dd70ad82bc978efdf2836391eaa34a358ddf5053ae265e936673392cf3dc7b83

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 01:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_fd1bfffa68ac087e8551af5d299a60ac_akira_coinminer_glassworm_rusty-stealer.exe
Size 8.6MB
Sample261017-btejsagv2y
SHA256 dd70ad82bc978efdf2836391eaa34a358ddf5053ae265e936673392cf3dc7b83
MD5 fd1bfffa68ac087e8551af5d299a60ac
SHA1 f6f44b30685195540cb84cc873cacf81fee45413
SHA512 f7aec3cef2765ae85ef93ca5b55074fb973d73886d1d80aa98d62955ad0409e4987c8b5e1b13f28583209f6ef9a2e9a831c281ba00f34a4f297146af223b00d5
SSDEEP 98304:1Oru+NQ4ZN1P6Q0zIQMzkfQHcSwUIV/61q6eEBOKdK4xT3fZ+ALVb:1OKrMuM1q6eEoKdK4t3xXZb
TLSH
T1A1965B56F27940E8C86AC179C2566233FB71B85903707ADB5BA44AB52F66FD02F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-10-16_fd1bfffa68ac087e8551af5d299a60ac_akira_coinminer_glassworm_rusty-stealer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_2017712209\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_525692658\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_525692658\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_1624847735\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_1438707551\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_525692658\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_525692658\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_1624847735\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_2017712209\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_525692658\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_525692658\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_525692658\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_525692658\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_1624847735\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_1624847735\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_1438707551\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_525692658\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_525692658\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_525692658\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_1624847735\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_1438707551\manifest.json	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1844	msedgewebview2.exe
1844	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4248	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3832	2026-10-16_fd1bfffa68ac087e8551af5d299a60ac_akira_coinminer_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 4248	3832	2026-10-16_fd1bfffa68ac087e8551af5d299a60ac_akira_coinminer_glassworm_rusty-stealer.exe	90
PID 4248 wrote to memory of 3424	4248	msedgewebview2.exe	91
PID 4248 wrote to memory of 4344	4248	msedgewebview2.exe	92
PID 4248 wrote to memory of 4344	4248	msedgewebview2.exe	92
PID 4248 wrote to memory of 4344	4248	msedgewebview2.exe	92
PID 4248 wrote to memory of 4344	4248	msedgewebview2.exe	92
PID 4248 wrote to memory of 1832	4248	msedgewebview2.exe	93
PID 4248 wrote to memory of 4100	4248	msedgewebview2.exe	94
PID 4248 wrote to memory of 4100	4248	msedgewebview2.exe	94
PID 4248 wrote to memory of 4100	4248	msedgewebview2.exe	94
PID 4248 wrote to memory of 3068	4248	msedgewebview2.exe	95
PID 4248 wrote to memory of 3068	4248	msedgewebview2.exe	95
PID 4248 wrote to memory of 3068	4248	msedgewebview2.exe	95
PID 4248 wrote to memory of 3068	4248	msedgewebview2.exe	95
PID 4248 wrote to memory of 3068	4248	msedgewebview2.exe	95
PID 4248 wrote to memory of 2608	4248	msedgewebview2.exe	98
PID 4248 wrote to memory of 2608	4248	msedgewebview2.exe	98
PID 4248 wrote to memory of 2608	4248	msedgewebview2.exe	98
PID 4248 wrote to memory of 2976	4248	msedgewebview2.exe	99
PID 4248 wrote to memory of 2976	4248	msedgewebview2.exe	99
PID 4248 wrote to memory of 2976	4248	msedgewebview2.exe	99
PID 4248 wrote to memory of 4184	4248	msedgewebview2.exe	100
PID 4248 wrote to memory of 4184	4248	msedgewebview2.exe	100
PID 4248 wrote to memory of 4184	4248	msedgewebview2.exe	100
PID 4248 wrote to memory of 1844	4248	msedgewebview2.exe	101
PID 4248 wrote to memory of 2536	4248	msedgewebview2.exe	102
PID 4248 wrote to memory of 2536	4248	msedgewebview2.exe	102
PID 4248 wrote to memory of 2536	4248	msedgewebview2.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-10-16_fd1bfffa68ac087e8551af5d299a60ac_akira_coinminer_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_fd1bfffa68ac087e8551af5d299a60ac_akira_coinminer_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-10-16_fd1bfffa68ac087e8551af5d299a60ac_akira_coinminer_glassworm_rusty-stealer.exe --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz,RemoveRedirectionBitmap --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3832.5820.4339695901475053745 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView /prefetch:4 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffd164f5fd8,0x7ffd164f5fe4,0x7ffd164f5ff0
    3⤵
    PID:3424
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-10-16_fd1bfffa68ac087e8551af5d299a60ac_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1840 --field-trial-handle=1844,i,4549237039480065820,15537274814901394021,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:4344
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-10-16_fd1bfffa68ac087e8551af5d299a60ac_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2084 --field-trial-handle=1844,i,4549237039480065820,15537274814901394021,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:1832
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-10-16_fd1bfffa68ac087e8551af5d299a60ac_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2308 --field-trial-handle=1844,i,4549237039480065820,15537274814901394021,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:4100
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-10-16_fd1bfffa68ac087e8551af5d299a60ac_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3516 --field-trial-handle=1844,i,4549237039480065820,15537274814901394021,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e /prefetch:1
    3⤵
    PID:3068
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-10-16_fd1bfffa68ac087e8551af5d299a60ac_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2132 --field-trial-handle=1844,i,4549237039480065820,15537274814901394021,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:2608
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-10-16_fd1bfffa68ac087e8551af5d299a60ac_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4544 --field-trial-handle=1844,i,4549237039480065820,15537274814901394021,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:2976
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-10-16_fd1bfffa68ac087e8551af5d299a60ac_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4612 --field-trial-handle=1844,i,4549237039480065820,15537274814901394021,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:4184
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-10-16_fd1bfffa68ac087e8551af5d299a60ac_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4596 --field-trial-handle=1844,i,4549237039480065820,15537274814901394021,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1844
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-10-16_fd1bfffa68ac087e8551af5d299a60ac_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4592 --field-trial-handle=1844,i,4549237039480065820,15537274814901394021,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:2536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

35500818-98b5-4913-9b62-cc1d77ee1297.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\35500818-98b5-4913-9b62-cc1d77ee1297.tmp
Size 15KB
SHA256 e6ffa42d9232d5a54c3c508489875da0999d8b1618d1fefa649f3a8270b35e78
MD5 fc0c3b5ea856169166bebef4ae17fda0
SHA1 4e5a43bb472999b2380ac42003ae1d7322dc0b39
SHA512 e2749a988b3dba4354d7dd80d3b749437526b2faf49b77ece457db10f5800a675eef38a8badb7070a649013d4162ab211d177f5cf4bf3ba07871fd659052ca87
SSDEEP 384:r+OBqImmJvGBLx3NaFMJFeNBSDGWtsP8Bt0g6rI:ScvGtlNFvE8Wk
TLSH
T1D8729D3A1C756B632CE7C60AFECA2747CA712253C4E27FE1D9EC8F0E116B0941392956
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e14c091a91858c8de10d3751f77c1a6c213f3207b1f0b38b7ffa7b37f0287e00
MD5 5424732c981ca441242c9f8a8f1a7346
SHA1 ce0b3d1425e9612b62ade8b78b78d93385e6e3c6
SHA512 12281eca8bc05482557da7c519c1fa93b33f92933f11d8523b48e56678d729a0a36908d2dc671083d76dc611b88508febd0a2d7816768bff98f0da85ca3d57a6
TLSH
T10FD0122633010634C02032772403620C3500D10B400D80057428A96D1E440700912481
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ff7eeff312610d809bee225369f7b7839356f4e85d81d6b8ecfd80aec0d805e2
MD5 1cb0463be5ec1a86ae70ff89a9114714
SHA1 204948286912157bd969875c2f213305ed1ba4a5
SHA512 528e2061a5033614ef9c77846af64d4fc111236f9732ccb924620846c6edc469aaccca9ccc11ed853da1ea52f91a8925e819ae82ab61c70918ec281a3efd08b7
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Cache\Cache_Data\f_000011
Size 73KB
SHA256 b43d81ecf3cec9ca74d8cdd347b52d8dcdc41383184e14557b2f70da2517be74
MD5 8de540ced3a9ffcaace45b1123aeb87a
SHA1 0b2f408f16026f8d87fb53e1bdeec3a30173eb0e
SHA512 2600adc83e77187077d9b0956866505f632db272c468dbde4a906d8e6b0ed1a16ec2f0b9c1b550db51826c7cfd8bb3746620c372e54d8a8d759bc647c34a505b
SSDEEP 1536:zFeKKAg+ZG5442ZGw85y9p3Hifk8pXsa3dBwulB3aZi/AyDJ1CB:zFelRaG5y9p3HH8maNBrpJ1a
TLSH
T1287312F0C437DA1AC3F288FE661160C1907AE44AC2BDFB7E647C790A29BBD6A7141507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Cache\Cache_Data\f_000012
Size 121KB
SHA256 66a8e60fde4f98e7df5b80767ee8cec2d412e96d18811d74301f4c0a2c066a82
MD5 21bb61ed9f24e072ca73a27c8efa3d97
SHA1 72f4016be559ce1ea331222ecd27c4918a9fa222
SHA512 ad7bbf8c57ba1807c899aecd8cea609fd00c3b55f195be2dec4c530ca2c3874dbdaf5744e78afcc6f3de69c81f5d9f73c501aa693da75e683efd97608d2e6cf7
SSDEEP 3072:DGvigMgrcxj8vQCRW552E5VxnBThromPFLAWYBZvp5osu:G71oCRWnHVxBtLMtTosu
TLSH
T134C302B627D1BB80CB53C65FE42817E8ED65EEB4BC94D086821B3F359818A4D09F52B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 864B
SHA256 c664be7f2a4c281a5a016743fae5c333fc6d967436c515352343d330372f38a7
MD5 0bf720fbec1790f535bbf53ed4fb14de
SHA1 82b07ec93a86e26accb404d0cd9b6cfb820500c7
SHA512 8404ac13cf232c2616051253c7cb628edfab1e1da2b15fdb276f8caa3926f7ebeab9777836e2083f136141f8db3ea7a22d6ad0d42b125048536ac89440af9365
TLSH
T17111A91241C4AB03CB31B47424CCE810B6BCB28B2093FE675985B5BBD5DF7A24AB24D6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 fac41c9d04693086f26a7487c3ab9023b0500115cf649bbbbe8a10a9aece99de
MD5 3582601855dba4a46cc6322fea2d024a
SHA1 919f7137693090feec2e8e64b3bea96d7fefbf78
SHA512 48676924b0041cff4fe740b6d05d498cb4520de41f0a423919515ceedb6e68104f455dea3708ba89b4caa67cf9f484a33028a3240bede647e99be684a2adb915
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

02607516-56c3-429a-8870-c491276aa872.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\02607516-56c3-429a-8870-c491276aa872.tmp
Size 1KB
SHA256 ddcb9f9b0eb22c396630c9bf709c0aef4d403b341fa96251ce7ebd1c48f831bc
MD5 5df2ebe0391937e98e3b9560d4c77f8c
SHA1 d353bfe4dcd5d86ad5800fc6e08e7b7bbaefe786
SHA512 3a837e10a1baae6bda1ed2202468f15d9c70b095d3e8923dcce3a1283d59ad61f00485971a78868a2299f7d11a8c431b60d9ed0a393dd6be46b17f7c3898eb5d
TLSH
T10F21CEE2D4FEF43B302D0BAA0C483C012BB9B8724192B8F4DA6B826C70954F71A53433
MD5 SHA1 SHA512 TLSH

Submit Download

2d99afc3-5c65-4f99-b592-c2cac7ea860b.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\2d99afc3-5c65-4f99-b592-c2cac7ea860b.tmp
Size 1KB
SHA256 9370b102ecfde48af728f52c3c9f751dfeac07c569b9b41f4f64e581683f76a7
MD5 868fba2746fba03174952f5db10650e7
SHA1 b83f8332b5be077adf8273f8671dc57ba8be2a45
SHA512 ffb09078b97a9c26f7c949cd2e127faa6dedee40694146ff8047793aaecf78057a97bf19ac2ab179760611fca77f33ea71e98da249ba346691cfd7ffbea28ee6
TLSH
T1A3219E5695FEF47B312A4BA608487C0127BAB4B14191B8F9DA6B826CF0E54F75942432
MD5 SHA1 SHA512 TLSH

Submit Download

3af293bf-6c3d-406a-b664-018d9b06c11e.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\3af293bf-6c3d-406a-b664-018d9b06c11e.tmp
Size 1KB
SHA256 6f47c5628f3839fc18dc1e5b89b49f52506a05c76a2a204628fa607efa41c407
MD5 6a5d04aaf3322d5f52f41d8df206a7fe
SHA1 4fd74bb1a29632679fdab8abda821108451483eb
SHA512 1414cf5fded0661630a6599fe18941cec241d99fade362c470fdec753506dcf3245ed6a46f06a388eee88223d3eb4e8bfb37fa2843230523afe36788b3c40e8a
TLSH
T12B21AFD2D5FEF87A21290FAA0C447C0126B9B8754192B8F8D6AA426C70954F71A53437
MD5 SHA1 SHA512 TLSH

Submit Download

3b03e154-1de2-4ef6-97fb-e3f45fa1a9e8.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\3b03e154-1de2-4ef6-97fb-e3f45fa1a9e8.tmp
Size 1KB
SHA256 4ce0da3c526d95e1b8c0e3bd6f53c41931160d8279749d10fe3ea88a256ff8d9
MD5 ae8d069cba79f1c142b99933183b606b
SHA1 93155a6acb9566cee02e161afe488e6a0ec40b7f
SHA512 a80d416b9ecdab6d33021a09fa645fc16df831c3452a869d52f14da7b82d0ef59b3c59f249d0ed32491f5f25495b747755a77324bb51b22cf3072b852a60c045
TLSH
T1C521C192D5FEF43B302D0BAA0C443C0116B9B8714152B8F8D66A422C70954F72A57433
MD5 SHA1 SHA512 TLSH

Submit Download

4b57ad33-0c96-4554-9cef-373878268883.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\4b57ad33-0c96-4554-9cef-373878268883.tmp
Size 1KB
SHA256 8c0ff3609f37df8b688d81184a1b69bf81b08975649f64906e691bbd36eb9dac
MD5 e963ea3a7619107e7d495458054c702f
SHA1 f71b76d05697f73ca96318204025013f07e6b57e
SHA512 90c09ef13a8e581bc1e34a6aa22558ddf0aef49115c5957917742433267759e920f5f89e9265920c64f21adb0788971dd6bae02e2d24bd23d3a9f948cd7faf51
TLSH
T1C621C192E4FEF47B302A0FA60C043C0117B9B8714152B8F5D66B426C70D54F71A03432
MD5 SHA1 SHA512 TLSH

Submit Download

5128f6f7-68e7-4948-a70c-0beceaca02f7.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\5128f6f7-68e7-4948-a70c-0beceaca02f7.tmp
Size 1KB
SHA256 5f39865c5306d29a5c4295a0341226d533ca773de341a8610a358c15624f2da9
MD5 c000d9e6a2c97597bfd3445d48992a16
SHA1 f94d842f35a011bd0816a3e03a3997c53c90ea2e
SHA512 d32900a3a8f69c8f63f6a8f2311042f92cb6cd92958f040fcf2e8dce6e71a54772566ca249f354f748f9eabf682fc0525b852f76ce0d0f15dc1700d5b3f4dbb2
TLSH
T187219196A5FEF47B312A4BA60C447C0517B9B8714192B8F5DA6B426C70D54F71943432
MD5 SHA1 SHA512 TLSH

Submit Download

58288b4a-6b0b-4b53-9b5c-2d8ebe7e6c4f.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\58288b4a-6b0b-4b53-9b5c-2d8ebe7e6c4f.tmp
Size 1KB
SHA256 7d8a185b22a88506de201c18cdc782257b566c66f878437f0569c8617be47f93
MD5 6560081afdacaadb938e3b9bb9b84d12
SHA1 f4ac7bf4fa1110cebf48bc58d8cf566cbd9fe02b
SHA512 362e415d124ebccf96730e7441578e886643a022ec1718233663e2f763427e8a7aa37971cd563672d7817f43d621855b918d4a0f936f04ae4c08c6e6aabb57ff
TLSH
T161219196A5FEF47B312A0BA60C487C0527B9B8714152B8F9D66B426CB0D54F75943432
MD5 SHA1 SHA512 TLSH

Submit Download

5c7bed4d-b9a5-46fe-a9bc-c08d57f8dd24.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\5c7bed4d-b9a5-46fe-a9bc-c08d57f8dd24.tmp
Size 1KB
SHA256 f60b581bef7130b93bc95e4ce89369db9bf0d225038eb2e94f58079130ef4c99
MD5 46311b39ad526ea149fe5590a03cdcc2
SHA1 cd18d1bb4393b481bbc69a6cd0ab3d7df81909ed
SHA512 5ceb0858deff02f047a5d7832b9d96ec09e18d1858a8730768f43d7d97b58c2915a12f4899d78044493bebae970280fbdfa80b15a90d7708d506cbdfb4e90067
TLSH
T18021CEE6D5FEF43B302D0BAA0C487C012BBAB8714192B8F4DA6A422C70954F75A53437
MD5 SHA1 SHA512 TLSH

Submit Download

5e5d3848-bef0-4ea1-a217-3a72721179eb.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\5e5d3848-bef0-4ea1-a217-3a72721179eb.tmp
Size 1KB
SHA256 04409854d74dc70226c2e933f9c6dc79cd6c8ff9ac73dd396bb9ac2b0fc32dde
MD5 0df003669469d9645ecfd8aed2c37048
SHA1 82d93a7b4388f44b4b9d7ab642366020fdb437d1
SHA512 fa9a219b3188b9b54e228a01b9cbeb50a4877435b2affc56fb48795914756cdba954872bf80b0347372f60c7982e30b8f0258b0c52545308a9606c9016a85811
TLSH
T1C821C1A2D4FEF43B312D0BAA0C487C0117BAB8B14192B8F5D66B422C70954F75A53433
MD5 SHA1 SHA512 TLSH

Submit Download

675dc170-716e-48da-b89d-43fc703e4050.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\675dc170-716e-48da-b89d-43fc703e4050.tmp
Size 1KB
SHA256 225e001e66ee1b3543476326dcf9c724e21389bd246e77b5eb87bfb3a92023d2
MD5 188c3bf38019fd325bf33aa19b8ba46f
SHA1 41534203f4784d5bb4dc54c2fa242251f5d08ff1
SHA512 e44f1b4af9bbd2d8fad3b955c927bc8cf6b0fad59dce70a9262797936fe04ec14541e518a9fbff0c6fc65c49732e94042d08b6c462afd90576a1344816cc8b31
TLSH
T18D21C1E2D4FEF43B302D0BA60C443C0116B9B8718192F8F8D6AA422C70954F72A53433
MD5 SHA1 SHA512 TLSH

Submit Download

73274bdc-7e00-463c-8fcd-3d704d6f6852.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\73274bdc-7e00-463c-8fcd-3d704d6f6852.tmp
Size 1KB
SHA256 28656926b0871e7be24a50fc347c08c90feb264f7bf7554b98a38780a7b2d3c5
MD5 488391eb34706afc12aaf31eddf1717d
SHA1 d5bbbd967d2332b6fc0a4afa58765563730c9466
SHA512 b4a48bbb86a16b69880c05021375272c69cbb5decc13f6ce679716775f212b1e1f77cbbb9a1fbba64e5f7214e9f312028b0bed8268bec15a5596afa0867f7f6d
TLSH
T17A21AFD295FFF43A30290BA60C443C0116B9B8714152B8F8D66A422C70D54F72A53437
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 55dd1266d5d8db4113ed155edd2022c3d2c721e8f649a406d25f8e030d6b4cd2
MD5 6026fade04d4dd6e3b451509cfa44adc
SHA1 1bb7f3a3a225f74221414c3ed222d7237ff1b2a2
SHA512 78895120d745aed877fe9e1c2e6b9ae1d2c3861cc0cc97177fe15e96931838d4285d50eceb1560cdb2b839e7328219033a8cc3c27a56271a76f6cedbd2008148
TLSH
T158219E5685FEF43B322A0BE70C487C0126BAB4F14155B8F9EA6A827C70954F31E42436
MD5 SHA1 SHA512 TLSH

Submit Download

bae7a3aa-b0de-4d36-a3b3-0bda5329bb06.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\bae7a3aa-b0de-4d36-a3b3-0bda5329bb06.tmp
Size 1KB
SHA256 054452d63a189a85bdd91b9929a601d579169866f700acf8ed80dcdfef02fdb3
MD5 2ca6faacd8bd0f8a999b107a943e3931
SHA1 1152e6836c302cf6444c58575068fce3dc783ef3
SHA512 7963df8dc6ea04ac8195264d072cb6e42e01e20b77198481aa93977146bfcbb955958a2204a524feadb8231023c8ac31daff3fabfa0ebebccfc84cdc2f38c7c9
TLSH
T133218EB3D2B446ADAF62E2FD7B1C6D278E191524136C3D4BCAD49B8BA3F1060D14460A
MD5 SHA1 SHA512 TLSH

Submit Download

e71f2c5f-3e48-46d2-9dfa-7e633c152d0a.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\e71f2c5f-3e48-46d2-9dfa-7e633c152d0a.tmp
Size 1KB
SHA256 2473c55bd85e3c7b283846d42456d3ee2f8d6f75ee29e1722cd428c887d1ce45
MD5 cffff93a1ce5868bc1e440950b1ccd16
SHA1 c8af90b712972515028f7ed794c8fcbf2964fc75
SHA512 b825128bcc4aa683bf51a65d50a959e4a15e9a46b91fb1bb61f0898c78cc593e28fd7de8eda62d798fb8126a5e68cc7eb7bfdc62093c3ee766204d4658355362
TLSH
T1FB21CEA2D5FEF43B302D0BAA0C443C012AB9B8714192B8F8DA6A422C70954F72A57433
MD5 SHA1 SHA512 TLSH

Submit Download

f461efa7-b9ac-44b1-94f6-b0cb532a7610.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\f461efa7-b9ac-44b1-94f6-b0cb532a7610.tmp
Size 1KB
SHA256 6efd117327ee42eda6afac5e9aca5006b0e0e17b52c1588f03b3c2a74a5c52d3
MD5 61ce286b5e9e7f6942de612f28df636f
SHA1 f2df9806e325cbab93ef021b4b1c78ee3674ff46
SHA512 6bbc7606088d29472a393ebe702ca2724e4f2e0ecc4bcd4f7b402a9d52501a35ab9b70c5b2399368515682d7fad5889458831ec6d04d96968ca103e9ad9014c8
TLSH
T1FE219E5695FEF43B312A1BAB08487C016BBAB8B14151B8F9DA6B826CB0954F71943432
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 72B
SHA256 d17531f6f906b809963e62c249305d8966ad02e79fe78bc688498ed315f5e903
MD5 5e9b27023e9946ed1a56c7005a5dbe62
SHA1 1f8df4e8c9ca318795e9d316571a057c02813403
SHA512 488a55182776377fb7da888403f0ad0901e965e6b3f136a942c0e7071028b2bb216d85121928201ddef147e4099c53cce38a1560238eeab17415bb12ba673c54
TLSH
T140A0023702541122D01002F0158D46CD2714993B564356074A90F295AC51190E112541
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 d104bd03b007f47e0d278fa5f7f31202cd9bda186e9b148b80f771a0912cac9f
MD5 fbf9e17d3bb4f996aa01f162f77e0846
SHA1 f852f9b8b0a03fed5161877936a366dc39a8cd6e
SHA512 9cebad74860d0ff2ceec7c14f5e6a1d8f7ff89c229bd2cd154546c35991f72b62cdf95864cc60a84c4f982d504e98d063e8cd9f85bb6247f7f8507d013677559
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

a62a685c-a133-41f6-9ce3-5afafa5c4b48.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\a62a685c-a133-41f6-9ce3-5afafa5c4b48.tmp
Size 6KB
SHA256 531f66e4083e0902415d0a3f103e2cccbd3534d71a9d978d5120dd62cc05e18d
MD5 466d4d93e7645a467c88fcc6947732c8
SHA1 4f15f13a7b3bafa762d9bdb1f4e827ae5c36d7bb
SHA512 dffb4a38f49a1051eb9bb91084b3c3b341f038bafcedcf5e599ce0ae9715b9baf0e56813bd3ff0cd701e7ca205659105377fc51bc2d89390996beea592cb4d59
SSDEEP 192:stw2ahTid6oUglbsV+FQnTQheBVgB+G6K:stw2alid5sGMQ/oK
TLSH
T163D1A4025E347ABB4CC6E219FA24BA17E2F95432B5D11E48EBFC462C14FB6DC6207807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd73261b-4b04-4e8a-aa63-385a78d74794.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\cd73261b-4b04-4e8a-aa63-385a78d74794.tmp
Size 6KB
SHA256 ed2d0e932f1c44295fbf5c59a4b67c34af9554e172f308d5e0b57912b8624749
MD5 e25dff40ed22f0663a4d7ff63580df54
SHA1 1855ce95c33ee0934f63ea66af206a3766570e38
SHA512 3ad9684d525ed1de713546e8b7d1be2689a80bf66490f941fa4077da8b7b66cd16b3336f54a80c2573f2e04d4f7ec191215983cea0ff13bdabdd423cfd372fdc
SSDEEP 192:stw2ahhid6oUglbsV+FQnTQheBVg3+G6K:stw2a7id5sGMQxoK
TLSH
T16CD194025E347ABB4CC7E619FA24BA13E2F55472B5D12E48EBFC461C14EB6DC620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Local State
Size 1KB
SHA256 e3bd67aafa39c1c2e990d4cc891c344a3deaa0e4084e11b5f14755a5db8978e6
MD5 f411e431fed4e7f7131e42492f82c147
SHA1 11017ecb9f1e12a1a05c08549428110fe815be61
SHA512 b34354cb6dc0499a5d5f43eec409d26475512d61cfa3c8b45a8289f96791b3bb49f61da5d978ce4810e2031f34dd8ef6df9d516b37cf517def464441be273d1c
TLSH
T18C218772E8B82FB3AC92674762937E176E70507BD5510F0091DCCB0801F319C625AC33
MD5 SHA1 SHA512 TLSH

Submit Download

af39487c-1a28-45fc-965a-853243719383.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\af39487c-1a28-45fc-965a-853243719383.tmp
Size 2KB
SHA256 30a3f1f2c83f4bd9a402ce069a1ef8d9b9900f9ccc6f3df47d86397da070e4e0
MD5 49980149b3c1134e548118e0aa47fb69
SHA1 6d5fd67c8c83b670a011d9233764be5a092be171
SHA512 31d9477fb1e85437a0defefb937b3ce0bf65159ff8ee7c59f80c1143970aae0c5c377124a2adc042678d386e7cd4048a0dd67f199756594645cfb247bedce903
TLSH
T1FF5175336C78AFB789A35B05B9873F229E769166E9A22F1096DC4B0801E755C2341C77
MD5 SHA1 SHA512 TLSH

Submit Download

ceda6f73-4b01-4ee6-999d-99ee10804f66.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\ceda6f73-4b01-4ee6-999d-99ee10804f66.tmp
Size 3KB
SHA256 69bbfd05b44785f8feea0fad32ef80aec65fd800291fc9c2f8695796be8a4a3d
MD5 df4bd7ee93bd16b0493928e1a1949a07
SHA1 67531009d6f893e585517aa2af1f2f777e6bad76
SHA512 776174cd2aa492c26772c9fd356d63a48c0b41d025c5713d72ac164117b71bea6d929a7d91ec6169a15cf6ed11f2262a643cd7c019b1666af8fc79a158246a94
TLSH
T1346153366DB8AE774EB39B05B9863B16ABA55127E9D13F54C6EC0F0C01E72982341C27
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_1438707551\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_1624847735\manifest.json
Size 102B
SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
MD5 19322c8a94f1ac01a70f8c58cdbbc720
SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
TLSH
T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_2017712209\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_525692658\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1844-545-0x0000026004600000-0x0000026004601000-memory.dmp

Download

memory/1844-546-0x0000026004600000-0x0000026004601000-memory.dmp

Download

memory/1844-547-0x0000026004600000-0x0000026004601000-memory.dmp

Download

memory/1844-549-0x0000026004600000-0x0000026004601000-memory.dmp

Download

memory/1844-548-0x0000026004600000-0x0000026004601000-memory.dmp

Download

memory/1844-550-0x0000026004600000-0x0000026004601000-memory.dmp

Download

memory/1844-539-0x0000026004600000-0x0000026004601000-memory.dmp

Download

memory/1844-541-0x0000026004600000-0x0000026004601000-memory.dmp

Download

memory/2536-581-0x000001F703FC0000-0x000001F703FEA000-memory.dmp

Download

memory/2536-570-0x000001F703FF0000-0x000001F703FF1000-memory.dmp

Download

memory/2608-393-0x0000021B40EC0000-0x0000021B40EEA000-memory.dmp

Download

memory/2608-384-0x00007FFD38680000-0x00007FFD38681000-memory.dmp

Download

memory/2608-385-0x0000021B40EF0000-0x0000021B40EF1000-memory.dmp

Download

memory/2976-430-0x000001AE55BF0000-0x000001AE55BF1000-memory.dmp

Download

memory/2976-465-0x000001AE55BC0000-0x000001AE55BEA000-memory.dmp

Download

memory/3068-113-0x00007FFD38790000-0x00007FFD38791000-memory.dmp

Download

memory/3068-310-0x0000017B22050000-0x0000017B220C4000-memory.dmp

Download

memory/3832-0-0x00007FF7E61A0000-0x00007FF7E6A37000-memory.dmp

Download

memory/4184-513-0x0000022782CC0000-0x0000022782CEA000-memory.dmp

Download

memory/4184-496-0x0000022782CF0000-0x0000022782CF1000-memory.dmp

Download

memory/4344-28-0x00007FFD38790000-0x00007FFD38791000-memory.dmp

Download