18015b2937a4700b8354d4c62085eb7b0f6a97c34e7d4a4103fbca26a7bd5abc

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 11:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_7d6f0551ad60ee6889d7b5214e688e13_akira_coinminer_glassworm_rusty-stealer.exe
Size 8.6MB
Sample260804-m9sbcsdl7s
SHA256 18015b2937a4700b8354d4c62085eb7b0f6a97c34e7d4a4103fbca26a7bd5abc
MD5 7d6f0551ad60ee6889d7b5214e688e13
SHA1 f8b4dc35a8b077415030ddd0c8b0da4af35075e6
SHA512 d0683bf035ea5764e06e7c4cdda70afe77c3e4852b394d866fbdb174a531ea436310c3bcab2a17eed604433af839f2270e8afad3cd2b05fb7c797402fe376d35
SSDEEP 98304:peCe+b5zY9Ldvhr0/n4VRdh3OL4XQ3yWla6uEBOadK4xCBfZ+ALhb:pelo4rala6uEoadK4gBxXFb
TLSH
T1A4966B56F27940E8C86AC179C2566233FB71B85903707ADB5BA44AB52F66FD02F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-03_7d6f0551ad60ee6889d7b5214e688e13_akira_coinminer_glassworm_rusty-stealer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1084694337\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1084694337\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1084694337\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_529142135\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_529142135\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1084694337\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_529142135\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_529142135\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1084694337\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1084694337\manifest.json	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5116	msedgewebview2.exe
5116	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4744	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2884	2026-08-03_7d6f0551ad60ee6889d7b5214e688e13_akira_coinminer_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 4744	2884	2026-08-03_7d6f0551ad60ee6889d7b5214e688e13_akira_coinminer_glassworm_rusty-stealer.exe	89
PID 4744 wrote to memory of 5128	4744	msedgewebview2.exe	90
PID 4744 wrote to memory of 820	4744	msedgewebview2.exe	91
PID 4744 wrote to memory of 820	4744	msedgewebview2.exe	91
PID 4744 wrote to memory of 820	4744	msedgewebview2.exe	91
PID 4744 wrote to memory of 820	4744	msedgewebview2.exe	91
PID 4744 wrote to memory of 3972	4744	msedgewebview2.exe	92
PID 4744 wrote to memory of 3864	4744	msedgewebview2.exe	93
PID 4744 wrote to memory of 3864	4744	msedgewebview2.exe	93
PID 4744 wrote to memory of 3864	4744	msedgewebview2.exe	93
PID 4744 wrote to memory of 1676	4744	msedgewebview2.exe	94
PID 4744 wrote to memory of 1676	4744	msedgewebview2.exe	94
PID 4744 wrote to memory of 1676	4744	msedgewebview2.exe	94
PID 4744 wrote to memory of 1676	4744	msedgewebview2.exe	94
PID 4744 wrote to memory of 1676	4744	msedgewebview2.exe	94
PID 4744 wrote to memory of 4972	4744	msedgewebview2.exe	98
PID 4744 wrote to memory of 4972	4744	msedgewebview2.exe	98
PID 4744 wrote to memory of 4972	4744	msedgewebview2.exe	98
PID 4744 wrote to memory of 4400	4744	msedgewebview2.exe	99
PID 4744 wrote to memory of 4400	4744	msedgewebview2.exe	99
PID 4744 wrote to memory of 4400	4744	msedgewebview2.exe	99
PID 4744 wrote to memory of 5116	4744	msedgewebview2.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-03_7d6f0551ad60ee6889d7b5214e688e13_akira_coinminer_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_7d6f0551ad60ee6889d7b5214e688e13_akira_coinminer_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-03_7d6f0551ad60ee6889d7b5214e688e13_akira_coinminer_glassworm_rusty-stealer.exe --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz,RemoveRedirectionBitmap --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2884.1668.1587036412786099830 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView /prefetch:4 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x198,0x7ffeed1a5fd8,0x7ffeed1a5fe4,0x7ffeed1a5ff0
    3⤵
    PID:5128
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-08-03_7d6f0551ad60ee6889d7b5214e688e13_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1756 --field-trial-handle=1764,i,13910217409004981480,4256194441190927410,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:820
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-08-03_7d6f0551ad60ee6889d7b5214e688e13_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2240 --field-trial-handle=1764,i,13910217409004981480,4256194441190927410,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:3972
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-08-03_7d6f0551ad60ee6889d7b5214e688e13_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2248 --field-trial-handle=1764,i,13910217409004981480,4256194441190927410,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:3864
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-08-03_7d6f0551ad60ee6889d7b5214e688e13_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3484 --field-trial-handle=1764,i,13910217409004981480,4256194441190927410,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe /prefetch:1
    3⤵
    PID:1676
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-08-03_7d6f0551ad60ee6889d7b5214e688e13_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2036 --field-trial-handle=1764,i,13910217409004981480,4256194441190927410,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:4972
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-08-03_7d6f0551ad60ee6889d7b5214e688e13_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2036 --field-trial-handle=1764,i,13910217409004981480,4256194441190927410,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:4400
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-08-03_7d6f0551ad60ee6889d7b5214e688e13_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4780 --field-trial-handle=1764,i,13910217409004981480,4256194441190927410,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e2e595a483279b1735c15bb300a1b26344b3cc8f6569158ed2dcabdc76da47f0
MD5 e3d31ba34d7340b7af73b40108f45b89
SHA1 58f1b0cdb3d7004f71c39c74a5a0f606e9017730
SHA512 289e1a81d59045e4304884366f047a050ea849f9d340f01e2e0ac3f1b259d829f3635f5eb8bec97114c4c114c1d3020e5c24fdd3b5bed95b72f1037d6208395d
TLSH
T1A4D0122E76128134D9503533100261085410CA0F94058200A52CA51D3B944641903841
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 125b58ab07ff9cbdd8dc484f24149a7d85446bcd89ac56156c619ec5d8ccab09
MD5 90211920824c387f3d1bb4f77c047481
SHA1 7113502297fe7acd2da133e034df2989d0fd0fdb
SHA512 cfa96e7fba73caaff9e64e2df8bab1ad6c520fa41f60012be1b2ffb509ce6617d048317335ea3474bd81528daae2fd0ee0bdcd1bfa38752a569eb111a7d216f7
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 816B
SHA256 43e85e95f8dae79ed761911ceedf68a0a32003f599104dedf8bd070aef7b7a7a
MD5 a6ce00bb745cc73a6e8d11bc8a8bc262
SHA1 2cd73ce9bf0090a8bcf748622af4695efca0aa27
SHA512 70d26e62593b50550a5e895af589b4a407be3a8ed0f78dfe17ad9d2f2054de9998a73a3b05baa978bc02e5ca52c65168ede96197592da9fee9fdc78817a11008
TLSH
T112019A4007C2A056DB77C3B400EA58B5F5B0A9705EE7DFE3FC41183A952A7E84A47D53
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 864B
SHA256 1fb4125157b17c43035a07d730c24757fc20d7f39a7a0866e02b3d545f8ba4c6
MD5 985652bc9c93799ab0feaeeecf04391b
SHA1 ec2d1dacab74ef624e7fc996b6588ed4c17134ce
SHA512 b369748a9de771254c5815ddb5f08596d87f7c4bdd8d9c22c2fc27acee3013496dd3a8ae52e3e671967a4876af33bab3f65eb044e44bf6fa7b0022c75e0bc4e6
TLSH
T1F411F9001B83A016CB37C27000EA58BAB57099749EE7CFE3FC41183A882A3E88A43C43
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c0c6.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59c0c6.TMP
Size 48B
SHA256 d4ecaf291a66915bd9d59f5c7612bcdf7f153d4084912aa2a452aecb6e763b32
MD5 c9b63c4a8b980d6693f6df6ea94c1f85
SHA1 0fc58a0cce74d06d3a14fa22ae99fb92e4bc62b4
SHA512 60484de6c82a3a5e40da53f34798acad013c4577a661a13a5122f8bd95f0e5051937287e025154d464289cbb0095ad8b28b15c75528693efb28e55a5ff33d187
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 73a845f039b29f84d86509adc12a3a8a517d3d7c00c5d31398ed72bc4f76057b
MD5 6aaacbe8ca00a5668a850a31f33d0caf
SHA1 e3f3cec88431ff79f5b9bbaa3aa7ee23daaaafc0
SHA512 ef7a9c02f8ab86bf03c8c6dff111904bd7322f3f2881123b4e3e74e8aec75b65112153c9ffc9029cfa7494cc1236f9d044e4429a37d39ad5c871a33d95b5ad64
TLSH
T14C31C1B383B045ADAF5261FC3B2C295B4E1D052503AC291BCED4EB4FD3F1860E144646
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a7ef5.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\Network Persistent State~RFe5a7ef5.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 691B
SHA256 3fa62736d756cbe73ff82069aded415639da738d123dc5cc384f5ee851815dd3
MD5 c870f8a25946eb8e7870725fe7efd5fb
SHA1 985af5d1ce93b5678cbb3e8f041a1c5ae3d121ae
SHA512 a7518a5efff5404d20708f22d4f7750361714283688db860f517229a026098d7a5a4a88b5bd9a1ecade89f7be69e026be4b294d8ba4d7468c4d3c677bfca9593
TLSH
T135014E578BFAB47B112E096659437806257FA474C542A5E9DB96412CA06A8F31E22072
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 691B
SHA256 659beceadefe0706b5716b0c125137efc262a6ec271947136aa88896f20694be
MD5 f403fa192a2455da0f7f68c17b715fd5
SHA1 e9453c16cccc74522ab685f7bdc371647ab27caf
SHA512 4b3212ea6433eb70260e4fa372873f98e9419b7bc6c7935dc108fe913a616549f936246ceba17405f709815fe4eac73f86ba2cc225e77497ed0234ac5d661d51
TLSH
T135019E578BBAF82F503D086A0A427806777BB0B1C14654F8DB56407CB0554F32E12023
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 691B
SHA256 596acea7cbd7fc7a2f1dff88e6481dadfd48cc8b0f11711195981d6420fca7ae
MD5 5cfc6ad3e32bf249275d83d2b0084dec
SHA1 adb87f6acf1ce3dd7b372829e5c5d285b3ccf36b
SHA512 05de1a9cd3c6231c0aa247b1a8faaea49d73143a7b3e22a946af9934ac5697f69333661555acee82f0c481e87086e5f288b45b46af9cb190574d251ef2b229de
TLSH
T176019E5787BEB87B117A0C760A43780635BBA4748142A5F8DB97846CA05A8F35E26032
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 691B
SHA256 7251f9024e0c17de81e33abaafd9b8292f85c1afad0d991fffaef305d1063407
MD5 919e492bb17cf4f5155124d3a094f7b2
SHA1 472c5a622658bbd4acbfd02f3d8dc3da4da47214
SHA512 b568d7b485a54a94579246bd4ff2aecfb26cb046f9a5d8dc0d2beb1125732be60de38a628db0a79ad29c1e5fa98c2afcebb6329bc9671bfefbf8cdfeccc74c88
TLSH
T1AF019E578BBAB87B117A08661E437806257FB470814295E8DB97446CA06A8F31A27032
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 691B
SHA256 f54f4ebad567d2294febb6da23013181937b8daee877d7ac856ff55020db6697
MD5 45d62e3fd231721f506d5eaa459c02ab
SHA1 f38ddf3a20a78605ff1985313ae6b7f798716427
SHA512 ef133915b7a2f938902c0844c0d5e52c93afdd799b45120780bd09e60521c34ad5b21512da84243a4577ad601893d867dcf22c560eb6cba180c4374027c059ee
TLSH
T103019E578BFAF83B117D08661D437806267FB070854254F8DB9A442CB0558F31A23032
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59ebbe.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\TransportSecurity~RFe59ebbe.TMP
Size 188B
SHA256 374498c06f667e18b4b1bc98a5f157e30ac6cdc5ab0d908010451f19779f2d93
MD5 0bb99781bbd33ac979f9d1a004165352
SHA1 e54e8db8bf1d4a0868f78236c62c9e1da05f0c53
SHA512 33f76d0e514fb31928643d415a0e16fb37e6a3edcfeef650c9875ccf3a0ec661eecf22c518a0772c1db72ca976cbb9309727c5e42da530346a9fd3bb7fca90a0
TLSH
T1C9C0C072007DE43A103C052D09C07D447F37F47002C094E8E682C53C90B007E6103023
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 67d6281b3d97b2f6db64cd7333e0311debb45465ca4fb70771cf6bc32d5e3a9f
MD5 7b2f3e04465f6d0d13c4027574b800c6
SHA1 d8dbe985cf4fe9eef2740df100596e7066f58bbe
SHA512 3f36f31e4694b17d3b1849701de3a65ff5d1492aad36f7cb7874ae90c9d712ca42da8b9e6ea965cff8e4ee0673fa2e0967e03124db8ce120ec565ac6eeaaddf4
SSDEEP 96:stB/dcaqlpb9bkVo5h16Z/js7/x+6MhmuecFQkZ1ehkee/K+gw28XM1C7K:st12a2qoCjsV+FRQkZQhkeFqG6K
TLSH
T192D1C8025A287DBB4CCBF619FA25B707E2F6A0B164D11E58E7F9462C04EE6DC6207C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 789189e8676836fcc2754cb09b19858855d00b02cd76e0b73fb7e700025af2e0
MD5 4170001b8770229821e2601655476522
SHA1 71c65241e48f07adda77a313d5ddf84ea90ec924
SHA512 1ca0fb265f3210011c930f37ff702a9ab5c7567c354c582e74f5eb52f3ad3a02374177a24b07c09aacaf67f0112d9750230354954aa4a44aed0ea2a461d84a4e
SSDEEP 96:stB/dcaqsGpb9bkVo5h16Z/js7/x+6MhmuecFQkZ1ehkee/K+g/Q28XM1C7K:st12aUqoCjsV+FRQkZQhkeFFQG6K
TLSH
T13ED1B7025A243CBB4CCBF619BA25BB17E2F5A0B164D11E58E7F9462C04EE6DC6203C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59ec3b.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Preferences~RFe59ec3b.TMP
Size 5KB
SHA256 0a3be5356e2188b7ef5c9cf1147d8083f365eb726c7694cc2d2590278bbef03f
MD5 e54cba975faa0843f24bec6e9e35a387
SHA1 4e9d49d6f94eec1f2b2564a61d714e3a6f6c2685
SHA512 b5e24d29ec17c185f606d61ddc2d8bef211c6c6419c5515ee4cf64eb7f061fa479b43c01032bd9e67acec7558f0681eb32b7d067578391671cbff8efb57f5ffa
SSDEEP 96:rB/dcaqlpb9bkJdo616Z/js7/x+6MhmuecFQkZ1eje/K+gi28XM1C7K:r12a2qohjsV+FRQkZQjF4G6K
TLSH
T1D5C1B7015A287DBB4CCAF209BA397747E2F6A0B165D51E58E7F9462C04EE6CC6307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 dea928bde57b9325a7f96cffbebe73e51865a54436f40ff99f11651b3874dcd1
MD5 3f67af3ab1e5f84b36c9a5f941723366
SHA1 ac08e67daf4a3611b6ab083dcdf28dbde15f73dd
SHA512 b6a35e92bb3b14ca8dd796dd4cfca3d6e7f7c5c0f94a4590bb9044ca1f7d73bb61f5edb96bad458f604b6b98a058ad5f27a74a7c1b9d6cce52947acb597bde05
TLSH
T173A0021941400235DC1387F99B6603A42F159A7E43111209AAF043C5CE98A558113480
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c152.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59c152.TMP
Size 48B
SHA256 d6edfd4d3dee08c7faeea27df90178d0c9d35a4e10d86bc6c16081d9662b477b
MD5 93cb5e9616ee6d94d35edd60c7f6c1a9
SHA1 189a0456493bf162f95387b0261d47189257ea0e
SHA512 fafa24f377e4ad1d2ca4f140425092599086cf57198291aca41a226bbd4fe857ef06c7cb0e6519e92c09e5b9c7d19a963b2874d4ff2a9ab19253f9ca1975c049
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Local State
Size 2KB
SHA256 aeee3d603802267fc31f8d1b4f778a28a0bd79bf9224a3d03949b6319d4bec07
MD5 c4016422ce8693afadb195b56bb9541c
SHA1 c3f4a64040f87ea81deeaa5d812566f7ace1c548
SHA512 7148ac39f1130649b8cda693029a40890d542267d166367adbc6e15d0c0e34d3f5668de920a32dfedc35e943398cae7358b1ab257417c36aba87c2e65369ff46
TLSH
T1E151A5B2BD247AB789F3570978473A279E7AA0E1DA522F21D6DD1B1800DB65C2702C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Local State
Size 3KB
SHA256 3f5b06fb9b222d102cf6e24670a0fe5be86eb7d691173431f33ffc9c3f1181ea
MD5 c5bcf54bb355d5c35e1bc678b86e532f
SHA1 0c52dd200bf7f8d3f6af22986c1cee2ffa365e6e
SHA512 040c85fafe22c00b5e499293a322498fc85bcf37574e30552754bba084c1ec3a23d2320eac8e6e8b88fc77edeaa49166ecb5b4c557ee092ee231283ab7c4bd3e
TLSH
T16861A576AD74B9774DF39B05B8863B16A7B5A0A2E9813F65C6EC1E0C01DB39C1341C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Local State
Size 3KB
SHA256 687a49053d2786e13fae2913df31474fff8ddbf4eacc171e5acac22718c59ce7
MD5 a36c1c4e83dbceb7e56db591baa5d667
SHA1 9bd8aa6666343a88fb89aa6f39b340a481f77774
SHA512 43b3f1f2ae5ba92e70b8bca5a75829dd790bba2b7d4b0ee9fb64fa96628f868c4b12c4deb05e6761186799d252ce4f144abcec7f48b19161cbfcdd6aa4e02c6a
TLSH
T11D817376A974797B4DF3D605B8463B06A7A9A0A3D5813FA9D6EC0F0D01DB29C1342817
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Local State
Size 15KB
SHA256 4c2b3a5de4d22e3d4a33b7e9c9b3611b22ad7aaacb3b914095a3289d3d3d7645
MD5 6afc0d1f70372eaacaddc9712cbdaad9
SHA1 40ec0cee8b662448f2651e45754f002ede6948b5
SHA512 8ce431fa144c223c4927a64f5451d04746862f3f641579faa6a2b8a6d6ee706da4de19c766cdf5d03fc312f5c6f421f83ab4ba28e2668237b14f2c9353d4f5a5
SSDEEP 384:k+aQikB+z/xvxjg/qhEvNBSDlmBIbd6O7b9zm:D/UxvxjgC+1Gx6O7bFm
TLSH
T13672AF2B96797E6795F7E6057949074FCBB9D8F291822E784AEE6F0D02C73980302817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5968e2.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Local State~RFe5968e2.TMP
Size 1KB
SHA256 8b2e28cef9c3d153f3dba367ecb1368415bd5af39b1fa424ca7fffc911f4e1b2
MD5 a52f5646d90f3958f1f8b2b839e4ab05
SHA1 ba2491a590741002d0296e7674c14ef75b7dbed0
SHA512 4f0f1b56aa3c5ae23decb63d5a669ea338c225f0c2a6f568fb276a18fe714cc89dde6cac7498bae077be180e5469427edb1e4c3a8428f6d0000eddf3f16a96e5
TLSH
T1F021B4F2ED643B739C92734730423A5F6E7574EAC3010D1091CD8A2902DB05CAB16C37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/820-27-0x00007FFF0E770000-0x00007FFF0E771000-memory.dmp

Download

memory/1676-103-0x00007FFF0E770000-0x00007FFF0E771000-memory.dmp

Download

memory/2884-0-0x00007FF67F690000-0x00007FF67FF27000-memory.dmp

Download

memory/4972-373-0x00007FFF0EB10000-0x00007FFF0EB11000-memory.dmp

Download

memory/4972-374-0x00007FFF0E910000-0x00007FFF0E911000-memory.dmp

Download

memory/5116-441-0x000001B884600000-0x000001B884601000-memory.dmp

Download

memory/5116-440-0x000001B884600000-0x000001B884601000-memory.dmp

Download

memory/5116-443-0x000001B884600000-0x000001B884601000-memory.dmp

Download

memory/5116-444-0x000001B884600000-0x000001B884601000-memory.dmp

Download

memory/5116-442-0x000001B884600000-0x000001B884601000-memory.dmp

Download

memory/5116-445-0x000001B884600000-0x000001B884601000-memory.dmp

Download

memory/5116-434-0x000001B884600000-0x000001B884601000-memory.dmp

Download

memory/5116-436-0x000001B884600000-0x000001B884601000-memory.dmp

Download