39d381d2904c1d9380455e78bd84abc19668d4cfb796f877c7f9d22c54429534

Analysis

user interaction
yes
max time kernel
102s
max time network
103s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 17:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kxhe0VKKLt.exe
Size 2.6MB
Sample260806-v4tagabc66
SHA256 39d381d2904c1d9380455e78bd84abc19668d4cfb796f877c7f9d22c54429534
MD5 3b78a9e40660b1eb29147d8d4bed7f94
SHA1 90228689fc86eac11542f3500a200a27462b25e6
SHA512 17d07460bf6ee7d6273b5a9cd1e4cd0fd82d9dfa9ddac95697d3c1aa119e7817852720ea8692c352f0a167e868d3f3908d24944e32fa81665da5cb2ae500bd7b
SSDEEP 49152:UbhC1DrJvIMrKVhd7W4C+s4HqVmCJUBjnCO+329mFjsEMNgWSEWDtl3Jw0zJd:UbhCBFv1sj7W4nHrCqG329WslNgXz3ym
TLSH
T115C533BF486084C8CBB5943E60EBE811B1BBEF24A55B3EBB63D5675358601710FBA4D0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	kxhe0VKKLt.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2760_1962296673\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2760_1962296673\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2760_1962296673\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2760_1962296673\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2760_1962296673\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2760_1095853078\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2760_1095853078\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2760_1095853078\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2760	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2356	kxhe0VKKLt.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2760	2356	kxhe0VKKLt.exe	89
PID 2760 wrote to memory of 3648	2760	msedgewebview2.exe	90
PID 2760 wrote to memory of 5464	2760	msedgewebview2.exe	91
PID 2760 wrote to memory of 5464	2760	msedgewebview2.exe	91
PID 2760 wrote to memory of 5464	2760	msedgewebview2.exe	91
PID 2760 wrote to memory of 5464	2760	msedgewebview2.exe	91
PID 2760 wrote to memory of 3440	2760	msedgewebview2.exe	92
PID 2760 wrote to memory of 1380	2760	msedgewebview2.exe	93
PID 2760 wrote to memory of 1380	2760	msedgewebview2.exe	93
PID 2760 wrote to memory of 1380	2760	msedgewebview2.exe	93
PID 2760 wrote to memory of 3796	2760	msedgewebview2.exe	94
PID 2760 wrote to memory of 3796	2760	msedgewebview2.exe	94
PID 2760 wrote to memory of 3796	2760	msedgewebview2.exe	94
PID 2760 wrote to memory of 3796	2760	msedgewebview2.exe	94
PID 2760 wrote to memory of 3796	2760	msedgewebview2.exe	94
PID 2760 wrote to memory of 5428	2760	msedgewebview2.exe	98
PID 2760 wrote to memory of 5428	2760	msedgewebview2.exe	98
PID 2760 wrote to memory of 5428	2760	msedgewebview2.exe	98
PID 2760 wrote to memory of 1992	2760	msedgewebview2.exe	99
PID 2760 wrote to memory of 1992	2760	msedgewebview2.exe	99
PID 2760 wrote to memory of 1992	2760	msedgewebview2.exe	99

C:\Users\Admin\AppData\Local\Temp\kxhe0VKKLt.exe
"C:\Users\Admin\AppData\Local\Temp\kxhe0VKKLt.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=kxhe0VKKLt.exe --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz,RemoveRedirectionBitmap --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2356.3608.430982595960771751 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView /prefetch:4 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x168,0x19c,0x7ffa5a925fd8,0x7ffa5a925fe4,0x7ffa5a925ff0
    3⤵
    PID:3648
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=kxhe0VKKLt.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1780,i,11540820512764218536,5811899737455725556,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:5464
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=kxhe0VKKLt.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2032 --field-trial-handle=1780,i,11540820512764218536,5811899737455725556,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:3440
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=kxhe0VKKLt.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2292 --field-trial-handle=1780,i,11540820512764218536,5811899737455725556,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:1380
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=kxhe0VKKLt.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3484 --field-trial-handle=1780,i,11540820512764218536,5811899737455725556,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe /prefetch:1
    3⤵
    PID:3796
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=kxhe0VKKLt.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=356 --field-trial-handle=1780,i,11540820512764218536,5811899737455725556,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:5428
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=kxhe0VKKLt.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4504 --field-trial-handle=1780,i,11540820512764218536,5811899737455725556,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:1992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0544dc102aa4f57095d9cf37fe3e95c9e5ec6cd57d32a5515a0bfc5ff36db542
MD5 a1e89d22dda28c5d4f1d2a0e69eaa00f
SHA1 6734f58efd0b224163064f4c369fff53a4b524b3
SHA512 e43cca569afb51ce4d34f0aaae5609809e358013c8ef75bb7055dac698ea9cb2628cd02e8c23496efe5effdd679e8b50cf20287732d2bd43f52fa02f567bfab0
TLSH
T174D0122237010138C02021331142610C1445D14B82064281E42E955DDE540D01D13841
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c094cc6ec72a581c69bc1754765bedd4e4beeab0f2e59d42d1d3aba0047f12d9
MD5 dec9169d774973c8f0b8b4d772876454
SHA1 cadb81fde4a6d1aad46df272a751da88bd89942c
SHA512 e5e7a2bddc9252cffea19d8f2046bb057c967a5dbeb8233f2d7814d681dea4a661036b60c8f844dcb0ae9447b97570cc0902fd7eefd6e73560a159f3c87744c0
TLSH
T118D0043057001014C015113511544104115D54C0570313C1D017104CCCD10C11453500
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 840B
SHA256 5423b84bc3547da3f5d6b38d06bf65de3fe41177a8e65dd65429fecd6a4c0198
MD5 4295b5a361d47e10c9398ee74045d1fe
SHA1 92a553434250571f1ed25ce551417bedb089346a
SHA512 65b17eb5220aa60dbd77adc0ffbc98ba521cac5434b5d49e0e046a8635f5a561ea7095a1eddd1a274fbb337f885b651b66dfe3702fb93fc0c869e0834aa9c3a6
TLSH
T1F7018703018BA19ADB4B417C10FAA9BA31B3650473EF0EFE2830D8B50A1A7ECC804086
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59dfa8.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59dfa8.TMP
Size 48B
SHA256 2cd91d2dc3cb2d1e32f467dd800fb6a0d59648c49cbd6f5595d5778f3e06d849
MD5 f9d60bd4395e05074d9e67d579a595d6
SHA1 09c8f2f58030206a83301de349644b6ed77b7b2c
SHA512 3b0bd45453f5ae547e275829712845fee3a41cf07123839792df0919b38d216148cb4365293c1c8eb4963b845a1de7733b932a4ce0ad79d4acbeaf5b62fddb1d
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 b8eea2c7b3ccad226bb7e19d76c61c9a6f84d41bcf7054bceb7bfef9281d42f0
MD5 ebaf322d950d16d12738fcd654562cb5
SHA1 a0dd74c2eb73d323c071eee9240cc72e965f9518
SHA512 e3663cb6fb0963574fd9d1c700677e96e5d3019c1f1e5c842939208632710201fa65d87651248a5e867021bae4bc8409895d7f98e92f6447d2ff7c7d63007a89
TLSH
T1D521C0B383B449AD9E5151FD3B2C2A2B8E1D442403AC291ACED8DB4FD3F1820D10464A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a9d1c.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\Network Persistent State~RFe5a9d1c.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 691B
SHA256 a2762f53e00463d37b1348b868d89701bad6a0a5846068ff14efc94e1404315c
MD5 8f20acd3f942cf70a96798d865b17e07
SHA1 e2dfe42cfa133446188db4d279392f29c159c4f0
SHA512 cbd6363d2d8724478c3196a7fda16cc489d94755443504dd67ff643fcbad163c574ec6b47b9cac3174e78af67e16ba2a4c9d0a4e4b438c4b524291d5ef20fbcc
TLSH
T14E014E9789FBF83B6028196A0E45FC057BB5B430464178F5C767412CB2E09F34A1646A
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 691B
SHA256 d61cbedb793fe4eebff437f051bb99db54d9ed3e8591f25b21769239fe94069e
MD5 cc3ce69eab3d3cd1505ddd1f3ac12e80
SHA1 aba301b5a053ad96dc20b026a6313aabee5df363
SHA512 499d092ed0d3b8fb9fed2a111484ccfc40f1409920c5e9406f2b3f13718c4797f07055e08567499de07c949736789aa970b946f5d39451dbbcc5abcd587152d4
TLSH
T12C014E9389FFF8376128196A0E45BC057AB6B431465168F5C767402CB2F09F34A1645A
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59f35f.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\TransportSecurity~RFe59f35f.TMP
Size 691B
SHA256 082a80f8b70827403ff91b547209a5f2cf382772499a898e2af0f26258f60db1
MD5 859ffe16d37e392f575ce930d7016e30
SHA1 4f0edfdbabec1009da6fcb6461f7baba7f9c4e04
SHA512 7f881a13cd5ca7dc1d8a8ca756aab7a8ee8dbb39404a97ea82d688aa0d192c9a0d93b833609b2b3a135385c60c8e70257b2d35fd8172ed0ece0fd2ce8c5e3fe7
TLSH
T1D80144A345FAF8375024596A0F56FC0576B5E430424174F9C737842CB2E09F30722C15
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 bf2f5cae2ed01ded28b4436fb322a0f9d77a14c62545f14c66bee99a311be9d7
MD5 ba74b9c66e48f04cb0fc08712c943ecb
SHA1 cee83ac0b529b89ee9153f5eed3892d7c390c941
SHA512 f7c4e4b281f4ce1f41247e2fcfe727d0aa8366c75692490ad06728bc2c4d64c203c2924958d134a25dd78a4408c725675e0c40c3ca93bc3a82e6c2d9cc87ce40
TLSH
T11FA0021911804115D80303B91E5601E43F289A658211324542A012C9CFEC1D6C1370D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59decd.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59decd.TMP
Size 48B
SHA256 8b0ef01c3e0be369d197f0191dd8b3ad16af6c3a55aade7ca2f1cb4343b1e9e3
MD5 e92007909e89426b25e61be3b67765d9
SHA1 3f5a8f944efef0b8068ba081875aca2ad0c53e77
SHA512 76075edbc2eaf24fc74665f9c6b4800294626929ea52dbc8a47e3ca71c688dfddf05b1356d639cf2ab9ca09135948081b9d402af86f1fb08e3d16d4ecf326b60
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

b48e8626-dc8f-4fc9-a611-35ca47ddb211.tmp

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\b48e8626-dc8f-4fc9-a611-35ca47ddb211.tmp
Size 6KB
SHA256 15afb597bbf0db0b08fbc2195c2b7f799e087778d160333c7b9f804cc6a9fbe2
MD5 b79a90bf17c4167024882d9c4085ed79
SHA1 eea1cebb368fec4539d978fce83bc6cd60bc1dfb
SHA512 918436abb0ebc11cbc30f746d199583bd462008ebf59d7de3f4ee5b98ab6c5e5f1728ba96357ad855c69464b21bd64994e189d5e847fc8731ee632d4b1c7556e
SSDEEP 96:stE/dcaJZMb9akGo5h16Z/Cxs7/x+6MhmuecFCreU1ehC7ketK+g5g28XM1C7K:stI2aTNoCCxsV+FRCreUQhC7kb/gG6K
TLSH
T183D1B7465A24797B4CCBE21EFA28BA16E2F5903178D11E68F7F9562C04DB6DC620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Local State
Size 15KB
SHA256 a9323febceb28221bb162714e90c20610ab8d85dc64699a20db3c496fdad6f69
MD5 764b048331ec62fe5e90c87bdc60dae4
SHA1 4870fb499e85b0df3cfd077da64c4ba375971448
SHA512 a5c1a45fe2d94ac8e4ac79749d13ccd362c57de6d8f0b4fcd7ffce1889094ad43c627278f153d00203d46b26ba929999f27e3fb1f8458d42d122c18f7e44be37
SSDEEP 384:2+aQikB+z/xvxjg/qhE5NBSMJKXazfe+dPAm9zQ:B/UxvxjgC+bKSmGYmFQ
TLSH
T11F729E2F55797E2795FBE905394D174FCBB894B295C17EB84AFE6F0902873C8030281A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Local State
Size 2KB
SHA256 93d8bcc912c44a501614ba5c745a17758c4010fa7788e3de7f056c378cf9b9bf
MD5 7256f8b7ef7bfbebc9639800aaee0d83
SHA1 496056e974c98f4ac9f2919322b12daae350e2c9
SHA512 355b39ac74c8e759c0efcb5acda0ba05f3690edc2f6eaefa93b34daba5c7c4451128d8089fef5a2c0d821b4f91ed5e3d7922a9d2a0d367989b9b81870e4fa847
TLSH
T13F51977368185B3789EA86197D8A3A238E3590619E512F75DBDE2F1801D728C2301C3F
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Local State
Size 3KB
SHA256 40d39484e740733e6cea2e223c33acfa01379a9db5d724016e9a0beb94d3ce62
MD5 869d34c74dc93d5865db9ec3c873d186
SHA1 6a0468860a9e8175a2d3915e08e17d334515749c
SHA512 a204c8d3db5f3a7c3b1a21269c6db9a1d60ccc31b60a479c3bfc3240c19b3980af75a2886b14296f0cf5ddcfb9a50ea5a9fa049840367f5664c5686894b97b41
TLSH
T1E461A5376964A93B4DF6CA15B8863B16ABA59023E9813FA9DAED1F0C01D738C1301C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe598822.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Local State~RFe598822.TMP
Size 1KB
SHA256 9bfc296a4f05f392b64df56a5ac69bfa6304a08376a49a9325aba1c5fceda5d0
MD5 e130451b3bb51b2a1c14aed3d1110d88
SHA1 a23b15b5698ef81f2d39be9aaa961a6529c73064
SHA512 d0a5955a6cf2c9e0f8ab280a19cca511b53b0c1f96c29488962456a04a1e76f120297aef4550635cb132b4a0baf6e29b8ea56478fb982083d1dcd5753afd0e76
TLSH
T17E2184B3E42C0F339CDC522B61923A9B0E30902786818E14E7DF1F1902A728C6536D3B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2356-252-0x00007FF7886A0000-0x00007FF788F49000-memory.dmp

Download

memory/2356-0-0x00007FF7886A0000-0x00007FF788F49000-memory.dmp

Download

memory/3796-113-0x00007FFA7A180000-0x00007FFA7A181000-memory.dmp

Download

memory/5428-317-0x00007FFA7B2C0000-0x00007FFA7B2C1000-memory.dmp

Download

memory/5428-318-0x00007FFA7A730000-0x00007FFA7A731000-memory.dmp

Download

memory/5464-25-0x00007FFA7A180000-0x00007FFA7A181000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads