fe72b00ad5ea93fe38a3aea221b783a03a6ee05ceb34b9ee70413ac090625c34

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 21:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_4632f93a10cff7b68835901b7ced7f4c_akira_coinminer_glassworm_rusty-stealer.exe
Size 8.6MB
Sample260930-1bd8qsxtcs
SHA256 fe72b00ad5ea93fe38a3aea221b783a03a6ee05ceb34b9ee70413ac090625c34
MD5 4632f93a10cff7b68835901b7ced7f4c
SHA1 333e201ebb1fac9d2d6b1521f33f77cfba3366d6
SHA512 f7e91a627a1ca8f180ad971648eeea73ce89a6f4c6cae48b967d5be9a3ed41029643521c5b6d62c6d6bc0e46ac02943f891b511cdd7d4d58c0c988ab5850f223
SSDEEP 98304:gOru+NQ4ZN1P6Q0zIQMzkfQHcSwUIV/61q6eEBOKdK4xT3fZ+ALVb:gOKrMuM1q6eEoKdK4t3xXZb
TLSH
T13A965B56F27940E8C86AC179C2566233FB71B85903707ADB5BA44AB52F66FD02F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-29_4632f93a10cff7b68835901b7ced7f4c_akira_coinminer_glassworm_rusty-stealer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 63 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_69478947\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-or.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_276869048\crl-set	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-es.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-te.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1691251239\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_69478947\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-da.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-be.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-as.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-el.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-it.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1691251239\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-af.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_276869048\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-la.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_276869048\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_69478947\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-et.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-hi.hyb	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4468	msedgewebview2.exe
4468	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4852	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1292	2026-09-29_4632f93a10cff7b68835901b7ced7f4c_akira_coinminer_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 4852	1292	2026-09-29_4632f93a10cff7b68835901b7ced7f4c_akira_coinminer_glassworm_rusty-stealer.exe	88
PID 4852 wrote to memory of 3400	4852	msedgewebview2.exe	89
PID 4852 wrote to memory of 4616	4852	msedgewebview2.exe	93
PID 4852 wrote to memory of 4616	4852	msedgewebview2.exe	93
PID 4852 wrote to memory of 4616	4852	msedgewebview2.exe	93
PID 4852 wrote to memory of 3232	4852	msedgewebview2.exe	94
PID 4852 wrote to memory of 468	4852	msedgewebview2.exe	95
PID 4852 wrote to memory of 468	4852	msedgewebview2.exe	95
PID 4852 wrote to memory of 2244	4852	msedgewebview2.exe	96
PID 4852 wrote to memory of 2244	4852	msedgewebview2.exe	96
PID 4852 wrote to memory of 2244	4852	msedgewebview2.exe	96
PID 4852 wrote to memory of 1484	4852	msedgewebview2.exe	114
PID 4852 wrote to memory of 1484	4852	msedgewebview2.exe	114
PID 4852 wrote to memory of 3840	4852	msedgewebview2.exe	117
PID 4852 wrote to memory of 3840	4852	msedgewebview2.exe	117
PID 4852 wrote to memory of 1784	4852	msedgewebview2.exe	118
PID 4852 wrote to memory of 1784	4852	msedgewebview2.exe	118
PID 4852 wrote to memory of 4468	4852	msedgewebview2.exe	120
PID 4852 wrote to memory of 1640	4852	msedgewebview2.exe	121
PID 4852 wrote to memory of 1640	4852	msedgewebview2.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-09-29_4632f93a10cff7b68835901b7ced7f4c_akira_coinminer_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_4632f93a10cff7b68835901b7ced7f4c_akira_coinminer_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-09-29_4632f93a10cff7b68835901b7ced7f4c_akira_coinminer_glassworm_rusty-stealer.exe --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=RemoveRedirectionBitmap --lang=en-US --mojo-named-platform-channel-pipe=1292.4444.14273601295378466592
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffd960bb078,0x7ffd960bb084,0x7ffd960bb090
    3⤵
    PID:3400
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-09-29_4632f93a10cff7b68835901b7ced7f4c_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1732,i,14383626388925297084,7366406271436953220,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1700 /prefetch:2
    3⤵
    PID:4616
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-09-29_4632f93a10cff7b68835901b7ced7f4c_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1912,i,14383626388925297084,7366406271436953220,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:3
    3⤵
    PID:3232
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-09-29_4632f93a10cff7b68835901b7ced7f4c_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2380,i,14383626388925297084,7366406271436953220,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:8
    3⤵
    PID:468
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-09-29_4632f93a10cff7b68835901b7ced7f4c_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3604,i,14383626388925297084,7366406271436953220,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:2244
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-09-29_4632f93a10cff7b68835901b7ced7f4c_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4600,i,14383626388925297084,7366406271436953220,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:8
    3⤵
    PID:1484
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-09-29_4632f93a10cff7b68835901b7ced7f4c_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4788,i,14383626388925297084,7366406271436953220,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:8
    3⤵
    PID:3840
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-09-29_4632f93a10cff7b68835901b7ced7f4c_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4748,i,14383626388925297084,7366406271436953220,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:8
    3⤵
    PID:1784
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-09-29_4632f93a10cff7b68835901b7ced7f4c_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4104,i,14383626388925297084,7366406271436953220,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4468
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-09-29_4632f93a10cff7b68835901b7ced7f4c_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4824,i,14383626388925297084,7366406271436953220,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:8
    3⤵
    PID:1640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1271283124\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4852_1691251239\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4852_276869048\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4852_69478947\manifest.fingerprint
Size 66B
SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
MD5 06d2b48de0edcb3e022ed639f0fb0085
SHA1 32f93d5a76998c407087269794026d1ea028828f
SHA512 3c883d4c342f95f28e4a76c73ce7151e8a76d6f5b2c86f90a9ee7f9976ae7e1be94c963489b326d2ff5f7c6423b29552d9aa09b65c17396c2f66ce271fe19506
TLSH
T1F3A022E32CE8880EACEC0AAB020A0AFA0ECC8000020280C80008080220028F0008CA8C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4852_69478947\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 186ea98b8664d6fca9ef0ad3d33c0dc67033a22985a761d974c2d7fbbd14fe48
MD5 a6d798d489cf9fcf0fd95a1b802c9555
SHA1 6f3fb007508f460622be21e2ef33d3ab76c0846c
SHA512 d7b296ebc4981823f7715b631fe62e07bce653c6a3d5c0e8691b8915caf2286a180e87ed3693de728c93396b6e39e3c324c0d81d5bd79aca2792d014c6362eb0
TLSH
T136D0122A33810534C46030730042E1480541D91F81064006946C862D2A040A8093E441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b501f376c5e5cff525c47efff1e28330a54e51690ff8f0cef91b976054ca4376
MD5 01a8ffb54c2f1439915403787d776869
SHA1 591d1acb30bbb8b25bd26e9ffb2528de75cb1078
SHA512 fe65ddad6a462ffd6ebad0ee2d7e2d2d899e5d638c0c93e3f69c95d89e64f5c3d602e3257cc4bbdaca6ff373490e0b62a902ecb43d606b8bfba53be92d05c902
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 f0f9676baa39e8cd219aea71a89f9cf89fd942a8d1a82bd06b75485cc3de4978
MD5 02d0a6ae7ec25ae09049a33ec5ee3e19
SHA1 5720a8f7ee5581b2d7333e099dcb7e7ca2cf5524
SHA512 cc1a53ccf1b79e631d5ba0929e856f5bfd9f71532e13c3764d573fdbf932c7047573d4a39c837ea56e33e6c8bb3d8765f15d6f3c3014075c7d42720170c59d64
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 864B
SHA256 e5c048cd4ccb01dc560f4abaebc473d7d451e75dcf77bc07c5dd61ac47a1c376
MD5 c64a48cca563881cc0e9c839a43db9cf
SHA1 2a9e5dc921f356b8d5edacac1b1b526b4c751898
SHA512 1bcf820a5f11ae772ad0f6b9d3e125e47d314bb96ce215c5cc2f7b47807b74caea8bc7a24fc9913759aa255b9925892c64ec8b475bba87c07e2275e6ad9d0082
TLSH
T178110031CCD3B008CBD9407088A4AC5C96F0B688F16013B77449DB85FD4BA914DBC7B6
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 8618829a117ec845b47217e4aa55496e8263dc3fb4ff33a5f350a0995cb5bb55
MD5 f2287ee6283bb5983888d4e43f41e562
SHA1 5b482f2125060675865577a32f4cb04afe606ed3
SHA512 ae34087c5e94abfac2641ee69452bf86bbf9ed9c416431c22c3b3622e6ba556dab5eb674f5b6ec3866849e43fb6d64fcfc6868838cd67baebc5f30a9fb4806f8
TLSH
T1ED218EE3D2B445ADAF61D2FC7B1C2D278E191914036C2E4BCAD49F9BA3F1060C24070A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe58fc6c.TMP

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\Network Persistent State~RFe58fc6c.TMP
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 284a60982555d4e1c2b51e808286546c779cbae27d6a4a2f01174d9939e8d801
MD5 3be32c0ef33bccbf604155cdab83646d
SHA1 2c8bca6992924e1564b3d6e827a9a138ec735928
SHA512 bdda553be12089a5f14498a19b9d54bc1faf78b1d0add8f8df3c5bf69f85419eaf682ee414759c6807eee61dda594956448f6a54aaa253d9abcf28fcfbd61458
TLSH
T116217CA6D67EE87B6028086B4E09FC016FFBE8360182F4F5CA5B53AC70C14F75A83452
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 3eacec40704933426da51f42510e6c64d3834a9c7d24cd5914730ee746d498ad
MD5 1c3c94f4184980ad47ed000958bd873e
SHA1 23182f90368359711aa55abe36e03515e0e3f838
SHA512 93d09f9db7c012a6ae2636d375f470aa7b10227addf475e69b0b3637ff8c7c4962bfcc0eb4a10160af1ecc1c42208f769177380acd8cab3ea77bbc52b658dc04
TLSH
T161216D97D67EE87B5028086B4E09FC016EFBEC350152B0E4CA5B436C70C14F75683462
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 22df64594064d5277b2e2aa36a738f2c9d0651e1843c4473b9d5d1e9e5ba4e0c
MD5 2e012a2c86aac48ac94a5bea995d1738
SHA1 8349fd6c7657333bf328058c219144456d96cee8
SHA512 20573cd2d7a113a72a086c7b1ace9bd92afc8aed2d22a52f2e0c861d302d56ed9da2605646d471b1c51a141ebee175eea508e286f49b5402e68a827e36a162d4
TLSH
T190216D96D67EE86B1028086B4E09FC056EFBE8350182B0E4CA5B43AC70C14F75683452
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 ee999fbc9b89c79148f82ab8ae9293fa8606c647e4b8a04e55c58fd8bfff50e6
MD5 1d3c4376d0150fdb3306c976502516fb
SHA1 5aa345ddd3aae9b3f1996ab04a93fee6d20f5663
SHA512 b3a00709a1d0589d68e7c044e43885dce67ebb06bb0d42e18bba0ed9acc6d25eea20400b85b371b652e461464063d657f57dda096799c922e6509aa64d3d80f4
TLSH
T186217CA6D67EE87B6028086B5E09FC016FFBE8360182F0F4CA5B43AC70D14F75A83452
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 4d85892bdd89d4ae5ce07d281f870b2a1a2cda8d7bde6b1ee5e329e2dd312d69
MD5 016ab6032a66783f5cbc3889a77110c6
SHA1 5916768787ed7638a881fa2616affd2207e042e3
SHA512 45cea99437907a0bced2de8e070272aa5d62ab2e2b51b8672377b1e799aea01883fb504464be708af72f1243028f2f8ca774fc746b06a03ff267dda5f5dd8327
TLSH
T110216AA6D67EE86B6028086B4E09FC016EFBEC360182F0E4CA5B52AC70C14F75A83452
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 7c896d973792645fff88f00365c25bda3dbe57e420cdc7c82fbb2bfc760601f0
MD5 c6f6bc3399e8a1f312b394e4a6ee1103
SHA1 3e81c388416c331967e7ae7814955a9772f94446
SHA512 6b92aaaa487b0d9ce7e2d582ed44b88b9454e52912ec305046b6b4f49047017762d3cdddf80943e866aaa9862e2cc8331fe073884582b4d955241db6c7bece38
TLSH
T18E217CA6D67EE87B6028086B4E09FC016FFBE9360182F4F4CA5B53AC70C14F75A83452
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 5c85b7ddf56fb3f386aa28d4a3ecf2a79facacc19599ca498a6cad6b20cf5dd8
MD5 7db1e7edd43325b90c72f2cc0d5fb67c
SHA1 f883cdd6f46e68b8236fc7dab75c15b3e1e4b2c4
SHA512 c24c41958734f499b346c62d15ae04a1e03818681bed975807d69fab0e697714a98901677cc2e8b1adc125e729135b8be4949be393a24672009d79c9b30795d9
TLSH
T1BA216D96967EE8675028086B4E09FC056FFBEC360142B4F5DA5B52BC70C14F75683462
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 19b5d980f2e7e1c8ebee12c0a69a2d1b3ab454bfb28be9101b3d7d6113d4d026
MD5 0f520df8956a65b67f4255ccc4599225
SHA1 0cbbe800b8c73525cf027baa96fe4ff34f64adc9
SHA512 03866227cf8458397e748992afe1d76507c48d22142ee7a5dd7457546834f25f407eb23daf18475b388704b661fb19960a46dc9037c32676b8b147bf002c0eb5
TLSH
T141216DA6D67EE8671028086B5E09FD016EFBE8350182B0E4CA5B526C70C15F75683452
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 556f5cee58c321a0d9670cb930c1d125283b0f5d06c68884d87e4b744c71d3f6
MD5 27ab924f16f4a38caf5e8a26cb66a94f
SHA1 31d7f19e7dcbd1f491ae3bb7a684d3f6413c37f9
SHA512 2e31811975dcc002bf5bdb0234ed1ab6dd1034c202b7625dab66069fcaac2eb0581b6e5278b344f8741b55931ae66b58fd4e02eeb84caf83658e22ee6f988e0e
TLSH
T1AB216AA6D67EE86B2028086B4E09FC016EFBE8360182B0E4DA5B52AC70C14F75A83452
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 224e0a4862c1d3e014a44732d6da364cbca8dc489f7c149d396f724be2db13fa
MD5 05c6370a63157d5ba4cf26d0ff7f8f2d
SHA1 274c2f270ee220a35acb08f9ecf025523c5f8aef
SHA512 bf05e14df3fbbc0233e77dde0f7027cea454ed9bcac3e39070b3b85334f442f12988ed57ab8ed13cb5a7defeb60c1ce3bbf82cca2b56fe0b5a701c8d673d958a
TLSH
T12A216AA6967EE87B6028086B5E09FC016EFBE8360182B4F5DA5B52AC70C14F75A83452
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 7caa8f8e57e736b361bfdcee62b726aefb4870c35a2b66795e009895202b46e8
MD5 13c8fe32d9de7693199f96dddc2e7e81
SHA1 9f0d9bb35208352374110d2ac379b6cbd632c94c
SHA512 115f18100b537c29d23ea98bb3b47a039f837fb308c8d0490d3159f23826a5e079a5a9ed4b87cf92f1e9f6ea79d27a389a7cd7fb66da4eeb438097f9bd9fb185
TLSH
T1B3213AA6967EE86B6028086B4E09FC016FFBE8364182B0F5DA5B42AC70D15F75A87452
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 6392bbf910d9afc8b1144c4a20a1a03db75c336395682cfa407ebc39fe1a7579
MD5 ca4b86e361e1a5f61c46996ba8b18862
SHA1 587527a18f6b9df549640c5b0dc52a9aa0a1e387
SHA512 cd6b40b239b38ecd1b4f06fffbee8902440970edddec70d9775952f423d236d918767437dd4f89b54b2aa1cd8b54a96452d7c1db2e582ed3635fa938e0e491d8
TLSH
T17C216DA6E67EE8671028086B4E09FC016FFBE8350142B0E4DA5B426C70C14F75687452
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 9797028da6c523f5df2204dfba5ac6a53ccb5c91aeb6467c32d21c7797967135
MD5 79ff9622a4d29179a91de2ee706c5bc9
SHA1 5e0f2cff351b0669a395b477238b6b26bf19249b
SHA512 9c74d25e18082f6238f0aa9b62be6cedb5213e52291765fe45281f0955ee2dee9c471c8d804b2069aa98df159e4e594e986dc0f3fcad81989354641c3a34426f
TLSH
T188216D96E67EE8671029086B4E09FC016FFBE8350142B0F4DA5B436C70C15F75683452
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe58e8f4.TMP

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity~RFe58e8f4.TMP
Size 1KB
SHA256 eb3ec91cf18a88c85830183c9c654594b9a5fa4e6810d7d3f1589cc32c2b5215
MD5 972a03018ba51464d41d437dd6e21fab
SHA1 2984bb42cf8c29ebe869aff9eb050f3b57f4b128
SHA512 04f5159595692723e61798d8d92968a72ea1d6d7fd0447fbba5ae84b9061120bbd7aa3de2c871e01002751eab92eb62f89a7d09e4ae9345e1a359a04ff997cd2
TLSH
T1B3217CA7E67EE4BB2028086B4E08FC026FFBE8350141B0E5CA6B436D70C15FB5687492
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 8d64a73dcd6dbd91c1e6edc533e1057cb0e890cd8f5814ef7375da545ce0a7df
MD5 069617054ebe15be4ffb566a3575e971
SHA1 543030efd8a5666da188e57e8c550e7a2ff94df3
SHA512 53374c81e57813cb86573233c9d3e1eaae41df156f7e00b2fe15af4c20c55cc6faccd4ea841dda641be1b58461354ec4fd52cf7321cf3da7cc0a0f4ebaf31aba
SSDEEP 192:st/0UalsfFZ8paWglz/S+WiSUiwUBmSqgdFMC:stcUaKIq/VIw/C
TLSH
T1F9E1B9429E6C7DB74CCBE219BA25BB12E2FA502165D04E58FBFC861C05E66DC6307C47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe592e3a.TMP

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Preferences~RFe592e3a.TMP
Size 6KB
SHA256 ef1a6a98441f23847029e54e756b0d101517391af1b3b714484ae8ef4b740d8c
MD5 da56d3af65d9021a16913275af4d322c
SHA1 12fdc9b0d3e3394160acd30a74796953a3a5cd3b
SHA512 cfc9e28860c82219774cbb701b6bd74711aba3be9ebf63f27824554eddc7940b468965d28243c6303fd2a5b179332d4c4087177d3e51936c7589a141223204c6
SSDEEP 192:st/0Ual4fFZ8paWglz/S+WiSUiwUBmSqNFM8:stcUaqIq/VIwc8
TLSH
T1B8E1A8429E7C79B74CCBE219BA35BB16E1FA102165D04E98EBFC851C09E66DC6307C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 8e08218fd7ff961b81bd31744f5b2de120bd2f11acd0f0b3901f17eda004b305
MD5 6019ebfdd34a9482da9eaa8a658d2a7c
SHA1 6f781ff28dad7105814dc78863b2666feb129e17
SHA512 28f8abd0d2c9be072606d700921b5ee9caeeb2bacf8244442476d3cb5181bb324e604a602cfc2c5e84e95e3d7ad8f941e5f4cdec12bbe23749c7eecb4ff9a387
TLSH
T1CDA0021742410511E0110BF010CD21853310592AC24312156AD0E285EC52570E529590
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e6e0.TMP

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e6e0.TMP
Size 48B
SHA256 62e680675572c261422fa935c5f6647c8ce85762b6b6991f50309b37b2d3a369
MD5 73d4ddd5de806b5543317911f575fa84
SHA1 0a4c1eceb7d67e7009b792adc856b1bfffac50fa
SHA512 08e1d8b438d07315d9d121ae2b4f7e5ad9601d5156e7800793a477eaa1dac6db1e045dc1a9dd768fcb0999fe09578fe684e7237179b17a66dc94bab7b34ad89f
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Local State
Size 1KB
SHA256 b4eb50dc0758aa2443c750ae11abf8d9a154dfa8640615c4c5c39f187f5321fa
MD5 ae54c03748f539e23d14f3800296180f
SHA1 79e623f9eb92aa6c33ab447ebf18ebe878665c15
SHA512 62c3cb6206563a78d50c3702b5d4f58840202764b4b21ccfcc0ad1dbad1482c965c18a5b992a3d26cab4ff5b02a86dad7e7c99d6c8bc81c61b20f8e2427d3753
TLSH
T13F31A7B1E8C83BB26C859A49714AFE971D70516AC121CF4CE4DD071D03DB6DCB22AE32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Local State
Size 2KB
SHA256 e6a8933a3e6ddd910dd1d3c0e663705076b304805583d57013edf99faf2f2a3d
MD5 681cf00eb87a3fa85b2d2426c2875b36
SHA1 ac1cc81d503d795acd7158fb95589b2782e70357
SHA512 51c2f38ccdaf9c998bd0905d87b5b560df58862625d2f3b66bac4171bc3164f31c08b1298e7b4f548b987c39e76052c0252580cf757551c0d902db88fad1ddb6
TLSH
T17351E772F848ABB748E28A48B94D7F229E754165D5616F48D9ED0B0C02CF69C3302D37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Local State
Size 3KB
SHA256 3330ffecc2dca64b1b1469094f635cafccea912908b463a41f7a0d9798c4d89c
MD5 5f3212c949cf70e60075224d97de180f
SHA1 980374c3fd69d80c31c992aff1b0ef0d81098b69
SHA512 d9d4ab42b83b16a1cbdfb741e5190a32b0d5a0ae77a250b4b0fdaf42dbf1cacd750e71c49921b2882acfbd8dd15d879b608329fbf64d8b6788c72a1c56a23fba
TLSH
T1A971C676E8A8A9774DE2D904B8892F16B7B54127D4917F9CD9EC0F0C02DB3D82302D17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Local State
Size 16KB
SHA256 1c7c90c444cfc5fbe42de4538b78ae5f27c61ac6c298444de7aa375bf219570f
MD5 60947e8e4baaf0a9ea9d7e5933745592
SHA1 9ee85b872c5634ca81a27b7b15ef829348d14dd3
SHA512 82e08ecf8c61ccdf31a0ad4e76fdb5458c7ba3fc81fba7060e56a962809ec5c3000c81a39647a03899c6f78fb6511c619e4e46507ff628469d269cef515277e5
SSDEEP 384:zO+aQikB+z/xvxjg/qhEUNbFsaRCaJVc9zy:N/UxvxjgC+S0aJSFy
TLSH
T10F729E2B94A83A6758B7F9057A4C4B5BDBB984A290C16EBC4EED5F0907CB7D41302D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe588f99.TMP

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Local State~RFe588f99.TMP
Size 1KB
SHA256 8393a45e60000d2f2dcbc810d1f50abd5293fa66d4412037c3e0f05c4b5b283c
MD5 82815385a03ca15c68748414f9eeb9f4
SHA1 d1caf84ef83e9febc69f57edb60dd4d11ec36946
SHA512 c7518f006e94c38456aa55a24c28178b5575514b2f770b8b82f10192087a5d2e1624ae154c05acb9e509ac2b86ea3562686db723eed71e43fe476a153a2e2bbb
TLSH
T1A62165B2D8887BF26C854949B15AFE861D70525A91108F0CE4DD0319039F9ECA226D32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/468-52-0x00007FFDB0CC0000-0x00007FFDB0CC1000-memory.dmp

Download

memory/468-51-0x00007FFDB1BC0000-0x00007FFDB1BC1000-memory.dmp

Download

memory/468-376-0x000001B549020000-0x000001B549050000-memory.dmp

Download

memory/1292-0-0x00007FF7E8230000-0x00007FF7E8AC7000-memory.dmp

Download

memory/1484-492-0x0000020C5B750000-0x0000020C5B780000-memory.dmp

Download

memory/1640-867-0x000001F72ADB0000-0x000001F72ADE0000-memory.dmp

Download

memory/1784-657-0x0000014217380000-0x00000142173B0000-memory.dmp

Download

memory/2244-131-0x00007FFDB2050000-0x00007FFDB2051000-memory.dmp

Download

memory/3840-549-0x00000175DD180000-0x00000175DD1B0000-memory.dmp

Download

memory/4468-842-0x000001205E880000-0x000001205E881000-memory.dmp

Download

memory/4468-846-0x000001205E880000-0x000001205E881000-memory.dmp

Download

memory/4468-845-0x000001205E880000-0x000001205E881000-memory.dmp

Download

memory/4468-844-0x000001205E880000-0x000001205E881000-memory.dmp

Download

memory/4468-843-0x000001205E880000-0x000001205E881000-memory.dmp

Download

memory/4468-847-0x000001205E880000-0x000001205E881000-memory.dmp

Download

memory/4468-841-0x000001205E880000-0x000001205E881000-memory.dmp

Download

memory/4468-836-0x000001205E880000-0x000001205E881000-memory.dmp

Download

memory/4468-835-0x000001205E880000-0x000001205E881000-memory.dmp

Download

memory/4468-834-0x000001205E880000-0x000001205E881000-memory.dmp

Download

memory/4616-375-0x0000016386CA0000-0x0000016386DCA000-memory.dmp

Download

memory/4616-26-0x00007FFDB2050000-0x00007FFDB2051000-memory.dmp

Download