c064f9994a37ec1aad877d386a4c623408c13d6ce71d8cb866c5b0a67d477c3e

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_4f32fe55a1e1ef06f5cb73e608e7290e_akira_coinminer_glassworm_rusty-stealer.exe
Size 8.6MB
Sample260804-n7d7dszakf
SHA256 c064f9994a37ec1aad877d386a4c623408c13d6ce71d8cb866c5b0a67d477c3e
MD5 4f32fe55a1e1ef06f5cb73e608e7290e
SHA1 2c7facc5a1cbf345c9711e49902b82b46e4ef7ac
SHA512 4b4e5e265793778b87f2f10afd021c30592feca95d03f8adac4b679e226aad31828706986c6cee1910f07d3caf97d2d02a3f03c73cef87474265e5cd5ad2eb34
SSDEEP 98304:peCe+b5zY9Ldvhr0/n4VRdh3OL4XQ3yWla6uEBOadK4xCBfZ+ALhb:pelo4rala6uEoadK4gBxXFb
TLSH
T1C9966B56F27940E8C86AC179C2566233FB71B85903707ADB5BA44AB52F66FD02F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-03_4f32fe55a1e1ef06f5cb73e608e7290e_akira_coinminer_glassworm_rusty-stealer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2032_687831886\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2032_853013539\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2032_853013539\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2032_853013539\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2032_853013539\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2032_853013539\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2032_853013539\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2032_213207776\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2032_853013539\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2032_853013539\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2032_853013539\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2032_853013539\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2032_853013539\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2032_213207776\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2032_687831886\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2032_687831886\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4572	msedgewebview2.exe
4572	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2032	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4548	2026-08-03_4f32fe55a1e1ef06f5cb73e608e7290e_akira_coinminer_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 2032	4548	2026-08-03_4f32fe55a1e1ef06f5cb73e608e7290e_akira_coinminer_glassworm_rusty-stealer.exe	91
PID 2032 wrote to memory of 6164	2032	msedgewebview2.exe	92
PID 2032 wrote to memory of 6952	2032	msedgewebview2.exe	93
PID 2032 wrote to memory of 6952	2032	msedgewebview2.exe	93
PID 2032 wrote to memory of 6952	2032	msedgewebview2.exe	93
PID 2032 wrote to memory of 6952	2032	msedgewebview2.exe	93
PID 2032 wrote to memory of 4968	2032	msedgewebview2.exe	94
PID 2032 wrote to memory of 6872	2032	msedgewebview2.exe	95
PID 2032 wrote to memory of 6872	2032	msedgewebview2.exe	95
PID 2032 wrote to memory of 6872	2032	msedgewebview2.exe	95
PID 2032 wrote to memory of 1772	2032	msedgewebview2.exe	96
PID 2032 wrote to memory of 1772	2032	msedgewebview2.exe	96
PID 2032 wrote to memory of 1772	2032	msedgewebview2.exe	96
PID 2032 wrote to memory of 1772	2032	msedgewebview2.exe	96
PID 2032 wrote to memory of 1772	2032	msedgewebview2.exe	96
PID 2032 wrote to memory of 6092	2032	msedgewebview2.exe	99
PID 2032 wrote to memory of 6092	2032	msedgewebview2.exe	99
PID 2032 wrote to memory of 6092	2032	msedgewebview2.exe	99
PID 2032 wrote to memory of 1796	2032	msedgewebview2.exe	100
PID 2032 wrote to memory of 1796	2032	msedgewebview2.exe	100
PID 2032 wrote to memory of 1796	2032	msedgewebview2.exe	100
PID 2032 wrote to memory of 4572	2032	msedgewebview2.exe	101
PID 2032 wrote to memory of 1368	2032	msedgewebview2.exe	102
PID 2032 wrote to memory of 1368	2032	msedgewebview2.exe	102
PID 2032 wrote to memory of 1368	2032	msedgewebview2.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-03_4f32fe55a1e1ef06f5cb73e608e7290e_akira_coinminer_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_4f32fe55a1e1ef06f5cb73e608e7290e_akira_coinminer_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-03_4f32fe55a1e1ef06f5cb73e608e7290e_akira_coinminer_glassworm_rusty-stealer.exe --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz,RemoveRedirectionBitmap --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4548.4732.14498485077498782556 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView /prefetch:4 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff979015fd8,0x7ff979015fe4,0x7ff979015ff0
    3⤵
    PID:6164
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-08-03_4f32fe55a1e1ef06f5cb73e608e7290e_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1768 --field-trial-handle=1776,i,12991039910533155600,17018272085039566823,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:6952
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-08-03_4f32fe55a1e1ef06f5cb73e608e7290e_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2124 --field-trial-handle=1776,i,12991039910533155600,17018272085039566823,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:4968
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-08-03_4f32fe55a1e1ef06f5cb73e608e7290e_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2260 --field-trial-handle=1776,i,12991039910533155600,17018272085039566823,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:6872
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-08-03_4f32fe55a1e1ef06f5cb73e608e7290e_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3420 --field-trial-handle=1776,i,12991039910533155600,17018272085039566823,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe /prefetch:1
    3⤵
    PID:1772
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-08-03_4f32fe55a1e1ef06f5cb73e608e7290e_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4632 --field-trial-handle=1776,i,12991039910533155600,17018272085039566823,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:6092
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-08-03_4f32fe55a1e1ef06f5cb73e608e7290e_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1912 --field-trial-handle=1776,i,12991039910533155600,17018272085039566823,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:1796
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-08-03_4f32fe55a1e1ef06f5cb73e608e7290e_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1280 --field-trial-handle=1776,i,12991039910533155600,17018272085039566823,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4572
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-08-03_4f32fe55a1e1ef06f5cb73e608e7290e_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4784 --field-trial-handle=1776,i,12991039910533155600,17018272085039566823,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:1368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c5d62239320b14d157bc011a76a9295720d2bf50302b96c27e1446c4d06e5254
MD5 c388f070bbbc7aede07e1c87118f39ee
SHA1 ab254d4251c60fc4cf2c9b8d8cf1ecbed8baf489
SHA512 3087e4bfbfb6528369c2c823240d18adaa6f90489b2edec8b57af4322f3bcce08e936c9e86bc6ac918cd10ffec1aa4b0818ab6f6fbd74bd42beb2734b31f808c
TLSH
T10CD012127741413CC4203233014372694440D22B81094005942EC51D5F0845409434A1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 84c8e8ecca906519f6aea9071f3e43c2c8aa5c7ee0bd50055d2df2fa0f7eb8df
MD5 7e11896738baaa34767e2a02c11ee12e
SHA1 094b7806214bf32e90a1e81e74bc8b25a1df3d0c
SHA512 cb21dec97dba2e3de45c8ce5e6194c195790205b7b2216f426190e18ab62a003a135c1e09ffb98dda8daee2d0b5290e0d415e3ea6f1bca00e275fd03e8e82395
TLSH
T12CD00410D740501DC411333101515371C150D53145050105401740044F4440500C3170
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

6957e653-b3ba-49e6-ad38-d55e06c35f0c.tmp

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\6957e653-b3ba-49e6-ad38-d55e06c35f0c.tmp
Size 6KB
SHA256 f7c2257951729171c2e6f09ebbf9fc486a927cedba1d7cdcdce8ea2a8f2b9543
MD5 e1fccf2af6f91541a63d0fe175b7c5fa
SHA1 bef14f733cb90c4dc4deb6670192e4ff9e728fc9
SHA512 a224e32b16a23fa12e1cf1a74d563ff873705af3419399f43194bab2a9eb6a0313fc3c25b03d9345bde4d82f6f11a1911bcab3e0567f0c1d1b227c034033490a
SSDEEP 96:stO/dca84Jb9NkRo5h16Z/qCs7/x+6MhmuecFnIg1ehuZBaeUK+gs28XM1C7K:stW2aDSoCqCsV+FRnIgQhuZBaMKG6K
TLSH
T1C2D196025E2879BB4CCAF219FA25BB17E2FE607265D11E68E7FD451C04DA5DC620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 864B
SHA256 01452177fffb88d48ef0053034f7aee6b66f8355c8c61b04d943df6291fe8dbc
MD5 8492cd8d75871850eea0db1c594d8f4c
SHA1 2c1b5a8bf9a2a95b0f67d2c91c7d2fcf64fee551
SHA512 0bc662bc7df1262ecbe101f69efeb866d6393daddb33db81bb8de1a556faa089469deedc13e1d2bc5725eefb6c5e98644cb7f9b1dc2f7ae79594feca81f727b5
TLSH
T1F01124051EC7A1DAFF0BC671C0EA19FA3177E060656F6FE344501D3B8E3B7598898046
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59df98.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59df98.TMP
Size 48B
SHA256 42bd298aeb1973d4919338708d2cb704c8f056eff7ea5bdbb71712a205191737
MD5 846d00092ad6be8aa982a79af5ef2e15
SHA1 bf8f7aaad7803c071830e6b1f4dcb6e493693890
SHA512 bdfebbcfa960892d6f4f9eebd2b3e678981922f6bd2a1c138710d0f4274a15f7fd5a3d8077d5e6765214f2704a75c9bf5303dbd3daec02c6e4dec38e759a8b3b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 e9e3939ddbb538d8a3de07cd7fcb10771342992d1f80ecb14396e5a0ce964028
MD5 11e70dd5ccd45396cd6b77d526cc171d
SHA1 cd4db0bd9159310a3caf94a50eb5ff5a3e069d3a
SHA512 10ef1cf2b999f9b731154b90b2ce73a222d21a6ac500b2491ceaf4a657159e5afbaa7cbb167edba625801d9508ae82084b47dc6d6abad860e283e958bbeefb5b
TLSH
T1942170F383B445ADAE5251FC3B2C692B8E1D492503AC295BCED8DB4FD3F1860E144A4A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a98b7.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\Network Persistent State~RFe5a98b7.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 691B
SHA256 09c017638a871546d7f02a45bcd3bc44ae3ddc7794425219c9f53c29a4251d44
MD5 824ad532af987aea8a7005c12bfcd03c
SHA1 b9190330d4c8d9abc50f780d7f72c003ba9de51b
SHA512 0c2a19983189b45bfcdfa81cfd7fb3c84af09dadafae31bae87739c20de6babfc8632e6f9e0e5eb75434ee674dd6d3bc8188e959b5c486716d4ef80ebf743b27
TLSH
T1E401D3379BBFF83F20284A6B0C02B90E5675B5714181A4F8DF56402DB0587FB6703026
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 691B
SHA256 7f5344b682bf0cd1cca2e2351847726d98b7de491a8e9668d58d2fa262a86f48
MD5 df5a81296e5b31c007b0085f44889272
SHA1 3cb0bb418d14f3e056a5e093dd8d35c075d5479b
SHA512 39aca5e1fac481cbe14ced59aa1233d187039162ec10d51ac18690fb1b8d0957ca373ad295460492ca41a014d3401c1f042c0c8ae487bf38fc5475d938121094
TLSH
T10001D36B9BBFFC3F3028496B0C02B80E5676B5714181A4F8DB56402DB0587FB5703066
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59f311.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\TransportSecurity~RFe59f311.TMP
Size 523B
SHA256 fa57d35d2daa3d6768f3568b7fa826e033ef9d6f6807071daa267a29350a417a
MD5 36f0a5c7ab292bee0d802a82c53d6ce6
SHA1 f9a9c321c09b43347bb29f3d4c36d7cd847a7f06
SHA512 880cc6de76a785304b5accf2de19798cb946550bc1f8d75ef6ec2449b26f742c9f170362654c8511589cf7368cef97481ccc48cd1fe2fa6fe7a1f41b9f526904
TLSH
T12EF09E27567FF87F60784A760C41B98E9AB6E4B04041B9F8EBA6813CB0546FB8703813
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 950a1f3fd5be6ffe0d4708e507bc0abca69ee31637c3cfc73c35cbe25113e21f
MD5 7963040a4148260a44fb3783fcbc4b71
SHA1 1dfab9a724012e571ee57100686b5ae25a18ef93
SHA512 42227fdca3978e8dcec3c1453ba0f311af0674036a616b7a8d37e35ea4600b66f49a90ca52fe723cb8af2260f9c485bae11c690c46ad14836a0f26dfba143b8f
SSDEEP 96:stO/dca8PGJb9NkRo5h16Z/qCs7/x+6MhmuecFnIg1ehuZBaeUK+gW28XM1C7K:stW2aVSoCqCsV+FRnIgQhuZBaMcG6K
TLSH
T169D1A6025E28797B8CCBF219BA257B17E2FD607265D01E68E7FD591C04DB5DC620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 51bf0fc64621ac859fe84911244e189359a634e012b16ba81c2f760d3ee68f05
MD5 bcf6b0e274323192311a3a44594280ff
SHA1 1155731e0136a28fd8956d2688b24bb115b8d692
SHA512 788d670ea8cd572670b41ef073048d36b8ea4b14208e82d17c4d70e715346a323cf8e064faca0ae0496fcbfed1da8c4cbe2f77ecef175c6576fe236c088ea015
TLSH
T14AA0021901447116EE0343B81A9501A46B155A678109221667F212D6CE689568112094
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59da87.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59da87.TMP
Size 48B
SHA256 67be83157a67065a3aad8b003552b544902a6af7b46f4e5d209cead627f0b694
MD5 6cf6d572f7d28db788e071e904a7dd25
SHA1 d5605f8b8fd442c6e1a4bf21909fb18bb3a061a1
SHA512 17902c392bb1fdaf685cbe332728445fd74252d2dc098a6ea06bad560970a4aa210adf178c07941b56589aea310f23638deb383873c2064d215f8ac2a7698081
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\shared_proto_db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Local State
Size 15KB
SHA256 9fd044151fbeeb0c3725e2e6a435e0f671f17214263591a25337592132a8eb85
MD5 750607481c412828d0aeb12fce60e3b7
SHA1 f847008eb5156d8064985c5c33fd1ddcc541ce0e
SHA512 5c3acf4b4cfde448bea6f96e38f5170703c30d733485b7165b387437aec85f4dba576b0f0fc67627e099dc305dde1a3f0d0257dbfb2d5f325ea2655658459b20
SSDEEP 384:y+aQikB+z/xvxjg/qhEDNBSQMaVE8fd6EH9zp:d/UxvxjgC+lTFl6EHFp
TLSH
T16A72AE2B95787E27D6F7E6157949074FCBBDA4F291C16E780AEE5F0C02872D8034281B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Local State
Size 2KB
SHA256 a3ec4d611154cb80fcc1ebf515fb4e4877dcefc26bf84fc5f56a9ccca473c806
MD5 ed0b8aed274a2dda61410bb47a7ecfc8
SHA1 bffa0904f20c55f91e4f22b81c1db7c00443d927
SHA512 548b1d6c0470ed9649be592d30b1d73bd9435e963aa3023e1211d809564789f5e88b03d2658424af1b73598204aa23e2710cb697e22d9aa60da71659970cf0bc
TLSH
T1D95197336D14AA37DAA367157A4A3B23DA7E60B19A611F2097DE0B1C018768D1352C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Local State
Size 3KB
SHA256 045e68fa4ab51bf01ebfb85c22bbf6055a55fc599a050f82337b64e3db5f624e
MD5 db74f8330ba52c944e1c25d1ddecd293
SHA1 ae100e4dea70101c9dc524e011a2046677f5d704
SHA512 82171e083209276449ec3b795c127bd63293c36de631e01d426b8a7f616232f8953c386dc1cf52b6c30d415236c9cf8cee25cc5c39d05cd012b03b041ceb87ca
TLSH
T12761A6336964A9378EE3AB05B9862B12B7B96073E5913F64D6ED0F0C01C738C1392C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe597f29.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Local State~RFe597f29.TMP
Size 1KB
SHA256 11d11b5bcceeaabaafc7dfc466c7bc226a8fbf9c6e645accc8fe26bb8a2e4e42
MD5 1373f1a64baa91d2f2f0fd40d985c645
SHA1 e413fb8d77037a0dfbc6bc5dffb994b8776858fa
SHA512 e539e09eadfaed30a2cacadbe36ee996888cb748b6e0ff3009517f531cc9f7fdae9067a9019f654fc06741fb770466d3a07a3a641e7ec932f0b42d4b8469fa07
TLSH
T1AA216873A6585B33EE937317324637576E7A70B691200D0066DF4F1C019714D86BAD3B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1772-102-0x00007FF999D80000-0x00007FF999D81000-memory.dmp

Download

memory/4548-0-0x00007FF77F230000-0x00007FF77FAC7000-memory.dmp

Download

memory/4572-383-0x0000021B88A90000-0x0000021B88A91000-memory.dmp

Download

memory/4572-385-0x0000021B88A90000-0x0000021B88A91000-memory.dmp

Download

memory/4572-394-0x0000021B88A90000-0x0000021B88A91000-memory.dmp

Download

memory/4572-393-0x0000021B88A90000-0x0000021B88A91000-memory.dmp

Download

memory/4572-389-0x0000021B88A90000-0x0000021B88A91000-memory.dmp

Download

memory/4572-392-0x0000021B88A90000-0x0000021B88A91000-memory.dmp

Download

memory/4572-391-0x0000021B88A90000-0x0000021B88A91000-memory.dmp

Download

memory/4572-390-0x0000021B88A90000-0x0000021B88A91000-memory.dmp

Download

memory/6092-336-0x00007FF99ADA0000-0x00007FF99ADA1000-memory.dmp

Download

memory/6092-337-0x00007FF99B5C0000-0x00007FF99B5C1000-memory.dmp

Download

memory/6952-30-0x00007FF999D80000-0x00007FF999D81000-memory.dmp

Download