hxxps://github[.]com/SpikeHD/dorion/releases/download/v7[.]0[.]1/Dorion_7[.]0[.]1_x64_en-US[.]msi

Analysis

geolocation tags

brbrazilsouth-america
user interaction
yes
max time kernel
92s
max time network
95s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
07/11/2026, 14:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/SpikeHD/dorion/releases/download/v7.0.1/Dorion_7.0.1_x64_en-US.msi
Sample261107-rh24pscw21

Score

7^/10

defense_evasion discovery persistence ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1992	Dorion.exe

Loads dropped DLL 1 IoCs

pid	Process
3828	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Dorion.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
77	raw.githubusercontent.com
78	raw.githubusercontent.com
82	discord.com
83	discord.com
85	discord.com

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Dorion\extension\manifest.json	msiexec.exe
File created	C:\Program Files\Dorion\Uninstall Dorion.lnk	msiexec.exe
File created	C:\Program Files\Dorion\Dorion.exe	msiexec.exe
File created	C:\Program Files\Dorion\extension\dnr-rules.json	msiexec.exe
File created	C:\Program Files\Dorion\extension\background.js	msiexec.exe
File created	C:\Program Files\Dorion\injection\shelter.js	msiexec.exe
File created	C:\Program Files\Dorion\icons\icon.ico	msiexec.exe
File created	C:\Program Files\Dorion\updater.exe	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{C1E443C0-6643-4E46-9647-3FC726480387}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{C1E443C0-6643-4E46-9647-3FC726480387}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e58b841.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58b83f.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C1E443C0-6643-4E46-9647-3FC726480387}	msiexec.exe
File created	C:\Windows\Installer\e58b83f.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBA43.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Dorion.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Dorion.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009cd1cdb4fed612370000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff0000000027010100008838019cd1cdb40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050dc000000ffffffff000000000700010000e841019cd1cdb4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4de0000000000000005000000ffffffff000000000700010000486a6f9cd1cdb400000000000090d4de000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea719cd1cdb400000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe

Modifies registry class 39 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\discord\DefaultIcon\ = "\"C:\\PROGRA~1\\Dorion\\Dorion.exe\",0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\discord	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C344E1C346664E46974F37C62843078\Language = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3718455638-2296795630-1576855121-1000\{00E4C161-28DC-41C3-849F-60C0C4D7DFC2}	msedgewebview2.exe
Key created	\REGISTRY\MACHINE\Software\Classes\discord	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C344E1C346664E46974F37C62843078\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C344E1C346664E46974F37C62843078\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C344E1C346664E46974F37C62843078\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C344E1C346664E46974F37C62843078\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\discord\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\discord\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0C344E1C346664E46974F37C62843078\External	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C344E1C346664E46974F37C62843078\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C344E1C346664E46974F37C62843078\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3718455638-2296795630-1576855121-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\discord\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0C344E1C346664E46974F37C62843078\ShortcutsFeature = "MainProgram"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C344E1C346664E46974F37C62843078	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C344E1C346664E46974F37C62843078\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C344E1C346664E46974F37C62843078\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\discord\ = "URL: protocol"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0C344E1C346664E46974F37C62843078\Environment = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C344E1C346664E46974F37C62843078\PackageCode = "69386D1D221709041AFABA87566525F6"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C344E1C346664E46974F37C62843078\SourceList\PackageName = "Dorion_7.0.1_x64_en-US.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C344E1C346664E46974F37C62843078\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C344E1C346664E46974F37C62843078\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\discord\shell	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C344E1C346664E46974F37C62843078\Version = "117440513"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\discord\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\discord\shell\open\command\ = "\"C:\\PROGRA~1\\Dorion\\Dorion.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0C344E1C346664E46974F37C62843078	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0C344E1C346664E46974F37C62843078\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C344E1C346664E46974F37C62843078\ProductName = "Dorion"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C344E1C346664E46974F37C62843078\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D89A64C52C793E457A43FF3FA5538716\0C344E1C346664E46974F37C62843078	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\discord\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C344E1C346664E46974F37C62843078\ProductIcon = "C:\\Windows\\Installer\\{C1E443C0-6643-4E46-9647-3FC726480387}\\ProductIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D89A64C52C793E457A43FF3FA5538716	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C344E1C346664E46974F37C62843078\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Dorion_7.0.1_x64_en-US.msi:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2472	msiexec.exe
2472	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4548	msedgewebview2.exe
4548	msedgewebview2.exe
4548	msedgewebview2.exe
4548	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1764	firefox.exe
Token: SeDebugPrivilege	1764	firefox.exe
Token: SeDebugPrivilege	1764	firefox.exe
Token: SeShutdownPrivilege	2052	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2052	msiexec.exe
Token: SeSecurityPrivilege	2472	msiexec.exe
Token: SeCreateTokenPrivilege	2052	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2052	msiexec.exe
Token: SeLockMemoryPrivilege	2052	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2052	msiexec.exe
Token: SeMachineAccountPrivilege	2052	msiexec.exe
Token: SeTcbPrivilege	2052	msiexec.exe
Token: SeSecurityPrivilege	2052	msiexec.exe
Token: SeTakeOwnershipPrivilege	2052	msiexec.exe
Token: SeLoadDriverPrivilege	2052	msiexec.exe
Token: SeSystemProfilePrivilege	2052	msiexec.exe
Token: SeSystemtimePrivilege	2052	msiexec.exe
Token: SeProfSingleProcessPrivilege	2052	msiexec.exe
Token: SeIncBasePriorityPrivilege	2052	msiexec.exe
Token: SeCreatePagefilePrivilege	2052	msiexec.exe
Token: SeCreatePermanentPrivilege	2052	msiexec.exe
Token: SeBackupPrivilege	2052	msiexec.exe
Token: SeRestorePrivilege	2052	msiexec.exe
Token: SeShutdownPrivilege	2052	msiexec.exe
Token: SeDebugPrivilege	2052	msiexec.exe
Token: SeAuditPrivilege	2052	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2052	msiexec.exe
Token: SeChangeNotifyPrivilege	2052	msiexec.exe
Token: SeRemoteShutdownPrivilege	2052	msiexec.exe
Token: SeUndockPrivilege	2052	msiexec.exe
Token: SeSyncAgentPrivilege	2052	msiexec.exe
Token: SeEnableDelegationPrivilege	2052	msiexec.exe
Token: SeManageVolumePrivilege	2052	msiexec.exe
Token: SeImpersonatePrivilege	2052	msiexec.exe
Token: SeCreateGlobalPrivilege	2052	msiexec.exe
Token: SeCreateTokenPrivilege	2052	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2052	msiexec.exe
Token: SeLockMemoryPrivilege	2052	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2052	msiexec.exe
Token: SeMachineAccountPrivilege	2052	msiexec.exe
Token: SeTcbPrivilege	2052	msiexec.exe
Token: SeSecurityPrivilege	2052	msiexec.exe
Token: SeTakeOwnershipPrivilege	2052	msiexec.exe
Token: SeLoadDriverPrivilege	2052	msiexec.exe
Token: SeSystemProfilePrivilege	2052	msiexec.exe
Token: SeSystemtimePrivilege	2052	msiexec.exe
Token: SeProfSingleProcessPrivilege	2052	msiexec.exe
Token: SeIncBasePriorityPrivilege	2052	msiexec.exe
Token: SeCreatePagefilePrivilege	2052	msiexec.exe
Token: SeCreatePermanentPrivilege	2052	msiexec.exe
Token: SeBackupPrivilege	2052	msiexec.exe
Token: SeRestorePrivilege	2052	msiexec.exe
Token: SeShutdownPrivilege	2052	msiexec.exe
Token: SeDebugPrivilege	2052	msiexec.exe
Token: SeAuditPrivilege	2052	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2052	msiexec.exe
Token: SeChangeNotifyPrivilege	2052	msiexec.exe
Token: SeRemoteShutdownPrivilege	2052	msiexec.exe
Token: SeUndockPrivilege	2052	msiexec.exe
Token: SeSyncAgentPrivilege	2052	msiexec.exe
Token: SeEnableDelegationPrivilege	2052	msiexec.exe
Token: SeManageVolumePrivilege	2052	msiexec.exe
Token: SeImpersonatePrivilege	2052	msiexec.exe
Token: SeCreateGlobalPrivilege	2052	msiexec.exe

Suspicious use of FindShellTrayWindow 19 IoCs

pid	Process
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
2052	msiexec.exe
2052	msiexec.exe
1992	Dorion.exe
1992	Dorion.exe
1992	Dorion.exe
1992	Dorion.exe
1992	Dorion.exe
1992	Dorion.exe
1992	Dorion.exe
1992	Dorion.exe
1992	Dorion.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
1992	Dorion.exe
1992	Dorion.exe
1992	Dorion.exe
1992	Dorion.exe
1992	Dorion.exe
1992	Dorion.exe
1992	Dorion.exe
1992	Dorion.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1764	firefox.exe
1992	Dorion.exe
1992	Dorion.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 1764	2776	firefox.exe	84
PID 2776 wrote to memory of 1764	2776	firefox.exe	84
PID 1764 wrote to memory of 2364	1764	firefox.exe	85
PID 1764 wrote to memory of 2364	1764	firefox.exe	85
PID 1764 wrote to memory of 2364	1764	firefox.exe	85
PID 1764 wrote to memory of 4244	1764	firefox.exe	86
PID 1764 wrote to memory of 4244	1764	firefox.exe	86
PID 1764 wrote to memory of 4244	1764	firefox.exe	86
PID 1764 wrote to memory of 4244	1764	firefox.exe	86
PID 1764 wrote to memory of 2524	1764	firefox.exe	87
PID 1764 wrote to memory of 2524	1764	firefox.exe	87
PID 1764 wrote to memory of 2524	1764	firefox.exe	87
PID 1764 wrote to memory of 2524	1764	firefox.exe	87
PID 1764 wrote to memory of 3764	1764	firefox.exe	88
PID 1764 wrote to memory of 3764	1764	firefox.exe	88
PID 1764 wrote to memory of 3764	1764	firefox.exe	88
PID 1764 wrote to memory of 1084	1764	firefox.exe	89
PID 1764 wrote to memory of 1084	1764	firefox.exe	89
PID 1764 wrote to memory of 1084	1764	firefox.exe	89
PID 1764 wrote to memory of 1084	1764	firefox.exe	89
PID 1764 wrote to memory of 3064	1764	firefox.exe	90
PID 1764 wrote to memory of 3064	1764	firefox.exe	90
PID 1764 wrote to memory of 3064	1764	firefox.exe	90
PID 1764 wrote to memory of 3064	1764	firefox.exe	90
PID 1764 wrote to memory of 212	1764	firefox.exe	91
PID 1764 wrote to memory of 212	1764	firefox.exe	91
PID 1764 wrote to memory of 212	1764	firefox.exe	91
PID 1764 wrote to memory of 212	1764	firefox.exe	91
PID 1764 wrote to memory of 4764	1764	firefox.exe	92
PID 1764 wrote to memory of 4764	1764	firefox.exe	92
PID 1764 wrote to memory of 4764	1764	firefox.exe	92
PID 1764 wrote to memory of 4764	1764	firefox.exe	92
PID 1764 wrote to memory of 1220	1764	firefox.exe	93
PID 1764 wrote to memory of 1220	1764	firefox.exe	93
PID 1764 wrote to memory of 1220	1764	firefox.exe	93
PID 1764 wrote to memory of 1220	1764	firefox.exe	93
PID 2472 wrote to memory of 3828	2472	msiexec.exe	104
PID 2472 wrote to memory of 4464	2472	msiexec.exe	111
PID 2052 wrote to memory of 1992	2052	msiexec.exe	114
PID 1992 wrote to memory of 4548	1992	Dorion.exe	115
PID 4548 wrote to memory of 4132	4548	msedgewebview2.exe	116
PID 4548 wrote to memory of 3856	4548	msedgewebview2.exe	117
PID 4548 wrote to memory of 3856	4548	msedgewebview2.exe	117
PID 4548 wrote to memory of 3856	4548	msedgewebview2.exe	117
PID 4548 wrote to memory of 4600	4548	msedgewebview2.exe	118
PID 4548 wrote to memory of 4156	4548	msedgewebview2.exe	119
PID 4548 wrote to memory of 4156	4548	msedgewebview2.exe	119
PID 4548 wrote to memory of 3628	4548	msedgewebview2.exe	120
PID 4548 wrote to memory of 3628	4548	msedgewebview2.exe	120
PID 4548 wrote to memory of 3628	4548	msedgewebview2.exe	120
PID 4548 wrote to memory of 4932	4548	msedgewebview2.exe	121
PID 4548 wrote to memory of 4932	4548	msedgewebview2.exe	121
PID 4548 wrote to memory of 4932	4548	msedgewebview2.exe	121
PID 4548 wrote to memory of 4496	4548	msedgewebview2.exe	122
PID 4548 wrote to memory of 4496	4548	msedgewebview2.exe	122
PID 4548 wrote to memory of 4496	4548	msedgewebview2.exe	122
PID 4548 wrote to memory of 5740	4548	msedgewebview2.exe	123
PID 4548 wrote to memory of 5740	4548	msedgewebview2.exe	123
PID 4548 wrote to memory of 5752	4548	msedgewebview2.exe	124
PID 4548 wrote to memory of 6680	4548	msedgewebview2.exe	128
PID 4548 wrote to memory of 6680	4548	msedgewebview2.exe	128
PID 4548 wrote to memory of 6680	4548	msedgewebview2.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/SpikeHD/dorion/releases/download/v7.0.1/Dorion_7.0.1_x64_en-US.msi"
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/SpikeHD/dorion/releases/download/v7.0.1/Dorion_7.0.1_x64_en-US.msi
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27100 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2072 -initialChannelId {9decdc6f-4940-4be3-9fe6-b16229ed7bb9} -parentPid 1764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1764" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2488 -prefsLen 27136 -prefMapHandle 2492 -prefMapSize 270279 -ipcHandle 2500 -initialChannelId {72981c14-15b6-4f3d-933b-c42d8c9af61c} -parentPid 1764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:4244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3864 -prefsLen 25164 -prefMapHandle 3868 -prefMapSize 270279 -jsInitHandle 3872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3880 -initialChannelId {1540945a-87bb-4c5e-82f9-f70592f551f3} -parentPid 1764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4028 -prefsLen 27277 -prefMapHandle 4032 -prefMapSize 270279 -ipcHandle 4104 -initialChannelId {8b79f4e9-c6e3-48f4-9bfb-19320d31772d} -parentPid 1764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1764" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1552 -prefsLen 34776 -prefMapHandle 1612 -prefMapSize 270279 -jsInitHandle 3096 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3208 -initialChannelId {4906ac7c-c73d-4343-ac20-93a5cd35e9d4} -parentPid 1764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5024 -prefsLen 34906 -prefMapHandle 5028 -prefMapSize 270279 -ipcHandle 3056 -initialChannelId {75f08817-e43b-44d8-8da1-865eca0affa4} -parentPid 1764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5264 -prefsLen 32845 -prefMapHandle 5260 -prefMapSize 270279 -jsInitHandle 5252 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5360 -initialChannelId {e3ed5613-d168-4bfb-a8df-740a535dc47c} -parentPid 1764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5520 -prefsLen 32845 -prefMapHandle 5272 -prefMapSize 270279 -jsInitHandle 5268 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3268 -initialChannelId {d915d0cf-c9ad-4679-86ca-5c9239ec5567} -parentPid 1764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5512 -prefsLen 32845 -prefMapHandle 5508 -prefMapSize 270279 -jsInitHandle 5504 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5560 -initialChannelId {087057c4-ef2e-4694-8104-f46f346c80e1} -parentPid 1764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1220

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\Dorion_7.0.1_x64_en-US.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Program Files\Dorion\Dorion.exe
  "C:\Program Files\Dorion\Dorion.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Dorion.exe --webview-exe-version=7.0.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --embedded-browser-webview-enable-extension --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1992.4060.6590408096257935437
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4548
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff88d53b078,0x7ff88d53b084,0x7ff88d53b090
      4⤵
      PID:4132
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --webview-exe-name=Dorion.exe --webview-exe-version=7.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1832,i,4067299260747163902,11933648529372803535,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1828 /prefetch:2
      4⤵
      PID:3856
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --webview-exe-name=Dorion.exe --webview-exe-version=7.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1948,i,4067299260747163902,11933648529372803535,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:3
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --webview-exe-name=Dorion.exe --webview-exe-version=7.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2144,i,4067299260747163902,11933648529372803535,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:8
      4⤵
      PID:4156
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --webview-exe-name=Dorion.exe --webview-exe-version=7.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3404,i,4067299260747163902,11933648529372803535,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
      4⤵
      PID:3628
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --webview-exe-name=Dorion.exe --webview-exe-version=7.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --extension-process --renderer-sub-type=extension --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4280,i,4067299260747163902,11933648529372803535,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
      4⤵
      PID:4932
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --webview-exe-name=Dorion.exe --webview-exe-version=7.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4484,i,4067299260747163902,11933648529372803535,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:1
      4⤵
      PID:4496
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --webview-exe-name=Dorion.exe --webview-exe-version=7.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=6060,i,4067299260747163902,11933648529372803535,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
      4⤵
      PID:5740
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --webview-exe-name=Dorion.exe --webview-exe-version=7.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=6044,i,4067299260747163902,11933648529372803535,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
      4⤵
      Modifies registry class
      PID:5752
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --webview-exe-name=Dorion.exe --webview-exe-version=7.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4832,i,4067299260747163902,11933648529372803535,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:1
      4⤵
      PID:6680

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 524934DCD36FC0CB0F9B840BE5DC3E6D C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3828
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4464

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1344

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x430 0x244
1⤵
PID:5972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58b840.rbs

Path C:\Config.Msi\e58b840.rbs
Size 12KB
SHA256 d3a7d36ce57d10c305ce59883f99cc73307c287bcc3bed327176e7f9758b83c9
MD5 82a157ec8242ae809b15c6fd397a9aef
SHA1 d305c02c718ba580ce3e1be933d87a8c163cc5a2
SHA512 8f9a17fd1a9371e928c019476cb472ea6348f06bd9240b31c71b7dfbdacbc9ec6d5722ef9bc81f468ce9cd4e044c5fb58bbda71c4b68f2250b56150738074a05
SSDEEP 192:ZEXv7GkKtSxwgXcbYtZtcgnz4deZrbzKaGnKaX2bNUxLezCqekUefMwWeLiNj2yY:ZivSkuSxwgXcUtZtcEz4OKxKpom
TLSH
T189424003BB01C2C2F5A707B0DF032B543BB2D2DCC315AB0B05DD99646E567D65FAAA4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dorion.exe

Path C:\Program Files\Dorion\Dorion.exe
Size 20.2MB
SHA256 a369178600db931ba584b63ed3a88c5e9dec4f2eed1f87ca4450f2b1c4951091
MD5 910460a6c8ddd2e9ef314e3d74d24ae7
SHA1 8663568aec59716595e558fc83b6b6245c4d443f
SHA512 d5888e48008e342356297e4723dad7b304fc56da5e6d86f71fff0ccf023e19700f4cec24437d43654d6cc0d8528138102a70cb765faee4ad2654dc5a5dbb1034
SSDEEP 98304:gfDG3PePLiEJsjsFQx6eWEhqloNtLOM1kILrDo5/caSwXwL99ylbf+ZNNVS0i+WZ:YfJsSo6eRx1kUS/caSwX8ZNNVSrF
TLSH
T17127F6217A5B99ACD19AC87083468A721E6130DB1B36B9FF44D452393F6DBF46F38318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.js

Path C:\Program Files\Dorion\extension\background.js
Size 885B
SHA256 1b4368ab5b4f68a873b0ebb032fc28969ae128745d3fca2c46450f223ad91e02
MD5 1c14b14559385dc7734b3155c1d830d4
SHA1 2d735c4c109760f11b0a7f9b9df127e1e57a9e67
SHA512 3bfe6c869df37afc121b5968f9db0144f0e483b457f2e2ad2d3da6399dcca5fd87edecfcda10a69ba2d077d8ad76aeb5d6ece124bec171c7bc967073bf858d2b
TLSH
T19D1100AF1C92811911F14B65CB13CBCAEB342C3E6272A1AC355C8AAA17F02C5465DBCD
MD5 SHA1 SHA512 TLSH

Submit Download

dnr-rules.json

Path C:\Program Files\Dorion\extension\dnr-rules.json
Size 327B
SHA256 056079f5522a15e72a1651640f7db320f7adbfecdde0692356a2b637f5bf3957
MD5 e35d273c4f6caa59d846acd305193b88
SHA1 6a1d5379ae8353a9d21d1ccfe1d2e4f32b589efd
SHA512 ef16938935070edc8e484bd495c701a7bafdcd16726b39daf1515602b701a9f33c86e211247f4738b1d97da03fc2edbf1a6fca1c9737d8fd0cb557ac4eba1961
TLSH
T1E3E01237C9596D3702F66338D0A55605E4B0430B6650451F3DBC405E5FB12655A45F4E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\Dorion\extension\manifest.json
Size 637B
SHA256 24d30380215fedd44f1c287fe006f38522fc174c12fec7397e72f6c86cad316f
MD5 487b689d22c19d74786eb517d1ca18aa
SHA1 98f98b5870ffbba0c19dde5be91f9ef1fe16cf02
SHA512 daab422151ebbf4ac07b4d146f15f96c5ebe32bcbe28b75710c6ec146857ee64d888289d6dd257b02ce9412c879e2304661cb09baf6dc0db470c8d04dad4d189
TLSH
T132F0F433C884193699B89B25EE350242F731074F51A41C5FB57E506D0F712B3816AF0D
MD5 SHA1 SHA512 TLSH

Submit Download

Dorion.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dorion\Dorion.lnk
Size 1KB
SHA256 fb033a8c77eb6f43b7edc72149dda42dabf288464ada3f632eada3750db54ef7
MD5 beb6fc7efd4491fc662782fa6e8fd8aa
SHA1 7f7b3d70573fef240b7e67b7f58fb645e59f63ac
SHA512 06f2358a8f3a09eea221de7975e1f8a85c38cb29af59108490c817838cf81c89073b39c00fd5e5c6b6c1c8cafb75e4d0f4fc055e4c20b7afb83b35bbcfc3495f
TLSH
T14441C12197E50796F2B103BA9D2255116B72BC16F9244F3BC1C5454C45B44019AE4F3F
MD5 SHA1 SHA512 TLSH

Submit Download

~orion.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dorion\~orion.tmp
Size 1KB
SHA256 d79ebf03aded90f946d935793a131eefc32f3e5e666ac1654f010f32b841bc90
MD5 7d61d91390ef755d1f58af9e04656ce2
SHA1 b23ec41150abcec243926eaa6476b65e9cc96d81
SHA512 dd72d41a18571706d402503f2ca395e227316b8d7b8ec9f33601dbdc4c8d03ed043860038362401ec32deb5e4ed61a8623c8cc1b1993a7863faa1bafea56f3a9
TLSH
T18F41CD2197F54796F3B203BAAD265A126B72BC16F9244F3AC1C5458C55B84009AE8F3F
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jikkdvu4.default-release\activity-stream.contile.json
Size 4KB
SHA256 363ae41643c5462b5e26b2e335587ffc23f02bbc6a32dd0c71e5c7b9e3ca2965
MD5 efd0736bde2d5f0dc3c0560c13470585
SHA1 40bccc6f0f9f2deb2f6c6caa7c27e9185d72e43e
SHA512 afdf1696adb0494e93356f9e396a218b7d33f2faea9e50f487ce40298edaa3797bab07230213b39a907dade958a2ec9d0a1956817e11221572b5e178a730d6a9
SSDEEP 96:sx2k93VuUb91G3o/IeMxdA4on4KYdXxy6DGSAblz:sA60A57egWywp0F
TLSH
T15F91F86FC938045F2B61BAF02C0B12D8F123700589E4CCA9A241DC3697E977EA4AE7C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jikkdvu4.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 51a4eeb3600ca1824e9d00f3159a136dbeeeeed7a6053b375207498fdf19531e
MD5 3c6952d20ed4d2da04566ababa72f918
SHA1 b9170cccea6712d3716c2b82da5d32c2360af73f
SHA512 56aeb6005fd6749165991a0389cfcf8e99f2957af25bf59bd3351d526efca2792f2ae03c014557e086e57973d19a7478fa8d10c6bf87428b30025ef56637dfa8
SSDEEP 768:dyJ1AWnjMb6jvA1SZsiKX551QH0LsxORjJmcyW+UhAOOrzx:MJ6W+6jv+SZs1XzuH0qOR+T
TLSH
T15A7309B3EAA8B5BB1B9137C72C0FB95B62E20155E34506DCFCE9C91C81CD254523E6AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jikkdvu4.default-release\activity-stream.discovery_stream.json
Size 74KB
SHA256 ac75fe23399db710b48e51533ffc083fbbd3c9cd72b9cabf784580227f488c39
MD5 a37f090fc8ebc039f18495c5e2c5ea97
SHA1 293f459e52e4bd5e727d41e33fcd6b7e9b3c44d4
SHA512 ed9f40eafbdf19f9ea14f9c072424a6b8159fb7ed082f11fa937036c10381271964a033499984fc78bceb4940fec5c1f0908dfc6c4ff156282c5c72c1f797194
SSDEEP 768:dyjpBhBvehyGo8ODQ76QgItft5Nd4BSW4diuEVHO2/vGDjL/UtmuhPPD35hJ9g:M1BhBvehxn2Qdt/ZrffXLM/PP3g
TLSH
T197731A63A6ADB1BB1FE037DB1C0FB94B52D10156E78501DDECEEDA0C81C8364427A5AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.weather_feed.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jikkdvu4.default-release\activity-stream.weather_feed.json
Size 14B
SHA256 1bead770ec2d7afc6ec1e9d35383f40ef676591e079dece21c38db17c5c24a20
MD5 3ea4da2ce03c4204ffe9b30074d62fac
SHA1 b6b82844f7ce93098971fea6f2559b220be08e2d
SHA512 dbbbee11f26deb954124b96d0fb7748ad170d9bab095f79691c83fb1dcfe57b453cd4ffd6a367c701d86bd676d40aabde7a390ecc57e2fcbd0c545d9940a41f2
MD5 SHA1 SHA512

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jikkdvu4.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 32dab9449e8d1af186b827510ee8e3671d8220ab21c259d07eeed450424e4164
MD5 c2281944e6b5fce4ceca1ef64150f9d1
SHA1 2f49f8b93d8228619c1116f8ee7d9fe5fd6612c0
SHA512 078247b633fe6c561e7d309997f0a40675b84013c821da0a61e9a107b1278c2882e101601433832fe33a96a9eed752c2c440ecbe9ee46cfee618e1a6f0e430a0
SSDEEP 1536:jTrliqqXjqwHCyMzyrq76gPpn7ME6rZ/BCDLkmd5klSmecvN7jqQxSjA/pA/WZ0P:j3lcCyMzwqn16OBv8BYbqczD
TLSH
T158A3AEF6DBA2CA7D95FFC02DAAC2843EF9263400B3A73009C963675452C6FB46775648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI7961.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI7961.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\addonStartup.json.lz4
Size 4KB
SHA256 0caa4ceab735f390e18bd0bff41bb13a1756b2fd16a687d654de79253d6cdd43
MD5 5e15fde1cd4a98a622444324522f3311
SHA1 5036c038d08dbce47ef18db4ffaf6900673682b5
SHA512 b726ba85f85f162ab0512895a8c0cf8ba0d42b3f6384bf87f62244d4dfeafd282adf40198defe80f27adef7c4884539786ba2f8592eceb4d275f2dd081850627
SSDEEP 96:dU55sWNNd2xWNhD4fMgGvmHQ0FVO1u+8TXqYjE2IXR1:dW2xohD4rGvmHA8Ti2a1
TLSH
T113918DB5D949FFA5FE37C08698D97F31D2DA5A7420AD9431F06BB2054CA0BE26786300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 06b3b0230c470c3ea86188eebd361ea2ee16f7eb2912051db910a9d955198b2a
MD5 d66fa8ee01d9b50b1ae7436e1588da86
SHA1 86f946bdd293627ecf14ab9c6cf7923cf9cd4d0a
SHA512 74eec6e68def978e7a3eb869f0b5fd5d8a7150e08f83a2730d3ef490f49eaa2d6e4e659e8177c76c9f6501bc05c7592085682770ccbaee010568a65f5da7a7c3
SSDEEP 192:fOv5zbo2aZZxyjnGl+N51d66Joz1zgCl6mc0dz:Qbo2aZZxyjGl+N3d66Joz1zgC1jd
TLSH
T16AD1BB68E628863BD418423BCCB61F500F75389A985E7F69319C640C2C576DE7B8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\datareporting\glean\events\events
Size 1KB
SHA256 6d021e65fe43d5b8f54d2e84f6fd622b8da222e9116a95841fa6f740e3c0035f
MD5 712b3f43071e2917dd949ba1c4c9110a
SHA1 5d0fda3327e51c03f7000b00165a60e1d9e3125c
SHA512 b3762442a197fbc186243ed97fde6bf7cb623587050a8fec0d8bd872c7714e55cffe3f3e02f242b2ca9bea49b8ff7c1e5d35d3eebe36b514ecd739ce246251b0
TLSH
T1C4214B5C7EBC4D2A5C87E65C7450018E53958E0B0C871C570D52FF8CCD81AD933AA46C
MD5 SHA1 SHA512 TLSH

Submit Download

18888dab-2748-4053-be4e-20daa8e9e3f0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\datareporting\glean\pending_pings\18888dab-2748-4053-be4e-20daa8e9e3f0
Size 2KB
SHA256 24a0a23c684202ca2f2e963e2b3aa3eeb68874b2321c0c1dd91bd8ed4aca77a4
MD5 c383d922d6d4c15dbb9b95d9aec795d6
SHA1 eecfeda95b88321dfd53a267c3df880218c904df
SHA512 23c0ccb6e3c20ffaec87ba03a19be0e12e6c9f744f43654903a5322529cd635c2126396bdb7085ae44567768c0cc23df1311bb6ae01d184f5880853b162640ab
TLSH
T11F41435CB5B84C774CCBE54D9491234E53944D5740822883AE51EF0CCD927AD336A42B
MD5 SHA1 SHA512 TLSH

Submit Download

2eaee992-ccb5-433f-9f16-1890de719803

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\datareporting\glean\pending_pings\2eaee992-ccb5-433f-9f16-1890de719803
Size 235B
SHA256 40197d626eb02546221c157560122a70f6e3a17d0b52915b4ed4e4c8b2d046a4
MD5 a9625e2e072f2c78fbf3a634868354fa
SHA1 92bdc5101c6d7c1f2ec15d31a6958522ecaf41d5
SHA512 0f4ef914aadae598fdc118bee20a46046881fdb8156c4261e4d4f44c6905bf9b922d3aeb7efb71c18e9f5e90108b451ec9043ce1592dcaaff36eb67f259bd698
TLSH
T19FD0A7852498675E49181F1EB1E069D630D9CC332464A861D6B14678DABDDCC42A191B
MD5 SHA1 SHA512 TLSH

Submit Download

69f420d3-5c3a-4139-9d49-d52f0395c5c3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\datareporting\glean\pending_pings\69f420d3-5c3a-4139-9d49-d52f0395c5c3
Size 886B
SHA256 6270c91ffc865901cd6458c08a53889ed44e6b9e7b6cfd6079ecc949bbed570a
MD5 00968200175e55ce8081bb3330740f94
SHA1 79fa76e927470356205c5d1e3cc32f89a5cedf88
SHA512 53db145be5a22b73c2cf8bdd82d894a7f6c28798f5687c54bbd0565602b309fc4f0af4b93181271da8d0bd73723d9ca32dacf2ba3b644aa2e4d3150a38f51aa5
TLSH
T1E01100849664BDB68938D24B89B17B428BD4703380CA58587D648F1C4CAB92DB3AA60B
MD5 SHA1 SHA512 TLSH

Submit Download

75e00f64-d015-49c7-8096-1f9fefb75737

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\datareporting\glean\pending_pings\75e00f64-d015-49c7-8096-1f9fefb75737
Size 15KB
SHA256 fc65d1df23c745a00190844bf1647e860ed51d2d3ac61f922fffdc85699443a7
MD5 0105b2caf070011fde11bf672bf45654
SHA1 3882acc78bebf501bd95a4ff22ef2773dd51a2c5
SHA512 af7fb9ea89b7ca504923e07e4c86090d8a13c1bab415da0a2c163c857b9282af11c7cb0ec07a79b9729315f26831446008ad17a9c7c83ccb43e023cc3cf15b82
SSDEEP 192:lD5w/jY1Hgm9l8BggBUS6cl6UShRz4VkDfGdhrzQOQrltIDQkSZrDRD1Ap7BM5Mv:lDoj4Nl8aglXUUShRMKDudhrrGEMmv
TLSH
T1DF72DA562860497A8251E36998FCBFC3E2F538CF4C419FCE9BE4BD085DDA06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

80b515b0-feee-497a-bb21-40faa2010d4c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\datareporting\glean\pending_pings\80b515b0-feee-497a-bb21-40faa2010d4c
Size 235B
SHA256 e40ae7313eb6b84596add522327279cc9ebaaedf65ad3ca606d0ee6d2ddd4621
MD5 41926c115ff21a02dcb309994b7b9c1e
SHA1 0b03a093849c9e80f855dde405ffdc200fdd75f1
SHA512 0f172ebd6c48e19bfe6c81ab208821447bab9dcf0670e4c4dfff4b3fa09bc66c7c5a6c738532e4421308687b79fd18669af09c9fa322c5fafa5676513c267844
TLSH
T137D097C42498A72E48141F02B0E02DCA30688C3314A0AC90EAE10A789AF9BCC012191A
MD5 SHA1 SHA512 TLSH

Submit Download

a3a05c14-a8b4-4740-9a07-facaeb7877e8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\datareporting\glean\pending_pings\a3a05c14-a8b4-4740-9a07-facaeb7877e8
Size 883B
SHA256 80a866b3bc8f743c5318da1d0449f2210c05a1a1b5a541bf25a9dc9adfc8d43a
MD5 8ff4d91201bbcbd2c889f29689947b9b
SHA1 10de6850902eb5209ed10dc945d826fbcc3d0c2a
SHA512 67f315c426b6753778139b5d0ffbdc0415db38ee6c0cb817ef512f34364b06451b0106587ba7c411fb56c1629900f63e324dfdf4758b0e5dde161afc1cc966a0
TLSH
T14C112385E674BDB6CC2C930B89A277024BE4393380C994147DB55E180C7F91DA36B60B
MD5 SHA1 SHA512 TLSH

Submit Download

downloads.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\downloads.json
Size 1KB
SHA256 1a57006ce13e885c07dd8ad7976da7fb3413347915fd837c5643bd3f0c947859
MD5 90f8b9241ce195dd23dd92da2035f122
SHA1 b9ab12e7c1ca05b4b73dd48469f18e560cb1dcdf
SHA512 b8bceee1e1312dba65042ff878870465c7c0aff273a8c27b92a46e2fffc6831fb872da7b92980ae8c58645a1e29885ea261c64a8e2290e298736f4d92e9d8e9b
TLSH
T1AD3174F6E106D93E7B066A925B1C3F5AD536E0DB458A445DB19DE888C0C00B9B4B7C2F
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\prefs-1.js
Size 6KB
SHA256 300305f8f56f1de4b3d1e1be99c467ec3d666041f87d955f2d0eba9c99cf0238
MD5 97981a33d8ed90a5c99d432725246ed4
SHA1 f5565b45e8e34e6f431d4322535d25b445c6b735
SHA512 d2a973d47e07c660284a903370f199e67ec77c7dcab7f55986f3d29580cbef65df4e421e7c99a35b753ff40b597e77ac7490f780f4aaaeb197cbbcdf1215d4e5
SSDEEP 96:xHXtUTUWqGqQrf6HG1zS3SSlkdv9ja+nEHsdCBw88P8L4cn4i8rB:RtxRcf6HGISSbcCBw88Hd
TLSH
T1A9E12F7894488F6F64B6776CAC688C719AB2013B7BBF28D750B65484054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\prefs.js
Size 6KB
SHA256 d20caecf267ce1e557408b73f59ca92d210b20a40ffb8b7bb872a5eb30ec3706
MD5 369084cd021c598fa9930adff4dd5cdc
SHA1 9a76d20370b5d8fec8849fb230d3495c6026479c
SHA512 bf62d2b45d371f3c76d981d088e29c762ebf8295d9d265c1b503338e2b3bcb013167b2ae3b8cd17c3b5bbce24495e4cab6c2fec23234f1a9276ea6d1074b3fed
SSDEEP 96:xHXtUTUWqGqQrf6sj1zSgSSlkdv9ja+nEHsdCBw88P8L4cn4i8rB:RtxRcf6sjrSSbcCBw88Hd
TLSH
T1DDE12F789448CF6F64B6776CAC648C31AAB2013B77BF28D750B65484054CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\prefs.js
Size 6KB
SHA256 5d898f168adb491fa2bcc2e900b1bbb4f257ee8f26b78515e6754aabf50c50d2
MD5 ba79b4ab02755c6a69f8b62687835a11
SHA1 b63d3e4d9dd72b71121b427cd72b81677b36043c
SHA512 1cb367503c699bbe691ef03d1520ffcb4790cb7c865a4296a80d1d56486055fd7316b291183aadbaf2638d459b0e6a2e4b33d826c066b71c70ed6cf4b33df882
SSDEEP 96:xHXtUTUJPqGqQrf6HGObzSvrSSlkdv9jjnEHsdCBw8OP8L4cn4i2B:RtZCRcf6HG1rSSjcCBw8Oh
TLSH
T109E12F7895088F6F64B6776CAC288C715AB2013B7BBF68D750B654C4054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\prefs.js
Size 6KB
SHA256 2bde04d9930246069a516d7104d5d7bbd1bd966bd51342de6d3c24434b8644e3
MD5 1a38bea1c76f3d7654568e2bdcfd64b8
SHA1 b78794b2e18db800dee3bca71ec1f2b3d8127547
SHA512 b4779b9f419b6cbd5ae2ba37111b5db966942b538d81e6fd8ee0bf11578b8195e15f6673a94ace8a555ae8d9942d7bbdf5e7b32b8fc78310165ee7a1bae910a0
SSDEEP 96:xHXtUTUJPqGqQrf6HG1zSvrSSlkdv9jjnEHsdCBw88P8L4cn4i8rB:RtZCRcf6HG+rSSjcCBw88Hd
TLSH
T1AEE11F7894088F6F74B6776CAC688C719AB2013B7BBF68D750B65484054CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\prefs.js
Size 6KB
SHA256 8d4a9cffe7920b46aac23a9650a04ac9e8a97002c4bbe5fa4acbf97c9d627f0d
MD5 2509d8e8d7807531faa9d12c85a1a041
SHA1 fb1ba548359b0d2834211299dbcd1735e1322aed
SHA512 513e35f53b5d73832ff66a69f34d43c96902a1049ea1573047aeb0d95f750494b87daab33ff812cafff9a37bb1fd096bac77c042f3f28e389b0d1964a9f4e3ec
SSDEEP 96:xHXtUTUWqGqQrf6HG1zSvrSSlkdv9ja+nEHsdCBw88P8L4cn4i8rB:RtxRcf6HG+rSSbcCBw88Hd
TLSH
T1A5E12F7894088B6F74B6776CAC688C319AB2013B7BBF28D750B65484054CF3882F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
TLSH
T14DB09296895A1070CE83259D73A47B92AE3E14F676A1164471ACA98C24BB0278657883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
TLSH
T1C9C02BC385460070CEC3229D33A07F92AE3F00FB37B10604706CA54C14770278203443
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
TLSH
T1A5D08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\sessionstore.jsonlz4
Size 1KB
SHA256 3e8e70613bc2712f11769a70caa95d55ff19b080b17838e9188c5701506e6a62
MD5 f6b47e0669d9a69b84bc7f248e5c2d0f
SHA1 f5582e79aa66b21925f0dfd3091d5dfab1ed6da1
SHA512 600ff0c1540406cdd43a5550c2a38bcf7fc1d5037dfc2bef951c09f8230376801ef53a76ef68aae2a7b3975b3229ee21b0d546fc84c96e950bf803c8d7e21f74
TLSH
T19421EAC3F56E3DF8FE259059D0CC07F5560D3432C9BA9CA0D9596C03A18E89A2BC714B
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.1MB
SHA256 042c0cfcba7acb828db369aa938b28245f6ccd513d4ae272c5030c4592917cd2
MD5 4b777176a622296d86014e0236faa86b
SHA1 3a0f831afbbe800a5abad4f4eb0f07231336eebc
SHA512 341a8b7814325f34e01be47fe15dc5ab0ddbe144d6fb2768d14b23f0c74563b8c0af59123529f0d22b9a1333bfab79e06c303a8ab48dea7d3d8da22482be46d9
SSDEEP 24576:b8qVjxYRwIUOcjwmPYxNoQGRnNyN++YPWgmfL6bDqO8b3oJlZsmzu2jqMq:b8Gl7UIYnqW3YDV8sJ7smzu2jqM
TLSH
T16D462AF820D1A257F3414033664593EF21EFD00C6027DA085BE95AE9A5B4CEF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\targeting.snapshot.json
Size 3KB
SHA256 5fbb7430f43e49e9aa1efa2e0e7e119e47be5782a39a00f97337b50fe7e84529
MD5 7323026c8d66a9bd1605ef00045d5e8c
SHA1 1ea68ae757d2539345a14aecccdb866424d0d61a
SHA512 21f84c7a4d4d913266f4066e338ab807954b6b346f33a07b67f31e42088802fb8ffc68deaaed3a2a5b9321e227c59aab90ff4598a193fcb6e4ded8a7c2b6dcfc
TLSH
T10C71701C961CA4BEA66BC3C0D6447F978BBD053370446458DAFE460C45FB5FB162611B
MD5 SHA1 SHA512 TLSH

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jikkdvu4.default-release\xulstore.json
Size 138B
SHA256 81ef165ad53b66d069fb647f3b801e9de87b7b09b37201943949ceba3e65bbea
MD5 20b352ea9514cb02dfaa2afcefa0b948
SHA1 16f12babd94531ff9bf0c6948065b40cc4558f0f
SHA512 2347fe24e07468c2d68f23d9c80aa1d1ddc29a066137acdb352930bf663202738f01548aecf9235a6cedae547340a9ffad60157a61d09889d152f4b09070059c
TLSH
T179C02BB0215FD8487F178FCF024D23843D2A851091C011A679C214E0008530F4C18308
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\dorion\config.json
Size 818B
SHA256 be5e72bf039de2c2051f7f8b9ccec426558a1261321e9316fdee4ecdc46fac62
MD5 aa1e17de336fbd035ec7389a0da7fd3f
SHA1 fbdf2c1cb6eef332a9ea0c65b9268f3e00f86de8
SHA512 38e5ee5aa41d1348f41d7650ceea95b3f5d4c5e9d2de5898ceb2522310ee8e5630f09fba96bc6f3d008a26b8f447344a79e7f6ab60c577223dfaf51e3f7ee7f7
TLSH
T16D016B0E4A24657E99A59205E6696B824F3C447336953DA8D2F986383DE71C301A320F
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\dorion\config.json
Size 987B
SHA256 c3968a81904865589100b646feba04e4c379a6522472fbaa0995310126246abd
MD5 0c1d443ab3d8a625a38098e77cfb468a
SHA1 9db8ac4732c94080796d438215e9c882f90d7cc3
SHA512 1e4ff04007ab395f371559a5119774aef9e843826db1a39f3773e6d992bbe79bb983033384b2de104ef1c71dd2ad1335a14a68ebdf65b897713a80d7216f3051
TLSH
T1EB112712C93852FF16F4A13CADAE91834B348D55438D3C1C826785182A1E73371F3ECA
MD5 SHA1 SHA512 TLSH

Submit Download

0a7bb922-555b-4b5b-9a1f-5a98d7c59fcf.tmp

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\0a7bb922-555b-4b5b-9a1f-5a98d7c59fcf.tmp
Size 4KB
SHA256 02d148ce7cc6abf47ab41d24dcde753301a956d5ad1e89f290027e65fa5a86b9
MD5 ceb3e24ec382cee924e79d309bf39084
SHA1 4779adbe7f82a5b66df5623a470fd461c5b26edb
SHA512 b5b72870c34249e06879d64ae3d5fd6cdd75936b41bb75f2a525b8cb49352d3637afb02c2e3497ea7c7ab4bd93e61dcd10bbe22af61a7bb7967fcda458890b01
SSDEEP 96:zunF43NkCEgfKQyJ88Frh/cInURoDoto+5D2DTXBoZx63aZsYDdNT7lpa:z2F43Nbm5pooDUh8TRoZAedJq
TLSH
T18291B631B8A4B9375DE3C949B9463B8AF6A19027D5A87F98C9EC0F1D01D778C2382C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

764fa3f0-5fe4-4cbf-b2f5-38c17407fe02.tmp

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\764fa3f0-5fe4-4cbf-b2f5-38c17407fe02.tmp
Size 1KB
SHA256 bb7bb03e58c485ff8bde2d3b55b4644ce499f8830937d2199439ec6f3a2c4f9e
MD5 229e35a034fb9fb1c8a11b9a646ea0ea
SHA1 edb83285766ed65e34597210db5cda9ccf8b2cd5
SHA512 b07f0298e8fa6e7ea1c542e5b3539722624f49c5fb6412ffdb68dfc658d5f3053f03b19b1949b71f16e0efb59dadea26de3d69a8f4594125f81c52d76519312b
TLSH
T1F73187B1E4C43E732C82598AB15376DFBE61A02BC2789F4492DD4B1D01D768C766AC33
MD5 SHA1 SHA512 TLSH

Submit Download

786ae608-b19b-49f0-9630-901c1a3a1c48.tmp

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\786ae608-b19b-49f0-9630-901c1a3a1c48.tmp
Size 16KB
SHA256 01041ba242e7c4231514001d8998b558c8a2bf9e7286b484b0e41ec51707aa42
MD5 8ede55ac3d5d100d81d7a251f9ab277a
SHA1 07fe7641e4a619978be3a66ac132aa7314e099dc
SHA512 8cbf68bbb82ec775423a814058e461415ccf9c9880a1b272856f063aac9738a76942928af08d4b0350be8021b69e9849f28ba337428fd7af846ad3d3059ed97d
SSDEEP 384:zI+OBqImmJvGBLx3NaFMJF13Nb7MbUcCIa:NcvGtlN1VCmT
TLSH
T19272BF7928657A573CE7C846BA89378BC761A257C2D87BE8CCEC9F0F016B5842392D11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9f3bc45109b2ea71d810ea1063a949bcba4560f15992dbb660c72f3e0066b2bf
MD5 eccf15e32783aeec3b30133065863667
SHA1 5b28304a117bd16a828ad3ec3b121fd4e2b3e9b3
SHA512 df7f1ad4c78c56203d67a51aa20bf9ce277ae0c31f850f01a0f4b91f7bd31f353a95ef9ce7f1fb804fb3e6a50bc2bd55ed3ae0f50c52a4622e8f204211a00725
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 418792e3ee7142223ce84289b1bcc5dc1683fb8e62ed12cf41be63a0f5608b13
MD5 76405102b972f2337af06263c7e0d1f0
SHA1 7f82a20fa468eff45805f33d8f2d855d0423a4de
SHA512 daeffdacf80f435aa77d181ff8907307e6089dcd3f0204bdc3d186fa0005fe430e58e93b041d63bad8bd79989fa47f7f79f9ce0b347817ecf96ff4280489e81e
TLSH
T1CFD0241333010734C450357310437DCC1401D31F404DC100743DCD1D1F150543D034C1
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

0aca6bdb-c9ff-430c-8eb0-6a9fa8eda816.tmp

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\0aca6bdb-c9ff-430c-8eb0-6a9fa8eda816.tmp
Size 6KB
SHA256 3aefac137452d68f61e75256dc811577dd34a96cc3d49377133c860c4d06c3fe
MD5 5db7d0b19a58178e46e527cddc34c2c6
SHA1 d6c0029785c3ff581f32e79f084ea926f644111c
SHA512 018d0dbbb74c37de8fec2e51533b29ca9ef5f33d633df4c171a47354750e2fb51e94eeb6f0c4f29bf066221c7d7253c7cf8ce394c0f452dbf6b893908d8f0167
SSDEEP 192:st10V2JftZ8pa9y/S+Wihm2mLX/4odYr2M8:stOV2JQh/V64oq8
TLSH
T1D0D1EA135E2869774CC7E6197A35BB5AE2F5502166D50E98EBFC851C08E67CC7307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

972b517d-e04d-4b6e-9e1c-5c9b2601849d.tmp

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\972b517d-e04d-4b6e-9e1c-5c9b2601849d.tmp
Size 7KB
SHA256 e52e8329ae00ed2af1e2229455afa66f982cd3fec004e0208c00cd34b7c09188
MD5 adee338a1b1c876dbe128a43d764ac18
SHA1 8fbbb111e1c90a067c67dc79d48cb224cc37f896
SHA512 68b7696d13cc6070e8bc21318e7c278ce073a2ff51a182c8d58f5eaf00ca358a0012599633d2a6095445ea1d58cb9cc96d08bec61d5cd039bf783b368cbab192
SSDEEP 192:st10V2gftZ8pa9y/S+Wihm2mLngqj4eOLvnAV2MC:stOV2gQh/Vtq3C
TLSH
T145F1E95399742D775CC7E529B521BB9AD2F5502166D80E88EBFC892C04EABDC3203C47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Cache\Cache_Data\f_000001
Size 34KB
SHA256 3bc11c04acfcdb0f480c3a8e61a1526184b47e3002e584d6aee1139edd54f604
MD5 700041a196aeddb50ace8e4b0e4434c7
SHA1 b24120575a616eaa57216b82b31a40cc58196101
SHA512 c0276a284df0edcbc85a01eb8525719a3c670c9c91c90f80b34e771c49b1004c486d50d077d6917820668b450c3f3d1e9bfc9e18e52779ba07520493660468f9
SSDEEP 768:tzGQ7PaAVbJ3lSWUhA97f/m8m11gkt/KYT3TsFSBNHzAkiAxX:cQzDVb7SWUhAFO8mX//K6su3iAxX
TLSH
T175F2E15E4603C1D88CDB5F50B78BC4DDABA5F052A992368D87388E8940FFDC11EA5D5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Cache\Cache_Data\f_000002
Size 23KB
SHA256 7d1faf55e440103a96190d6a691e92dabed76776778b3fc753d3388c1f382ac9
MD5 2508aabae3774a3c862d36de6bf80a98
SHA1 180aec029bc76550d3f6a3fa445da0f2f6213247
SHA512 9af326e252ebd3f4f438c67360667d5a179d57333ca48a4b34373b97063212d9a686ed952b8506a03d0ffe6cb780c25c8d40ea753dfdd3e64bc01d0cf12fdb06
SSDEEP 384:v3xsW+Pp0fYMOLsRk+jw1AAB9EPPGqpUcx/upQ3mhz5F5NMDkphu6IyTddreEkET:vWRN5LsRK0PPGqpUeupz9F5NMYphu6IK
TLSH
T1ABB2E0BB411473BA33B9D6EAB7EE43030140890BD5C9B29E2BDD8699A10B7E3011F356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Cache\Cache_Data\f_000003
Size 26KB
SHA256 8078ac6f086afa65538bbe0f0b1a75796d68ce8c11fcd473ea6701081fcfd4d4
MD5 20835ee9858617b403a8a14bb0b4d647
SHA1 c2832d8a164db90cbd34c7be5155a9b212407a3d
SHA512 8fee318e65693ca515b133bbef9fe367649a549b84ebd01aff0bd8b327c4619e7b824dd85dfb9bff8e4857e0ed27099d2a3ac2f5d9270f6aa801dbf0c36f6f6e
SSDEEP 768:L2dzaihGidRvTjlz2Y9SoYPE/oS/YdluA8CVX15O0U:LAzt17pNUdmc0N
TLSH
T180C2E16EECC43B0474D2E9AFF4B82AB1139D027A0816B25EB6AA1C17F4546FC501D16A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Cache\Cache_Data\f_000004
Size 57KB
SHA256 1d20b9aa41c6ecb638e3a904e051ecda4e212677b53a065e5039d10a15236c88
MD5 851606e96f5e7d1ed80c8e761ba8cf28
SHA1 31b09356727a2e97513eb10eb3d1f027e7482f10
SHA512 f88ba170629e41eef34f11abaf0ed0b7d466a8c828b73c63214a3a9170a7947ad3ed0fe29c373a27631ea46e5f4b49eb1d488415c1761332cdd1607e96031bc2
SSDEEP 1536:n327/dbuqdyB26ohQK7wIZVSucx3C4YkKvWTzqk/nwR:GrdxyB2gOvfzxkKvWTfnwR
TLSH
T16B43022AD6BEB77EC94C07E0502887640318DA18E34C5FC92377466C8559FEF5B1B86B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Cache\Cache_Data\f_000006
Size 28KB
SHA256 3bfb64889d2895551008610e856c8d5e2bfca52804aca5c9a5128a53e1a859c3
MD5 6569aff040db38f2fdafea6e159d6e5d
SHA1 08edacce4e159e58c5cd604087821a8f5bdf50d1
SHA512 1d09bba925bc85dcb8eeb1f04087a705728fad160c9c7c3eedd0872b226a12ae65d73c9f60e866d703e3a343880b577c2e60f908d42979dc9cf85535f42a4d15
SSDEEP 768:zPFYdjYjCfrp18HCCMF/XI5aDdZ9ud/Wjgg:To1F/XwaDq/y
TLSH
T124D2F128CFDD20E79B115864B58BC8E5C5B2CA9B0CE3607D89F1E40526AE70E5AC17CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Cache\Cache_Data\f_000007
Size 36KB
SHA256 1c9dce94e2cd1bf0b69f4d2be4175da07194871131c208e2aa474cda639a5ca8
MD5 e68bc2d0e46224071e590256edda0ee6
SHA1 76998a60fc611096d9dab19575852ad0613bde78
SHA512 f8cfdeac2330c2f0abfaabc8f57ff84cc8948c675b9a63d531ab553565b90e8a54da1ad46d829a7044095bbcb81073dacc6361424aa135aceb07ac91bcf651af
SSDEEP 768:YOCKzoPKsYroISxxVDA4kuxKSjAfrfTT1AW9x6I+akZKR/DgLGw7Z:i0rdSxxbcW0/39ZkZy/DmZ
TLSH
T132F2F13DEB11E326A0DC176BFBD01A9B5F97D09814482CF438B069C763396867DD429D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Cache\Cache_Data\f_000008
Size 334KB
SHA256 5d5d2fb03a5d598f4016aac43f5ab6333c4741b1109bce567c07eb0b7b1363d5
MD5 a80e32a3e712f202fbcbfc5a1101fdee
SHA1 1f7adcaa873c65918631e94684ec908206f3f1c4
SHA512 81fe609f98ba830ead28da9d310047209f6b41afb11618e83dad6ea0b3750e50a906b271160c9ad57bcefd8ec17b3500fa973ac1565528b3390b9ae558ee9110
SSDEEP 6144:FrQbiAj5DeYcaiciE8rp8f29/RcNTTUATE4a+KKCOW3CFf+t3F:BY5DeYcZci1l8u9ZcNVH5c3+aF
TLSH
T1B27423780D6262C8827BFF57A5269C10EB3147F2472D613C1D739FA34D22616C789AC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Cache\Cache_Data\f_000009
Size 213KB
SHA256 684fdbd33416fb7601d7147bfb6cd71a5ca91464ed86720da2b4d0b19bbd8ef6
MD5 c720af5b060fc2124d213120213734f5
SHA1 a9a21df08e7ab045307aa3f00eb42b703caf6df5
SHA512 57b822a9a084ea99c1cd427610263cbea65ef7ce754e7279fa965ad34485d424e99956332e4e1d21690e40b87754b342dafd0cad388fdb5af0e30b8a92ca2883
SSDEEP 6144:ZdBb5AOWr5O/mpfstTegIsbtDw0INbaJtEoV:ZdXMU/mpfs1egIsFF2e8oV
TLSH
T1EE24127A035D8D621D027439412FD392E2261DA4D3ADDEFB43B3886276A4B5C92FBC71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

3c6c3c51-6b1d-4df1-b3e5-164a984b1e5f.tmp

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Network\3c6c3c51-6b1d-4df1-b3e5-164a984b1e5f.tmp
Size 1KB
SHA256 b1f8ab1cc5797ce1eb8cd45ae26104c3aa740880c57db816373af5280bd54dbc
MD5 96b8a50c360b53662b20afee0956a006
SHA1 0477e7b60010e899664adbdad3d6addabce27e80
SHA512 7cb953a7aabaf3c67cdb31679100e194471a03684fb3ecea06a37dd3e2d4418c0ff11f0d32d94bba2c9cc3ad90c1f54124c83973db15c631d938df27f23b4079
TLSH
T12D318C63DA7FE42B60394D7B0E18BD096EBAE935058150FACB9BE63C60C14B307D7462
MD5 SHA1 SHA512 TLSH

Submit Download

7377720e-2ae8-4e21-b6dc-006574cc08bb.tmp

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Network\7377720e-2ae8-4e21-b6dc-006574cc08bb.tmp
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

978418cb-7492-474c-bf6d-fb34d7d97b09.tmp

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Network\978418cb-7492-474c-bf6d-fb34d7d97b09.tmp
Size 857B
SHA256 57b040500a80b013ccb788699ad582ee83d745c52839f95f64fc31fc3745d13e
MD5 0ed618b93b655690954e4516f0d9d3e9
SHA1 d1d129ccb56bc1a243f374e052676bd05bbccbc3
SHA512 0a42a6e5c19ffb98dae2a2b9e18c4eb8f2c24fef7759762f6ae0db3dbb9b9a95eaa6703b2c6b005d2fe5b2b54dd92aeae17d9ff361e019567e0a1d7849796aa3
TLSH
T1FE115573D9BEE03B60384A2B1B49BC052EBAF935058154F9CB9AE63C20C14A307D7892
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 410663915bba600e7341472cd7963431d5c6b9446e1bed3c3e945cd93762f9be
MD5 93f4788b38b7f7f732e717ce2711aca0
SHA1 0985ad9cff0057506d78fc2762dd95236ff14919
SHA512 5afe5b9d0b6dd71f1210dc39d2708111f30987787ef07b5b6d111bd2ee177251ff2100cc7855f5b72fc26591c22b16c1d4302d3877c78dfbafb2575d3130a9c0
TLSH
T128F0C933E47EE43794788A2B0F447E145EBAF631018150F8C79EEA3C60840B34BC3452
MD5 SHA1 SHA512 TLSH

Submit Download

b3838a07-ac19-48a4-a8d2-8439ddabeb81.tmp

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Network\b3838a07-ac19-48a4-a8d2-8439ddabeb81.tmp
Size 1KB
SHA256 89f9bb0ccb67d9fac2819e846c63d3cab5bd693af683a69657385f2b92c0cc8b
MD5 cdd553fb63529e026a22a3f555fd001b
SHA1 d746b40bf39556a077e16f1bc4428ce537093a7c
SHA512 957c5f232351bd114ce0bfd35fd2439b1fb62eabfe9a666f231d2ef666a522355c9c1871ce267fb1bd7564dd6366ac50e3021b9d94faad64fbea88eb85a1b613
TLSH
T1F9218C73DA7ED07B603989670F58FD092EBAA935058150F9CB9AD63C60C14F307C38A2
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Preferences
Size 6KB
SHA256 879f1421707666e4ad03d258e6898774644a27783335bf0815fe31e37a7bfa74
MD5 063d668c2baf05bdb450751da1fbc82f
SHA1 8e1ad248f0f0ec770c49785baa3d8d97f75784ec
SHA512 a517d4d22520b11968f63c2cdd0e575ed1ea7420cad94a2021447f5849bddb21d86ca6ca1ca802dff46cece44b6cb956c2975fab5fecec7744d62f38c1146610
SSDEEP 192:st10A2JfrZ8pF9y/S+Wihm2mLIRwdYA2M8:stOA2J6G/Vlwv8
TLSH
T1A4D1E8139E286D774CC7E219BA35BB5AD2F5502166D90D98EBFC852C08EA7CC7207C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 114B
SHA256 4ec4c34459aad822065d80b5a4cb15a844f2413f337f6bd89ff0a6253fb7c77d
MD5 2e1d6a858892e902e3bf2ee279d3669e
SHA1 0b47d5af5b20861518faaa02fb8fe91971f4af3a
SHA512 5a87d6cecf2a47aab11b9231dbb3373d5c02f1910558c5908740c88902aaa6b7c9d9605d27d1c647defe7023a4cacf00fa9cfad70c6839294dab5ed6492a4965
TLSH
T10DB0126780120D611F2E17B08623F0AE8B530DDCB98AC0CAF263304A20357237303EE3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 177B
SHA256 0f3c454fc01a2f7fbd033322a6f3b76a89c6a7c6b024277e15192c846a9f6a08
MD5 f8678c98d21357c491d74a17522d2670
SHA1 7570505e065bc16fe2e0db9b593148319b0eb987
SHA512 d628deeb67008e514efcf22c79caede86f3b5cb9fd4250472064c4ed267326f32b928d4f71559c5a58c0a8a5fb85be57e51d4020eca32b23569e4501b3ef1cf2
TLSH
T1CAC0C01B40220C90171A47518A1260BDC7130CCC2184E0C0F34330052435303D333ECB
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 170B
SHA256 0c58fefe5616c23d2751e2aea5a8f32438fbbac3a2a27e598c09dfd59641b99e
MD5 37f827e66d0d012be99afc0de28302f3
SHA1 ef916429423beecba9dae9c0e330e0cebd44e46c
SHA512 57d0b7455c40dec01aa29a3fc4ee8fbc2ded08f6339b4cdc424b76e376245598285151b3ab01adcd521e94fa966cd433c785ee51fefe33f891f65462deda9fd6
TLSH
T11CC0805B40524DD0072E5F615A1271B9C71704CC7195E1C1F352450514457139363DD7
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Service Worker\ScriptCache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 72B
SHA256 db6ce01d720ff782e85d45674e2f65dabd82a8e837e96e5cdb26491403e15eb4
MD5 b5109bfe737f92fb27cc8c633fe427f3
SHA1 cf35ede8b3acac0d0a4ef148d8dcfe1cfc58c204
SHA512 0a35e9998004f279a8edacc14e13f5e46ee6fd607c798d1c9ec7aad2589232da3c3d4324705e04c6a48824df767dece1bc013aab09cb21df5d1f87f9c976ec79
TLSH
T1E8A0021701740315C20432B8115706952312DDA6915273454391E3F6BC50560A112040
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 b2ac0e383ba9c6f0ce6275531695ba42c326dde0cc77dbed0464beaf690fd544
MD5 c61faef64204a197e7d9adb272849790
SHA1 20c27392643949fb445b12f9371b79a08887e9ce
SHA512 103bfca015b64158e364c9acd011e34d043e5fc1cf6e7f8f422e3776f142840e97588e77518f9b5a2a065e8ec81cf43bba3195fdc3adc026371cc81e5f3a2b9b
TLSH
T1EFA0021146800354C20112B0251506B45201DE258052034242D18746BC600E09621480
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Local State
Size 1KB
SHA256 11f9eddca226cfad2346eb236cac89be3a9c8754e172081bfbe62a6c4b3adfb4
MD5 4f27251881d0d21de853a427fda08db5
SHA1 fea9f3891d6e92a3f7d5a5b2e359c57981d5480a
SHA512 e5a21cbb67ea037d91036ca6c269ec6a0726dbafd7e2099faffde54b7ddfae6404aef07c9673cd4eb62eebb185f5849021aa5a9b4c9502a1c05ec97d7cde3c84
TLSH
T1C82165B2D4C47EB36C42488AF26376CE7E90A02B92789F0892DD471D01D798C666AC33
MD5 SHA1 SHA512 TLSH

Submit Download

ef48f1a5-fd84-4d73-b125-4f5d41a531b2.tmp

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\ef48f1a5-fd84-4d73-b125-4f5d41a531b2.tmp
Size 3KB
SHA256 940b922131afeec33564bc92618cf2fff8021f762d0b82acad54e3ea4239f682
MD5 e43b09d0906f37659b35caf1de418cd6
SHA1 97b095826195f79c54bdf2a86da17bb035bcb637
SHA512 b9565b596ee0d28a6e6ed406784a6193eedbdf9dff40ef5c009c4fc9ecd4045f61b3238b3b834e475d7ce03f125defd4ce9aa7ac6b5703ae995439522bac2e95
TLSH
T19571C832A8A4B9370DE39D45B8863B5AF6A19127D5E93F94D5EC0F1C01C778C2341C17
MD5 SHA1 SHA512 TLSH

Submit Download

fefa8b38-d8ec-4646-9fed-310254e75948.tmp

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\fefa8b38-d8ec-4646-9fed-310254e75948.tmp
Size 2KB
SHA256 c623aab5f0c4f681c7c0a31bdc3787f443c7bcbe533332838c35ed5dcea218fd
MD5 6b798dd7bf991a41c6bb85204a9b2cca
SHA1 46a76aff584ae3eedbeceeedc20675e8a7299c28
SHA512 d0dad8ce52cf1377a2129e2f5c922662578593d5025655361b26294313e1e21fe27130e11a10c5412e69b4d44b7867879b9a262df2a3d7722e2be6db5e2b8e07
TLSH
T17451E872B8847A7758D34948B9463BD6FA71A16687792F5095DD0B1C00C764C3342C37
MD5 SHA1 SHA512 TLSH

Submit Download

Dorion_7.0.1_x64_en-US.msi:Zone.Identifier

Path C:\Users\Admin\Downloads\Dorion_7.0.1_x64_en-US.msi:Zone.Identifier
Size 968B
SHA256 c318c1f596b97694d2e1f91b8198ed69467a1ab51196fd2e5d0a62d6a931bc6d
MD5 702ac2d8514178d7e610d47675f82410
SHA1 69d93c115fb22a0c105800c82ce2c0ca48d2d04f
SHA512 326e216539d56477883c341d46dbf95ed832396bbd2e7a6c25197e1f0ff95b054097e1efb558aa0ed97048feab60cb7d96e0092e0ff9504872b9f544acedf3a3
TLSH
T1B91110E7E018A51E6B0B79935E5D6EAE901BA0EB450A454DB10AE098C4C05B9B0E793B
MD5 SHA1 SHA512 TLSH

Submit Download

Dorion_7.eQ3FO6HX.0.1_x64_en-US.msi.part

Path C:\Users\Admin\Downloads\Dorion_7.eQ3FO6HX.0.1_x64_en-US.msi.part
Size 8.2MB
SHA256 69177808072584b80943be340964b17e5d40b2be68c106a8afb42cff7bd22014
MD5 57b2cd468c7d6bc265354ffbd0e2b1de
SHA1 3efd361913eca86d6c69c95aee086c6693eb044c
SHA512 cb52badaaedf60282c482eda3a26ce4b8918dd1b0a46c4db34602d0f9aad967367d9c61e8d494a3ff6941761b73137c97da78a42def0cbde67c665470a500c5a
SSDEEP 196608:63L1tPbrTCQmiHot0LPmzRcAkLthXGy1mAvUY3GdfsmW/kgMisHx:UrTXmiIyTmzRFkLLGy1m03Gum6s
TLSH
T11F8633ABBED2863AC4121F71097A9FE05618BC90579198DBA38175FCDDF10E12B76CC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xMro1fJn.msi.part

Path C:\Users\Admin\Downloads\xMro1fJn.msi.part
Size 1KB
SHA256 852484ceb7b9edb8891e0ec1199ca3e8665d6d23900c00dad5d001ca867698ec
MD5 6bdd97063830aec53d944742b010cafa
SHA1 2905aebd7ea4aa68efd2d462786942f7fbf3ed11
SHA512 e58e56e0c73940c0f6341bf3ed84f3311701b7633b7a3fa8506f3aef3796fa9e3c1b10686a501a507d27570c15da6346e6ef7a63bae0ca2f852a124ad4f08350
TLSH
T19D21024136A0C455C294453A4DC3D2442735BC00DD0706433096734F59306944258400
MD5 SHA1 SHA512 TLSH

Submit Download

plugins.json

Path C:\Users\Admin\dorion\plugins\plugins.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.0MB
SHA256 268b55350d48029e4df1b121eaa61e5f7ad8c27a89131b164c233351839b61be
MD5 f598bbcff1695529d094072d471e37b4
SHA1 46ce6a71aa7e40b33ab91597749aa2d1de0954ad
SHA512 cad6927f8f6a13972dd61dc7d888160f17ed7cdbe2971c80c152072fed7160d2eaa03067da7470fe499e8271d9afb922109dcc3e832650398575d0a16b490956
SSDEEP 24576:LEpmg3MRdoO/vvTLzoquwp2EyM7xnSF8GKotcjG48fajWWk6I/pm/2BxzX:lU
TLSH
T11147E32436F92110F7B39E3DA8F16A234D3A7D5B9C15DE8D05451B4E0822FB1E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{d69b9abb-f248-4194-ae95-c96d21201286}_OnDiskSnapshotProp

Path \??\Volume{b4cdd19c-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{d69b9abb-f248-4194-ae95-c96d21201286}_OnDiskSnapshotProp
Size 6KB
SHA256 a9bed538e6c72f3aeec4a85f70de0d9ec10fcf2a345c1aaf900226e9f218abec
MD5 f26d944a813a203345290a08d13b1c6f
SHA1 181332de4a68b263a40b9a5cb845f136706a2148
SHA512 6cb5bca2187b8b45b206ed2d10a15c39cd2c56d4151852b72425c6de05b26317e193e3c66b8a8ccbc9eb24ff4ce1940aeb3e1af5116a5ffbe112c71e532ce308
SSDEEP 96:FcnXyd9v95vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:oA9v9Tb++ZVm
TLSH
T147D189085AF54711E2B3AB7229F14557A877B811EF33CB8E0198238E2671A10F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3628-583-0x00007FF8AD770000-0x00007FF8AD771000-memory.dmp

Download

memory/3856-553-0x00007FF8AD770000-0x00007FF8AD771000-memory.dmp

Download

memory/3856-1796-0x000001ABA1020000-0x000001ABA1022000-memory.dmp

Download

memory/3856-1798-0x000001ABA1030000-0x000001ABA1032000-memory.dmp

Download

memory/3856-1800-0x000001ABA1130000-0x000001ABA1133000-memory.dmp

Download

memory/3856-1801-0x000001ABA0FD0000-0x000001ABA0FD5000-memory.dmp

Download

memory/3856-1795-0x000001ABA0FD0000-0x000001ABA0FD1000-memory.dmp

Download

memory/4156-563-0x00007FF8AD600000-0x00007FF8AD601000-memory.dmp

Download

memory/4156-560-0x00007FF8AD520000-0x00007FF8AD521000-memory.dmp

Download