669dcdf0f5c4542432e85ae1ae7c17_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=816 --field-trial-handle=1736,i,14982028662162331270,323765552632042350,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:1976
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-29_f1669dcdf0f5c4542432e85ae1ae7c17_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4816 --field-trial-handle=1736,i,14982028662162331270,323765552632042350,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4108
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-29_f1669dcdf0f5c4542432e85ae1ae7c17_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1048 --field-trial-handle=1736,i,14982028662162331270,323765552632042350,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:5020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 43ea09fade76cf576f596bd06138c0633c9b1301f9b292c31df1b84a1748be65
MD5 e5e4416a9d1c3a63dbe23d21079004e9
SHA1 7fa1a67a343875982b2f5093f0e1d39ffbda1c96
SHA512 1f698fb203da4ca2d7b1467a4b4f95a28428b377ee06a04cbb93e1efad9af42d544c5478d7f988973180f71839f611c9cef41ab215a8061c7592b873ee68499a
TLSH
T1BED02223B3020238C8303033000BB30E0880EB0F800A8000A83CEBEEAF080B00E8B8C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 03867c09870f569702750e0c70ba2757f2d012512e8613261636dfceb316b9dc
MD5 99a0227c728461ab01967313c008a561
SHA1 b3f5cbbd02936b16a68ee31261071bf41cc81cb6
SHA512 5d4f4c78027acde7f06a9b78151e1e12d1c54582b1ec0527f0f3f870c519f4fa015715243228b373c4e4f5a9727e2b060e1328ef991a8b6f8587d6d5bc831906
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 816B
SHA256 a9c4e4fa9302c2d262b6c5450c95c3008581168200f6317aa6ae8595db95289d
MD5 c573c1d0f200b859c85105420cfb0e25
SHA1 2f8c4cd7e8d7ec947b74fee66a998432fd0f2123
SHA512 68472b5b3a269bedcba1aae14bb37fc7045e4b329faa9eb2fb6a82f36e62382f81a7a8a4c14737359e9186fefd2e7c11587812f674438fdf967759048268b534
TLSH
T1BC01520402C3910ACBCD02B303EA09AA34B163D0102F1FE308A0EC3B08AB7A898CCC82
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 840B
SHA256 2e723fbe9a44d7ee53964601279880d937c7211027316f12fe2b00143ce1d1b0
MD5 89cd0149585645dcceb18d5503ba9d1c
SHA1 8f2c65ac77a06df01f198b9ac638a9e01369b777
SHA512 06b43212286525e344ac4550dab24209bcd3f3ce94823110cc1928c18ef7e89738763a7adb742af8fb523cd74f7a89805670339a346806b4ffd8b32478bff9e8
TLSH
T1E001241002C39109CBCE01B303DA59A634B0A3D1506F1FE30561DC3B095F79D98CCC82
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d49c.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59d49c.TMP
Size 48B
SHA256 909669335c47b6fbfca1352cb44608f520e57b8126269accee90469ff3a6da81
MD5 9981c0965ef6aae8ac24f047f8d9e1a6
SHA1 65a6c56639db6ba956b423d466fa31f3c5c022cd
SHA512 4b03a4620e891461526952530452f70fe7bde85a9a32df22192473efc793e37361d42bd366e1c2fa3a921b6fca0d432974edc994b26c96c1f6c74539292e19ef
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 af04421b3b70c94c4c7345d8b5eea1cfdac19154ebec9ee7652b2a3de3e7fc5d
MD5 7ccf16d33d975f39938af15ec4f3e27f
SHA1 a28a6fe1474a7a39b70e50d571452b544f5bbc79
SHA512 5b2b49c33e903f9ffe52c6d62ad22d5b2214a99022f1a9f86dc1125138502a0c0b7e1ea6e93fe58354bb3a6a6def155255b38d8aefd1ccdd2eeaedd84ab118f0
TLSH
T1CC2190B383B445AD9F5251FC3B2C2A5B4E1D451503AC295ACED4EB4FD3F1860E24464A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a928d.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\Network Persistent State~RFe5a928d.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 683B
SHA256 1a4009cef9660dbbb41326a854d037be2b82fd20c57a8c10aa972ec63af10f96
MD5 4ef58c93be8c592f837874c1b8219a49
SHA1 8b094c33f016cf59a80f101a1c664c1f203bac2f
SHA512 cdece4a4315a80055a225771076b39bee49c425f4b2ed0ee1c45e58d26192c83afe72de26a9897ff8b83985e73de0d40c83fa4b685f41af1ba2e9b382e2c9256
TLSH
T11D0144AB51FEB67E70285A570C44BE01567BE4304641A4F4C79E802EB0C6CF7151B432
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 683B
SHA256 06dadac162e609e9b312959d0106048ff618345900509a2167f48cbce57992f2
MD5 126d31b8c58ef802ab31127bcef85d0b
SHA1 bad4dbc92034a5e9987f5b8a1485eeafc2067623
SHA512 ee4f6d0d08f0b752d49bb03a8c77426850f7cd3493e13f5d8b304c49bb9c57de356b65418d4826b4a793c0b8b92acae88bdf4a3dfe93d6faed0741239208f686
TLSH
T13C012BEB81FEB56A60685A670C40BE012B7AF4308642A4F4C79A802EB0D68F7161B423
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 687B
SHA256 8aba78611a8de907e02fd4aa0cae5b33014da4af62ae40e7ef288d2c78cd7500
MD5 4232221daabc0d8ccd33191a39f22bb2
SHA1 ee5701c9e0b7ca9162c9983d64dbda8185778129
SHA512 79705c5098d99ba9ee3e706e20cdc84628ccbeff63a81a384478a8e2efc7d382f0de4b3641faa7745106daa14271644d980df1145e0f963ecc921c756f71cef3
TLSH
T119012097C5BDB53A702C5A670C40BE415AB7F434864158FCCB5B802EA0D5DF7550B452
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 687B
SHA256 0d796d82f581134e89fa4f275310453590830d7c27c15866c335da52b33d60ef
MD5 87f7c2dc93e6742826d6e814da467dbf
SHA1 597cf3a4d5e3e96af094709664c302b823a3fc38
SHA512 22d0fdc6ee092bc8288290c90a5748410850da2c8c6f5be6d2550f56251d6cb49c1b52a6684d5a1e86fbbdd56e39257b690ef607c1e24edac716560766851e76
TLSH
T198014497C5BEB93E70285A670C44BE4167B7F474464264F8CB5B803EA0D6DF7150B462
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59ffb3.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\TransportSecurity~RFe59ffb3.TMP
Size 186B
SHA256 136c8c98b0dcfe5770b8a73fa59ef2fb00d101ef7b59f62d72ab0962b3a64c14
MD5 d1e49a4b995c9f089e2b96c4d211db8c
SHA1 59065e46a9b1f9b3618104359a62c1d33316368f
SHA512 a8c9cb4a7b91ed4ba3bc33eb0d167b951c7fd66647785a76e8935078c8f631262415a942f6f871b85f47a1915708501f5c9a9b35e446ed1f1975665918349693
TLSH
T10FC0C0F280BDE836303807230A88BE007F3FF032414198E8D28B813DA1600B7C30B453
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 ad825399f802451a8026d06bededd19e7f5193ccb72e94353e0492fde843c896
MD5 c348dbb3d1560f11dcc309ec767d504c
SHA1 2716e606dfa92132b4647b53ccdc2b417a9aaf3d
SHA512 1cbeb0d4668666f264ca7e5e4edba8af2fa7b18947dadef8e1dae9b941e298b81747373964827c7c3cfd171be4dc37744421fd020c5125fc0307ff9d339402a5
SSDEEP 96:stK/dcaqTGlb9ykKo5h16Z/5s7/x+6MhmuecFYZ1ehndzeFK+guw28XM1C7K:sty2acloC5sV+FRYZQhndzbzG6K
TLSH
T140D194065A6869BB4CC7F11AFA39BB17E2F55432A5D01E58E7FC4A1C04DAADC630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 69ba87b9735b83c6d1bdb416aff20fcb7eae4471e515dc7680afd2c7dca13cd0
MD5 e299129908f90513194756c444f23d1d
SHA1 762c4023b18512a1ebe60eda529aaf6284c9d4f0
SHA512 7177034e7ffa4b6fd9a289670496f00ffba1a52bfaba21cc7be07f9e45c902e1a3657636c3ba7e3964b90f72dc31491be2fa6337bce8e6679ce6f90196ca1714
SSDEEP 96:stK/dcaq8lb9ykKo5h16Z/5s7/x+6MhmuecFYZ1ehndzeFK+g7V28XM1C7K:sty2auloC5sV+FRYZQhndzbHG6K
TLSH
T100D195065E6C69BB4CC7F11AFA38BB17E2F55432A5D11E58E7F84A1C04DA6DC630B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a0040.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Preferences~RFe5a0040.TMP
Size 5KB
SHA256 de406676bee8b9b3de782057bfcc2bb6e760ac9ed0eb4945effec70c0e0cc172
MD5 5863a583aca73fd26ba76f8849fdcb18
SHA1 99494c51ed47575a464d03a4b11b9d707704f5c0
SHA512 c155cdf2cc3acc2bd0747b59ec7bbae04025bcb07a07e4f9ac9ec5aeb116ea9c133bb064a73a0c883dd3b1b970072160501361295f96d6e49b434287345e7089
SSDEEP 96:rK/dcaq8lb9ykkdo616Z/5s7/x+6MhmuecFYZ1ejeFK+gQ28XM1C7K:ry2aujoh5sV+FRYZQjbOG6K
TLSH
T177C1B7065E6C69BB4CC7F109FA397A07E2F5543275D52E58E7F88A1C08DA5CC630B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 3e08649fcfcfa6691171c7ce9903d674152b00b033f7d4f4592ef4f7d556f030
MD5 81cf2eb598dd4d9b6c08bc8f1583d57b
SHA1 09e60809e6532cbea291cbd89e2cb28a649b8b16
SHA512 0ccce8e4545301a8bc6b943f9b1a0481200f66cc2b3f647479dd9a143d2a1fd8813f185d5846b98981c69c090fdcff905edb227b0c14b59326933cfc344e5719
TLSH
T1D2A0025121404516C48143B5204B15C8A3175925C3015627A2DC0AC98FA0369521D240
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d40f.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59d40f.TMP
Size 48B
SHA256 7c124bfda982f9228c0e128684630025b5e8c71a40f1fbe7660bbfc0caea558e
MD5 eb6af4f56618906d3b671b46600e27bc
SHA1 720f4d81fe629098fd9a5f7c40fd2e4627b2e1b2
SHA512 d54501643a19a26347e717588b1c1806eb8bb9a9f12846de550287a52f0774e9a7c240de1a20e87c6fba976176d34529770384f98b48e3ae23eda0a47a2eedea
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Local State
Size 3KB
SHA256 6a879e160d5c805cc1178e4000168946ad163353c20b6f1cde960b2d83a98757
MD5 987f860e5b09f5f7df5260d871b2c294
SHA1 d395c29b2e3ddfb38d4269edb010d0ce11d1d5b7
SHA512 a5cb5521baff5c1a22b25b1749221a3706a290d13c8e081619eb6a40aa5db0e847883402a7730c5e8905567dfa479b969ac6a8f9418b35e3153806adbc6e8515
TLSH
T105617237A874AA674EF29A05B98A3B12ABA58167DAC53F54D6FC0F0D01D73881342C26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Local State
Size 3KB
SHA256 be06d7ca9984054be9f1e1f9a83b4b3076111a26054b704c7f3cd1319500cd61
MD5 820d51954ca8204950c0d10c7cb2dc7a
SHA1 6a7c12265cee906c52ebe1776c02beaf32fcb26a
SHA512 5c974973a772bab453af7c387c6094267216988a8a7c5d63e87eee305fc633c89a5282c47b1a1423b9bc0f01550ee249238df40362b11a9049a8b3f723d002b3
TLSH
T1C98192276474AA674EF2DA06B94A3F13A6A19063D9C53F94D6FC0F0D019738C1386C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Local State
Size 2KB
SHA256 13df77b07b58e19a701ed0f8442eb9d701c8e898b71d07a5bc4383b4b8828060
MD5 2036e24d9c858a77f8950b1cb6e2c969
SHA1 0171e5a4b3a98135d11b7f92a80694dc6100a8f2
SHA512 2e522d0e0e51fb4b10dc68d100578903baf0b102f2a9b951bda17f3707f0f5b4de697c31383bab27d858bfe0683c5414ff1db2d9e0de8c9dfce411bd9a23fe1e
TLSH
T115516333B8249B778AE25B45794A7F239A759196DB921F00E6EC0B0C419765C2346C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Local State
Size 15KB
SHA256 63c73541036f9616ada45371fb5f98444000f97e17994a8eafbebeba20d362da
MD5 91b6749c043044abd376456c867fb6b9
SHA1 e5da90ae14a24f65a7d7fab7446b25f78ddd201b
SHA512 631dfcc9b66cdeb799630a170bf96578bca445f91d31442e7c11ddbd373151f3e1bca989b7a0f76132b1aeaea0673980fa42f9e8e616603a72038d902b182447
SSDEEP 384:H+aQikB+z/xvxjg/qhE/NBSIjSJAKQ3B4H9zw:W/UxvxjgC+DjsFCBcFw
TLSH
T11B72AE3B50786E2295F3EA0179191B4BDBB898A3C5C22BB88EFC5F0906873981346D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe597d73.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Local State~RFe597d73.TMP
Size 1KB
SHA256 f01e7a5643e29071d6cb1d7a0fe68ed99f481a569444f2c7580843da79b862c5
MD5 9afc44e1888e89582e0d4340d99403a3
SHA1 4f7e04ad8682bfd409242d5280741b9ff3065ebf
SHA512 f7d8fbf063e1145d5285d87b9ed83f9ef8d5e25965b76ba540edc36a69e128ac652cdb1a61f78b4f58666e3aaa0396192d2d00e6ca85cc4b54bdf16e9476db46
TLSH
T1A32165B3E4789BB29DD267863207BB175E7140ABC6910F00B2ED4B5D45A620C936AC36
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4108-438-0x000001FCBA790000-0x000001FCBA791000-memory.dmp

Download

memory/4108-433-0x000001FCBA790000-0x000001FCBA791000-memory.dmp

Download

memory/4108-431-0x000001FCBA790000-0x000001FCBA791000-memory.dmp

Download

memory/4108-439-0x000001FCBA790000-0x000001FCBA791000-memory.dmp

Download

memory/4108-443-0x000001FCBA790000-0x000001FCBA791000-memory.dmp

Download

memory/4108-442-0x000001FCBA790000-0x000001FCBA791000-memory.dmp

Download

memory/4108-441-0x000001FCBA790000-0x000001FCBA791000-memory.dmp

Download

memory/4108-440-0x000001FCBA790000-0x000001FCBA791000-memory.dmp

Download

memory/4248-242-0x000001AFD1310000-0x000001AFD13B8000-memory.dmp

Download

memory/4248-33-0x00007FFD0F5F0000-0x00007FFD0F5F1000-memory.dmp

Download

memory/4772-0-0x00007FF659E00000-0x00007FF65A697000-memory.dmp

Download

memory/5148-103-0x00007FFD0F5F0000-0x00007FFD0F5F1000-memory.dmp

Download

memory/5540-358-0x00007FFD0F870000-0x00007FFD0F871000-memory.dmp

Download

memory/5540-359-0x00007FFD0E0F0000-0x00007FFD0E0F1000-memory.dmp

Download