70c02f06ddbe8d2d22509a61efebc646bf17a8cc83c79028f85cfbee96a0f449

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_097aea6627bceeb71ad420698da461c7_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260701-bads5sdv6t
SHA256 70c02f06ddbe8d2d22509a61efebc646bf17a8cc83c79028f85cfbee96a0f449
MD5 097aea6627bceeb71ad420698da461c7
SHA1 1968f9bf0ed32311768bffb7275bfa2a52c569d2
SHA512 c2c0efe83a8f635d6f059ef17d87e00bcb2df101bb766b844b29654c96d7910e6312bcc0e17df031e5afa62569ea4250427929aa891025c47a02773322a3ef2e
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3m:CebAjOKn3wRKRJ3m
TLSH
T100D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2412	msedge.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2412_1061201518\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2412_2028314208\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2412_2028314208\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2412_696873342\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2412_696873342\well_known_domains.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2412_1061201518\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2412_2028314208\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2412_2028314208\kp_pinslist.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6412	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273409748225639"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2900715619-172032027-1873877232-1000\{DC74F103-4E79-4B47-950F-67802228A77F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
6612	wmic.exe
6612	wmic.exe
6612	wmic.exe
6612	wmic.exe
4540	msedge.exe
4540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4212	2026-06-30_097aea6627bceeb71ad420698da461c7_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	6612	wmic.exe
Token: SeSecurityPrivilege	6612	wmic.exe
Token: SeTakeOwnershipPrivilege	6612	wmic.exe
Token: SeLoadDriverPrivilege	6612	wmic.exe
Token: SeSystemProfilePrivilege	6612	wmic.exe
Token: SeSystemtimePrivilege	6612	wmic.exe
Token: SeProfSingleProcessPrivilege	6612	wmic.exe
Token: SeIncBasePriorityPrivilege	6612	wmic.exe
Token: SeCreatePagefilePrivilege	6612	wmic.exe
Token: SeBackupPrivilege	6612	wmic.exe
Token: SeRestorePrivilege	6612	wmic.exe
Token: SeShutdownPrivilege	6612	wmic.exe
Token: SeDebugPrivilege	6612	wmic.exe
Token: SeSystemEnvironmentPrivilege	6612	wmic.exe
Token: SeRemoteShutdownPrivilege	6612	wmic.exe
Token: SeUndockPrivilege	6612	wmic.exe
Token: SeManageVolumePrivilege	6612	wmic.exe
Token: 33	6612	wmic.exe
Token: 34	6612	wmic.exe
Token: 35	6612	wmic.exe
Token: 36	6612	wmic.exe
Token: SeIncreaseQuotaPrivilege	6612	wmic.exe
Token: SeSecurityPrivilege	6612	wmic.exe
Token: SeTakeOwnershipPrivilege	6612	wmic.exe
Token: SeLoadDriverPrivilege	6612	wmic.exe
Token: SeSystemProfilePrivilege	6612	wmic.exe
Token: SeSystemtimePrivilege	6612	wmic.exe
Token: SeProfSingleProcessPrivilege	6612	wmic.exe
Token: SeIncBasePriorityPrivilege	6612	wmic.exe
Token: SeCreatePagefilePrivilege	6612	wmic.exe
Token: SeBackupPrivilege	6612	wmic.exe
Token: SeRestorePrivilege	6612	wmic.exe
Token: SeShutdownPrivilege	6612	wmic.exe
Token: SeDebugPrivilege	6612	wmic.exe
Token: SeSystemEnvironmentPrivilege	6612	wmic.exe
Token: SeRemoteShutdownPrivilege	6612	wmic.exe
Token: SeUndockPrivilege	6612	wmic.exe
Token: SeManageVolumePrivilege	6612	wmic.exe
Token: 33	6612	wmic.exe
Token: 34	6612	wmic.exe
Token: 35	6612	wmic.exe
Token: 36	6612	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2412	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 4224	4212	2026-06-30_097aea6627bceeb71ad420698da461c7_akira_glassworm_rusty-stealer.exe	89
PID 4212 wrote to memory of 2412	4212	2026-06-30_097aea6627bceeb71ad420698da461c7_akira_glassworm_rusty-stealer.exe	91
PID 2412 wrote to memory of 4524	2412	msedge.exe	92
PID 2412 wrote to memory of 6972	2412	msedge.exe	93
PID 2412 wrote to memory of 6412	2412	msedge.exe	94
PID 2412 wrote to memory of 6972	2412	msedge.exe	93
PID 2412 wrote to memory of 6972	2412	msedge.exe	93
PID 2412 wrote to memory of 5532	2412	msedge.exe	95
PID 2412 wrote to memory of 5532	2412	msedge.exe	95
PID 2412 wrote to memory of 5732	2412	msedge.exe	97
PID 2412 wrote to memory of 1776	2412	msedge.exe	98
PID 2412 wrote to memory of 5732	2412	msedge.exe	97
PID 2412 wrote to memory of 5732	2412	msedge.exe	97
PID 2412 wrote to memory of 1776	2412	msedge.exe	98
PID 2412 wrote to memory of 1776	2412	msedge.exe	98
PID 2412 wrote to memory of 1668	2412	msedge.exe	99
PID 2412 wrote to memory of 1668	2412	msedge.exe	99
PID 2412 wrote to memory of 1668	2412	msedge.exe	99
PID 2412 wrote to memory of 6356	2412	msedge.exe	100
PID 2412 wrote to memory of 6356	2412	msedge.exe	100
PID 2412 wrote to memory of 6356	2412	msedge.exe	100
PID 2412 wrote to memory of 5196	2412	msedge.exe	101
PID 2412 wrote to memory of 5196	2412	msedge.exe	101
PID 2412 wrote to memory of 3112	2412	msedge.exe	102
PID 2412 wrote to memory of 3112	2412	msedge.exe	102
PID 2412 wrote to memory of 2044	2412	msedge.exe	104
PID 4212 wrote to memory of 6612	4212	2026-06-30_097aea6627bceeb71ad420698da461c7_akira_glassworm_rusty-stealer.exe	107
PID 2412 wrote to memory of 2000	2412	msedge.exe	111
PID 2412 wrote to memory of 2628	2412	msedge.exe	112
PID 2412 wrote to memory of 2816	2412	msedge.exe	113
PID 4212 wrote to memory of 3796	4212	2026-06-30_097aea6627bceeb71ad420698da461c7_akira_glassworm_rusty-stealer.exe	114
PID 2412 wrote to memory of 6748	2412	msedge.exe	116
PID 2412 wrote to memory of 6748	2412	msedge.exe	116
PID 2412 wrote to memory of 6844	2412	msedge.exe	119
PID 2412 wrote to memory of 6844	2412	msedge.exe	119
PID 2412 wrote to memory of 4848	2412	msedge.exe	120
PID 2412 wrote to memory of 4848	2412	msedge.exe	120
PID 4212 wrote to memory of 5444	4212	2026-06-30_097aea6627bceeb71ad420698da461c7_akira_glassworm_rusty-stealer.exe	121
PID 2412 wrote to memory of 4540	2412	msedge.exe	123
PID 2412 wrote to memory of 5836	2412	msedge.exe	124
PID 2412 wrote to memory of 5836	2412	msedge.exe	124

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4224	attrib.exe
3796	attrib.exe
5444	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-30_097aea6627bceeb71ad420698da461c7_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_097aea6627bceeb71ad420698da461c7_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-06-30_097aea6627bceeb71ad420698da461c7_akira_glassworm_rusty-stealer.old_1782867371
  2⤵
  - Views/modifies file attributes
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7fff69a5c188,0x7fff69a5c194,0x7fff69a5c1a0
    3⤵
    PID:4524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,136885044828621871,15039481066726252598,262144 --field-trial-handle=2548,i,5261163512035176096,17036701692439380484,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:2
    3⤵
    PID:6972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,9636945049405087500,5190353895861413417,524288 --field-trial-handle=2548,i,5261163512035176096,17036701692439380484,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,1643612106643755165,775754420508972867,524288 --field-trial-handle=2548,i,5261163512035176096,17036701692439380484,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:13
    3⤵
    PID:5532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,15247800367497675787,14579755016095870216,2097152 --field-trial-handle=2548,i,5261163512035176096,17036701692439380484,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    PID:5732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,6130592771026289833,6694939834080241029,2097152 --field-trial-handle=2548,i,5261163512035176096,17036701692439380484,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
    3⤵
    PID:1776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5084,i,12550337412661518342,2017662119503518903,2097152 --field-trial-handle=2548,i,5261163512035176096,17036701692439380484,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:9
    3⤵
    PID:1668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5364,i,9663950200432429170,17322819316153897167,2097152 --field-trial-handle=2548,i,5261163512035176096,17036701692439380484,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:15
    3⤵
    PID:6356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,14364019390302145083,16289142689242065030,524288 --field-trial-handle=2548,i,5261163512035176096,17036701692439380484,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
    3⤵
    PID:5196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,495028048179127361,12813820197737594638,524288 --field-trial-handle=2548,i,5261163512035176096,17036701692439380484,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
    3⤵
    PID:3112
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,12646083141484746064,12464155878263475544,524288 --field-trial-handle=2548,i,5261163512035176096,17036701692439380484,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
    3⤵
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,12646083141484746064,12464155878263475544,524288 --field-trial-handle=2548,i,5261163512035176096,17036701692439380484,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
    3⤵
    PID:2044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,8808520694262888721,3015173683683676502,524288 --field-trial-handle=2548,i,5261163512035176096,17036701692439380484,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
    3⤵
    PID:2000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,12600724513541743488,8000472830761254427,524288 --field-trial-handle=2548,i,5261163512035176096,17036701692439380484,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
    3⤵
    PID:2628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,2219343614246917809,18356982881926889117,524288 --field-trial-handle=2548,i,5261163512035176096,17036701692439380484,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
    3⤵
    PID:2816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,8023290703295142657,10465743026084719745,524288 --field-trial-handle=2548,i,5261163512035176096,17036701692439380484,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:14
    3⤵
    PID:6748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,4000891744957381091,10060763942032104761,524288 --field-trial-handle=2548,i,5261163512035176096,17036701692439380484,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:14
    3⤵
    PID:6844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,3227955980060078656,8492442493904160679,524288 --field-trial-handle=2548,i,5261163512035176096,17036701692439380484,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:14
    3⤵
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6216,i,4523454977848174914,3549066907447333769,262144 --field-trial-handle=2548,i,5261163512035176096,17036701692439380484,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,1753743212616947462,12257344921798382921,524288 --field-trial-handle=2548,i,5261163512035176096,17036701692439380484,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
    3⤵
    PID:5836
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6612
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-06-30_097aea6627bceeb71ad420698da461c7_akira_glassworm_rusty-stealer.old_1782867431
  2⤵
  - Views/modifies file attributes
  PID:3796
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-06-30_097aea6627bceeb71ad420698da461c7_akira_glassworm_rusty-stealer.old_1782867491
  2⤵
  - Views/modifies file attributes
  PID:5444

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b363f693690aa479b03b10f13d837c7277e1cd8d6c10d7150235a6d4eee0f34
MD5 ddf8b13fdf9db751ce6cc3328e266fa7
SHA1 1cd0cf7ab6698157c24338d81d076859d18cfba7
SHA512 e7b35b46a0f47d516568817a1f6db4f2445e353959197912eea8a7ab8f6a257b9bc5ba855ad99faa8b859e7ac8c3141a43c223c051fe9bd656f75b6384e18fc8
TLSH
T1E8D08CF0BB297982D26534B2B5229711B2B140AA3A2BD6D1A4A0C50C8C3B8D9A786183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da3763f60ede3fa709aa0345487a9c5f026859c06ed1a1549de777571c438d2d
MD5 2ebd0330bb082497ebc47348c4ecee38
SHA1 f164cfe0a87fae91d8a0b0b31f0178ebf3aadd02
SHA512 294595e3213375937c97fffd24323394a2b90fd0b46d24771fcf9359e2edbe425b26aefe714432eaccd7516ab0d793eaa33eb35fa55b9df13c535af5d9da8f67
TLSH
T1FFD080F0B7197582D5653471B521971171B1409D391BD5D19090850C4C778D55745187
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3838e0c9b97b740997025cc20f9894a4fb2fc1d09513fd3de779b19d7f969df9
MD5 339ab2331fb3aae4a95fd88c7e816532
SHA1 6574ff6ed98e60945fa77f8a7d8ad1edb5290a0d
SHA512 5703e993048ce770ae38db5cd87e9d20ad636253535d52856c3755705dc6df3c453a6d3e0d99cf03becd2767b8b650787c5242fb56cd30f29d5089d3da98f0d9
TLSH
T14DE02BEAC961EC3B08FC0F2C74924749EB50132B2B41494F3B3C920C4FB5276819187C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 37a25c0b4c312cc0cc593709579c0b84e847c21d70a7d50450925f96b3ff85d7
MD5 ff5e9f48b3c22678ee805d1d3c896ed3
SHA1 413757df3bdc62c86eb2726e516ab94854cae8ea
SHA512 33b9fa1736ac146e8143a05851a11b375bca3f1860d0e8400299f2ff75bdbc0421c3b941f989a5561b376ce116637ec9fe1a22f45bda6d4e4b57959c0062e033
TLSH
T1E9712B4D0733186DE76603B698D619C7FF7CBCCA0207EEAF409DD03A8886B04A59E270
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590aa5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590aa5.TMP
Size 3KB
SHA256 a4306f4fff89a0832c7f7faa79137a215ab9f9525a462a6bbfb108b1d8343039
MD5 367929cf1dbe5b4629304404ba0a90f7
SHA1 0965f4f42dac3dcd9d652d26c6dae8d2dfba5b71
SHA512 18252896aa8f7819306122cac1a149d90b6bb8f830ec070ab4e402fd21af483a681e997a0528653d575ec02500639308cc5df86860976ad930f2d73e7424cdb9
TLSH
T10261F85D0337182DE72603B690D6258BFF7CBCC64607EEAE509DE07A8886B04959E670
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 91bbbaba3dfb58b51457d6de6cb6f83f5a0d8b2ac37f1fe525d8cb8e17b7db57
MD5 95863498cf4123bb28a9c6c350b1cda9
SHA1 4a36981fe08d11322219cacd3092eebab780afde
SHA512 9ffc0c9443718afde18a33b353b2c166f4d47f4a35c4322f6a46c893e73cb976775fcf5a0e78e9d995ec99a83920c91f2ab108726a785b87fdba90c3932dc65c
TLSH
T17241BFF783E4856E891196F0AA18BE2BCE1C0915832C3D5AC9E4EF5B93F3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 c3a868089ca9ed5a3ab3dca36f55f84b2d54bd22d4b31a09eff7217314b08d70
MD5 2f4ee00786feceb4b94d350087ff85c9
SHA1 a5466d72b86bf0450877c6fd82f0363432696c89
SHA512 fcedd0c63712b6359acf43e87b94cbcfd9eb63ef49b707a0bc61871262423f0eed3890e3e34f6b71e23c0f7676dcfc7ece5270bd12a0803a49efee9653eca40b
SSDEEP 192:sxRV/PRIFyMqZjK1Ml8UQYecYj/fzzsYxuDCBpZsGJlsJwp4zoA8peVS/g6+WNIF:sxRN9q+k/fHsgVBnsGr4in/5IuONTsO
TLSH
T13172E91A6A38597BCCDBD219FA95BF53D6F8112392904E44AAFC8A0C01E77DD211783F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 58b5fc462a4ffb163f6c29e4cf739d42c9cd8456126480109617e931a187729a
MD5 29190019995f794c51982f127b0c37ca
SHA1 f885974d402fe969a7c9506ab44b2c8c5460e512
SHA512 87fa54cd2bb46edb0f71d90ff54058b02a29f087b54e6c623ba2f1510653fbd6ca9bdf8dc512c5ba04c993d3c54b05668dcb691934ae04186370f3004801ca31
SSDEEP 192:sxRV/PRIFyMqZjK1Ml8wcYj/fzzsfuOpZsGJlsJwp4zoA8peVS/g6+WNIYmYOwVu:sxRN9Ck/fHsfRnsGr4in/5IqONTjz
TLSH
T12272FA1A6A34597BCCCBD209FA45BF53D6F81123A2904E44AAFC8A1C05E76DD211783F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 133fde4227962ede588ebd87353ebfa350793af184b8ada139d990725fe310b6
MD5 c7b8bafda8ced6e50dbeb5dac2612ea5
SHA1 ae0434488055bbc62b92dbad05f60db4c889576d
SHA512 8f937a381c083c0424e4e334280e7ab74dcbedb9c49a0944a1d65fed129e35e8ab937366f44b86b5166034891927021e06497c165d81281ce1dbe344887efdb7
SSDEEP 768:RGqO3j7pLuL7yrWgzvfiX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVou7z9wQroPwhf:RGqO3VE7yrWgzvfiXu1jaru7pw7Pwhf
TLSH
T14BE2FC3B680CC77E4F804E9CEC29BE9A6DA802CF56D8895447EE844C03C7AFB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 9e13daf3a0cf1850ec27aeb8508b39a372cd554030871f1d059b96ac745a9f5d
MD5 99d87a930e674b3c7f487504ca985992
SHA1 e451854ddeb6c9b3c9d9a78b402ba2b519a52523
SHA512 d549eaa0aa6c73c57948ce3b997a7b98c6fcfae80c60ab4bb2675b11bdf384b1c152badfbe56825447a2632f76ac15ca1c97dd52484b8d91c17718ee961d40a1
SSDEEP 384:9TqfDxl5UVY3bXp3ZUzD4BzSc7eCUG2XatW6AE3k18UFa20TWaseefCFeSo83MtX:aR55IlHnOLRXxxinztF
TLSH
T180B29E5070BA2B00387D29099379D42F594630A230DEA87B7B6836E56F67F005FFDAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a770056986cd95ad29b6c11b63c0895c25deb7dc5d9e3f83c5828ec3aa40403b
MD5 d40672305745b8dcd52d34003d06629d
SHA1 69a285c6b8391667af1fecf344f9b3813cd3c88d
SHA512 3797f9c22ccd219f233de0df8cc64b08f453f7b11b05f046c3a1bd30d2a96feda7358f576b0b5733968aec9eb27927307b29559baab5113f69df075be30c8c67
SSDEEP 384:n0iF1tNn/s3n9SsD8No8TUNTUlIRYJznNVdHXYfo4GBq1cTGco0iZodn8mn15wbu:PF1j+9RtwgYaGQqGc7iSdn8mn12bfJ4
TLSH
T123C24936DCA4CA6BEDF78FD9B7097A5AEEE001A3859819D4DAD84D4D01C72DD0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b3b81e2574398c2a5ecb95dc8f76f0871750974fb60c5bc5d5c37d4d797489f5
MD5 0cdf4989a7c0de07e6a79e730668612a
SHA1 9a45faf181f7f705ebe7787890862c23c6485d0b
SHA512 0bac86b5bdb4630b9b0c368b473057f58019e936eb6b6ed438649dd5b54e6dfef09899dc4aba5cf69695eca7b059bca718c18d38e7c6244d40058b20c6aff8ae
SSDEEP 384:nUiF1tNn/s3n9S/8Nm8TUNTUlIRYznN9eURXYfo4GBq1cTGco0iZodt9IX0IidKW:vF1j+9m/wgDUcGQqGc7iSdt9I78Kzy
TLSH
T1EFD24B36EC65CEB7ECEA8BD8B7057A57EEE412A385889DD4D6C81D4C00C729D130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 aa752d8f7fe8309554a3b12b96196712473c701cf6fe2b4a583d89ed576cfc52
MD5 1273cc6a547a626d84470258435d4131
SHA1 6fed8466618a119a3025ede8fb6249069dbd99b7
SHA512 8c32132ea88153dca1a5b48d00225d8a1f70f715889fc8b1f3e45fa58e05443b775b2e0f6b8887d7f33afcb53d2a47e59a3326ab2103e8ee1b75da7495e5a708
SSDEEP 384:nViF1tNn/s3n9Sn8Nm8TUNTUlIRiznN5eURXYfo4GBq1cTGco0iZodtvIX0IidKA:cF1j+96/wgxUcGQqGc7iSdtvI78Kz0
TLSH
T173D24A36EC65CEB7ECEA8BD9B7097A47EEE412A385889DD4D6C81D4C00C729D130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

well_known_domains.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll
Size 572KB
SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
MD5 f5f5b37fd514776f455864502c852773
SHA1 8d5ed434173fd77feb33cb6cb0fad5e2388d97c6
SHA512 b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6
SSDEEP 6144:XbBXgDO9CyiiKPFv3GPkDNiTHoIDiXkCBIvzVXCfwX5pWr+W1gUe3h576:XbBQDwi5FvGPkDNirYBIvzVXCoXWiWr
TLSH
T130C49E02B7D846A8D07AD0748A574642EA76BC950F74A6DF02E0B27D2F77BE45B3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 35b36ba0e75360548bb72fdb9f2d838534441aa97515aae978d4119d61cc07e8
MD5 b37391d85f054ba8fa9674e720ccace1
SHA1 fe74cc68d907c14c882de35ae419045ff84d74b9
SHA512 b09e85dad91428e547f62815dac1cad467e16ca6c497d5ddf60bb2ccfcef455056063d1bceacc8d4daf1a97abe78062014316b65573236362bc82415e4044233
TLSH
T158314FE09C392DD2C4BD0DAF748B38FC94D8D726F59434786854E998823D65E668083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 9d4ad9492818544e20565699d9f61156e7ecf63e7d6990272c110ae619ab9ed7
MD5 e530fb042d6f771e566f1ea863697945
SHA1 6dbdbed424bbc1f288c450098d34b9fcc75a3454
SHA512 89461a4282166cae39097ea6db5c6df540659ad69a28f8a333c3063453cdc13f9cd3581cd8da5b178b7b5df78556d6d0d84bd4bbca50adaf24aad96a2f7ded1e
TLSH
T1224160E08C382DD1D0BD0D6F748738FC94E8D726F494307C6858E998467A64D618083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 2e2a7cce2ec89d175c57ab4464e03e6f026dcd07c0c94a617ceb577eba390524
MD5 e3ccd78c3e78fd6096cb6ba1956895e7
SHA1 ce1584d47e3c91e91c77c4a53553eea0350e2973
SHA512 a46c43329ac095949e08647a02c3e8d43b76ba88cbb17e77f30340bf209dd62d42648410aaf55d49c981881f5ad85da827537d59071652306ec1c6de3d40c7b6
TLSH
T1893140E09C392DD2C4BE0DAF648B38FC94D8C726F59434786854ED98563D15E268083F
MD5 SHA1 SHA512 TLSH

Submit Download

2026-06-30_097aea6627bceeb71ad420698da461c7_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-06-30_097aea6627bceeb71ad420698da461c7_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 46f059eb143b74bb32c64fd153cc7850a42a31451c663e1fca52464d5cbedc5e
MD5 ca870c82d723b228ffd173b1f9facc54
SHA1 a29561b828b76c0fa92368ff2328a3ae0ad6e934
SHA512 5637bc8433369b698885d207e6000cccf6af0249cd430d0a9e73cfcb20068134f484c30936297d3a1fa5d6941f22496daa2a132e9757f561e4b3d403a8851674
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3s:CebAjOKn3wRKRJ3s
TLSH
T1A1D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-06-30_097aea6627bceeb71ad420698da461c7_akira_glassworm_rusty-stealer.old_1782867431

Path C:\Users\Admin\AppData\Local\Temp\2026-06-30_097aea6627bceeb71ad420698da461c7_akira_glassworm_rusty-stealer.old_1782867431
Size 2.7MB
SHA256 dafbc6de87475acda43e0bf22423d2b3982645a3ae2411cf15fdb47c8d643580
MD5 e61fec77f2716cc82cf424b51397c7e5
SHA1 da8cdd93fcd26cf4413322aaa30b8acee3d9b97b
SHA512 6598469d75e06fccadad8bbf793a499da13973e6701c7f1cfec9f06fb3d9bef26af727632c0e254a84395e1e6e9bddc9594e6fcf1e2bda0c90ec605072108394
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3t:CebAjOKn3wRKRJ3t
TLSH
T1C4D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4212-228-0x00007FF6358A0000-0x00007FF635B61000-memory.dmp

Download

memory/4212-236-0x00007FF6358A0000-0x00007FF635B61000-memory.dmp

Download

memory/4212-257-0x00007FF6358A0000-0x00007FF635B61000-memory.dmp

Download

memory/4212-230-0x00007FF6358A0000-0x00007FF635B61000-memory.dmp

Download

memory/4212-271-0x00007FF6358A0000-0x00007FF635B61000-memory.dmp

Download

memory/4212-281-0x00007FF6358A0000-0x00007FF635B61000-memory.dmp

Download

memory/4212-229-0x00007FF6358A0000-0x00007FF635B61000-memory.dmp

Download

memory/4212-298-0x00007FF6358A0000-0x00007FF635B61000-memory.dmp

Download

memory/4212-304-0x00007FF6358A0000-0x00007FF635B61000-memory.dmp

Download

memory/4212-197-0x00007FF6358A0000-0x00007FF635B61000-memory.dmp

Download

memory/4212-314-0x00007FF6358A0000-0x00007FF635B61000-memory.dmp

Download

memory/4212-187-0x00007FF6358A0000-0x00007FF635B61000-memory.dmp

Download

memory/4212-165-0x00007FF6358A0000-0x00007FF635B61000-memory.dmp

Download

memory/4212-339-0x00007FF6358A0000-0x00007FF635B61000-memory.dmp

Download