7b14aa8dc83bf93523af63caeb725169cad23aa4061fc05c88c741dd4ea7db8d

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 02:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_c1b737e72010a671550f630c03591741_akira_coinminer_glassworm_rusty-stealer.exe
Size 8.6MB
Sample260825-cg2n8adr2w
SHA256 7b14aa8dc83bf93523af63caeb725169cad23aa4061fc05c88c741dd4ea7db8d
MD5 c1b737e72010a671550f630c03591741
SHA1 a12b80801113465864c001272032986feb9cd6ce
SHA512 9a0e98d1b376d67b5b9f527e655ad0082a6cd7305bde1278b526844a209f0ecede1d9244398c3cce9ebd3a4a1d1fdf9d2247bfd33f91a79353c4d5f79d7357c3
SSDEEP 98304:zOru+NQ4ZN1P6Q0zIQMzkfQHcSwUIV/61q6eEBOKdK4xT3fZ+ALVb:zOKrMuM1q6eEoKdK4t3xXZb
TLSH
T117965B56F27940E8C86AC179C2566233FB71B85903707ADB5BA44AB52F66FD02F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-24_c1b737e72010a671550f630c03591741_akira_coinminer_glassworm_rusty-stealer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 24 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_1022318189\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_576343384\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_536743275\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_401026163\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_401026163\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_401026163\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_401026163\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_401026163\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_401026163\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_401026163\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_1022318189\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_1022318189\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_576343384\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_536743275\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_401026163\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_401026163\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_401026163\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_401026163\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_1022318189\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_576343384\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_536743275\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_401026163\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_401026163\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_401026163\Part-NL	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1180	msedgewebview2.exe
1180	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5500	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2636	2026-08-24_c1b737e72010a671550f630c03591741_akira_coinminer_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 5500	2636	2026-08-24_c1b737e72010a671550f630c03591741_akira_coinminer_glassworm_rusty-stealer.exe	88
PID 5500 wrote to memory of 5216	5500	msedgewebview2.exe	89
PID 5500 wrote to memory of 208	5500	msedgewebview2.exe	90
PID 5500 wrote to memory of 208	5500	msedgewebview2.exe	90
PID 5500 wrote to memory of 208	5500	msedgewebview2.exe	90
PID 5500 wrote to memory of 208	5500	msedgewebview2.exe	90
PID 5500 wrote to memory of 1780	5500	msedgewebview2.exe	91
PID 5500 wrote to memory of 4216	5500	msedgewebview2.exe	92
PID 5500 wrote to memory of 4216	5500	msedgewebview2.exe	92
PID 5500 wrote to memory of 4216	5500	msedgewebview2.exe	92
PID 5500 wrote to memory of 1352	5500	msedgewebview2.exe	93
PID 5500 wrote to memory of 1352	5500	msedgewebview2.exe	93
PID 5500 wrote to memory of 1352	5500	msedgewebview2.exe	93
PID 5500 wrote to memory of 1352	5500	msedgewebview2.exe	93
PID 5500 wrote to memory of 1352	5500	msedgewebview2.exe	93
PID 5500 wrote to memory of 4616	5500	msedgewebview2.exe	97
PID 5500 wrote to memory of 4616	5500	msedgewebview2.exe	97
PID 5500 wrote to memory of 4616	5500	msedgewebview2.exe	97
PID 5500 wrote to memory of 1104	5500	msedgewebview2.exe	98
PID 5500 wrote to memory of 1104	5500	msedgewebview2.exe	98
PID 5500 wrote to memory of 1104	5500	msedgewebview2.exe	98
PID 5500 wrote to memory of 5372	5500	msedgewebview2.exe	99
PID 5500 wrote to memory of 5372	5500	msedgewebview2.exe	99
PID 5500 wrote to memory of 5372	5500	msedgewebview2.exe	99
PID 5500 wrote to memory of 1180	5500	msedgewebview2.exe	100
PID 5500 wrote to memory of 2720	5500	msedgewebview2.exe	101
PID 5500 wrote to memory of 2720	5500	msedgewebview2.exe	101
PID 5500 wrote to memory of 2720	5500	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-24_c1b737e72010a671550f630c03591741_akira_coinminer_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_c1b737e72010a671550f630c03591741_akira_coinminer_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-24_c1b737e72010a671550f630c03591741_akira_coinminer_glassworm_rusty-stealer.exe --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz,RemoveRedirectionBitmap --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2636.624.6098305965330485372 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5500
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView /prefetch:4 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x198,0x7ffeb7ad5fd8,0x7ffeb7ad5fe4,0x7ffeb7ad5ff0
    3⤵
    PID:5216
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-08-24_c1b737e72010a671550f630c03591741_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1828 --field-trial-handle=1832,i,8341855969345239168,10518937247478762384,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:208
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-08-24_c1b737e72010a671550f630c03591741_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2144 --field-trial-handle=1832,i,8341855969345239168,10518937247478762384,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:1780
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-08-24_c1b737e72010a671550f630c03591741_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2248 --field-trial-handle=1832,i,8341855969345239168,10518937247478762384,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:4216
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-08-24_c1b737e72010a671550f630c03591741_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3500 --field-trial-handle=1832,i,8341855969345239168,10518937247478762384,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e /prefetch:1
    3⤵
    PID:1352
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-08-24_c1b737e72010a671550f630c03591741_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4128 --field-trial-handle=1832,i,8341855969345239168,10518937247478762384,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:4616
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-08-24_c1b737e72010a671550f630c03591741_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4720 --field-trial-handle=1832,i,8341855969345239168,10518937247478762384,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:1104
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-08-24_c1b737e72010a671550f630c03591741_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4692 --field-trial-handle=1832,i,8341855969345239168,10518937247478762384,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:5372
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-08-24_c1b737e72010a671550f630c03591741_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4692 --field-trial-handle=1832,i,8341855969345239168,10518937247478762384,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1180
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-08-24_c1b737e72010a671550f630c03591741_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4516 --field-trial-handle=1832,i,8341855969345239168,10518937247478762384,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:2720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 afbf9e27685f32b7d10c8f75535520f16e39611fff5b7bc7b6bfdc89952c5d6a
MD5 467739489d5fbdcd91f483df483a9d25
SHA1 1efdc57af393a0d39d88dd633ef0d0a07d5628ac
SHA512 a516978d4fcec00a202fd38c4c1949a5d4e66da54587f07c0e6b568800b3327d7263c4caac98103532b4ae4cf6aab97448c50c9c20ea52d5240574b2c9875db2
TLSH
T193D012973682017CC41020730002A1080400C10F7089C1015C28CA1D5A844980D02441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5b8afbdb01877d3d2f793f0e2b13055541cee0732b889d316ca4d7430ec87ff0
MD5 461bedd537d8789637df35c3e9858bb4
SHA1 541471e306fb58281c0756beab2328456ed1b918
SHA512 948a05b3d49df595802204511a8db4c6be4b1c7f32162202533b306efbe4c9756484d4b7d4da07b831a8284716d1034267d2a51cc33a06a53b0972b88f73397d
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

8e23f685-117f-46aa-b3e9-d567057f551b.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\8e23f685-117f-46aa-b3e9-d567057f551b.tmp
Size 6KB
SHA256 fb2912e7b5360d74c0a2cb6c1207954a42cbd7b1e5da9cc47a9ff187a05c070e
MD5 b97136ce0e999696d96b41dc0ebf8e3a
SHA1 36df552a98c7645f2e479c91744ebb7f63011ff2
SHA512 2c290816d2f353308bc5ffa6ce9bbd75cd768511d1587fd47ff6e32fca0472222abc3c52cec805342e22c8bb36d0cbeabc46318238732f09c853c6696cfb4988
SSDEEP 96:st2/dcax2/b9mPkdo5h16ZLglps7/x+6Mhmuec8tXS1ehCNNehK+gSYa28XM1C7K:stu2aPmoUglpsV+FQtCQhwN7FaG6K
TLSH
T1FAD1B7435A2879BB4CC6E219FA39BA07E3F5547175D11E58E7F84A2C28DA6DC2207807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 840B
SHA256 70bea4e62257f0345227a7b0298be5b513b1d004ad3fe18d493813b7d6141fe3
MD5 f69c157d811e7954df6b0982f374dbb0
SHA1 32a013e0d9684204df698c8a0a1a5202be72368c
SHA512 30a3601639bb714239b98e7c245303b95f1e03be4b5607323afbc7e10a2235ba7c899614c473987dcfde26a3ab891fcdb9fe75f997240a66733fec14d2d1ae11
TLSH
T19601971102DDB54ACFC86E7223F26CE2B1B488333253DEDF10805AB606C3FCD8206A69
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a3be1.TMP

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a3be1.TMP
Size 48B
SHA256 841dbe112acf4e2b00f2f9a58ae300393114d61624a205cccbb96b580fccc7de
MD5 79d9f5c385e5af7656f66225f2b23c7c
SHA1 b0feb0d14e038bdc5c3fa85a0ae6082c711c96e0
SHA512 9ab888f6a0d2dba372bd9ee1914f4b387e0efe25cdc9210cc293b64bf7020f68001ae4bdf4fd4195f179d6c7b8c3effd1e55bf41350c52c372304792f0f73f4d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 b4279ace901e6f3b304261dcc7768fa5b29fd5b20d649d5d9dcd2f54dc172ba2
MD5 fb04609ccdc62bf2ad31f2293c24953f
SHA1 a9c7081a888ba047f34038228885921f092ee8f5
SHA512 f631bddcafb58f38bff01742e5763ae84039f6600d7564ddf4fb41a32774f5e3803f03d5231fdc387519af4b1b3b74dec346cbde46f76ae2c6ddf8481096d503
TLSH
T1642170B3D2B445AD9F62D2FD7F2C6D27DE191524036C2E4BCAD49F9BA3F1060C14460A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a4f5a.TMP

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\Network Persistent State~RFe5a4f5a.TMP
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 5f73c3029b5f1cec60b39aac912a2fa9a9f7ceacd57d079e04d89063e9759a4c
MD5 01ec121b632b07673148cc3325f6311b
SHA1 694f4a4fa1a3392080f0826679f598a9c0f2cc63
SHA512 97c316d3803c4a73c912f2e505389cde2784a0ea4505db93df940298350b3104e093737fee1dc79b66846a6ee7bc99eab10f18342f286778d62a73de16059208
TLSH
T1B22191A7B67EF82B3069086F1D88BC031FB9A872458164ECCA56D13DB0955FB4E06857
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 001c9c54787b94500a45fe3fe4cc2524e49477329017aa1855f7e7f8a1432d74
MD5 1907f6a005c254175bf93b5d2e46242c
SHA1 469804510640d230c6cdaa4d3fd021adb5f19eed
SHA512 218be28c1abacd2bae4e3aefb192a958c57898fc86fdb66af5144b631c102b055086fe6bccfc6f53e6de843ddf4c94399d96ac51cf0308723ff3730ab092a18a
TLSH
T133219197F2BEF42B3069096F1D44BC031FB9A8734581A4E8CA56C13CB0555FB8E06853
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 5beaa89af0cca3a8746a1b3880da2bfc98329174e0e61f2b48bc0f6fe7f3a544
MD5 a536139e794d0f76b92601a266abc7c4
SHA1 0e29bc71a96283398dfb8acfd3ed2c339099254d
SHA512 7b6fb3d7e0030a00090fc8a03308f7fda1d12deb0a6171ceb0e3f666e1ba06fbcfb1af27af0f3c764a1581d2cbe638e6484a588bc3541df0f95ce81508fed4ba
TLSH
T15A2161A7F2BEF42B3069086F1D44BC031FB9A9724581A4E8DA56C13CB0555F79E06857
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 4b426bbb192ac6ecc76ff4a8e76337d47a84510a1689840331577946037d3861
MD5 3829bd7faeb069e128fea2b98f2b43ec
SHA1 28ee3fe5f692ee2e936f08c83e1a15bac174cc6d
SHA512 3d2f8c0a090c491eb2da66c77b90a76c2a0ad85c9653a9e2113d78a5b49d5372678248bbc39d582bafc31f728151af06577bc2abee5a96c388f061fcc72960fa
TLSH
T15621C1A3F27EF83B3059082F1C84BC031FB9AC720481A4E8CA66C13DB0555FB4E06853
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 361ed9d2ce9886983e59f923a7bc8a7eb0dd3c0c38d77310918ab4e57ae49cc9
MD5 ba809c7b1c39591ca3f0eded1b931718
SHA1 1362a023b98376d7594eadd7377339ec394a1979
SHA512 548b1964c19e747a71196b8874274e38ddc20e10936ed8b977ebc3f457697f64af4dd379e6bb9deb240787350a3723da071a961ba9e68e097c9f784235ac70f5
TLSH
T1F5219197F2BEF42B30A9096F1D44BC031FB9A8724981A4E8CA56C13CB0555FB8E06853
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 12f4a5930e1e8a07664c4628ddfb45b937590064a414264a382c78cc162198ce
MD5 87a51ba11e9cff483eebb8a0e07bd91e
SHA1 8d187083cc722accbc80dd332ae233b8440d7f77
SHA512 51ad13a1e8fa8217f5ec70af89ef452b752014ae273e014af8c5126611620d55544d7d6aa3cb5a90959c91ecb34c60d73cad69ec2d07b30e810645725da47d53
TLSH
T1032191A7B2BEF83B3059086F1D88BC031FB9A8724581A4ECDA56C13DB0555FB8E06857
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 e2b0a30f6baef96d4ac91ce0e9714663306a675e7e6ddafdaf315dfaddaa857b
MD5 61a6d1a6265cd4303e22c960984fd88d
SHA1 f7d6c2460a19791ff5bcaf83c00ef063c04715ce
SHA512 e81888b5b50d5b4b2babb97e50b772d951c0357a6368d4e5fb8bc20400a741405282861bfe78604e992a8ba7e9b95549288930fafc15b99097adadfcc70301f7
TLSH
T14D219EA7F2BEF83B3069086F1D84BC031FB9A8724581A4F8CA56C53CB0955FB4E06857
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 79aab81fdee983fdddf474eb9282b846719d337805aeb596c42f46bb6c79a962
MD5 e8587fbd7e97c2f8c178ed2cd9f0c1b1
SHA1 b48b4aff7eea25254dae0ce88d6e1c73a3a99147
SHA512 cc12478c32a95af2245e66dd279cc2fecdf3213cfe777fa0e979779491a195f1d71c4f683dfabb3ac8e2a10b471c5dd3be8bbdf56352625a28fa5060ed7e7f2a
TLSH
T1BC219197B67EF82B30A9087F1D84BC071FB9EC724581A4E8CA56D13CB0555FB4E06857
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 2811d55b4c5ce838bce9bac8b2eb76e0d9a889b0836bea6499f4b56542541f79
MD5 cddc4af0604dfce697ef41fc73a15719
SHA1 6a7124159cbfce6823c3da76c91e8aeaed42ebb3
SHA512 9e1563a023f0e766175176cca720880451f640d56c4c88554e5bde22011578d505a1165111f0dc8f32610190fea4a5242a5baad4124717d56b575754010bd845
TLSH
T1F42161A7F2BEF82B30690C6F1D44BC032FB9A9724581A4E8DA56C13CB0555FB9E06857
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 fc41c1b9a89473ab99a6a4d219c187aea153173e1752a82bb64175f17e31b304
MD5 d2a2b7f15b943b7166a8f74f6c011a45
SHA1 737dc6708c211956f1ead7a0d8d2ac4c0bbf391f
SHA512 74bd5807f243d481a31c0711fa353dce1de1d01a0ec0379a1ae5777c021570cad18bee80522d01327f387640263e409bb9acd5f463204bee8614e6414ae18133
TLSH
T19E219197F27EF47B30A9086F1D84BC031FB9A976458164E8CA66C13CB0555F74E06853
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 f497b2e227a68da5e01f390acfa5f6df3fd1436933c542df20580343bbcdb88c
MD5 ab3b427a6c625a5ffb18b5394b34a11d
SHA1 e2c47825816d64164359bf23305b0f42bd519868
SHA512 a7e9943938af1d55d44f04b6edc799acaee0869e96df22bd7f7e20b17245c81461c0fc799e0d3a08b7d2bf39105c168a15ee5e1c3d73df7f82329adcdf37272d
TLSH
T14B219197F27EF42B3069086F1D48BC031FB9A872458264E8CA56C13CB0555F78E06853
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 35ea409e093652e07c6bec23466f0ef38a2e9d9e8a4dbfcded3d99f9c3d679aa
MD5 d8a01db02d815124755744736155155b
SHA1 40abb29786da90e4e9fdbc5b59cca392118fd60e
SHA512 b2ba4c87b77d7cae0996c15a30794e08bd8cd7eb63c1dafdd1648150b707a0e6bd5b3959e24db633406df0564a3ea927f8a2868970d6300c21d75122219c0cf8
TLSH
T1EC219197B2BEF82B3069086F1D44BC031FB9A8724581A4E8CA56C13CB0A55FB8E06853
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 30f13cfc9dbdd1c25fe4b33df5e07da09cc6e68e8924227acb5ee923edb94be2
MD5 0fc53cbbe121be9803f060be49944ff3
SHA1 495bf59ff6954d10aee4af50310d075fb0a6e2ef
SHA512 35fb163082ffa5ca31af543cc1d686d8cc2a7e55c3b18611c028288a821a5dba2cfb720e19e4bcd5203cfaab5281e9c14945178bcd278542136719581f144d2a
TLSH
T16D216197F2BEF42B3069086F1D44BC031FB9A9724581A4E8DA56C13CB0555F75E06857
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5a3bd2.TMP

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity~RFe5a3bd2.TMP
Size 1KB
SHA256 70d35d714c454ca5c4511f204d83209169a208ad69b34db20196a4ceb8643867
MD5 317ea94f6ecc6096ee359b8865cc1d90
SHA1 2bd573afdac485a0b453c7ad17846db726d5f26f
SHA512 07751295916b3cb3f8ec1e38d4ea0ca668b64ea6d424ae5fd2ea9a5bdcb9c8cb20e97ec52cb97241e60cc54c57c494bb70a9af119f03d00d580c09f77f82b7f0
TLSH
T18B21ACE3E2BEF83B3069096B1D84BC031EB9ED7200C2A4E8CA56C23CB0555F74E06847
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 e55440215f8d6c6b90e89d4d887de5e1ae8f2a5046f747dd31250927173b55ac
MD5 0b8903a048f303dfd880f2a78a4f316e
SHA1 29a4164dcb72ee22bc9c5e7512b06632f8870617
SHA512 37f9d0f58057dc98a47ddb5efb8416b5f5eba7de24dc2a61f82099f4e2fae6df4ab4929b16fcc2dfc3c7bb3fed886c90157813a4e02feed9afd0e3426cd6f3c3
SSDEEP 96:st2/dcaxNG/b9mPkdo5h16ZLglps7/x+6Mhmuec8tXS1ehCNNehK+gSPL28XM1CO:stu2atmoUglpsV+FQtCQhwN7GLG6K
TLSH
T12AD1B8435A2879BB8CC7E219FA297B17E3F5547165D11E48E7FC4A2C28DB6DC220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 72B
SHA256 7215a2962347cc43930a00a9553480bc07fed9f0af6c3d5d9df7c35037934d3a
MD5 c07471614376478fdf2bf0ed6b0db78e
SHA1 743222cc95d75178b096df3360fb6351b8988472
SHA512 95ed089f2f4b4c59d5ca22bbcdafcf5cd87b95a0a9bfb89b29400ff4f28451a04ac5eb904618cacde141ceea35e39d19bb52b7bf7c1f9f29720766f2f7632bf0
TLSH
T13EA0022B4141111BD1360FF0504D81C43210D925410356114E94E2CADC526D0E1210A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a3a0d.TMP

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a3a0d.TMP
Size 48B
SHA256 5bd50b4048b384c5f370cff71ba4ef7a715f28f63e3f18fdf6b4d09d08d2cf66
MD5 4508871a0536a9aaf93a841a6ab04bfa
SHA1 3a4b0ac02c06faf9c8b367df258f10bd9149e015
SHA512 202fd15d17a511f9d1f937675413117e497e3be7f3fa725a9c53ac8a04b8d9fc302346532de2c1b86c7250fef660aa130abd1ab3fe883747775b84d9b1b8552a
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Local State
Size 15KB
SHA256 5626181740900049451ad29fc2d3feee8aa620f3baeb6783d55e429c68fdf65a
MD5 8bc22767491e9e1eaba7a96d60fba435
SHA1 f2259e0da1c174676164d060a27fc29abc2cfdf2
SHA512 edb4c13085c104ec93344e721075eb3c7fa9feb1a6aa3dd307df26df24c2d88321c8e8d373935e44a60d8d7198d4afcd9c125967bf0c37acbe576243a31abe9e
SSDEEP 384:++aQikB+z/xvxjg/qhEDNBSzAzM831d4FW9zN:J/UxvxjgC+XjT4wFN
TLSH
T1E772AE2B95797E63E5F3E60579490B8BCBB888B290C26E744DBD6F0D16C33D81346806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Local State
Size 1KB
SHA256 bc60556fa17b606392fa87c8c68117bf8eca46064f11b5d14261844e04dd429a
MD5 b93059d5bb8422bfe9e1cce6b66568bd
SHA1 b209b4fb0b97af615a76f8951c8140320a94ff72
SHA512 525a54c7a4b81ff49148b2672a649a74f0d62e66f2c000f417743b844395b89c8064d2e0acd9fb74583f64451397a9a3be55c810db74adc0a9464983bf65c24a
TLSH
T19D2165B3E4717BB3EC82938A7253BB975E30446781154F0065ED4B1E06E358CD27AC32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Local State
Size 2KB
SHA256 a2dfda55f0f7ed6fe366385a7f3e33e9d3b5c60e4297a5c09917006806744cd6
MD5 6637c336ea9f8204a5d1e57e363d8f8c
SHA1 0e4bfc56a5208cb101da0b216b47590eff6a0328
SHA512 949fc31a33a2de8fffaaa562778805dfbd8c3bee9226667389f013439a40f1c1fa39164abea722b2cdcaed1649eeef8cfe0c45a66e6cd8c52e4b9acad247b0a3
TLSH
T1D3519573B830BBB7D9E38649BA477F63CE7540A299521F11AAEC0B1C01D369C5355C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Local State
Size 3KB
SHA256 bb1052d3938048a919a453bb597e48adc471920968fb753b58c1c29307e438d7
MD5 7a213894673633e8c115d4bceeb64e84
SHA1 a2d8647aebffd3c2a56508f8ab677476a50a8e41
SHA512 8fb91bc305c26cc17a0710cde45cdc6e7412b22a73d9b2fed9460380bf96155bb5861eaf1b33801284f3826b321c03722de872f4c808e2c2f068b27a9e24250c
TLSH
T16D616267A970AA678DE39A09B9863B17ABB54027E4963F65DAFC0F0D01D33881391C17
MD5 SHA1 SHA512 TLSH

Submit Download

memory/208-27-0x00007FFED8FD0000-0x00007FFED8FD1000-memory.dmp

Download

memory/1180-465-0x0000013E84600000-0x0000013E84601000-memory.dmp

Download

memory/1180-467-0x0000013E84600000-0x0000013E84601000-memory.dmp

Download

memory/1180-476-0x0000013E84600000-0x0000013E84601000-memory.dmp

Download

memory/1180-474-0x0000013E84600000-0x0000013E84601000-memory.dmp

Download

memory/1180-471-0x0000013E84600000-0x0000013E84601000-memory.dmp

Download

memory/1180-473-0x0000013E84600000-0x0000013E84601000-memory.dmp

Download

memory/1180-472-0x0000013E84600000-0x0000013E84601000-memory.dmp

Download

memory/1180-475-0x0000013E84600000-0x0000013E84601000-memory.dmp

Download

memory/1352-111-0x00007FFED8FD0000-0x00007FFED8FD1000-memory.dmp

Download

memory/2636-0-0x00007FF7E7290000-0x00007FF7E7B27000-memory.dmp

Download

memory/4616-375-0x00007FFED9A50000-0x00007FFED9A51000-memory.dmp

Download

memory/4616-376-0x00007FFED8DE0000-0x00007FFED8DE1000-memory.dmp

Download