7263f6773eabd3acd77edf4cbe23f637c2c76899f0d93082b873440071054fdb

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_52f760d7c0856edf95f3e60e01d5ce80_akira_coinminer_glassworm_rusty-stealer.exe
Size 8.6MB
Sample261030-e7sv4sv1ay
SHA256 7263f6773eabd3acd77edf4cbe23f637c2c76899f0d93082b873440071054fdb
MD5 52f760d7c0856edf95f3e60e01d5ce80
SHA1 a8fffc07c63771bb8c7749e23e8c4aac27c80cb8
SHA512 6cac9a65734fe41606effc402e778ddbc3643ba4ba82495836f62edea768e21dd756c8531f9d130430f24dfc3b379e1cb23beba0bcbea1aa079bed531584eeaa
SSDEEP 98304:+Ov1eztodNQcNAe8vKkdj8wasx9IhnsEjzJeKEx4vdXr7rChCs6eU+cV4b:+ON7kbIjzJpEWvdXrvhs6DTKb
TLSH
T1B1966B56F27940E8C86AC179C3566233FB71B85903706ADB5BA44AB52F66FD02F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-10-28_52f760d7c0856edf95f3e60e01d5ce80_akira_coinminer_glassworm_rusty-stealer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_277215062\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_277215062\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_103099469\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_103099469\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_103099469\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_277215062\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_103099469\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_103099469\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_277215062\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_277215062\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_357450603\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_103099469\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_103099469\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_103099469\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_103099469\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_357450603\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_103099469\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_103099469\ranked_dicts	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2256	msedgewebview2.exe
2256	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3820	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5708	2026-10-28_52f760d7c0856edf95f3e60e01d5ce80_akira_coinminer_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5708 wrote to memory of 3820	5708	2026-10-28_52f760d7c0856edf95f3e60e01d5ce80_akira_coinminer_glassworm_rusty-stealer.exe	89
PID 3820 wrote to memory of 4108	3820	msedgewebview2.exe	90
PID 3820 wrote to memory of 5240	3820	msedgewebview2.exe	91
PID 3820 wrote to memory of 5240	3820	msedgewebview2.exe	91
PID 3820 wrote to memory of 5240	3820	msedgewebview2.exe	91
PID 3820 wrote to memory of 5240	3820	msedgewebview2.exe	91
PID 3820 wrote to memory of 2820	3820	msedgewebview2.exe	92
PID 3820 wrote to memory of 3032	3820	msedgewebview2.exe	93
PID 3820 wrote to memory of 3032	3820	msedgewebview2.exe	93
PID 3820 wrote to memory of 3032	3820	msedgewebview2.exe	93
PID 3820 wrote to memory of 5844	3820	msedgewebview2.exe	94
PID 3820 wrote to memory of 5844	3820	msedgewebview2.exe	94
PID 3820 wrote to memory of 5844	3820	msedgewebview2.exe	94
PID 3820 wrote to memory of 5844	3820	msedgewebview2.exe	94
PID 3820 wrote to memory of 5844	3820	msedgewebview2.exe	94
PID 3820 wrote to memory of 2332	3820	msedgewebview2.exe	98
PID 3820 wrote to memory of 2332	3820	msedgewebview2.exe	98
PID 3820 wrote to memory of 2332	3820	msedgewebview2.exe	98
PID 3820 wrote to memory of 5904	3820	msedgewebview2.exe	99
PID 3820 wrote to memory of 5904	3820	msedgewebview2.exe	99
PID 3820 wrote to memory of 5904	3820	msedgewebview2.exe	99
PID 3820 wrote to memory of 2256	3820	msedgewebview2.exe	100
PID 3820 wrote to memory of 2840	3820	msedgewebview2.exe	101
PID 3820 wrote to memory of 2840	3820	msedgewebview2.exe	101
PID 3820 wrote to memory of 2840	3820	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-10-28_52f760d7c0856edf95f3e60e01d5ce80_akira_coinminer_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_52f760d7c0856edf95f3e60e01d5ce80_akira_coinminer_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5708
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-10-28_52f760d7c0856edf95f3e60e01d5ce80_akira_coinminer_glassworm_rusty-stealer.exe --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz,RemoveRedirectionBitmap --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5708.4716.15158317192712218825 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView /prefetch:4 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x168,0x104,0x7ffc3a715fd8,0x7ffc3a715fe4,0x7ffc3a715ff0
    3⤵
    PID:4108
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-10-28_52f760d7c0856edf95f3e60e01d5ce80_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1752 --field-trial-handle=1748,i,5474739401780720244,16670731163714940861,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:5240
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-10-28_52f760d7c0856edf95f3e60e01d5ce80_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2136 --field-trial-handle=1748,i,5474739401780720244,16670731163714940861,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:2820
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-10-28_52f760d7c0856edf95f3e60e01d5ce80_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2244 --field-trial-handle=1748,i,5474739401780720244,16670731163714940861,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:3032
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-10-28_52f760d7c0856edf95f3e60e01d5ce80_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=2876 --field-trial-handle=1748,i,5474739401780720244,16670731163714940861,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e /prefetch:1
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-10-28_52f760d7c0856edf95f3e60e01d5ce80_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4644 --field-trial-handle=1748,i,5474739401780720244,16670731163714940861,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:2332
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-10-28_52f760d7c0856edf95f3e60e01d5ce80_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4560 --field-trial-handle=1748,i,5474739401780720244,16670731163714940861,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:5904
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-10-28_52f760d7c0856edf95f3e60e01d5ce80_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4540 --field-trial-handle=1748,i,5474739401780720244,16670731163714940861,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2256
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-10-28_52f760d7c0856edf95f3e60e01d5ce80_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2108 --field-trial-handle=1748,i,5474739401780720244,16670731163714940861,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:2840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

17115544-eb6d-4838-b52c-1ed3358e99a8.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\17115544-eb6d-4838-b52c-1ed3358e99a8.tmp
Size 15KB
SHA256 dbe5daa70fd6dd24f0a57ebf37b8270d1a80295e7952570b549bf18339ac165d
MD5 15d50ce2d0ffd26da83079fd4ff07d95
SHA1 e2eb88850271899a9b28e52a1b7b1b5ebd33e01a
SHA512 c451a69a9fdcdcdefe2c0a2f15cde7cc3842aeae71d195fd8f5bab4a9fe321802a1408ba64e552ff8f820ca2cc8315928c8c702c0c14b3468cfc12b4d3d84a1a
SSDEEP 384:K+OBqImmJvGBLx3NaFMJF3NBSagWi9AAcbEg6rM:fcvGtlNkRcmg
TLSH
T19A729EB61C756E332CFBC609BA8A2353CB6962A3C0D57BD5DDEC9F0F516B1940342826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 fa139b6ed351c127780f7f26175accc2b002bd5cf0e5236eecc7181d674c16f8
MD5 98ce25a1261b0a7d3d61258382688e6f
SHA1 ed3c3b07616021c34bd9d8ae820029c58b41e59f
SHA512 9ee609c5ab0373503499a50cb5713a4787740d9b385f236e0e9e2d4218e02fab7fcf1a057f072a1934484590ade8a840722f32595a58ec91469972e506a510ad
TLSH
T12FD01223B2450238C0206033454271082501D15F405D8145652C855D2A1C4501903852
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c908655be017b73566a0e2317def0a8e1aea344468cc39be1941f2c23d4f0962
MD5 46e8a4ecd0c90229fcbf8dfb5956f906
SHA1 dd283b72176128c22b5f5508bf20be388c8f1c58
SHA512 9f239d4b6501a17b303c62d6c6128a4a9ffbf371e5b665aba731adefcce1c00d6f0a5d300fce4ea74105c28516674f24b80cb24c264b59204bd8b81014528b82
TLSH
T15ED00431F14C0114D010D033C55051007311D4D5007D475513140044145C4001003511
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 576B
SHA256 b3022f9e2ac7803046a9abad018fe2700650e478564b56744d27fc8ccf8d3e4d
MD5 c9e908ada981e56c26082ddf33b72d95
SHA1 106cacb3718c675b2d5bd429ac125cbdeba85505
SHA512 64c66ab7e9921a24aba4b4f57b267e5311950e0637f91b1c92d06299f9c552fb2e9c6afd87a1e2c75389c2e17b30ef5122d4ae9deb99d03a761e1ca7c4f9eaea
TLSH
T172F0264238C45CCEDFB6C2750C516CC223637A143A16132726504173A4577F9742D2B7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 b09849e69438ca92c8efc52d4af9af343bc15cbeb4009c561561a0dc31aa9e83
MD5 f6930bb55122efd022aeeb0ec74e195f
SHA1 8dc10201635fc4e0cb9480b1a06d29bd6dde00d9
SHA512 4ac613eff74198f066826808a4f6cfb0bc824f694f468fb4813896759ac34db6091100bb1c9a2d340db111420e60d932830539c83d0fc8e1225862aeff5dabbf
MD5 SHA1 SHA512

Submit Download

67ad56ef-3a92-4217-9a21-bd08e0f59476.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\67ad56ef-3a92-4217-9a21-bd08e0f59476.tmp
Size 1KB
SHA256 c3641f9efc3ed116931817bd0ac65f9afaa65c1f865f3a9208a05bc399886b83
MD5 a651c82719a20e40e043b1af68c5d1fd
SHA1 b374ab30e9190254c7d4a2a10eb71f34f6cffb3b
SHA512 cf952e5f0ff31c254a0f8cf5bd52a608436b07459ca95eb02f30204a68ad65a4017004ab4f63789e56bc880f614b94b54ef327b3ed35a4cac6095a60be83bb9a
TLSH
T1B311925799FAF87B5069897A0DC8BC153A77B431014568F8CE67822EA0918F31B57863
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 391d9eb677cd445bc7e40c34d8906ec9e8590a00494e4c65941dd4ea368851a2
MD5 274a182d4ed338430c96bf8ef96e53cb
SHA1 878d560e42103f50722889e2591a104e99e95f22
SHA512 f66d3835e81f71e4cf4c6ae28e802418baf7c090e758388e7183f146d05389c1ef15c6a134e288041f1eb885dbd3f0eda8e94404f8c0e318e7214ed39e40447c
TLSH
T1EC11925799FAF87B6069893A0DC87C053EB7B531018664F8CE17822EB0D18F31B57857
MD5 SHA1 SHA512 TLSH

Submit Download

cbf20bdc-1ab0-4454-a37e-05edbd0f054e.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\cbf20bdc-1ab0-4454-a37e-05edbd0f054e.tmp
Size 1KB
SHA256 1ad79c5a57af597d6f2b88df8b7b6a1dfe866a587ae7cb730c9d563f49c759b6
MD5 e23a85773981806862c30eae1c9e1d7b
SHA1 a3fe74ddf4826b3e46ebbbfae37254f7459421f5
SHA512 e5292ed8bb29948581a45d627ea7e7e41f0e531059866349e160d3bcc8de9728cdb36b94aba3abb66f46bba5cf8906740ddbd6871ffa296e2d800fad898d5b8d
TLSH
T19D317DA3D2B4469CEF61D1FC7A2C6D67DE1D1928036C2D9BCAC49F8BA3F1060D24470A
MD5 SHA1 SHA512 TLSH

Submit Download

d1a2cc75-0157-4373-a79e-7f04d00cc8f5.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\d1a2cc75-0157-4373-a79e-7f04d00cc8f5.tmp
Size 1KB
SHA256 d50c100a047af423b0ca951e9ac312c0043e02c1f6de8196fe1694507da5c643
MD5 3c598c626e4b787146688c45b6741707
SHA1 8dbfdf6d24e146d46d53e6b388810ee1ec2b5aeb
SHA512 948a7e31aec1fd4a6c4ec58a1f6e709e907dd60ec796f26d248917bc8ed73192bc8c015b2ae999c001808ba357951fd453c6b55deb4e2c7ef25a7d275a79f80d
TLSH
T153218EA3D2B445ADAF61D1FC7E2C6D67DE1D1528036C2D9BCAD49B9BA3F1060C14470A
MD5 SHA1 SHA512 TLSH

Submit Download

dda3da12-6d82-4d24-ba37-503c30e4f9b3.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\dda3da12-6d82-4d24-ba37-503c30e4f9b3.tmp
Size 1KB
SHA256 2e23ebcb00903c203d0a664ed0845857dc19cf20da8ec52f92a2062d97051798
MD5 28770a7f1c6b42ada8e141fd96138e1d
SHA1 3ebdf00599ff6dee9ecb265a945771e361afa0e8
SHA512 69b5e1de9dc493c6f3a9d9ee5740805a1cc260af8a4ca3308fd845e3f4dfaa1ad176b962b3587f30f32121b9bfcaa32e5d6845993a1e854c801c450da6df116b
TLSH
T1DA11C2979AFAF87B50298D360CC8BC153A76B431024564F8CE17823EB0808F30B57863
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 72B
SHA256 ffae4777f7678d0f1482960d56b4a192379d86d397dd1155b2d49dc277523ab3
MD5 4d44518a7446338c3d40530e07879073
SHA1 564b695c82be84c0c93ef21122a1614ed53922b2
SHA512 7b926cb54a0bc88e7c3f4b1818523c810422b40c50d361bb97e76bffef2a5259b28462adb579d04f7dce57d408b8a0c45194d9854918e9b17c678a69238df0b6
TLSH
T11CA0021711441119C47546F0105D15C532545B65551322014BA1E2E68D611A0E2115D5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 74d1640c1e993c3a32dac63ca7a91af038a3f8027fc5e509b22bc13a9e6bca50
MD5 56c0a2ba93e6a14d60e73b50706703e9
SHA1 9ee02c8d3e708ed8ca5a19e4c11b944421430d8b
SHA512 e62268034af53a9a2dbaa2a51bb5c30056f167e484e3932af3d9d9bb544efecaea385d88bcd8ee13151d257862b3ca1f6eacd7467b0936b7104fc4de0ff758f9
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

c03e9a32-2e30-4e09-9945-47aed8162677.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\c03e9a32-2e30-4e09-9945-47aed8162677.tmp
Size 6KB
SHA256 47b49868e504f283a9a770513011a31fa10ae2708204b2867cfa624c46dc4025
MD5 1e728e8cd9285e2e4a99325733777644
SHA1 731c5cd5b61af26ca790a2bfd86c7486b54c63a7
SHA512 307ff6acfc83e0fa070c4e7b5fb429798b028addcadd6709d3701f8d16c2659b33a4f795fe9cf1cf6b6d2530bcad339fe114c3178f5ca5eeb343c9e361470496
SSDEEP 96:stC/dca/Bbb9kkso5h16ZLglXs7/x+6MhmueciDuS1ehuLeyK+gk28XM1C7K:sta2aEHoUglXsV+FmDZQhuLyiG6K
TLSH
T10CD1A7125E28797B4CCAE219BA35BB16E2F9607175D11E98E7FC4A2C04EB6DC6307C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ea7fe75c-fc14-452c-9283-1599a04d5753.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\ea7fe75c-fc14-452c-9283-1599a04d5753.tmp
Size 6KB
SHA256 d33d8b6719f4a22a491b38f6219ccbadcb2f6abccc39ce51c2f6568b315202e5
MD5 8d96188d78d5600e02b0b344bd68c2d2
SHA1 d4b5cc82021fb358aa9c1ef345bb236e54c52a5c
SHA512 0097d261d899b7e7639ea0d03667f078d6db881aee0d211602d7d9ed9c199dee7a5e9d398f1f08cdbfeb91e7eb1a611d2018b7fcd8b3a58023e10f9737b60d09
SSDEEP 96:stC/dca/oGbb9kkso5h16ZLglXs7/x+6MhmueciDuS1ehuLeyK+go28XM1C7K:sta2aGHoUglXsV+FmDZQhuLyKG6K
TLSH
T1C2D1A7125E24797B4CCBE219BA35BB16E2F9607175D11E58E7FC4A1C04EB6DC6203807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Local State
Size 1KB
SHA256 45ad174ababd8e3fc4b1c369953b087f02def77edb996379f46072c9538743dd
MD5 7d99edb314bd85a31fd336ab7b12d393
SHA1 fa66081e7ff8d42d12f032990592d9a08d7580e4
SHA512 7017f8da2c02e4e5b7cfd198e18f701de3a183630c00d4733e13c538d311511453cd3e08cc8cc74c446df106c26a285d3444a37cab5c1759ae3d7ab337e52912
TLSH
T1042165B2AAB40F32ADC69706715736B3AE24207BD2208E1177DC4F1C52D61EC9919C37
MD5 SHA1 SHA512 TLSH

Submit Download

ed06fcdd-d024-4cf6-b452-415b5ea61a6c.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\ed06fcdd-d024-4cf6-b452-415b5ea61a6c.tmp
Size 2KB
SHA256 69a44de0b3306d92b05547c390403f2a3de8b55ba0f0bcb1d7e3f698f79ddd99
MD5 71ed718e0c5c06b1c71e52ecce10d9af
SHA1 b8aaedcc7a100e7a11fd64ce3a9900a523008943
SHA512 8e0a3541ddfd86b47f4d0328fb93667e97fea7eb94158a5516c8c10c4e38304ea438359395c157aea2055c9c455b75a27a4b6797d5177cb732568fff75027a90
TLSH
T17B51A73369206B3399E2870579873B33DE3960B6A6622F61ABDC0F0C01DB5AC1741C3B
MD5 SHA1 SHA512 TLSH

Submit Download

f8d5af8e-2d3f-4caf-a6dc-f8a42d82c3b7.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\f8d5af8e-2d3f-4caf-a6dc-f8a42d82c3b7.tmp
Size 3KB
SHA256 29123d20958eb78cd22d36a48d361d4f0beed6022c3a6647c8f36b602c891b72
MD5 8d43aac615ba89b40a52bc3c57c908e7
SHA1 33e1adbb176ccf8d32bac07b8c6da4421c40cbd1
SHA512 165e6426e0b409b30a1a41f2dcd2ee625cb2ea659227643b3b52a66c5b44d807b84aff74a74d3d5950bb7d58a15381ac836c8f25dcee75f553e65413845dc2f2
TLSH
T1BE6184376974A9374DF2DB05B8863722EBA95037E5917FA5DAEC0F0C01D72981341C27
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_103099469\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_277215062\manifest.json
Size 102B
SHA256 0ed889bea99f74fede865222f4cacca4277c63023db98efa666d42ba1f7f9502
MD5 329ad25b265a82c711c72c02a553a353
SHA1 a9a666d4182caad82edd399fdab141473670c5a7
SHA512 b81005847e76dc513b255b36704dec0ae84c922d23dc152cc42bb3eec9e18cb083e601bb90562b3f3c9b2ac540e801866f59277b9c43c0b97fd3e90b688f26c5
TLSH
T178B01220EC10B4B3000403AC0C6CC3C063372F032C4079180DE59F84E80D9DBE071E29
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_357450603\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

memory/2256-389-0x0000023E964C0000-0x0000023E964C1000-memory.dmp

Download

memory/2256-382-0x0000023E964C0000-0x0000023E964C1000-memory.dmp

Download

memory/2256-384-0x0000023E964C0000-0x0000023E964C1000-memory.dmp

Download

memory/2256-393-0x0000023E964C0000-0x0000023E964C1000-memory.dmp

Download

memory/2256-392-0x0000023E964C0000-0x0000023E964C1000-memory.dmp

Download

memory/2256-391-0x0000023E964C0000-0x0000023E964C1000-memory.dmp

Download

memory/2256-390-0x0000023E964C0000-0x0000023E964C1000-memory.dmp

Download

memory/2256-388-0x0000023E964C0000-0x0000023E964C1000-memory.dmp

Download

memory/2332-337-0x00007FFC5CA20000-0x00007FFC5CA21000-memory.dmp

Download

memory/2332-336-0x00007FFC5C1B0000-0x00007FFC5C1B1000-memory.dmp

Download

memory/5240-31-0x00007FFC5CBE0000-0x00007FFC5CBE1000-memory.dmp

Download

memory/5708-0-0x00007FF6FE510000-0x00007FF6FEDAF000-memory.dmp

Download

memory/5844-44-0x00007FFC5CBE0000-0x00007FFC5CBE1000-memory.dmp

Download