5a9fba7bf661e6f4c7b61406c794e016ec1500fa5593211d97da9d8da58f5daf

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_17dbd7f1697262eee8a942acc86b32dc_akira_cobalt-strike_coinminer_glassworm_rusty-stealer_satacom.exe
Size 8.6MB
Sample260731-pkl46atsft
SHA256 5a9fba7bf661e6f4c7b61406c794e016ec1500fa5593211d97da9d8da58f5daf
MD5 17dbd7f1697262eee8a942acc86b32dc
SHA1 05aea00435f52f04c988ea2cf41bff62efd92434
SHA512 aed353bc2f4657bcf4b46d71a8820aa31f02ee16279d16a3fde10673785296579116330f0a066108875ee35da3a62735a676a62cd4efb3c864985fe1d7f924c4
SSDEEP 98304:Mt4lFiXqO7/mN9B2oKsMCWQxFTVzthj/iQl//GFofdQ+fZ+ALSzd:MtwCovlj/iQlnGFofS+xXSd
TLSH
T1F8966B56F27940E9C86AC179C2566233FB31B85903707ADB5BA44AB52F66FD02F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-31_17dbd7f1697262eee8a942acc86b32dc_akira_cobalt-strike_coinminer_glassworm_rusty-stealer_satacom.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4360	msedgewebview2.exe
4360	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2252	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
724	2026-07-31_17dbd7f1697262eee8a942acc86b32dc_akira_cobalt-strike_coinminer_glassworm_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 724 wrote to memory of 2252	724	2026-07-31_17dbd7f1697262eee8a942acc86b32dc_akira_cobalt-strike_coinminer_glassworm_rusty-stealer_satacom.exe	89
PID 2252 wrote to memory of 5020	2252	msedgewebview2.exe	90
PID 2252 wrote to memory of 4976	2252	msedgewebview2.exe	91
PID 2252 wrote to memory of 4976	2252	msedgewebview2.exe	91
PID 2252 wrote to memory of 4976	2252	msedgewebview2.exe	91
PID 2252 wrote to memory of 4976	2252	msedgewebview2.exe	91
PID 2252 wrote to memory of 4364	2252	msedgewebview2.exe	92
PID 2252 wrote to memory of 2456	2252	msedgewebview2.exe	93
PID 2252 wrote to memory of 2456	2252	msedgewebview2.exe	93
PID 2252 wrote to memory of 2456	2252	msedgewebview2.exe	93
PID 2252 wrote to memory of 1080	2252	msedgewebview2.exe	94
PID 2252 wrote to memory of 1080	2252	msedgewebview2.exe	94
PID 2252 wrote to memory of 1080	2252	msedgewebview2.exe	94
PID 2252 wrote to memory of 1080	2252	msedgewebview2.exe	94
PID 2252 wrote to memory of 1080	2252	msedgewebview2.exe	94
PID 2252 wrote to memory of 4360	2252	msedgewebview2.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-07-31_17dbd7f1697262eee8a942acc86b32dc_akira_cobalt-strike_coinminer_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_17dbd7f1697262eee8a942acc86b32dc_akira_cobalt-strike_coinminer_glassworm_rusty-stealer_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:724
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-31_17dbd7f1697262eee8a942acc86b32dc_akira_cobalt-strike_coinminer_glassworm_rusty-stealer_satacom.exe --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz,RemoveRedirectionBitmap --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=724.4340.2641214433850376756 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView /prefetch:4 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffd8da05fd8,0x7ffd8da05fe4,0x7ffd8da05ff0
    3⤵
    PID:5020
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-31_17dbd7f1697262eee8a942acc86b32dc_akira_cobalt-strike_coinminer_glassworm_rusty-stealer_satacom.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1756 --field-trial-handle=1760,i,16682317629995714577,2086629912050619521,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:4976
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-31_17dbd7f1697262eee8a942acc86b32dc_akira_cobalt-strike_coinminer_glassworm_rusty-stealer_satacom.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2004 --field-trial-handle=1760,i,16682317629995714577,2086629912050619521,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:4364
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-31_17dbd7f1697262eee8a942acc86b32dc_akira_cobalt-strike_coinminer_glassworm_rusty-stealer_satacom.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2268 --field-trial-handle=1760,i,16682317629995714577,2086629912050619521,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:2456
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-31_17dbd7f1697262eee8a942acc86b32dc_akira_cobalt-strike_coinminer_glassworm_rusty-stealer_satacom.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3428 --field-trial-handle=1760,i,16682317629995714577,2086629912050619521,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e /prefetch:1
    3⤵
    PID:1080
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-31_17dbd7f1697262eee8a942acc86b32dc_akira_cobalt-strike_coinminer_glassworm_rusty-stealer_satacom.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2768 --field-trial-handle=1760,i,16682317629995714577,2086629912050619521,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 39e1624d6b762e57fa10f5277d3ec1634ebc76d2fbcf8bda0ccaf5713357bdcb
MD5 34238f5da1697ca9213d614ba1bc7ef5
SHA1 afc8751f1feaa22cca8bad1e58abbd295d7ec820
SHA512 1e8d635a8020556cf457a9f1d86cae98768c07e3a7acf8f8acc99f24145636b76593fae3b5a78400b3f5f2e4bb2cc787a6e9d6c8b769997e5ccefc7ada6f7927
TLSH
T137D0122232174234C41031333442A1490500C14F408580415838C56D1B0405C1A57841
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 58c8ff50047e72afaef0b01d383e3a26f541222d61de0e3ea59bba8b1c8fbfac
MD5 0e0edbeb24b49de24437b11be8b1a200
SHA1 5cc055a3e24617d8f3dd1db9b9f1500fae93d1c2
SHA512 c42432d50d543c106442fc8fe0e14a0345634b2fce486b63749c0e9f5758692b59c0899a9505578a959f450c54c3e593e256cd05ce9b059de107dc7091c27414
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

7a745a6f-ee6b-4dc0-a2f3-32dd57bae8b0.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\7a745a6f-ee6b-4dc0-a2f3-32dd57bae8b0.tmp
Size 5KB
SHA256 59f528b5ffb77538ef7e56f14cc6c12a339380dd02a0e4005e46a4da96bfe09a
MD5 e09ce731bdb51b04c8bd62131087b0b4
SHA1 9c12e720dd3a0c5ef1d7d9a6266fd21c102ccf12
SHA512 1354531e662d37b4984c31308d78648d726a77be19c2e42a9ec0f98ba0bc459bf120fd884f1e91650651087778564159af23dea718073c99469c8f0abf130d9a
SSDEEP 96:rn/dcaPMhdb9dkrdo616ZLglIis7/x+6MhmuecZQE1ejeCK+gg28XM1C7K:r/2aE1UoZglIisV+FlQEQjqGG6K
TLSH
T160C1B742AE28697B4CC6E109BA297B07E2F9507275D51E5CE7F8871C09DA6CC6307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 816B
SHA256 c1999f9309043c40c92264e089391f296632a6b993cefb09255e343fb10a4723
MD5 860060b79c9c74a4d1cddc59253775a3
SHA1 ae02a9351ba436317442d5cfb0aa465273c8ce1c
SHA512 944e520ec11a4036dba15ca23478b61d5e5be04b4c9bbd0f134e96b0258cbd8a5287b7182a7afa28dec928b54003430545beac2ff03f4f42d8fd55bdc4db3d07
TLSH
T14F01FAA0B4C548C2EB2BE43468D88C8033B4CB3376431EF327629C7B950ABDE8202192
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594210.TMP

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe594210.TMP
Size 48B
SHA256 9f807521f743b35de8786dd1f7fed647166e787aa365e6a535a4c31f9b9a54f4
MD5 c9486cd38e22b55c41b750a61c627a03
SHA1 9c869243219940f99652c00a91a34c30ee342ad9
SHA512 9832d47d086eed9158a889db3e2d5ab9ec64b5471adbd8f894a18eeb82285a25d1417fcf855dd4f0b80bb02911a73b831c1fc2f098218edc08745ff809704507
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Extension Rules\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\Network Persistent State
Size 882B
SHA256 f73a67b898184bdc1cb0150c967ea4a5478581bb7b82178e9cc9ddfd635415d0
MD5 3f3453e8a704e7eb81953e0aa46871b8
SHA1 0a820efd51b8d969fbe9507b2689341b90f73fe2
SHA512 e796a4c5a786807af57ffe1b92e7efea810eed64dec665b59d4676716df735891df04b23467b7020bfabdefd1d9c37d038d4b3ca95d19c31ac37164d52611e10
TLSH
T174115CA3D5B446AD9F6192FC2B2C6D2BCE191514036C2D5BCAD4AB9BA3F1060C100A4A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59e7d6.TMP

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\Network Persistent State~RFe59e7d6.TMP
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 689B
SHA256 5b568d2b8ade75a9bd8a631e689652dca2dbdf11cd8b55dbbd7383bee45fe81f
MD5 5e037baeec325dfa53326f415782b49b
SHA1 90a42fcb992ce5465925eeb9d2c7d66aef6e2315
SHA512 26d464a64f3c80d4977b5696e5cf7cadd0ec6653e2a4fe3f90c20e706c4fb1f7183fab3311a134ff4c504500dcb843af3854ccd19a46dbf68927ad8ac45e122f
TLSH
T1AF017BA2907EE47B2128586B69157C062B79F43201C794E8DA66813C709017B470B822
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 689B
SHA256 14f1a80f3b85c98ea489a0490a6f1c788001e85cdc338999715ee3ad545755b3
MD5 202aa3dbecfba13cc3c07f825e51110e
SHA1 e26587c209efbe6a3bd8da6896f3f9c9aa6250ae
SHA512 9e99ccf87387ddc03e1e23165d638b598dc92afdb6363dca1892972c61c03a179d2a2e9d43ad008942800a14ced6a8b3125e7a7f4730d158894e61937b3ba3d6
TLSH
T184017BB3A07EE8772128486B29057D422BB9F472018794E4DA16413C70904BF870B822
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 689B
SHA256 dbcaad48d02dc931b78673618a0cc2177813af8f1da01b45a9690f444c687227
MD5 1acffc87095c6d1cbaceec0077683dda
SHA1 6187b76d04450fe7aa46cf89160ef3f1269f09b2
SHA512 e95677589482b97b1f97235ee4c8076b2dac3f95be2dd1ec186ae32bfd11b2969dcd23dfd7ae1a93afa4c04ab4079e1ff81f93f99ca469fcf6689a3590d672fe
TLSH
T14E017BA2D0BEE87B212C596B29557D422AB9F472018694F4D656413C70904BB460B823
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 689B
SHA256 ff4e45b405cb49e8426cb85deae714679783047f5f63fdfc7424c974d037f0d2
MD5 1397b5f8603cf27953f6a3c39478e3a6
SHA1 e26925f192a7c252c1b162c9f9b64c62d59defff
SHA512 4deba436d8bc752ec64b6f81d9d72ac9bd2b25b17da65700306649b3d640a7b5f79a1a2c22ed5dfb8032f214895d8471a448eb7000edc39940b536ede564cdaa
TLSH
T1D3019EA390BEF87B212C496B2D457D532BB9F472018798F4DB56453C70904BB870B823
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 689B
SHA256 af49b936d133354cfb09941d276a3e401ed42659135b27aa7c1724f82438426c
MD5 5cf07de7f0e3aa6c981d0ab22f7cccf7
SHA1 2eea46eabcf072176a951bb39e16e2851a486a99
SHA512 a45eb22ae5c9e64bf5ed865d8da82cbb94e1c3acb947d5cf936c979a6b88c99e8d14c4491eac93c0b2bd2b24b2a6e9bcbc8881e61f92a20395cb69ee85d20b94
TLSH
T107017BB3A07EE4776128486B69157D422BB9F472018794F4D716413CB09047F870B822
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 689B
SHA256 dc7daf22cfe84ec49a7038c0e140129ec384d64ecc8ef81e0e92b81afaeb7457
MD5 6f63421ed26663bee87cba65b444655b
SHA1 7d7b5fd43952b6e6330fdc9a2737d4d931817444
SHA512 918f3912cc3da58c86b4c743be7871397bdae642a5480388c295e2ce4e882212b049b85a0c30d5142494b646e2909961392f19734ba0c740f9805f8cabb303e2
TLSH
T16E017BA2E07EE4772128486B69157C432BB9F4B2018794E4DB16413C70900BF860B823
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 689B
SHA256 f085ff7a7f884ea068d4ea95006d9a023b977568fab49b8202ac84bb179d98a7
MD5 fac3a59f76224b1df600c75caa4e6f71
SHA1 4b721ad30ce9a3ba167787e0f2e2f0f96532af43
SHA512 a108d4bdaa50f882f227aa330a919ca2286440933d6bc3d6ab7e20f56168da3aa8ed0e0ecc849e82e9d73a81ec5444321779e78b42f2c7f8ba5fc891e9187d7b
TLSH
T1F3017BA3907EE4772128486B6D057C522BB9F472018794F4D726853C709047F8B0B822
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 689B
SHA256 e1b870509e8d2cf04eb679ef3b11273e0d4cd5b13ea4f16ef7329e18b1a7830f
MD5 b2edabd1a42ca004e37461173f400799
SHA1 c0e70bbe741233968364ffd3ee165be1fdd9abaa
SHA512 9c198e4a066c911cca1074462d91deb356ed184a3cb18e929c8dae8c8d732a45fe854301870357275cbec3969ebdd8621c9cc7c152746613646b9ed8e1558e41
TLSH
T14F017BA3917EE8776128886B29157D522BB9F476018794F8D616413D70904BF9B0B822
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 689B
SHA256 5124cc4206dcf95facdb2f1fac08b8a1339e80ace78f7e47f3c9895753a9e1b3
MD5 cb3eeeff59a34f3a705b6f373cfb3092
SHA1 fe489ff8aa67e1d40c5918a4d23abf24e7f58b4f
SHA512 55a7b0f08c939c977c54433c9908cfe1f03bdff3778062e68b9ce66ea1234228a9b177e523d17e1abd3ac1d181b80acff71d21fe5f2635c0acffb0d006602a25
TLSH
T156017BA3907EE87B6128486B69057C422BB9F472018794E4DB16413C709447F870B822
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 689B
SHA256 90a94c6983b2a4ebb18e37515bb252fcc7174e9375819784e966c6485a97ae15
MD5 a05e9a6293d033782b212871dd676cdb
SHA1 249e0ac2fe8deb6f793fcac9a82a7144eb8dba86
SHA512 c7c22c5d10e33d86f70060bb7d6d7e7f629b689e3108d1d68a70ab8e602c10b84d0813927e37a09358b25970deb4ea294aa869283058cb73becfca5b9f1e96a8
TLSH
T1C0017BA3907EE8772128486B6D057D522BB9F476018794E4D616813CB0904BB870B822
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59be55.TMP

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity~RFe59be55.TMP
Size 522B
SHA256 ca80932b2b3797ec0b32f9ef3962dcbceb1b38a27432a77f8773bd775bdc38d9
MD5 750f3faa70b33a5a069fce52ed3d7d57
SHA1 3782da0285eadb37abb00373d05991bde75466d2
SHA512 5426d3a0659c30aca7b663e34cde319e0f79b9652bd70b7008328220baa1084f4c022d9e90b51db6322918e8a44137bb95e61a476d86c0ce67a6d238f75f83a4
TLSH
T13AF059A390BEE877616C886B1A15BD022B75F4371187A8E8C626457EB0900BB1A0F422
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 d38d10af91c76e4667cbc8ca848bd0950712c50c671166784b94b0fcf60b9b4e
MD5 ad6b2573eaa5152997cb7bc98ea10b4b
SHA1 5b23e8e888c9ce8b8432b9b4f5f6f0651cf4851a
SHA512 41e52a6b89cc979e91c9d3eba7b46f4e695bad101fae68e012fef34f222ac31f0441a87dd941de34e97a8485060ae74f61cf38183ef7604350ad54f07f3a93ee
SSDEEP 96:stn/dcaPMhdb9dkPo5h16ZLglIis7/x+6MhmuecZQE1ejeCK+gg28XM1C7K:st/2aE14oUglIisV+FlQEQjqGG6K
TLSH
T195D1B742AE28797B4CC7E109BA297B07E2F9507275D51E58E7F8871C09EA6CC6307C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 dc84598fd03610581ed006d6732d516d324911f281e655ad503048a6f05398a2
MD5 fe6f7acc817fe4eedfeba94adadee10a
SHA1 c992d8d0226706785883b2a45a569b9415c3a592
SHA512 a9ef2ea765930115cf3fc5607657516811df9cb8a0c56646ac42313a1de6e7e3662dd5b840060dc97fab573032271410cfdbd1e605fe889b9bf35958523a3868
SSDEEP 96:stn/dcaPDGhdb9dkPo5h16ZLglIis7/x+6MhmuecZQE1ejeCK+g128XM1C7K:st/2ae14oUglIisV+FlQEQjqfG6K
TLSH
T1CAD1B642AE28697B4CC7E119BA297B07E2F9507275D51E5CE7F8861C08EA6DC6307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 0cdc54aa770ebb72226506be3662bea8219d0c34728011a369082291ff3f3e63
MD5 87a55886f2186df46cdaf8c77c85a718
SHA1 56bfefb977c1fa578a1794a2cfebcab7ef949316
SHA512 a341e7cb52eebf3c6f0643e19bcb63081aa7671358fad48d0ed0eb2227bfe6a43eab213173fae96f31ff4ac06249e3d2d08a33e09ec232b423a0d46eadeb1a76
TLSH
T107A0021B57504A61D01047F0114E15C426115D2561171B528EA0EB9A8C51198E151080
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5940a9.TMP

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5940a9.TMP
Size 48B
SHA256 bb5fe77e44c64f415ec007c1c853e4c80081cb5ab1a277f4b995a3e52866e4b5
MD5 0225407dbe357b6932121055888a1915
SHA1 19362bb26bacce89de2220fa11843eb21ccd1398
SHA512 a5fc355f4de6c15c0953c4dbc2d002a193fe781c6cc634187959e0a84310890678459f6ef3a8489c7304f49ed0233206ad4669015deb91d87d5a5ee6d605eb7e
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Local State
Size 3KB
SHA256 ce31430780d5067d49a1f188eabe515ea8f4240c46dba7a837562628ea7495cc
MD5 d7fbe04f8f7f799fe16ea3903ea4ae28
SHA1 5917ab7c31ad45c4d56a491cc683d33ee9359174
SHA512 5a31b57a9536f3af9dc20c74324d7e03de4514986c6235f49cdc1e59ccc57a360995786a8185a2a5d5464b021dfec1b0aedd75dabce4e0270bbe3dffb0cce7e5
TLSH
T140815227A574AA374DF2C505B9863F06B7B55067E6996F98D5EC0F0E029B3CD0342C26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Local State
Size 2KB
SHA256 0e5cb87f8b93f99783cc7fd000bf27a69ef6a2a3022951348a408c971331e478
MD5 3ad113a1b0b6f39a9874e478e44b27bd
SHA1 46ae1787a195668053904f4b8603cd6ac84ba164
SHA512 f03de45ba2f419e44408245fbd9550fa204d278519f3055ee3cd2993958755f5602c56d99c294a89f06c66977a231473866addde018f1136e09e501e91ca814a
TLSH
T1A2517473B824AB378DE38605794B3F13AE7950B1DB562F14A6DC0B1D42DB69D1341C3A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Local State
Size 3KB
SHA256 afbce6089efbd39578aa7280352abf9a45d3fe74693530711e2fe9e26e3b8353
MD5 57f550a4443f9881c35d855b7bd307d3
SHA1 264e9a322cca41355ac3fde12ef714aa0472b012
SHA512 0e0122e696f8ea0d83fd0e6409271c9206a145d730de22e7d7aa3478d7708cf500856e484e35ba2fe6c5b1c0e96953e9e10f48ecdaba65eb3c13c522740ce55b
TLSH
T17761642BA974AA374DF38A0579863F06B7B55072E6967F58D6EC0F0D02DB38D1341C26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Local State
Size 15KB
SHA256 c653d1d84b65a0c4aaad56a66e2ce22a670657cf19502d211c78fe72d6313089
MD5 bffa844a1035031155cd16c11d092a17
SHA1 96728f8c5463c7cddaa51ce47ca36ffab563f330
SHA512 31b8c9279e5af2b5ecbb94f9ef94453be82a3e662241986926ae1b81c0be1144313df65e7ffce785e3f2513f9b6ab53e308dfa9e05c032de2d01ccda51532771
SSDEEP 384:1+aQikB+z/xvxjg/qhE5NBS8absfqtOobv9zh:A/UxvxjgC+jaAiXbvFh
TLSH
T13C72AE3B64787D2395F3E6017A5D1B4FDAB988B291C26EA849AD5F0E07DB3D80302916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58eae8.TMP

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Local State~RFe58eae8.TMP
Size 1KB
SHA256 4202d823d6c44ecc9b7174a6bff27895bf6abc5ff1c7353fe71f829215d471a0
MD5 b144718914ee160d9696daefb4d7bf4e
SHA1 781a549935cf7ddeef5eca00be38dca4d98144c8
SHA512 eb3ff9c5a6e9b51ba86d6ea4e792349dda92c033d3b27d5d0b7501bad617754bfa372a5c6ae134bcd8e34f37c5c46d249ad670f40dc773e28f1495fbf5e31e52
TLSH
T16F2162B3E4749F328CD6520636977A076E3120B6C3568F08A2DD8B1E039A2CE5761C3A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/724-0-0x00007FF7E8400000-0x00007FF7E8C99000-memory.dmp

Download

memory/1080-103-0x00007FFDAE330000-0x00007FFDAE331000-memory.dmp

Download

memory/4360-386-0x0000023FEAFA0000-0x0000023FEAFA1000-memory.dmp

Download

memory/4360-393-0x0000023FEAFA0000-0x0000023FEAFA1000-memory.dmp

Download

memory/4360-392-0x0000023FEAFA0000-0x0000023FEAFA1000-memory.dmp

Download

memory/4360-391-0x0000023FEAFA0000-0x0000023FEAFA1000-memory.dmp

Download

memory/4360-395-0x0000023FEAFA0000-0x0000023FEAFA1000-memory.dmp

Download

memory/4360-394-0x0000023FEAFA0000-0x0000023FEAFA1000-memory.dmp

Download

memory/4360-390-0x0000023FEAFA0000-0x0000023FEAFA1000-memory.dmp

Download

memory/4360-384-0x0000023FEAFA0000-0x0000023FEAFA1000-memory.dmp

Download

memory/4976-25-0x00007FFDAE330000-0x00007FFDAE331000-memory.dmp

Download