edbb2645b9e581d6fdc0f275589eb7330c5f9e31704ae227a3627e975d41ad96

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 07:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_4915f6d1f0c106f999a23d182e4f9c77_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260629-jlnfqaas2k
SHA256 edbb2645b9e581d6fdc0f275589eb7330c5f9e31704ae227a3627e975d41ad96
MD5 4915f6d1f0c106f999a23d182e4f9c77
SHA1 13b3b53d1265c5ad57f36dc79152d05fef511fe7
SHA512 1e87bafbad0d16d380d585179631bd9e6e6a566efa3e9c9d33ba179fce291212374d8a7e51790934bd41371667330c2c187d95ead763b604415922e549321538
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3i:CebAjOKn3wRKRJ3i
TLSH
T104D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_76604274\ct_config.pb	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_356059588\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_356059588\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_1089109523\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_76604274\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_76604274\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_1089109523\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_76604274\crs.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2356	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271927408794345"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2882181966-868590553-1461876573-1000\{663816E4-DBC0-4457-A65F-2A590E14427C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
776	wmic.exe
776	wmic.exe
776	wmic.exe
776	wmic.exe
1292	msedge.exe
1292	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
6048	2026-06-27_4915f6d1f0c106f999a23d182e4f9c77_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	776	wmic.exe
Token: SeSecurityPrivilege	776	wmic.exe
Token: SeTakeOwnershipPrivilege	776	wmic.exe
Token: SeLoadDriverPrivilege	776	wmic.exe
Token: SeSystemProfilePrivilege	776	wmic.exe
Token: SeSystemtimePrivilege	776	wmic.exe
Token: SeProfSingleProcessPrivilege	776	wmic.exe
Token: SeIncBasePriorityPrivilege	776	wmic.exe
Token: SeCreatePagefilePrivilege	776	wmic.exe
Token: SeBackupPrivilege	776	wmic.exe
Token: SeRestorePrivilege	776	wmic.exe
Token: SeShutdownPrivilege	776	wmic.exe
Token: SeDebugPrivilege	776	wmic.exe
Token: SeSystemEnvironmentPrivilege	776	wmic.exe
Token: SeRemoteShutdownPrivilege	776	wmic.exe
Token: SeUndockPrivilege	776	wmic.exe
Token: SeManageVolumePrivilege	776	wmic.exe
Token: 33	776	wmic.exe
Token: 34	776	wmic.exe
Token: 35	776	wmic.exe
Token: 36	776	wmic.exe
Token: SeIncreaseQuotaPrivilege	776	wmic.exe
Token: SeSecurityPrivilege	776	wmic.exe
Token: SeTakeOwnershipPrivilege	776	wmic.exe
Token: SeLoadDriverPrivilege	776	wmic.exe
Token: SeSystemProfilePrivilege	776	wmic.exe
Token: SeSystemtimePrivilege	776	wmic.exe
Token: SeProfSingleProcessPrivilege	776	wmic.exe
Token: SeIncBasePriorityPrivilege	776	wmic.exe
Token: SeCreatePagefilePrivilege	776	wmic.exe
Token: SeBackupPrivilege	776	wmic.exe
Token: SeRestorePrivilege	776	wmic.exe
Token: SeShutdownPrivilege	776	wmic.exe
Token: SeDebugPrivilege	776	wmic.exe
Token: SeSystemEnvironmentPrivilege	776	wmic.exe
Token: SeRemoteShutdownPrivilege	776	wmic.exe
Token: SeUndockPrivilege	776	wmic.exe
Token: SeManageVolumePrivilege	776	wmic.exe
Token: 33	776	wmic.exe
Token: 34	776	wmic.exe
Token: 35	776	wmic.exe
Token: 36	776	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4720	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 6048 wrote to memory of 4344	6048	2026-06-27_4915f6d1f0c106f999a23d182e4f9c77_akira_glassworm_rusty-stealer.exe	92
PID 6048 wrote to memory of 4720	6048	2026-06-27_4915f6d1f0c106f999a23d182e4f9c77_akira_glassworm_rusty-stealer.exe	94
PID 4720 wrote to memory of 3956	4720	msedge.exe	95
PID 4720 wrote to memory of 6236	4720	msedge.exe	96
PID 4720 wrote to memory of 2356	4720	msedge.exe	98
PID 4720 wrote to memory of 6236	4720	msedge.exe	96
PID 4720 wrote to memory of 6236	4720	msedge.exe	96
PID 4720 wrote to memory of 5124	4720	msedge.exe	99
PID 4720 wrote to memory of 5124	4720	msedge.exe	99
PID 4720 wrote to memory of 6324	4720	msedge.exe	100
PID 4720 wrote to memory of 6324	4720	msedge.exe	100
PID 4720 wrote to memory of 6324	4720	msedge.exe	100
PID 4720 wrote to memory of 2136	4720	msedge.exe	101
PID 4720 wrote to memory of 2136	4720	msedge.exe	101
PID 4720 wrote to memory of 2136	4720	msedge.exe	101
PID 4720 wrote to memory of 6248	4720	msedge.exe	102
PID 4720 wrote to memory of 6248	4720	msedge.exe	102
PID 4720 wrote to memory of 6248	4720	msedge.exe	102
PID 4720 wrote to memory of 6176	4720	msedge.exe	103
PID 4720 wrote to memory of 6176	4720	msedge.exe	103
PID 4720 wrote to memory of 6176	4720	msedge.exe	103
PID 4720 wrote to memory of 3564	4720	msedge.exe	105
PID 4720 wrote to memory of 3116	4720	msedge.exe	104
PID 4720 wrote to memory of 3564	4720	msedge.exe	105
PID 4720 wrote to memory of 3116	4720	msedge.exe	104
PID 4720 wrote to memory of 1428	4720	msedge.exe	107
PID 6048 wrote to memory of 776	6048	2026-06-27_4915f6d1f0c106f999a23d182e4f9c77_akira_glassworm_rusty-stealer.exe	110
PID 4720 wrote to memory of 6796	4720	msedge.exe	114
PID 4720 wrote to memory of 1776	4720	msedge.exe	115
PID 4720 wrote to memory of 944	4720	msedge.exe	116
PID 6048 wrote to memory of 3060	6048	2026-06-27_4915f6d1f0c106f999a23d182e4f9c77_akira_glassworm_rusty-stealer.exe	117
PID 4720 wrote to memory of 5608	4720	msedge.exe	119
PID 4720 wrote to memory of 5608	4720	msedge.exe	119
PID 4720 wrote to memory of 2924	4720	msedge.exe	122
PID 4720 wrote to memory of 2924	4720	msedge.exe	122
PID 4720 wrote to memory of 2436	4720	msedge.exe	123
PID 4720 wrote to memory of 2436	4720	msedge.exe	123
PID 6048 wrote to memory of 6948	6048	2026-06-27_4915f6d1f0c106f999a23d182e4f9c77_akira_glassworm_rusty-stealer.exe	124
PID 4720 wrote to memory of 1292	4720	msedge.exe	126
PID 4720 wrote to memory of 3536	4720	msedge.exe	127
PID 4720 wrote to memory of 3536	4720	msedge.exe	127

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4344	attrib.exe
3060	attrib.exe
6948	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-27_4915f6d1f0c106f999a23d182e4f9c77_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_4915f6d1f0c106f999a23d182e4f9c77_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:6048
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-06-27_4915f6d1f0c106f999a23d182e4f9c77_akira_glassworm_rusty-stealer.old_1782719137
  2⤵
  - Views/modifies file attributes
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffbdc88c188,0x7ffbdc88c194,0x7ffbdc88c1a0
    3⤵
    PID:3956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,2485893953277768091,293563747381667109,262144 --field-trial-handle=2400,i,16801451211313639740,4076494878865752899,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:2
    3⤵
    PID:6236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,15299427350884163751,18123264059878401690,524288 --field-trial-handle=2400,i,16801451211313639740,4076494878865752899,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,125417828994562612,2730818270862845927,524288 --field-trial-handle=2400,i,16801451211313639740,4076494878865752899,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:13
    3⤵
    PID:5124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=2968,i,16862926580487916543,1831499805287732238,2097152 --field-trial-handle=2400,i,16801451211313639740,4076494878865752899,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:6324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,15037004950262581476,17158906224851265333,2097152 --field-trial-handle=2400,i,16801451211313639740,4076494878865752899,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:2136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5036,i,14875055030627486835,17785652804621528886,2097152 --field-trial-handle=2400,i,16801451211313639740,4076494878865752899,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:9
    3⤵
    PID:6248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5208,i,11703583258847161764,13146055329865162157,2097152 --field-trial-handle=2400,i,16801451211313639740,4076494878865752899,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:15
    3⤵
    PID:6176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,1838272246825313021,4455368220703865901,524288 --field-trial-handle=2400,i,16801451211313639740,4076494878865752899,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
    3⤵
    PID:3116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,14559772908468781017,329372428852980411,524288 --field-trial-handle=2400,i,16801451211313639740,4076494878865752899,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
    3⤵
    PID:3564
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,15300659269206253676,6734628807661632646,524288 --field-trial-handle=2400,i,16801451211313639740,4076494878865752899,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
    3⤵
    PID:2076
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,15300659269206253676,6734628807661632646,524288 --field-trial-handle=2400,i,16801451211313639740,4076494878865752899,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
    3⤵
    PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,16726337815991905551,8915536596065012304,524288 --field-trial-handle=2400,i,16801451211313639740,4076494878865752899,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
    3⤵
    PID:6796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,13202526184177301153,8920188635900903277,524288 --field-trial-handle=2400,i,16801451211313639740,4076494878865752899,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
    3⤵
    PID:1776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,9163406955963822758,12964237030866397275,524288 --field-trial-handle=2400,i,16801451211313639740,4076494878865752899,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
    3⤵
    PID:944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,12067673174991201651,3491342428594340197,524288 --field-trial-handle=2400,i,16801451211313639740,4076494878865752899,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
    3⤵
    PID:5608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,16603499524866689895,5802304266682323113,524288 --field-trial-handle=2400,i,16801451211313639740,4076494878865752899,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
    3⤵
    PID:2924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,12258574036840005851,15136480499247963797,524288 --field-trial-handle=2400,i,16801451211313639740,4076494878865752899,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
    3⤵
    PID:2436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=920,i,12098323032816189790,4516648867128827676,262144 --field-trial-handle=2400,i,16801451211313639740,4076494878865752899,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,13579225263102835226,13094473284475832996,524288 --field-trial-handle=2400,i,16801451211313639740,4076494878865752899,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:14
    3⤵
    PID:3536
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:776
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-06-27_4915f6d1f0c106f999a23d182e4f9c77_akira_glassworm_rusty-stealer.old_1782719197
  2⤵
  - Views/modifies file attributes
  PID:3060
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-06-27_4915f6d1f0c106f999a23d182e4f9c77_akira_glassworm_rusty-stealer.old_1782719257
  2⤵
  - Views/modifies file attributes
  PID:6948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f60cd2d9231e56b0a0784a59fb17664fa333e06aac5ee1d5692effc5152b5c30
MD5 cce4d9b2c5f5fb7c3bfaaab4af8f0448
SHA1 17b40c534fd35eb849f575565dee407cf6215d92
SHA512 5e1cbca923a813696df373e5b185a1b3fc4f73a39029b41c0ce02bf3dea25ad383c02c9763a6d8965f882055fcabaceefe0852b44c19af280ddaf74994edc4e6
TLSH
T119D080357B46EC53C41630715C3743B46256825A6967D5177450801EC88659577D214B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ff07219f3594693f0fac57895f6888104d17957d039d3530d82987134771108b
MD5 26fba9d3c09d715a1b951844cadd62c5
SHA1 9e4dc8d0a08f2feba8c030b217c14a6a5c1e4827
SHA512 fc2fc417004bf59d775f5e0fafa0e6d4883632e585e21934aba3d8697554f979efd3a818d1e74c7713d51b1993f1678a707621ebef66bdf01536cd7793ff1e31
TLSH
T184D080357B46EC53C0163071583743A4625682166567D5177850D01EC846595B7D2147
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 132ec3142b86b9dd47403d006db598ba67195a81b7a2472bcba340cadd2a9cdb
MD5 16b6aa47a193d87961a764bf18647785
SHA1 b8275e0a31c8d7e7245fd897bb3e34c06a3f23f0
SHA512 ab59f827787fe2636399a56a5843f574a6f670fa3fc777793aa58da3c49f144ce823ce4b5339a24a6d7843e333ebab1afc24b161c95034c7abf8ba9a2f3f2e8c
TLSH
T17EF0F4AADC31AC7719FD1B1C30984B4BF75013672782999B3A3C920C8FB1A7B498592C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2aa432ea3dbddab3bd3f59ff29b1bd1e519e2f15264305513da1625c2641bbaf
MD5 02bd6c13f82e81c5eb05e477ad345040
SHA1 070090d7118368baaf7840474261d8c1797e112a
SHA512 00a9fd707dc1e2a96ca932bda37ccee51a01681ed42b3c7c3d36c285d2610a0729f109daba2001f4789df35527b855da25aa913b8ab75cb2f12021711def8daa
TLSH
T107713C8643210522EB714A38E0E075893F74245A1D17DE0A1FDBDF39EB06F847B9E49B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c58d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c58d.TMP
Size 3KB
SHA256 3f6ec1760a6d56c49893b5e7be43a6edf000c35a9b8f574183d5407d01657838
MD5 c32837d7c73d42b71ed240bdfc13419b
SHA1 ee0fda228532a96bd52934d078bee7bd9b4d9940
SHA512 e1b2ef58a5a123433652d2e81fe409b6dc982bce5bc6f307ad98b0b60e892aa369abaa65ef40867d3f89ae74cbaa5130b63411a7142d4ea53ea5bcb7656f4288
TLSH
T190715D8643200522EB718979D0E131893F7428161D1BEE1A1FDBDF39EB06B847B1E49B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f884d8647edac3a6f002aed3afdcd817aae8ab3177747efb21682a059585ad76
MD5 bdc69df8d55ea1de929dc9e6db276660
SHA1 293a5993fcb44a354ddd379bef735c2d9197f49a
SHA512 dbeeb127db148b14d369976b222bcec170c096790b87920eb3831f4043c00e28a74aef049655c47bd31cce6690b7967ff6c61eb24b04fbb913c627874bc24d6d
TLSH
T127417DF783F8856E890196F0AB186E1BCE2D0954432C3D9A89E4AF5B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d35f1191817031be718fa531d2d45b80b9691fe29c01aae42e16aab119168bf4
MD5 8d9a65f787d7ad8e53341cabd4927806
SHA1 d6c0f70382d4ec5a2b4665c96e29c9f05a6a1a42
SHA512 eefc1ef2daf8c9c091088ccbe1db1cdf5398ee10943d38e378046d15e0487cea8742f1b9c24a99a6bcd62000802a45878578336d4e9003b3127f0869808d69a1
SSDEEP 192:sxRrRXyMqZjK1Ml8wc//fEspOMpPZ5NtBWlhzoA8peRn/g6+WNIY0vOw694K6PGo:sxRr4C//fEspXRLWqOn/5InOl4K6tGj2
TLSH
T17872D8156924597BCCDFE219FA45BF53D6F81523E2905E44AAFC9B0C04E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 dd38a334e65ffa136c592b2ceeedfcf557585e97083fb55bbce67bab89ae09ea
MD5 4154b9affc087cdefc2cc59182c313e8
SHA1 bd293a0438a24ed190a0c3f9a4e685e722139e5c
SHA512 fb3141b09035a2ed7bd691618cc0f860381b59252e24cd2909223e676f41df1e66599a4679b4671a4e8c93891f1f28a9aa2c17d259dc8d4c5be467281153c66e
SSDEEP 384:sxRr4qP//fEsc3WRLWqOn/5IwOl4K6tGCox:sffP//fuW0/5IP4K6ds
TLSH
T19672E915A9385977CCDFE219FA45BF53D6F81523A2801E44AAFC9B0C05E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 198bae7ef5f7f0d9d7ffe0a6cceec5a66036d7bf78d4f27745321f21c8e2a1dd
MD5 b3c52d12c9ec7db592dfa0a9d9356227
SHA1 f18b32b3e489b0df7c2950acc8cb0358ee792c48
SHA512 66647d53f21054b56fda2b5d31bdf643ee72a9ced0aec08d9bc9c82be80c7b2254e78757d7318cf1fb96a5f69f34c36741c626cc292d71ef2ac6fb39870e2feb
SSDEEP 768:PXoDFl7pLuL7jGWgoqfjs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVRP9RiW5oroVNAh:PXoDFzE7jGWgoqfjsu1jaWP9QW5TVNAh
TLSH
T129E2FC3B684CCB7E4F80499CED2ABD9F6DE801CF96D88D5447EA840C03C6AEB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 5e6fe8f590ee251419f32f5f53dc6ecc3e7c32aec7dd682d2e95e95fd5ac3ee2
MD5 df152d6c30ce49be64c218c9adc40c17
SHA1 18b035e3340db96ebe0aee250da85e52449fa1d4
SHA512 19bf2e6874d1482a8cceee48c9650562535f5b45398961fbf07197cde473a6f9f89fb6c68a004d7e082748cebe6adafe290ccb45a81f2897fbc633a08cacdba7
SSDEEP 192:6H76D7ElhDfFJfpdBJ9XvC79FBLlTY3D95X:6b6XEHDdJBd79/ChFVo
TLSH
T1A7B21851797E220538BE2918E1A5856F674130B3301EA63B3BBC50E61EA7E005FFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c189ab6970a1d006ec28f639a89c8206479916bb5069aab4e9510ab9c7506d18
MD5 cd0b8a0b2013178ea9db8f1f92fe0ad7
SHA1 d99c71ab7ea47982ffff85385d681ff00ad1605f
SHA512 bca8b5df13ae8a7a702405bc985a1d2ffb49ffb09fe47494d03a0a849007f7f45bd68205e10eca03066c7f7f79d0e0df57ec1010c781db72f3fa9488982994ee
SSDEEP 768:pF1j+96TwguNIKGinefqwtHSri+056Vvv:Y96sNxeflGiUVvv
TLSH
T102C24A36D864DAB79DEA4FCAB7097646AEF002A3C0DC6AC8D9D91D4D00972DD1347C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ec80a3f2cab0f48ccf69d71a788cbf23e82c8956f4fe1256eacc612083f2c003
MD5 99eedcbe214b660bacc9a85b4a6d9320
SHA1 f4b0f99c88e9dfe0f0f9f927b37ea84896834bd9
SHA512 e5806d8f6a1b7aef94fbe49a5d07036d84e9fe1ae00d31500f12e7f8a7fec0d2ea018721e4f2361b22bc65e10c239c5ab38e2611b7dc265d7c3233294dfd7607
SSDEEP 768:6F1j+93twgkasLGinefqwtOKmn12bfJyhvC:f934akefll0yJyhvC
TLSH
T13FD25B32D864CE77ADEB8FC9B3097246AEE011A385CC5AD8D9D94D4D01D72CE170BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 fe9adfe05e6778d1cfeee186af636b761a90216a0d7405e7ea67bd77191c9666
MD5 3293f55e95c4a680b13731ba1867728d
SHA1 da71595692dc31d478693d4a0182c1dee1e2b256
SHA512 654e19d54659481a0f967f45b8f3e7acf4ff8513e9a65a9ab0f619eabde2d0743434a85654998f14eed7ce50fc52d7bfcf59ec02ad21d8d404989a2f2ef45b2a
SSDEEP 768:4F1j+9LtwgkisLGinefqwtDKmn12bfJyhvC:19L4ikefl20yJyhvC
TLSH
T1A4D25B32D864CE77ADEB8FC9B34972469EE011A385CC5AD8D9D94D4C01D72CE170BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e6c9bd67ee9bcd32501165b25cc212c71cb8e9a78bde0436328033639f6b3d17
MD5 8a530fc0c177c942893e51dcc9f148c8
SHA1 541e19bf7af345c4cb891f78117bbcfbcfa52bc5
SHA512 537c7a428464d4078653bd96228b214da0db0cc822488df191bb7ec3362494caf0f72e673d866bf5b7b0d48f947b3fe07671fa9035494b59bfdbbe0a89b05727
SSDEEP 768:gF1j+93twgkasLGinefqwtGKmn12bfJyhvC:t934akeflt0yJyhvC
TLSH
T12AD24B32D864CE77ADEB8BC9B3097246AEE002B385CC5AD8D9D94E4D01D72CD170BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 ba61a8c317037c5e125d1273a2d1fce544092b6616e3958dd7ca8343111569f6
MD5 8268003c2882716563c31ddfa3550e1d
SHA1 d9d50da52b0d2111652e505a9be788cd9ea25008
SHA512 bc163967c62061dc1b895f8ab765ab6e759d5052b166042f1199062d2da9da4c84f3675510a7b699efb4c88639d8d70ba6425e94828c396e798fdd11b92dd87a
TLSH
T1903162F19C391ED2C07E0CEFA04B25FC84D8D322F5A430796898EDA84A3D55E254083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 2ba8fec559f33cfc181dbc0ace98d16c853918d9a0f2103593d16ddd327de78e
MD5 8dcd0a2a00b7a0677f1fe3336051985a
SHA1 364c6f3de81f66b8210391fcab6ffc15964dc5ec
SHA512 82d99d29456029b6d02978b2132bedfb8df805e94fcedb94b55c0d6f67408c3cf1c6b277c1c8afe34ba9b281a440b300fbecf56091cdbbef4cad60fe05838cc3
TLSH
T1833140E098392ED1D0BD0DAFB48B25FC94D8D622F594347D2CA8E998867D95D258083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 84cdd561676234ba8cc0ee13b290ae3b0f5f7c669ee80be6fa8c99e01526c5f8
MD5 ac67f3dfa6d2c8b66e90c1256da5fcdc
SHA1 99ee712be3bfc148a9e0770789e1d2be5e464d4f
SHA512 336559d56dabb2a2e43f94a45bdd5596cdd45001c0d8b6d696018fc622326aadf7787b0ad99857d5bfeb0e4d0dc392845fd84e4ec10494bd34c7c731aa334869
TLSH
T10D3161E098392ED2C07E0DAFB09B39FC94D8C222F5A8347D2894EC98463D55E258083F
MD5 SHA1 SHA512 TLSH

Submit Download

2026-06-27_4915f6d1f0c106f999a23d182e4f9c77_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-06-27_4915f6d1f0c106f999a23d182e4f9c77_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 eea3c837b1597b5e9b20a9c74e2dc41655831dd514d381b1f6a308ea8a7b0669
MD5 356a85fb1934e01ab04c359517132c33
SHA1 3f40bb08ed5caed11f48585461dea09a48e56c43
SHA512 707efc10d07758e810aa08cc808222d4604caedd6fa811ffeb6445c891343132fd876c891f43d01d7b93f58ccdc19515e1febd0e73fa812c46c45eae6d83d8c1
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3u:CebAjOKn3wRKRJ3u
TLSH
T16DD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-06-27_4915f6d1f0c106f999a23d182e4f9c77_akira_glassworm_rusty-stealer.old_1782719197

Path C:\Users\Admin\AppData\Local\Temp\2026-06-27_4915f6d1f0c106f999a23d182e4f9c77_akira_glassworm_rusty-stealer.old_1782719197
Size 2.7MB
SHA256 460e26333c2dce0f9f05fb0081d58ccbe519054430da769ed5f7795500c0fe01
MD5 7735fdad1ea17ab823da456f46b582da
SHA1 580f78c9ecc3c03927fd6ab8940c9ff53367c78e
SHA512 c19d0c27efe32426fb6aa371faa1d36749e553122ef708c1debfd5c7283d54514412abd3094e7a8fd6cffe21090ec15f4f99776e0f4768b3656f72f674d1e867
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ32:CebAjOKn3wRKRJ32
TLSH
T12DD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6048-278-0x00007FF746A20000-0x00007FF746CE1000-memory.dmp

Download

memory/6048-242-0x00007FF746A20000-0x00007FF746CE1000-memory.dmp

Download

memory/6048-194-0x00007FF746A20000-0x00007FF746CE1000-memory.dmp

Download

memory/6048-172-0x00007FF746A20000-0x00007FF746CE1000-memory.dmp

Download

memory/6048-210-0x00007FF746A20000-0x00007FF746CE1000-memory.dmp

Download

memory/6048-286-0x00007FF746A20000-0x00007FF746CE1000-memory.dmp

Download

memory/6048-235-0x00007FF746A20000-0x00007FF746CE1000-memory.dmp

Download

memory/6048-303-0x00007FF746A20000-0x00007FF746CE1000-memory.dmp

Download

memory/6048-310-0x00007FF746A20000-0x00007FF746CE1000-memory.dmp

Download

memory/6048-324-0x00007FF746A20000-0x00007FF746CE1000-memory.dmp

Download

memory/6048-236-0x00007FF746A20000-0x00007FF746CE1000-memory.dmp

Download

memory/6048-204-0x00007FF746A20000-0x00007FF746CE1000-memory.dmp

Download

memory/6048-349-0x00007FF746A20000-0x00007FF746CE1000-memory.dmp

Download