d239cbd25bd4e6326dcbdbf26dd3c28099879f717fcf0015b5bdc7c32e2e6802

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 18:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-30_bbe6cb21de9598787b3e60b90bf857b2_akira_coinminer_glassworm_rusty-stealer.exe
Size 8.6MB
Sample261030-w67fjsfv9m
SHA256 d239cbd25bd4e6326dcbdbf26dd3c28099879f717fcf0015b5bdc7c32e2e6802
MD5 bbe6cb21de9598787b3e60b90bf857b2
SHA1 50cc4ae7a69a1ddf69f709948c807a4e97312507
SHA512 897821f405e776a198a2e74a5bd83295d0be048ae6f9f97ef1316ed6ececfbb85820caa668c9de95c9b4b404ee9e93393f50bb3ebbee11f9354b2cf8be231a9c
SSDEEP 98304:pOru+NQ4ZN1P6Q0zIQMzkfQHcSwUIV/61q6eEBOKdK4xT3fZ+ALVb:pOKrMuM1q6eEoKdK4t3xXZb
TLSH
T15A965B56F27940E8C86AC179C2566233FB71B85903707ADB5BA44AB52F66FD02F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-10-30_bbe6cb21de9598787b3e60b90bf857b2_akira_coinminer_glassworm_rusty-stealer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 20 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_1040137585\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_99239244\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_1769296039\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_1769296039\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_1769296039\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_1040137585\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_1040137585\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_99239244\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_1769296039\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_1769296039\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_1769296039\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_1040137585\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_99239244\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_1769296039\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_99239244\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_99239244\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_1769296039\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_1769296039\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_1769296039\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_1769296039\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4424	msedgewebview2.exe
4424	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1688	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5880	2026-10-30_bbe6cb21de9598787b3e60b90bf857b2_akira_coinminer_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5880 wrote to memory of 1688	5880	2026-10-30_bbe6cb21de9598787b3e60b90bf857b2_akira_coinminer_glassworm_rusty-stealer.exe	89
PID 1688 wrote to memory of 1660	1688	msedgewebview2.exe	90
PID 1688 wrote to memory of 4708	1688	msedgewebview2.exe	91
PID 1688 wrote to memory of 4708	1688	msedgewebview2.exe	91
PID 1688 wrote to memory of 4708	1688	msedgewebview2.exe	91
PID 1688 wrote to memory of 4708	1688	msedgewebview2.exe	91
PID 1688 wrote to memory of 2168	1688	msedgewebview2.exe	92
PID 1688 wrote to memory of 4276	1688	msedgewebview2.exe	93
PID 1688 wrote to memory of 4276	1688	msedgewebview2.exe	93
PID 1688 wrote to memory of 4276	1688	msedgewebview2.exe	93
PID 1688 wrote to memory of 2068	1688	msedgewebview2.exe	94
PID 1688 wrote to memory of 2068	1688	msedgewebview2.exe	94
PID 1688 wrote to memory of 2068	1688	msedgewebview2.exe	94
PID 1688 wrote to memory of 2068	1688	msedgewebview2.exe	94
PID 1688 wrote to memory of 2068	1688	msedgewebview2.exe	94
PID 1688 wrote to memory of 4672	1688	msedgewebview2.exe	98
PID 1688 wrote to memory of 4672	1688	msedgewebview2.exe	98
PID 1688 wrote to memory of 4672	1688	msedgewebview2.exe	98
PID 1688 wrote to memory of 2312	1688	msedgewebview2.exe	99
PID 1688 wrote to memory of 2312	1688	msedgewebview2.exe	99
PID 1688 wrote to memory of 2312	1688	msedgewebview2.exe	99
PID 1688 wrote to memory of 4424	1688	msedgewebview2.exe	100
PID 1688 wrote to memory of 4260	1688	msedgewebview2.exe	101
PID 1688 wrote to memory of 4260	1688	msedgewebview2.exe	101
PID 1688 wrote to memory of 4260	1688	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-10-30_bbe6cb21de9598787b3e60b90bf857b2_akira_coinminer_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-30_bbe6cb21de9598787b3e60b90bf857b2_akira_coinminer_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5880
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-10-30_bbe6cb21de9598787b3e60b90bf857b2_akira_coinminer_glassworm_rusty-stealer.exe --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz,RemoveRedirectionBitmap --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5880.3152.10234797369377419646 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView /prefetch:4 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0xac,0x7ff8a0035fd8,0x7ff8a0035fe4,0x7ff8a0035ff0
    3⤵
    PID:1660
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-10-30_bbe6cb21de9598787b3e60b90bf857b2_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1800 --field-trial-handle=1804,i,8937268622914763298,5348065730643795076,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:4708
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-10-30_bbe6cb21de9598787b3e60b90bf857b2_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2232 --field-trial-handle=1804,i,8937268622914763298,5348065730643795076,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:2168
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-10-30_bbe6cb21de9598787b3e60b90bf857b2_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2404 --field-trial-handle=1804,i,8937268622914763298,5348065730643795076,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:4276
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-10-30_bbe6cb21de9598787b3e60b90bf857b2_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3464 --field-trial-handle=1804,i,8937268622914763298,5348065730643795076,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e /prefetch:1
    3⤵
    PID:2068
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-10-30_bbe6cb21de9598787b3e60b90bf857b2_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4716 --field-trial-handle=1804,i,8937268622914763298,5348065730643795076,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:4672
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-10-30_bbe6cb21de9598787b3e60b90bf857b2_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4720 --field-trial-handle=1804,i,8937268622914763298,5348065730643795076,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:2312
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-10-30_bbe6cb21de9598787b3e60b90bf857b2_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4720 --field-trial-handle=1804,i,8937268622914763298,5348065730643795076,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4424
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView" --webview-exe-name=2026-10-30_bbe6cb21de9598787b3e60b90bf857b2_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=816 --field-trial-handle=1804,i,8937268622914763298,5348065730643795076,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:228dc5f1559e1bb1bb357b5136a1bf542d52c49e
    3⤵
    PID:4260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1a312585-7327-4aca-afcf-033d9ca9b771.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\1a312585-7327-4aca-afcf-033d9ca9b771.tmp
Size 2KB
SHA256 bf2f6c12c0f6b17764896b029a35bc5cd62818df98371adaa586b73a90c53f93
MD5 065d85be9f7b1088b7ceef2a91d3a0f9
SHA1 2e7417ba4ef48271adb5d3012eb9e715f13fa43a
SHA512 12d7bbcd714846fad482b915464e43828e9bc1130c8048db0c1d00027fe66ddf4b4b84295ebf792b44c99a1fe34950a997b65ed55862aa71e696506061a051f0
TLSH
T12C51A833AD14BF3789E28614790A7B23DF799192E6923F94A6ED0B0C01D714C1346C37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ffed320e11600f0da28a5ba25439cd94b06f9e13740372ad83bce1476e82c2e6
MD5 c713642f39872565c69daabef1710b46
SHA1 978c7dcc3550d191b8ddbb912e054c027c899090
SHA512 903a4ccfc67b8b8209690ba658aebb313fb477550042fc96dac56990b992b20dbf89b1942f7664c5cde53f6de238eee081d73c40d06714290ac85f0cef94b3eb
TLSH
T14AD0122333918274C01039330103A5481440C12F80054040F4ED855F2E080500D02451
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f87e9130714180a5752da8d7b1fae3e5ef2dab658c309da0a2d78357259d8e3b
MD5 197e968c7922b9f88521ab0c85fcb919
SHA1 bb7f345c2dfd2f4839086ffce0e306283e97eb87
SHA512 85818dad122f924ef51de6465231fee69ca93770ce1faf2a96eb3dffb0cd156b149fd3559876bbbbc9c9e129d8cb1a020eb6fafb7315167d627e254cdeb66948
TLSH
T185D0047153D0D140D1443D370111C5505154443450111150F0DD00471C440000401010
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

0127ff99-67d9-4199-9ff8-96d906cff550.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\0127ff99-67d9-4199-9ff8-96d906cff550.tmp
Size 6KB
SHA256 490272eae01fdc2e4b802a664ea46e5b9f19787cdbabeb329003b157576c977e
MD5 3b425aa721aa2dd7ecaa058018a5cc90
SHA1 787162831675e18d58258d03e11229c597cc34df
SHA512 7a535c6e531a13aec33f0ac0b7fae7cfca0213e8268f3291214a93e1999814eebd825aee2c61dcd468275079cbd9dab764a0d74fd063894c9512e8af853b505a
SSDEEP 96:stA/dcae1Gpb9pkFEo5h16ZLgl1s7/x+6Mhmuec8Xa41ehD8elK+gC28XM1C7K:st02aBVoUgl1sV+FQXa4QhD83YG6K
TLSH
T1B6D1A7026E647D7B4CCBE118BA25BA17E2F9503275D11E98FBFC492C04DA6DC6207D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e327c60-d082-42ab-95fc-897f7cc74403.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\9e327c60-d082-42ab-95fc-897f7cc74403.tmp
Size 6KB
SHA256 d3b5c27392b491cd39bca824058732f81f0593ba3b61e64622315bfff6becacc
MD5 37525b9c6e12d28c8756aea8af9f50ab
SHA1 a775b8ce5a2b85df302408bc0afe194ae7dacef5
SHA512 3ecaef6f90fdca13c8e8e2ba6b45bd8e1d3550926963b2dcb73c32d6222148542b0556ffdd8b4cf9aa035d3854b7e93b0384395fe4b7e9e0a02fc4d313198cec
SSDEEP 96:stA/dcaeupb9pkFEo5h16ZLgl1s7/x+6Mhmuec8Xa41ehD8elK+gp28XM1C7K:st02abVoUgl1sV+FQXa4QhD83DG6K
TLSH
T158D1A7026E247D7B4CCAE118BA25BA16F2F9503275D11E98FBFC4A2C04D66DC6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Cache\Cache_Data\f_000011
Size 73KB
SHA256 b43d81ecf3cec9ca74d8cdd347b52d8dcdc41383184e14557b2f70da2517be74
MD5 8de540ced3a9ffcaace45b1123aeb87a
SHA1 0b2f408f16026f8d87fb53e1bdeec3a30173eb0e
SHA512 2600adc83e77187077d9b0956866505f632db272c468dbde4a906d8e6b0ed1a16ec2f0b9c1b550db51826c7cfd8bb3746620c372e54d8a8d759bc647c34a505b
SSDEEP 1536:zFeKKAg+ZG5442ZGw85y9p3Hifk8pXsa3dBwulB3aZi/AyDJ1CB:zFelRaG5y9p3HH8maNBrpJ1a
TLSH
T1287312F0C437DA1AC3F288FE661160C1907AE44AC2BDFB7E647C790A29BBD6A7141507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Cache\Cache_Data\f_000012
Size 121KB
SHA256 66a8e60fde4f98e7df5b80767ee8cec2d412e96d18811d74301f4c0a2c066a82
MD5 21bb61ed9f24e072ca73a27c8efa3d97
SHA1 72f4016be559ce1ea331222ecd27c4918a9fa222
SHA512 ad7bbf8c57ba1807c899aecd8cea609fd00c3b55f195be2dec4c530ca2c3874dbdaf5744e78afcc6f3de69c81f5d9f73c501aa693da75e683efd97608d2e6cf7
SSDEEP 3072:DGvigMgrcxj8vQCRW552E5VxnBThromPFLAWYBZvp5osu:G71oCRWnHVxBtLMtTosu
TLSH
T134C302B627D1BB80CB53C65FE42817E8ED65EEB4BC94D086821B3F359818A4D09F52B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 864B
SHA256 c59f4b815379e1a379bffd1d0d036642f8249bae8dafc3531b12e0f9f8d84c7c
MD5 8a4c8b6ca440e71c35146a6453ace707
SHA1 6fbf99b82e84ee5029174d068078fda5ae850626
SHA512 cdce71332344dde458513fe3c98f053c553497ceba17c6b55cb13cd6eea52942b423c21fdeae0c5135285d0958af8b80eb8e23d4f5a1eb5f7292a90e86354e28
TLSH
T1A811C91EC5C140C0CB1440310FE0BF02B9B242DBA1831E0320429EB8DD0FB804DF30B9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 4defb94799f201d6547ac2b2b087bd6f472eac87765075552ff83ed51e056c3a
MD5 adc7a18f4dbea70692691121b404e299
SHA1 d4eaa1b000e79f26c3ae16700acddb9a6f871d7b
SHA512 22fe96a61e49858a39b4aefc9665ff72e7647bae237fb448147c369849b27e137f479a064ba01c9b98b58738152d12734dbc4d0180d768a02a9099721bbfcd1a
MD5 SHA1 SHA512

Submit Download

0821b023-d8c8-4eb1-a22f-f26fabe7f5c4.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\0821b023-d8c8-4eb1-a22f-f26fabe7f5c4.tmp
Size 1KB
SHA256 d5ea0920ec3e96ff03cb3407bd5f4f815a02c11803dbb353e808d93f4e4100f0
MD5 f1b763815db1d2f61e39d83cd85e8b43
SHA1 382e1955b593acea09d6e690dad36831eba63154
SHA512 a596baf20f1eeb80de3f4b14f426d451f529dc5353a49bd4eb810ba81b52592d2402dd98aeb9ff1fa481c62bee9665e8abb79bc75ce1bc1b13c7183663d9625e
TLSH
T13F219A56967FB87B602909B71C49B8056E7AF437419150F5EA56432C70824FB1A07457
MD5 SHA1 SHA512 TLSH

Submit Download

351fbfaa-29ba-46ee-8574-a364c28255f9.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\351fbfaa-29ba-46ee-8574-a364c28255f9.tmp
Size 1KB
SHA256 26af537763caa6531dce248b537133bf726f332ecb48a3c0467453a3072214e1
MD5 07d179e9fcdf3c397ce56a68c82be6c1
SHA1 590a8a9dffccc23ee7000d505134f09c40f82224
SHA512 78e02561a11d77864017b65706ae92df94ee3cf201d7483dde37c595b7574107ad3e9c77ec3443bfab740dbb1bf9d0bfc6b4921b4a50a6f87732ad5f1b1218a8
TLSH
T10E21AC579A7FB87F602909B71C89B8056F7AF437409150F5EB1A432C70825FB1A07417
MD5 SHA1 SHA512 TLSH

Submit Download

49b74d07-d8ee-48f1-8c5f-eb78840a9844.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\49b74d07-d8ee-48f1-8c5f-eb78840a9844.tmp
Size 1KB
SHA256 d4b2847acc9e122189bede90f13178acd749087430f1d5f1101739b8ad431a37
MD5 29b38164e54b9cf59c4999c1308da76e
SHA1 4d4699ebf4beb3ca75ffed83d9ae16b3c945ebbb
SHA512 f189300c65025fd28cf288cc6b19618191e36b88b7a89e39581cfeed1ee8f648a15fa5e5e1d5464381131e43b8acb6c791f3b98d350ce1389d57b0516a4e5191
TLSH
T180219AA3DA7AB87F642D09B70C05B8057ABAF837009150E1EB17432C71921B72A07816
MD5 SHA1 SHA512 TLSH

Submit Download

51ce00ad-5a6b-42e0-98b8-55138184d54a.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\51ce00ad-5a6b-42e0-98b8-55138184d54a.tmp
Size 1KB
SHA256 eaf0d46afed646f5f77889845c9969cb14b1eb710f97c4e032a6a146ca34ae27
MD5 b9067cf975822c2a6ce0bff2b825c883
SHA1 3033c7bd410e4da7ffc1bbd676e76012c8c11e20
SHA512 4333a802ac2f0cde88461c38a7dbe561b1fa9aa24025af9413eafd22cf27007227d6c4598e26b5e1a598c758128206b3b46e551cbda5d78a62617064eec8920f
TLSH
T1AF219A56967FB8BF702909B71C49B8056E7AF4374091A0F5EA1A432C70825BB1A07817
MD5 SHA1 SHA512 TLSH

Submit Download

719931aa-d863-4576-9007-98e75e8539e6.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\719931aa-d863-4576-9007-98e75e8539e6.tmp
Size 1KB
SHA256 af882f1c76c84e256b98be9dd1bc780c864770336869bb4b88d216d6a300efde
MD5 a1b91826d15f96b57b3dc1c9c068ad01
SHA1 ef19551f7f4c8147ec2ac0ed397cc574665edfea
SHA512 9c68ab233556ab17577e49fc3cd84dd6f97ab75c269eb9baed5995d8658beb58c034affc6536c8d004c3a4572be4dbe3ecebfaae40e4a20276af18b3bf5c1637
TLSH
T1BE21A9579ABFB87B602D09B71C49B8096FBAF4374191A0F5EB5A432C70824FB1A07817
MD5 SHA1 SHA512 TLSH

Submit Download

95e4699f-86d7-4759-983b-278883870388.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\95e4699f-86d7-4759-983b-278883870388.tmp
Size 1KB
SHA256 db3f5cc754b8bbe85a22137f134b31205cb249e6de4548bfc7a2d7ded39917ca
MD5 1fb625323fe467cd18f3cd0c5a4cfa0b
SHA1 d1d3195b0d09c3119e75ca038cdc998e274cb38e
SHA512 77be9cfe6b68d285d132f405ceb9997cc37129fe7c6f7b4255b933a8b6e0270bbb98053d2face8823ed2c28a19f330dfbe8f7336c24879b46dac0079f5d80872
TLSH
T1F82170B3D2B445ADAF62D2FC7B1C2D27DF191524036C2E5BCAC49F9BA3F1060C144A0A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 2cf2c981cc97a4e90b64a73b3e95ab52a9ef2da5ea5dee9fdc9669406d3e61b9
MD5 41d199e8ea4c10495deca4431c0cb8bf
SHA1 7f0eeb3ef15be275aba64b1508ec354ddf4df361
SHA512 ad798a4a8fdcf2b101b45cc0e641fb75a7badbe624d6404475553c8463bea6831d8ec14678b3323e2fbbb675083a412072b68a9a7a99962965e33214b774c26a
TLSH
T12F21CEA3D5BFB87F603908B70C49B8057F7AF53600A190F1EA1B432C70825F71A07416
MD5 SHA1 SHA512 TLSH

Submit Download

a85dc5ba-736d-450c-b64b-1637e80212ef.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\a85dc5ba-736d-450c-b64b-1637e80212ef.tmp
Size 1KB
SHA256 55d4fcb32aaaeb9c989401a5bc94665cab0fce90eef7a43bbc4bd9f979d3a654
MD5 5dc8638730a2c4bd9d4e113af7c76399
SHA1 bdbad5a8e76c8d7103e850afd76441af959fdf65
SHA512 0b68fe1d28f0b52f6e4eb155964b74aa6b281554c075d5e49f918450904b0b343a23a7267c7fdc9d7172f47fadc6b3df7143cc8274304703daced1bcabe768ef
TLSH
T19921A9579A7FB87F602909B71C49B8056FBAF4374091A0F5EA5A432CB0824FB1A07817
MD5 SHA1 SHA512 TLSH

Submit Download

a8e5cd65-0aa3-49e4-a44d-e9ae2f02af41.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\a8e5cd65-0aa3-49e4-a44d-e9ae2f02af41.tmp
Size 1KB
SHA256 c6ce7e084fd3169aa07561cec86c9f24f481367f2f938d6956480846d6636c64
MD5 a461a0bed6c57a8d7997d2cf59acbbe9
SHA1 088b5382d7922dd14a460b29ed09c38ff7f0225f
SHA512 a8420e510fc8b31ec0be8309ce397edd71c690c3befc1e16a84710460353e29d9001f3652b1ee46de1ddb2c65f29a4c4ec04b37b563fffd7f871ed1d73629763
TLSH
T17B21AC579A7FB87F612909B71C49B8056F7AF437409150F5EA5A432C70824FB1A17817
MD5 SHA1 SHA512 TLSH

Submit Download

c3bb4e8e-7f32-4fb8-b822-f11c2543c547.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\c3bb4e8e-7f32-4fb8-b822-f11c2543c547.tmp
Size 1KB
SHA256 8a028145fb23f1123807f1b3ed00cc23733326f724e84912a3269d2bc323057d
MD5 7f1c9ace5869e2da1f7119a538410fce
SHA1 b462c26a2449abb28b6a4f343024cb2ddea1196d
SHA512 f8c16a5c104691be3091b6c434ebe0fb6a215d1b51f495073c16f2da7a7c21d0552b1094e810670e2ae18054d4e7569afa6c5879f8ba4bfae6909717020fd802
TLSH
T10921AC57967FF8BB603909B71C49B8056FBAF837419160F5EA56432C70828FB1A07427
MD5 SHA1 SHA512 TLSH

Submit Download

cbf7750f-6589-46ad-b6ea-3a68aa124bfb.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\cbf7750f-6589-46ad-b6ea-3a68aa124bfb.tmp
Size 1KB
SHA256 e682cd2efee02e3b89b533738aa2bf4f322054b7162f8bbec78acb41eee37162
MD5 830777d698d6bb3706722a5e05fad585
SHA1 f9ee6a763f591f55be5205579531c8e70df3e5d2
SHA512 3adc7331db202c9a179f8bdd9cc1681a0d8f42d9724b50e4627cd4f79f71565267a9344f967495df8752c07455125cb882fdeaccb4ef797c7a1cba4019a3d04f
TLSH
T19A219A56967FB87F603909B71C49B8056F7AF437409150F5EA16432C70824FB1A07417
MD5 SHA1 SHA512 TLSH

Submit Download

ce72a03b-dc54-4328-a477-0911b30ce288.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\ce72a03b-dc54-4328-a477-0911b30ce288.tmp
Size 1KB
SHA256 7ede77f39fb373739e5bd08fbea03b14af6bbde1dcf811a0a857b5cdddab8d78
MD5 4613a68d7d694c413b5ca54b4e1eee18
SHA1 51d4e9362b07d63e45a6315c359a963d8feeb240
SHA512 04806b363c935b09145a3cc19ba7e5c5fcb12178eb685185b2937f6274b187ab7dd37e702ef0cd710a09e6eeeeda0a73f51c178c5b14be9a24403741f8b7a8c4
TLSH
T1C12197569A7BB8BB612909B71C49B8056FBAF4374091A0F5EA1A432CB0864FB1A07817
MD5 SHA1 SHA512 TLSH

Submit Download

d7da4399-a1e9-4291-aee1-6c8efe93d277.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\d7da4399-a1e9-4291-aee1-6c8efe93d277.tmp
Size 1KB
SHA256 987b8d93ed33703c4db2c8dfc41efaf58fd11c1eba27aed2fc3a9d7db3801962
MD5 3a796f2826c9782e1338535b93d487e2
SHA1 b7b43ae0856c44b8f98ebb77ea033bb5cd4c025d
SHA512 5bfe2097336e053ac2b8d1be5f91681fa73dc797b3233416bf3d15a6741c774bea49004880a2b4988e3d4a6953a26bc218d53542c7ad4b0ae89c657ed032afaf
TLSH
T1482197569A7BB87F603909B71C49B8056EBAF8374191A0F5EA1A432CB0825BB1A07817
MD5 SHA1 SHA512 TLSH

Submit Download

eaf2986b-0b87-420b-a4a4-c951fa08d9b3.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\eaf2986b-0b87-420b-a4a4-c951fa08d9b3.tmp
Size 1KB
SHA256 e2133c622cdda884e6540d8a6c47e28ef2e3e8759d12b59717c6af221f52b96c
MD5 664a1aafff8aae62fe3dca95662f0547
SHA1 e2315b41578e83e802fdca5b3a68364a095a9d33
SHA512 24cd89900a02e4e4539e806dfc45a849755b681a5e631d5d35ac82d048e391e7897050c728207108be0366f3680ab4356e3e6e766735ad4eddaee7a3d17a9434
TLSH
T1D021AC57967FB87F602909B71C49B8056F7AF437409190F5EB1A432C70824FB1A07417
MD5 SHA1 SHA512 TLSH

Submit Download

f4d8ab73-afc6-4ac1-b603-c1aa627a794d.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Network\f4d8ab73-afc6-4ac1-b603-c1aa627a794d.tmp
Size 1KB
SHA256 62a24da412920824bd0b6be47233f287e498c712715bcc1aa1eff440a1cec2a6
MD5 9a152a399f9a7b1214b3e2c9ce634e57
SHA1 8f8aa423dcaf8599e27e6571c9d0cbe4abb9f9ab
SHA512 34554d75c5f158efcc19a8efd62a451ee781b7d4a9ce59fdc789b0742d5fdd005f684794b8f2c301e90b6a4f052d5d827c64993f34dc021e1ae29609efbcb70d
TLSH
T171216A96DA7BB87F642D09B71C45B9056EBAF837405150E1EB16832C70925F71A07416
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 72B
SHA256 d53b29dce28410166fc18b2f62ff123f6dcfc29ed9a9610aa3a5eb23df228bfe
MD5 e7052fc76b14c4e95f6ac1b721d1ffd0
SHA1 e1167f4e4e528f2da561990a1cd74e30f8faa991
SHA512 a49773e67545db5caa6b6c7c9bc2e5abc0fddba09a12f9457c0f252144fb82940a8fd311eb97b9aed6ee7304438fb435db013970ba7e648f8db5f96770bdd18b
TLSH
T13BA0026B01405551D41106F0255D138433555A35460B12024A91F2AA8C51194F916540
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 7f023df87cc874c79998c088cf1a0eabfcc49a4e7957e5707c5d7afc38469cf2
MD5 3f9e4513bab122df265b121dd8bd656e
SHA1 19a8592eb8af847ba664ae680b382cb90771cbed
SHA512 e7c635924134a19c57376bc567f667fae81ce9b4b630518d9544ca813e0cf07b852a910dbddac87866e59885423b5e9cd16ffb62c9cd733bf6f5a2d5966ca7a7
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\shared_proto_db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\Local State
Size 1KB
SHA256 147e842a83b51967ddef9f4a4d5c1f93b74f277fa3be31775af51856c3e3b6c8
MD5 96ea74941ae8e9ed4eb6c73d5d8b2328
SHA1 4436471d40d986f3754862f2e40f047b61ae2086
SHA512 6f647c877920389d79825ffe4fc4bf56bcc930a35d6b2168568205a1e849b2c299aafdcfdb28db6bf7ec667fa60a60bc83af44a57980132e9c299848f1a8233f
TLSH
T15B217773E9A8AF336D9666553206B767AF3050A7D1529F4472ED4B1C02D310CE66EC33
MD5 SHA1 SHA512 TLSH

Submit Download

a9dc6bdd-6680-4989-ad20-2e19833c47c1.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\a9dc6bdd-6680-4989-ad20-2e19833c47c1.tmp
Size 15KB
SHA256 911d42bcdb9532ff9014d09eb7e8fa2248a904f497c8130bba3b3f8efa28dd75
MD5 44aefdcecad223e074671497c4eb8619
SHA1 e2ebeae0492314d8119b858f689f01ff66c92a2b
SHA512 63d3d833eef028743f128fd92288d3bdc71027d2ec2ca82bf4e8a83d997d347692d71d502a8d5587ea51b35cac3a4bd3a5afb0ac7ce7be57e429292fdbc525e8
SSDEEP 384:2+OBqImmJvGBLx3NaFMJFxNBSAumRzDg6rY:jcvGtlNykzJs
TLSH
T13372AE772C756E272CEBC509BA8D2747CB696293C0D07BD8EDEC9F0E416B0841352D56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b867ba8f-521e-455c-8171-9974b969247e.tmp

Path C:\Users\Admin\AppData\Local\pro.orion-security.launcher\EBWebView\b867ba8f-521e-455c-8171-9974b969247e.tmp
Size 3KB
SHA256 023fe1c8ce2f89e99c047a046fc2d6d7fc9ee666791e37cf89d2e9273d0e01f3
MD5 b02a8713f4799e1bfd881f3caac8acb4
SHA1 b7d0c7c4ca779a4cc209783b6f7ee65916fff41b
SHA512 1d082125431d57a760512f43e6742d90a974c2701b7d37f74a6d44a2e4c111ae0ce3f2c2342e0c6f708520e3cb8460e802c8cb5b294c72b01ae654b0f486680d
TLSH
T189616337A974AE3B4EE2DA0479462B16F7B95163E5953F98D6EC0F0C01D728C1342C17
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_1040137585\manifest.json
Size 108B
SHA256 8d58f4f4ef20dff6cd1c27243ddbe12d50713f2cf8bb22ba73696bbb04b36f4c
MD5 8e9357dbfee2ec0378af047a76d0b453
SHA1 794f8cce8fbea87b2b62162769bee35c319ebfa0
SHA512 85b5f52013803198e6af0ba37c9c3c66ce4bed4df5a7ee86ca1fc7c3658e2c973e92eed88fd36864d4743db44ad81fda7b24e70ef7530212e85b12c13d5db29d
TLSH
T1E2B012A13C007DBB1DCD03760060E3D783B63E0A1659190006DB6D422A4C9FB137253F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_1769296039\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1688_99239244\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2068-92-0x00007FF8C1240000-0x00007FF8C1241000-memory.dmp

Download

memory/4424-484-0x00000235ACE80000-0x00000235ACE81000-memory.dmp

Download

memory/4424-480-0x00000235ACE80000-0x00000235ACE81000-memory.dmp

Download

memory/4424-481-0x00000235ACE80000-0x00000235ACE81000-memory.dmp

Download

memory/4424-485-0x00000235ACE80000-0x00000235ACE81000-memory.dmp

Download

memory/4424-483-0x00000235ACE80000-0x00000235ACE81000-memory.dmp

Download

memory/4424-482-0x00000235ACE80000-0x00000235ACE81000-memory.dmp

Download

memory/4424-476-0x00000235ACE80000-0x00000235ACE81000-memory.dmp

Download

memory/4424-474-0x00000235ACE80000-0x00000235ACE81000-memory.dmp

Download

memory/4672-391-0x00007FF8C1470000-0x00007FF8C1471000-memory.dmp

Download

memory/4672-390-0x00007FF8C1240000-0x00007FF8C1241000-memory.dmp

Download

memory/4708-28-0x00007FF8C1240000-0x00007FF8C1241000-memory.dmp

Download

memory/5880-0-0x00007FF602C70000-0x00007FF603507000-memory.dmp

Download